Hacker News Reader

Comment by inglor | Hacker News Reader

I see their point - I think weapon sales (like Pegasus) should be regulated but blaming the company is kind of silly. It's exactly like blaming Colt for weapon sales.

Should weapon sales be regulated? Sure. Is NSO regulated by both the Israeli and US government? Sure.

Are those governments doing a good job regulating NSO? No.

Is the poor job of their regulation causing people to get hurt and NSO is complicit? Yes.

The solution in this case is to regulate selling Pegasus as strictly as selling weapons like the F-35 rather than like an AR-15.

View on HN

> I see their point - I think weapon sales (like Pegasus) should be regulated but blaming the company is kind of silly. It's exactly like blaming Colt for weapon sales.

It's not entirely the same situation, though.

In the case of Pegasus, NSO don't hand over the tool and that's the end of it. They continue to operate the attack servers on behalf of their clients - they're actively involved in the process.

Colt aren't there handing you each individual bullet, and pretending they can't see your target.

Heckler&Koch has been fined large sums for illegally selling small arms, for example in 2019 3.7 Million EUR and suspended prison sentences for selling to Mexico: https://www.deutschlandfunkkultur.de/prozess-um-waffenherste... (sorry, German)

The Colt comparison seems wrong. They don't know their customer do they? It's the gun shop's job to make sure they aren't selling to a crazy person, or ex-con.

NSO know who they're selling to and knowingly sold this software to tyrants that they knew would do bad stuff with it.

I agree and I think it's a regulatory problem. I think companies like NSO should be forced to go to a middleman and be regulated a lot more strictly.

This is exactly the point I was trying to make.

(BTW: Colt sell weapons to dictator armies too)

This is actually a good point. And here in the UK we sold a lot of weapons to Saudi Arabia.

But I guess (at least in theory) these are for use in military operations, not against civilians and journalists.

a colt is nominally for defence, hacking tools have no legitimate use.

Best defense is a good offense. Was it wrong for the Dutch to hack Cozy Bear?

What defense is that when it gets misused in schools and shopping malls?

The one who puts down the mass shooter.

“Man with Hunting Rifle Foils Attempted Mass Shooting at Apartment Complex” https://www.5newsonline.com/article/news/local/fort-smith-po...

“Nominally” they’re not made to be misused

Depends whose side you're on.

There has never been a legitimate application of software of this type since back orifice and sub 7. The only difference is this one is modern and also can be updated to leverage the latest zero day. this type of software should be banned and the company should be dismantled in addition to classifying the software as a weapons sale. In my opinion, it should be classified as a weapon of mass destruction, because it is.

I was going to interject, but I learned that the American definition of Weapon of Mass Destruction is actually wide, and not limited to what is actually causing mass destruction like an atomic bomb or a biological attack.

> In its criminal complaint against the main suspect of the Boston Marathon bombing of 15 April 2013, the FBI refers to a pressure-cooker improvised bomb as a "weapon of mass destruction."

In this context, classifying it as a WMD could make sense (especially for a ransomware which can disable hospitals and sensitive infrastructure), but I think that using WMD to describe it is really watering down the word : an atomic bomb is creating orders of magnitudes more destruction than a spyware

I have seen this software (well, not this software, a military equivalent) save a life in real time so it'd be very hard to convince me.

Quoting an earlier reply from last year:

> When I was in the Israeli army, I personally saw a phone being hacked, info being pulled and the info being used to stop a terrorist attack targeting civilians. I was not involved in the hack (I served in the navy).

> In that particular case (but not the majority of cases) the target of the hack was an Israeli citizen who was practicing terrorism (against the Arab minority). After their info was intercepted they were arrested and the situation was de-escalated.

This is an edge case, and is not a legitimate justification that billions of global users should need to worry about. The right to data privacy and right to free speech is more important than the lives in this scenario. At the permanent cost of inherit human freedoms and rights, you save a few thousand lives within a short time horizon. Over a longer time horizon, that same system that saved thousands of lives will kill millions more, and it will be done in total silence of anyone that dares to speak up and be a dissident.

Such unverifiable, and easy to claim justifications (often used to whitewash acts of dubious morality, like torture etc.) do not do much though.

Is it not more like blaming the people selling ransomware tools?

People selling ransomware tools are not legal companies regulated by the Israeli and US government. If NSO didn't pay income tax or wasn't regulated by governments I'd agree.

To be clear: I think the poor job regulating tools like Pegasus by governments is due to their incompetence in regulating this sort of weapon not to gain something.

I also think a lot of this PR is because NSO likes it to get more clients as this sort of PR shows that their tool works - you never hear this sort of PR about their many many competitors in this space (like Verint, HackingTeam etc).

We are enabling them instead of shutting them down which is unfortunate.

Similarly if you were making stealth fighter jets underground and selling them to dictators it'd be more like ransomware.

> To be clear: I think the poor job regulating tools like Pegasus by governments is due to their incompetence in regulating this sort of weapon not to gain something.

What data do you have to back up this belief? Because as the number one customer for these types of tools, it sure doesn’t seem like incompetence to me.

What exactly changed after the Snowden leaks? The US government isn’t in the business of protecting your secrets.

the definition of ransomeware tools can be hard imho. There is still an ongoing discussion about what are hacking tools and sometimes wireshark is called as example.

E.g. they describe their tools as:

> develops best-in-class technology to help government agencies detect and prevent a wide-range of local and global threats.

Only if their customers are state actors

Reply on news.ycombinator.com