Hacker News Reader

I think the argument for legitimate application in Uganda is partly negated by allegations that political opposition was also being targeted [1].

[1] https://twitter.com/norbertmao/status/1463364241688305664

That's not why anything was done over it. If they had kept it to political opposition they'd still be using it today. It's specifically using it to root out spies that the US dislikes.

But that would be a scope shift, so if we're going there, now do Stingrays, PRISM, paralell construction, and FISA - but I won't say these are quality arguments. Outside this admitted whataboutism on my part, the very narrow defense I'm indicating for NSO in this specific case is it was within the sovereign right of this customer to use it, and it's only going to happen more often as this market is infinite.

I still think the Americans are just mad they got owned by Uganda. I'd bet this isn't the first time they have scored points against the low expectations of their "advisors," either so: well played. Point Uganda. I think this is a really funny precedent, and I can't believe I'm defending either of them, but the arguments back just aren't powerful when compared to demand for the tools of sovereignty, and we should give the conseqeunces of that due consideration.

> as it was by a state without a mature domestic intelligence capability going to market to buy tools of one, to spy on actual spies in its borders

How do you intend to support your claim that the 11 US diplomats and employees from the US embassy are spies (and thus are supposedly legitimate targets in your view)?

Nowhere does it say US spies were the targets. And no other story on this subject has presented evidence of that either.

I think the general idea is that the USG doubtlessly conducts espionage on Uganda, thus making all formal employees of the USG fair game for espionage. Which makes a good deal of sense. The reason NSO spyware on State Department phones is upsetting isn't that it targets the State Department employees, but that it targets the USG.

US intelligence organizations openly state that a common way for them to operate in a country is to give their agents cover "jobs" at the state department. When state department employees or "employees" work at an embassy they are diplomats. Apparently this is common in the intelligence world.

Whether these particular people were spies, it seems like proper counter-intelligence to track all diplomats pretty closely because at least some of them are going to be intelligence operatives.

Tracking movement vs intercepting communication is a very different thing. In general, any attempt to spy on an ally is going to get a lot of egg on your face if it comes out, and if it's using tools your ally helped finance and/etc, you can bet it's going to get complicated.

In this instance, Israel needs the US, Pegasus was Israel's technical gorilla in the spy world, and it got used on the US by someone they sold it to. This level of fallout given that is not unexpected; Israel cares more about maintaining ties with the US than they do about a given tool, company, or to enable Ugandan spying operations.

> it seems like proper counter-intelligence to track all diplomats pretty closely because at least some of them are going to be intelligence operatives.

Curious, do you happen to know what such spies do?

I'm wondering if it's just a reporting the news, talking to people and collecting information that can be legally obtained.

they are often actual cia agents, which means collecting humint and building sources and networks. eg https://cryptocomb.org

I wouldn’t hazard a guess about the exact number, but spies being given diplomatic cover (and diplomats spying) has been the norm for centuries. A huge chunk of Cold War spy craft was about diplomatic personnel trying to evade their followers in order to meet with their contacts without exposing them.

A huge chunk of the American intelligence leaked by WikiLeaks was collected by "diplomats".

The job of diplomats is to collect intelligence and represent their government.

Whether they collect it overtly or covertly is the issue here.

The USG had an "agreement" with Israel that NSO products wouldn't be used against the USG. Uganda did.

So the USG is making it clear to Israel that they have to rein in NSO and other "private enterprise" spy product providers.

So you've never read the WikiLeaks?

There's this joke people say the only reason the US doesn't have regime change factions is because it doesn't have a US embassy.

You're absolutely right, and I don't think anyone else has made that point. The problem was the spies they tried to fuck with were American spies and American wasn't going to stand for that. As you say, NSO are now just a toy, and if they are destroyed thanks to this, no-one is going to give a fuck.

I cannot see a world in which use of NSO tech is legitimate. Get a court order to tap the phone line, etc.

How can usage of a Mossad / IDF tool be considered legitimate? Just because the ruling party in a state decides so, doesn't mean this has any bearing on human rights or _legitimacy_.

China is eradicating Uyghur culture and running for-profit concentration camps. These are legitimate uses of their Governmental powers. Does that make them ethical? Of course not.

Technology like this is dystopian and anti-humanity. There is no way that this technology is profitable, exported and somehow used for "legitimate" purposes. The entire enterprise is predicated on making vulnerable people more vulnerable. The end result is more Khashoggi awfulness, how could it NOT be?

I'd say mostly because we don't have transnational law that has teeth. Most nations have laws prohibiting murder, yet if one nation does it to another nation, somehow it's not illegal.

I think many of us may fear a transnational government, yet we have transnational organized crime, transnational companies, transnational communication networks, etc. at some point, I hope we also get more transnational governance to balance some of those other entities.

In a well-functioning system (of which there are very few in this world), it's possible to use these tools responsibly.

For example, you could secure access and get insight into a terrorist ring using encrypted messengers, once the necessary paperwork has been done, reviewed and approved by an independent judge. Phone taps and internet taps worked great until everything became encrypted. Hard drives that cannot be accessed, conversations that cannot be monitored, you name it; the governments of the world have a difficult decision to make after about 120 years of easy access to criminal's conspiracies.

I'm not sure if there's any system of government in the world I'd currently trust with this power, but it's not inherently impossible to use these tools ethically. At the end of the day, governments are desperate for a solution for the encrypted nature of modern data and communications and don't think that there are any other solutions than either allowing the police to hack or banning/restricting encryption. I'm not sure which option I prefer, but I believe (fear) either will become the accepted norm within our lifetimes.

Countries conducting espionage is a well established and has been done for centuries. At the same time, the CIA doesn't get court orders when they want to listen in on FSB agents, nor vice versa. I don't see why Uganda should be held to different standards or why partnering with an Israeli company instead of developing the tools themselves should matter here.

Ok, but why carry water for that or them?

It's not Uganda that's being held to account here. Its NSO, and not just for selling to Uganda.

> I cannot see a world in which use of NSO tech is legitimate. Get a court order to tap the phone line, etc.

In general, I am against government overreach, so I agree with a lot of what you said.

However, let us say I have a court order to surveil person X - how am I ever going to get all the information when they could be communicating via a phone call, SMS, iMessage, whatsapp, gmail, facebook messenger, signal, telegram, discord and a myriad of other mechanisms with a myriad of identities. The easiest solution for me (the snooper) would be to surveil your entire phone, including click history and screenshots when feasible. No?

Once again, let us forget the person side for a minute. Let us talk about someone with genuine need to surveil. How will ever do it with today's technology? It aint easy.

Half of those services will happily share all of that person’s data when handed a warrant. Some don’t even require that much.

On the flipside, a snooper will always have to do a monumental and maybe impossible amount of work to break a one-time pad by chipping away at the security that surrounds it.

What makes security tech fundamentally different? Why should it be easy to break? A warrant lets someone search my belongings; it does not compel me to give law enforcement the information they are seeking.

  > A warrant lets someone search my belongings; it does not compel me
  > to give law enforcement the information they are seeking.

This is the issue. An investigator's limited permission to search a specific aspect of one's belongings does not infringe upon one's right to be secure in the remainder of his belongings. At least, not in the context of nations which have explicitly granted that right.

What makes you think Uganda or China wouldn't be able to get court orders to sign off on their respective actions?

Uganda has a very capable domestic intelligence network and I would be surprised if all they were doing to these "diplomats" (spies for the US) is hacking into their phones. This has made the news, but it is the one of the least egregious things Museveni and his son - esp the son - have done in the past two or so years as they faced the strongest challenge to his rule ever yet. I am very sure that locals, particularly the opposition, had it much worse than American spies, although that most likely won't make the news.

Honestly, I think it’s simpler than that. The US does not want smaller nations to have comparable hacking and spying capabilities…