Why We’re Suing NSO
knightcolumbia.org
knightcolumbia.org
The whole point of setups like this is to circumvent legal checks and balances to get information they wouldn't normally be able to get. No intelligence apparatus is going to give up that ability, especially not over some silly foreign lawsuit complaining about hacking. This isn't even a slap on the wrist, it's just legal theater.
2. Judges are human and can apply appropriate principles.
From the privacy angle, nobody cares about NSO profitability... the point is that even if they go bankrupt, the underlying people, technologies, procedures, and overall shadiness will not only remain but grow stronger and more hidden, learning from this incident. Zero-days will keep getting found and bought and used for surveillance, and that is not something the legal system can solve, because a major customer IS state buyers who are funneling resources to it to purposefully circumvent legal protections. Judges aren't almighty, the law is selectively enforced, and almost always overridden for "national security" purposes.
You really can just look this stuff up. You don't have to start from first principles and try to reason your way to conclusions.
It is a game of whack'a'mole. But a business that gets you sued is radioactive for investors. SO while the technology exists, and means will be found by well funded agencies to exploit it, it will become less and less accessible to private corporations as a business model.
That is a good thing. That results from suing them.
This is literally an arm of the Israeli intelligence apparatus. The laws as you and I see them do not apply in any form whatsoever to NSO.
But reality is judges and the justice system are intentionally analog and human and fallible, and can use judgment to sledgehammer people trying to use one simple trick.
I think people on HN have a really bad habit of mythologizing CNE shops. You do not in fact need state sponsorship to do exploit R&D and build software implants; dozens of people have started companies that do exactly that, and they get bought routinely. All of them have state actors as their primary client base.
I wouldn't be at all surprised to learn that NSO has a tight relationship with the IDF, the same way lots of commercial CNE shops in the US have relationships with NSA. I wouldn't even be surprised to learn the relationship is deeper than that. But there is no evidence at all that NSO is an "arm of Israeli intelligence" in any formal sense, and a lot of countervailing evidence.
It's possible the only thing that distinguishes NSO from any of a dozen other shops is that they happen to be Israeli. Somehow, a CNE shop in Auckland just doesn't seem to excite HN the same way. Maybe there's more to the story than I'm suggesting! But, like, you know what they say about extraordinary claims.
https://www.axios.com/2021/07/22/nso-group-spying-investors
> The bottom line: NSO isn't some rogue company being operated out of the basements of shadowy founders. Instead, it's been empowered by institutional investors that appear to have turned a blind eye to its deeds in the pursuit of profit.
https://www.nytimes.com/2022/01/28/magazine/nso-group-israel...
> The F.B.I. had bought a version of Pegasus, NSO’s premier spying tool. For nearly a decade, the Israeli firm had been selling its surveillance software on a subscription basis to law-enforcement and intelligence agencies around the world, promising that it could do what no one else — not a private company, not even a state intelligence service — could do: consistently and reliably crack the encrypted communications of any iPhone or Android smartphone.
> Since NSO had introduced Pegasus to the global market in 2011, it had helped Mexican authorities capture Joaquín Guzmán Loera, the drug lord known as El Chapo. European investigators have quietly used Pegasus to thwart terrorist plots, fight organized crime and, in one case, take down a global child-abuse ring, identifying dozens of suspects in more than 40 countries. In a broader sense, NSO’s products seemed to solve one of the biggest problems facing law-enforcement and intelligence agencies in the 21st century: that criminals and terrorists had better technology for encrypting their communications than investigators had to decrypt them. The criminal world had gone dark even as it was increasingly going global.
https://www.theguardian.com/news/2021/jul/31/nso-group-israe...
> If the deal proceeds, the California-based company would take over the fund that owns NSO at a difficult time for the Israeli company. The French government has called for an investigation into allegations that NSO clients listed key government officials, including most of Emmanuel Macron’s cabinet, as persons of interest. In the US, a senior Biden administration official involved in national security has also raised concerns about the Pegusus project revelations to an Israeli official.
https://citizenlab.ca/2016/08/million-dollar-dissident-iphon...
Ahmed Mansoor--the particular UAE dissident who was being targeted in that analysis--is often in the crosshairs, and I think it just goes to further the point of your narrative that there are other companies from countries people ignore (as they don't get to go "oh no! it's Israel! they're scary!") providing software that people are trying to use to hack his devices. One of the other attempts I had paid some attention to was an Italian company named Hacking Team.
https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million...
That hack also relied on third-party software, this time written by Collin Mulliner, whom I had known from grad school. He developed software that was somewhat analogous to my work for iOS that ran on Android, and he actually started getting flack as if he had something to do with the hacking, and so ended up publishing a blog post and public statements pointing out his software was both reusable and even sometimes open source, and he had no involvement.
https://www.mulliner.org/blog/blosxom.cgi/security/hackingte...
Maybe I should have worded it better.
Yes, companies like NSO most probably do receive institutional money, in the same way that some of the taxes we pay go to purchasing tanks and ammunition (i.e. the military doesn't run from a rogue basement), my point was that if that institutional money were somehow to be gone overnight it will not be the end of the world for companies like NSO, or for the people that they employ.
Worst case scenario the company goes bankrupt and another NSO-like company takes its place, with the same stakeholders behind it. But all the institutional and VC money in the world won't help take a NSO-like company off the ground if it doesn't have the right state-approved and and state-sponsored stakeholders.
I suspect this is because they operate in a way such that Hacker News doesn’t really hear about them.
I don't know what that says about NSO. I have no trouble believing NSO has culpability comparable to Watt's. It helps NSO that they're not generally operating under US criminal justice jurisdiction. Nothing special had to be done to convict Watt.
So do you think fighting all organized criminal activity is pointless?
If not, how do you distinguish someone like NSO from, say, a smuggling ring?
I want to watch the 60-mins interview with NSO now
Wow, just ... wow.
That is worth a read.
There is no principled take here. This is a problem with who the software was sold to, not that the software was sold.
Untrue. In any hands tools like these, combined with the vulnerable consumer products, are dreadful. Selling tools like these to anybody is unethical. If they buy these tools they are up to no good.
If such a tool could have prevented 9/11 (the argument that NSO makes) isn’t that a good?
What is problematic is that these tools are used with very little transparency and oversight (not necessarily disclosing vulnerabilities) which allows such tools to be targeted on not just “criminals” but also anyone organizations/nation states deems problematic (journalists, advocates, dissidents, etc)
A country wanting to penalize one of NSA's suppliers could single out a commercial CNE supplier and sue them the way US entities are suing NSO. That would jam the target company up, and prevent them from getting investment or doing M&A with companies under that country's jurisdiction. But for obvious reasons, US jurisdiction is a lot more commercially impactful than, say, Indonesian or Russian. Suing NSO is thus probably more impactful than suing a random NSA xdev supplier.
The understanding about SIGINT between intelligence agencies is especially strong within NATO (it probably doesn't need saying that the US and major Commonwealth countries have an even closer relationship still). For a long time, it was "common knowledge" that the biggest SIGINT challenge the US had was France, not any actual global military adversary. It's a little unlikely any major western market country is going to go to the mattresses over state-sponsored CNE from one of their own countries. I assume they have better ways of working this stuff out than lawsuits, which is why we never hear about them.
(I am out over my skis on at least the last paragraph of this analysis so take it for what it's worth.)
We do know how to do it. But security runs counter to convenience so we do not.
Eliminating the competition doesn’t really make a lot of sense as a justification.
If the US Military felt threatened by a private Israeli company, wouldn’t it be more effective to put significant pressure on the Israeli government instead?
Let's use the same logic and apply it to kinetic weapons: US defense contractors made and sold weapons to saudi arabia who used it to kill a lot of Yemenis, mostly civilians. Should not these defense contractors be sued by any Yemeni-American whose relatives were killed by saudi arabia? Well that can't happen for many reasons but my favorite is the fact that private companies selling to foreign governments are not required to evaluate the intentions of that government, merely its legitimacy and follow the country's laws on foreign arms sales.
Did the NSO group violate Israeli law? No. So they traded with the legitimate governments of foreign nations lawfully. Is there a US law that requires evaluating the intent of foreign governments by foreign (or domestic) companies when selling cyber or other weapons? No.
The fact is, selling to governments is not the same as selling to individuals. When an individual wants to murder someone, selling them a weapon knowingly makes you complicit in the murder. Governments are special because so long as they are legitimate, they can murder their own people as much as they want. Even commit genocide (unless they signed a treaty in the past to make them accountable to an international court).
I keep running into this frustraring sentiment that so many of my fellow americans (and westerners) for some reason refuse to understand and honor a foreign nation's sovreignity. Of course I disagree with what the central american governments are doing to their own journalists. But it is up to those sovreign nations to self-determine, with or without fairness or democracy or the will of the people their own fate. They are sovreign, that means external people or governments don't get to impose their will or ways or hold them accountable without the consent of their government. I can't decide if this arrogant view is a left over from manifest destiny in the US or europe's claim that they colonized forein sovreign nations because their ways were barbaric and wrong. Every native american government the US eradicated or african,latin and asian country whose governments were removed by force to colonize them was neither democratic nor did they trear their own people under the same rules against cruelty and fairness that existed in the west and their invasion was justified as "better for them" in every case. Let those journalists and people fight for the change they desire and fail or succeed under their own terms. It is their own neighbors and citizens that are members of any police or military force keeping their government in power and revolutions happen without the CIA or the west meddling and installing a puppet or undermining sovreignity.
A person cannot claim to have learned from the errors of their ancestors if that person refuses to let go of those very same erring ways.
The answer is partially included in the latter part of your comment. Companies like NSO are "out-sourced" entities of the Israeli intelligence apparatus. If the shit hits the fan, as it happened in this company's case, then the intelligence agencies can say that they had nothing to do with it all.
There are companies like NSO all over the world, many competing in the same legal jurisdiction. Like I said upthread: nobody on HN has a weird theory about how an Auckland CNE/xdev shop is an arm of NZSIS, but everyone thinks they understand the IDF well enough to attribute NSO to it.
Some of us do, i.e. even though we might have never personally heard of those companies we almost automatically equate cybersecurity/surveillance stuff with state entities. In this geopolitical climate it would be foolish not to do it.
The thing that is different with Israel is that it has got its mandatory 2-year military conscription and that it has a dedicated cyber unit which is manned by fresh and very bright conscripts. Afaik no other state entity around the world has that.
According to The Guardian:
"...a senior White House official suggested that any possible deal could be seen as an effort by a foreign government to circumvent US export control measures. The senior White House official also said that a transaction with a blacklisted company involving any American company – particularly a cleared defence contractor – 'would spur intensive review to examine whether the transaction poses a counterintelligence threat to the US government and its systems and information'.
...
There were other complications. The Israeli ministry of defence would have had to sign off on any takeover of NSO surveillance technology by a US company and it is far from clear whether officials were willing to bless any deal that took control of NSO’s licences away from Israel.
...the person also said that the deal faced several unresolved issues, including whether the technology would be housed in Israel or the US and whether Israel would be allowed to continue to use the technology as a customer." [1]
Of these obstacles, it seems like the biggest was related to counter-intelligence, i.e. that the Israeli intelligence services could feed any disinformation they liked to the American intelligence services via NSO? That's how I read this, anyway. I'm a noob to this though, and would love to be corrected if I'm wrong.
1. https://www.theguardian.com/us-news/2022/jul/10/us-defence-f...
Building a tank factory is legal if you pay taxes and only sell your tanks to whomever the government lets you. Killing someone with a tank is not.
Whether it doesn’t tossed out for a variety of factors is another story.