For better or worse, NSO's product is a weapon. How is it any different from an M-16? Where is the outrage towards the people who used this weapon against the State Department?
No, because it isn't novel, it's not wide reaching, it's not at arm's length and it cannot be stopped.
Stuxnet, a novel American-Israeli cyber weapon, purpose built to hit Iran, was absolutely billed as such. And it was received differently, by Iran, than would be e.g. an American-made gun fired by Iraqis at Iranian surrogates.
NSO is making and selling cyberweapons. They're doing it now. These weapons are hitting the U.S. government and its allies to an unknown extent. And they can be turned off, right now, if Jerusalem orders it.
U.S. persons being shot in Uganda by Kalashnikovs are none of these things. It's not novel. Nobody wonders if the Ugandans are going to show up, guns blazing, in Arlington. And Moscow can't remotely disable the guns.
For an "average soldier" weapon, such as an M-16 - $Company isn't likely to catch much grief - unless they're selling a considerable quantity of them, or to an extremely notorious buyer. Similar for a cyberweapon - but an "everyday" one, which wouldn't be a big surprise for a C-list ransomware group to use.
Vs. NSO's stuff seems to be the sort of top-tech goodies which A-list nation states use to maintain & enjoy their A-list status. Whether any actual harm results from this incident... publicly letting a bunch of "the wrong sorts" into that exclusive clubhouse is getting NSO into really deep do-do with "the regulars".
The situation is less "M-16 and rounds sold once-off", and more of a turnkey armed drone (or surveillance drone, if you're charitable) service provided to governments, where the missiles, fuel, and airbases are provided by a private party on an ongoing basis. It's more of a tailored service, than a sale of goods.
They do not give the software to their clients to go use somewhere in the world fully independently (self hosted payload dropper, C&C, etc)
They're a direct participant in the network traffic. Unlike a dumb purely offline piece of hardware like a M4 rifle or similar.
Also, there's outrage towards NSO because Israel is supposedly an American ally. Israel needs American support, and yet Israel freely allows Israeli corporations to sell services American enemies. And this isn't an isolated company--there are other Israeli hacking companies that target Americans, such as Black Cube.
It's all about the specific class of weapon. There are general understandings about who can get sold what weapon without the US getting mad. No radars or surface-to-air missiles for China or Russia or for random tiny dictatorships; but it's totally okay to sell them to India or Latin America. Dumber things like artillery pieces can go anywhere, even places under US sanctions like Myanmar, without crossing any lines. But this isn't written in treaties; it's all implicit understandings and learned patterns of retaliation.
For this new class of weapon, both sides are still feeling out the rules. The US is laying down precedents that put NSO's products much closer to the rules for radars and missiles, while Israel is pushing the limits to see how far the US can live with.
Small arms proliferation is much harder to control, but yes there has been extensive reporting on Operation Fast and Furious where US gun sellers were allowed to sell to Mexican cartels under ATF supervision. [0] Those guns were used against both US and Mexican citizens, including fatally against 1 US Border Patrol Agent in 2010.
Looking farther back, during the Falklands war in the early 80s there was much controversy over the Exocet anti-ship missile, which was manufactured and sold by France. When these missiles were successfully used against British warships near the Falklands, Britian successfully lobbied for France to stop selling them to the Argentinians.[1]
So yes, it's actually very common to put the responsibility of how their products are used on arms manufacturers. It's a good thing and it keeps the world safer.
[0]https://en.wikipedia.org/wiki/ATF_gunwalking_scandal [1]https://www.bbc.com/news/magazine-17256975
The comments here focus on NSO because the story is about what NSO did. This is computer tech kind of community so you’re going to see more computer weapon stories here than stories about improper use of rifles.
But there are clear understandings that e.g. nothing goes to China, and no fancy radars go even to untrustworthy places like Myanmar. NSO is still in a gray zone.
And yes I'm acutely aware that the CIA literally ran torture training camps in the 1970s but two wrong don't make something right.
It is highly unlikely that NSO group actually gives out their exploits, based on what we know about previous exploitations that have become known. It's more like they offer an interface to execute their exploits on a given target. The fact that they can block entities from using their service, after having had access to it (like they supposedly did in this case), very strongly supports this hypothesis. Hence they're offering a service, to use weapons for (or rather, in the name of) some (government) entity that pays them money to do so.
Imagine bombing-as-a-service, as an instance. That's much more like it, and your argument doesn't hold in that case.
Fuck NSO, for sure. But I'm just not sure Israel should be held accountable for the actions of a private corporation with no apparent political motivations, just as in your M-16 example.
https://www.haaretz.com/israel-news/tech-news/israel-will-re...
Follow the industry long enough and you'll know how Hacking Team (Italy), Finfisher (Germany), Gamma International (UK), smaller and larger firms have rightfully attracted their fair share of condemnation. Journalists pile on when a story gains momentum, this round was started by the published list of targets and Citizen Lab. We can't call this anti-semitism yet.
Defending it just because it's Israeli would be as unjustifiable as attacking it just because it's Israeli.
That’s pretty obvious and it’s disingenuous that you’re trying to steer the conversation in that direction
NSO gets particular flack because they're inextricable from the weapon they sell. If an M-16 is used to shoot someone, provenance is probably harder to prove; weapons change hands all the time, or are smuggled to ne're-do-wells via the black market. But everyone using Pegasus, as far as we know, is an NSO client; NSO made the choice to provide that software, including NSO support and NSO services.