FinSpy Commercial Spyware Abused By Governments 87
plover writes "The NY Times has a story about FinSpy, a commercial spyware package sold 'only for law enforcement purposes,' being used by governments to spy on dissidents, journalists, and others. Two U.S. computer experts, Morgan Marquis-Boire from Google, and Bill Marczak, a PhD student in Computer Science, have been tracking it down around the world. 'The software proved to be the stuff of a spy film: it can grab images of computer screens, record Skype chats, turn on cameras and microphones and log keystrokes. The two men said they discovered mobile versions of the spyware customized for all major mobile phones. But what made the software especially sophisticated was how well it avoided detection. Its creators specifically engineered it to elude antivirus software made by Kaspersky Lab, Symantec, F-Secure and others.'"
*insert fake surprise here* (Score:5, Insightful)
Paywall (Score:5, Insightful)
Unpossible! (Score:4, Insightful)
Long time concern (Score:5, Insightful)
It has always concerned me the loopholes which you know are being abused.
Sure, the government isn't 'legally' allowed to spy on citizens without following the Constitution. But that doesn't hold for 3rd Parties. Nor does it hold true for other governments.
Oh the government didn't conduct the surveillance, it just purchased the already performed surveillance dataset from 'Private Investigation Company XYZ'. See, it was the private company that did the spying, not the government. The data wasn't only spy data, it was also available to be sold to marketing firms, so it isn't just a shell for the government, the government just happens to buy from them. A lot.
I'm also really curious to know about the whole 'sharing' of intelligence data.
Sure, our intelligence agencies aren't 'supposed' to spy on US citizens, but they can spy on UK citizens. And the UK agencies ARE spying on the US citizens. So when that data package from the UK agencies is shared with the US agencies, it's just a convenient benefit. The US agencies didn't technically do anything to perform the spying, they just benefit from it.
I'm sure I'm being paranoid, but it doesn't even require maliciousness on behalf of the agencies. It just requires people who try really hard to do their jobs. Something that is technically legal can be immoral, unethical, evil, oppressive, and counter-productive... but technically legal is still legal.
Re:*insert fake surprise here* (Score:5, Insightful)
"Whenever a controversial law is proposed, and its supporters, when confronted with an egregious abuse it would permit, use a phrase along the lines of 'Perhaps in theory, but the law would never be applied in that way' - they're lying. They intend to use the law that way as early and as often as possible.
Meringuoid's Law [slashdot.org], Nov 24, 2005.
Think of it from Dad's viewpoint: the Dad who buys his newborn son a new power drill and fishing gear, and a set of Lego Mindstorms for his first birthday. The kid may not be interested in carpentry, angling, or robotics, but Dad sure loves the excuse to go shopping!
Re:Yes (Score:5, Insightful)
The moral of the story is this: dissidents should airgap any system they use for sensitive/secret material.
I genuinely do not understand how people don't get this. You want to push against the big boys? Assume they have tools you've never even imagined. It's just like sterilization in medicine. You don't know what the patient has, so you treat everything they touch like it's covered in plague. Diligence, children, diligence is the key to anonymity.
Is it wrong that this exists? Probably. Are you naive for believing that these types of tools aren't used every day? Absolutely.