Hacker News Reader

> "NSO is a technology company. We do not operate the system, nor do we have access to the data of our customers, yet they are obligated to provide us with such information under investigations."

This is an abdication of responsibility and I agree the substance and tone of the response from them is really bad.

Just because you don't have direct customer data access does not mean that you don't hold some responsibility for how the tools you sell can and will be used. This is especially the case when you sell zero day security exploits in very high risk use cases.

This response suggests the culture on the inside is probably as bad as it looks from the outside. Based on this, I'd guess abuse of their tools is lot worse than what's publicly known.

A serious company operating in a high risk space would lead the messaging with and own the high risk issue directly and how they try to contain it in order to do pragmatic good in difficult areas. Instead we see a childish almost petulant, knee-jerk response that the bad things are 'not their fault' because they're just a software company.

These guys are just rationalizing their own bad behavior.

https://zalberico.com/essay/2020/06/13/zoom-in-china.html

I think it’s worse than just abdicating responsibility. As if they just didn’t know bad things cound happen.

They’re selling this software to literal tyrants. They knew full well what this would be used for.

I don't think they're claiming they didn't know bad things could happen. Their "Transparency and Responsibility Report" is essentially a detailed accounting of how they weighed that risk when licensing their software. I think one can certainly take issue with their approach, but they don't appear to be naive about the risks.

Their response in this post suggests they don't view this targeting as related to them or their responsibility.

> "The list is not a list of targets or potential targets of Pegasus.

> "The numbers in the list are not related to NSO group.

> "Any claim that a name in the list is necessarily related to a Pegasus target or Pegasus potential target is erroneous and false.

> "NSO is a technology company. We do not operate the system, nor do we have access to the data of our customers, yet they are obligated to provide us with such information under investigations."

My read of this is it's the kind of carefully worded intel-like response, basically saying the people targeted are not Pegasus(tm) targets because Pegasus is the name of the product and it 'technically' doesn't do the targeting on its own, the customers do the targeting - therefore not our fault and not related to us, we just sell software. (Even though the customers used NSO software to do the targeting, sold to them by NSO).

I said they don't appear to be abdicating responsibility for the risk their software could be used for bad things to happen. If you look at the report, it's all about weighing that risk against the risks of not licensing their software.

They are abdicating responsibility for the list, which doesn't seem unreasonable since the Pegasus Project has been pretty explicit that they don't know where the list came from, who put it together, or why any particular entry was put in to the list. The Pegasus Project guys have already walked back their statement that the list is phones that have been targeted by Pegasus, so...

It very much sounds like someone found some HLR logs and then failed to determine whether that list was specific to Pegasus or not. It seems very unlikely that there'd be HLR logs that would be specific to Pegasus somewhere, so I'm not sure how anyone could expect them to take responsibility for such a list.

Thanks for the details - given that, they could have written a real response to the allegations rather than this blog post they posted and it would have come across better.

This blog post comes across very defensive somewhat clueless, doesn't inspire confidence.

I get why they'd not want to engage with the media (media writers are often useless at best, if not actively/intentionally harmful with regard to this kind of technical nuance), but that's no excuse for the response they have here. If they were going to go direct they should have done it right.

For the curious, their report: https://www.nsogroup.com/wp-content/uploads/2021/06/ReportBo...

The tough thing about being attacked in the press with misinformation is it is very difficult to respond in a way that comes across well. As you can see from the Post's publication of the correspondence from NSO (https://www.washingtonpost.com/investigations/2021/07/18/nso...), they did try to inform the media about the technical nuance, but it's hard to get between a journalist and what looks like a great story.

I think a skilled and experienced PR professional could have maybe navigated this successfully, but I've seen plenty of them fail in less difficult contexts than this.

It's also tougher when you're an organization that blew its credibility before this latest thing even happened.

This is an excellent point. "We're responsible for the good applications, just not the bad ones"

The modern commecial business corporation is ineherently a risk-externalising structure, which is specifically indicated in certain naming conventions, notably the "limited liability corporation". Legally it exists to sheild investors, as well as creditors and officers, from full personal liability. That has certain advantages, but as with all forms of impunity is subject to and the direct source of tremendous abuses.

Capitalism is often touted as an "engine of wealth generation", but what is in fact measured in financial reports and national GDP accounts is not wealth but profit, revenues less costs, where both seek the advantage of ecnomic externalities (positive externalities for profits, negative externalities for costs) to maximise those profits. The foundations of economics of the firm (microeconomics) are found in cost-accounting, and cost-accounting itself was limited to the expenses and revenues that could be measured (theree's a version of Goodhart's Law buried in here somewhere). Alexander Hamilton Church is the father of modern cost-accounting and gives some interesting insights. (Yes, related to the othere A.H.)

GDP is a measure of cash flows, rather than actual increase in national capital, wealth, or well-being. (With some adjustments.)

Economic definitions of wealth differ, though Adam Smith's was "the annual labour and produce of the nation". In general, it is the notion of productive capability (labour, motive, or change power, effectively available energy) plus stored capital to use that energy, plus resources to act on, and sinks to exhaust to. (Industrial knowledge is a form of copital.)

NSO Group's activities and rhetoric are par for the course.

>there's a version of Goodhart's Law [ https://en.wikipedia.org/wiki/Goodhart%27s_law ] buried in here somewhere

and/or:

* Campbell's law — https://en.wikipedia.org/wiki/Campbell%27s_law

* the Lucas critique —https://en.wikipedia.org/wiki/Lucas_critique

* the McNamara fallacy —https://en.wikipedia.org/wiki/McNamara_fallacy

Previous discussion of Goodhart's law on Hacker News: https://news.ycombinator.com/item?id=23762526

Thanks, and also for the spell-check (corrected in original).

A good set of additions as well, McNamara Fallacy especially.

> you're a league of superheroes saving the world from all its evils.

Never mind that every authoritarian regime labels its opponents as "terrorists". Thanks, "War On Terror" for enabling this!

Being convinced beyond any shred of doubt that you are on the sight of light and righteousness is a very common gateway to ultimate evil.

The truly good tend to doubt themselves to the extreme.

> Never mind that every authoritarian regime labels its opponents as "terrorists". Thanks, "War On Terror" for enabling this!

Um, the British in Ireland started this within a few years after the words “terrorism” and “terrorist” referring initially specifically to the acts of the Jacobin revolutionary regime in France, and the perpetrators of those acts, were coined, and its been pretty common since. Blaming the US’s early 21st Century War on Terror for the trend is... inaccurate.

Malicious context removal exposes another truth...

> I completely believe Pegasus has the ability to help with a kidnapping

These tools cut both ways.

> Kashoggi's widows

Plural?

In some cultures muslims can have four wives.

Muslims can marry four wives, but it is generally not recommended. Most muslim-majority countries place restrictions on polygny, and at least one (Turkey) has outlawed it entirely.

Jamal Khashoggi was married three times.

https://en.wikipedia.org/wiki/Jamal_Khashoggi

It’s unusual to call his ex-wives his widows?

It is. That's not the aspect I was addressing. The number of former wives of Khashoggi is, however, trivial to research.

The accepted definition of a widow is a woman who was married to person at the time of that person's death:

https://legal-dictionary.thefreedictionary.com/widow

(The definition specifies "husband", though I suspect with the rise in gay marriages, a female survivor of an intact legal union will be considered a widow regardless of the deceased spouse's gender.)

There's also the peculiarity of Western (predominantly Christian) tradition to unquestioningly accept serial polygamy, but not simultaneous, despite at least the sexual elements the latter itself being a widespread practice.

I can't speak for notafraudster's intent, though their usage isn't an accepted one.

> I can't speak for notafraudster's intent, though their usage isn't an accepted one.

Maybe they'd just picked up "He'd had three wives" or similar and assumed they were simultaneous.

He had a religious marriage with Hatice, not a civil one, and in fact was reluctantly going to the Saudi consulate to finalize the divorce papers for his separated second wife, which they told him could only be done in person. Apparently MBS has assured him personally no harm would come to him.