Do they just sell, or operate the hacking software for their clients? If they operate it, is it illegal for an Israeli company to hack an American citizen (I assume it is illegal in America, but how about Israel?)
Is the sale of hacking software regulated in any way?
This part doesn't matter much in practicality. Like it is illegal for the US gov't to spy on their citizens. It is illegal for the UK to spy on their citizens. So the NSA made a deal with the UK. They spy on us, we spy on them, and exchange the info. There, the US didn't break the law and neither did the UK. They worked around it.
We live in a shadowy world.
https://www.theguardian.com/world/2013/nov/20/us-uk-secret-d...
Let’s not mince words, this is officials of the United States of America conspiring with foreign hostile [0] powers to undermine the rights and security of the American public. It’s treason, and an incoming president with the stones required could arrest much of the former administration’s “intelligence community” leadership in midnight raids via the insurrection act.
[0] Foreign intelligence services are, by design, hostile powers even if they belong to an ally. The UK is an ally, but GCHQ is a hostile agency from the perspective of the United States public which these agencies supposedly serve.
Sure they could, but they won't. No president will, if for no other reason then out of fear that the next one from the opposite party will do the same to their administration. Unless they outright shoot someone in front of witnesses, I don't expect this ever to happen, regardless of the level of corruption.
Nor would the Insurrection Act be in any way needed or relevant to arresting former (or current) intelligence officials for either actual treason, or any illegal conspiracy with allied intelligence services regarding surveillance.
> Chairman of the Joint Chiefs of Staff Mark Milley took steps to prevent then-President Donald Trump from misusing the country's nuclear arsenal during the last month of his presidency, according to a new book by The Washington Post's Bob Woodward and Robert Costa obtained by NBC News.
> The book, set to be released Sept. 21, also recounted a phone conversation Milley had with House Speaker Nancy Pelosi after the Jan. 6 violence at the Capitol, which Pelosi blamed on an "unhinged" Trump. Pelosi said in January that she spoke to Milley about "preventing an unstable president from initiating military hostilities or accessing the launch codes and ordering a nuclear strike."
> "I can guarantee you, you can take it to the bank, that there'll be, that the nuclear triggers are secure and we're not going to do — we're not going to allow anything crazy, illegal, immoral or unethical to happen," Milley told her, according to a transcript of the call obtained by the authors.
> "The president alone can order the use of nuclear weapons. But he doesn't make the decision alone. One person can order it, several people have to launch it," he said later in the conversation.
> After the call, Milley summoned senior officers from the National Military Command Center to go over the procedures for launching nuclear weapons, the book said. He told the officers that if they got a call, "you do the procedure. You do the process. And I'm part of that procedure," he said — making sure he was in the loop on any planned military actions, the book said.
https://www.nbcnews.com/news/military/milley-acted-prevent-t...
There is no constitution. Take the politics out of it. This is treason.
It would be treason for Milley to countermand a legal order, but asking for key servicemen to review the details of an admittedly complicated bit of military law and to prepare themselves for exactly what decision they might need to make in realtime - nothing illegal about that.
https://www.theverge.com/2016/11/23/13718768/uk-surveillance...
It's therefore easier to get a friendly government to do the hacking and to pass on the discovered info, which side-steps any legal accountability.
Yet a company like NSO weaponizes and abuses all sorts of vulnerabilities they get their hands on and sell it to thugs around the world who then use it against Americans and the same politicians couldn't care less
https://www.cbsnews.com/news/interview-with-ceo-of-nso-group...
> "Das BKA hat nach Angaben der stellvertretenden Behördenleiterin sichergestellt, dass keine sensiblen Daten bei der Firma NSO landen würden. So würden Hashwerte für Telefonnummern vergeben, damit das Unternehmen die Zielpersonen nicht identifizieren könne."
They claim that this way the NSO Group would not be able to identify the victims. Obviously that is a fat lie, as a phone number hash could trivially be brute-forced, even on a home pc.
From the sounds of it, NSO Group does not give out the zeroday exploits, but rather do the dirty work of exploiting/infecting the victim themselves, and then hand over control. But the writing is pretty vague.
Seeing all these democratic countries, including my home country support this kind of stuff by buying their malware, is extremely disheartening to me, when there is clear evidence that it is being misused by authoritarian governments. It also makes me feel powerless.
[0] https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-softwar...
So I don't see how a government hiring someone to hack someone else is not complicit.
Unless if that government branch had the legal right to execute that hack. Because if they were legally able to, but were unable to themselves, it makes sense to hire someone to do the job for them (if that is legal?)
I am quite in awe how for example exploit brokers like Zerodium and Thaddeus Grugq are allowed to sell their services to oppressive regimes, and getting away with it (a clear case of morally bankrupt). They are powerful weapons, and should be treated as such (export controlled etc).
They've also made other claims that only make sense if they do.
https://www.techdirt.com/articles/20210723/22444547234/nso-g...
Interesting podcast on NSO group from darknet diaries.
I don’t know about regulations in the field. All I know is that “US gov buys a lot of X, therefore it X is not regulated” is not a convincing argument.
This is not legal advice, obviously.
An interesting point. Given the vendor and customers for NSO's products, Federal law (in the US) would apply, rather than state law.
That said, an interesting parallel would be possession of burglary tools[0], which is a crime in many places in the US. However, given that "burglary tools" are generally just tools (e.g., bolt cutters), intent or mens rea[2] becomes important.
Presumably, a similar argument could be made about tools like nmap, nc, ettercap, metasploit, etc., since they can be used for legitimate purposes, even though they're also used for site intrusions/compromises.
NSO's tools, presumably, are mostly used for the latter rather than the former. I'm guessing (IANAL) that's one of the rationales used to restrict sales/exports.
Is that a convincing argument to criminalize activity and saddle it with strict liability[1]? I'm not so sure, but I'm also not a DOJ lawyer.
All that said, I don't think it's all just "marketing copy." As with most things, context and nuance matter. I make no judgement WRT the appropriateness of such restrictions, as I'm not in possession of all the facts.
Even so, while I tend toward the free flow of information, there is something to the idea that if you're caught at the back door of a jewelry store late at night with bolt cutters, that implies mens rea much more than having bolt cutters in the toolbox in your garage. YMMV.
[0] https://codes.findlaw.com/ny/penal-law/pen-sect-140-35.html
[1] https://www.law.cornell.edu/wex/strict_liability
[2] https://www.law.cornell.edu/wex/mens_rea
Edit: Fixed typo.
Even with regards the restricting import, the government is largely limited to sanctioning particular actors involved in the transaction.
I’m really a bit surprised that this isn’t more widely understood on HN. Anybody who operated a web server in the 90s is likely to know about Bernstein vs DoJ, and even if you operate one today you’re still likely to encounter the idea of an “export cipher”.
I misunderstood your point. I (mistakenly) thought that your reference to "marketing copy" related to the US Government's justification of restrictions on tech exports, not NSO's sales pitches.
My apologies.
If the government tried to ban certain types of software from being made/distributed, they would either make a law that’s never enforced (like the obviously unconstitutional DMCA anti-circumvention law), or a law that’s immediately struck down by the courts.
The scene has been set again in Afghanistan. It isn’t ICBMs but it’s not a virtuous circle when you are dealing with weaponry.
https://www.theverge.com/2021/10/22/22740155/commerce-depart... ("New US rules on spyware exports try to limit surveillance tech like Pegasus")
edit: and HN thread
https://news.ycombinator.com/item?id=28933981 ("U.S. tightens export controls on items used in surveillance of private citizens")
No US law enforcement is going to honor an Israeli subpeona I believe, and vice versa.
It isn't a crime to exploit your own property.
Presumably, the hacking was done by Saudi authorities from SA, using NSO-developed tools. Citizenship of the target is not very relevant, but it does matter where "the event" happened.
If the reporter was in Saudi Arabia when the hack happened, then Saudi laws apply and essentially Saudi government gets to set conditions on whether it was legal or not, and if it was forbidden by their laws, then what consequences (if any!) that should have.
If the reporter was in USA at the time, then it would be reasonable to apply US jurisdiction and try and investigate it as a crime in USA. However, Saudi Arabia can refuse to cooperate and even if USA prosecutors identify the culprits and convict them, Saudi Arabia can refuse to extradite them and choose to protect them. In essence, if it's not a random foreign criminal but someone from the actual foreign government that has harmed USA citizens in USA, it's not really a criminal matter as much as a diplomatic one, where all the other aspects of USA-Saudi relationships matter much more than any facts about the actual case; USA can choose to make a big deal out of it or ignore it, but historical precedent shows that it likely will be ignored as the Department of State considers all the other factors of Middle Eastern politics as much more important, SA could likely get away with literal murder (e.g. Khashoggi), not just some hacks.
In a similar manner, perhaps you could argue that NSO is an accomplice in that crime (I'm not saying that this would succeed - in general, arms exporters are not considered liable for whoever the purchasing country harms), but that essentially comes down to (a) whether USA prosecutors are willing to pursue this, and (b) whether Israel is willing to cooperate, as in the absence of specific treaties it would be legitimate for Israel to say "NSO did not violate our laws, we won't enforce any foreign judgements about this event"; if so, then any action would be limited to seizing whatever assets NSO has in USA (if any!) and/or trying to capture the involved people (if specific people can be identified) when they are traveling outside of Israel somewhere within the reach of USA. USA could apply diplomatic pressure to get Israel to restrict NSO, however, it doesn't seem likely that USA wants it so much to actually try and change that.
For another of your questions, sale of hacking software can be regulated by countries in whatever way each country wishes. In this case, as far as I understand, Israel treats is as essentially an equivalent of "arms export" where NSO has to obtain approval from Israel government for their foreign customers, but in this case it is not contested that NSO did have all the required approvals to sell their tools to Saudi Arabia.
In general, countries do hire mercenaries/private military contractors/etc, and it is not considered anything special, and many powerful countries (including e.g. the USA) routinely use mercenaries in their campaigns. the "sending" nation may restrict their people and companies from mercenary actions abroad if they choose to, but if e.g. Israel is okay with their company hiring out as a "mercenary" (the term usually implies directly participating in a conflict while being armed and excludes any other support such as training, logistics, software, etc, but for the sake of argument let's assume it applies here) for Saudi Arabia then there would be nothing unusual about that - for example, Saudi Arabia has used thousands of mercenaries in Yemen.
If the specific individuals commit something that's a crime in USA then USA can try to put them on trial, but that works exactly the same no matter if they're Saudi citizens working Saudi government or serving in Saudi military, or foreigners contracted out to Saudi government as "mercenaries"; in both cases it's up to the local government whether they want to hand them over (effectively betraying their own "employees") or refuse.
They can be held personally responsible in USA criminal courts no matter if they're civilians or uniformed SA government employees - if a foreign government agent does something on your soil, you can (and should) apply standard criminal law can no matter if they're an uniformed employee in their service or not - for example, the Russian officers UK charged with Salisbury Novichok poisonings. However, USA courts can't enforce any judgements without cooperation of the host countries.
And Saudi Arabia can arbitrarily ignore the victims' complaints, foreign charges and convictions and their enforcement if they want, no matter if the violators civilians or uniformed government employees, that's only a difference if SA chooses to make that distinction. Uniforms would imply some differences in their rights according to Geneva convention if they would be captured as prisoners of war in an active armed conflict, but this is not an active armed conflict and they have not been captured as PoWs.
With respect to extradition or local prosecution Saudi Arabia can arbitrarily extend their protection to whomever they choose to, no matter what their status or citizenship is - if they have not made e.g. a bilateral treaty with USA where they agree that they will extradite such people, they do not have to do so.