Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Government Privacy

NSO, Not Government Clients, Operates Its Spyware (theguardian.com) 45

jojowombl shares a report from The Guardian: Legal documents released in ongoing US litigation between NSO Group and WhatsApp have revealed for the first time that the Israeli cyberweapons maker -- and not its government customers -- is the party that "installs and extracts" information from mobile phones targeted by the company's hacking software. The new details were contained in sworn depositions from NSO Group employees, portions of which were published for the first time on Thursday.

It comes five years after WhatsApp, the popular messaging app owned by Facebook, first announced it was filing suit against NSO. The company, which was blacklisted by the Biden administration in 2021, makes what is widely considered the world's most sophisticated hacking software, which -- according to researchers -- has been used in the past in Saudi Arabia, Dubai, India, Mexico, Morocco and Rwanda. [...] At the heart of the legal fight was an allegation by WhatsApp that NSO had long denied: that it was the Israeli company itself, and not its government clients around the world, who were operating the spyware. NSO has always said that its product is meant to be used to prevent serious crime and terrorism, and that clients are obligated not to abuse the spyware. It has also insisted that it does not know who its clients are targeting. [...]

To make its case, WhatsApp was allowed by Judge Phyllis Hamilton to make its case, including citing depositions that have previously been redacted and out of public view. In one, an NSO employee said customers only needed to enter a phone number of the person whose information was being sought. Then, the employee said, "the rest is done automatically by the system." In other words, the process was not operated by customers. Rather NSO alone decided to access WhatsApp's servers when it designed (and continuously upgraded) Pegasus to target individuals' phones.
A spokesperson for NSO, Gil Lainer, said in a statement: "NSO stands behind its previous statements in which we repeatedly detailed that the system is operated solely by our clients and that neither NSO nor its employees have access to the intelligence gathered by the system. We are confident that these claims, like many others in the past, will be proven wrong in court, and we look forward to the opportunity to do so."
This discussion has been archived. No new comments can be posted.

NSO, Not Government Clients, Operates Its Spyware

Comments Filter:
  • by evanh ( 627108 ) on Friday November 15, 2024 @09:05PM (#64949423)

    When asked like that, it's pretty clear NSO always retain the ability to disable the software. After all, they're always going to want to control/update who it can be used against. Not unlike being able to cut off the supply of munitions.

  • by Gravis Zero ( 934156 ) on Friday November 15, 2024 @09:40PM (#64949463)

    I'm no lawyer but if you keep doing business with a government that violates human rights of the people the you provide information on, you are an accomplice to the crime.

    • Which government is this, specifically?
    • Yeah, but who isn't doing it? All the finest people in the parts of the world that care about Interpol are using NSO's services.

      • Yeah, but who isn't doing it?

        Presently, the US government. No idea about which E.U. countries are or are not using them.

        All the finest people in the parts of the world that care about Interpol are using NSO's services.

        European governments cutting them off wouldn't be a huge ask. Do remember that all things are replaceable, especially the NSO. Their downfall will leave a vacuum and you can be sure that someone will step in to fill it.

        • Do remember that all things are replaceable, especially the NSO. Their downfall will leave a vacuum and you can be sure that someone will step in to fill it.

          If what they are doing was trivial, others would be known for doing it as successfully as they are.

          • There are actually a lot of security firms finding exploitable bugs. The difference is that this one decided to exploit them for money rather than report them.

            NSO isn't a group of super hackers, they are normal security researchers with leadership that is indifferent to the people they hurt.

  • Simple test (Score:5, Interesting)

    by spaceman375 ( 780812 ) on Friday November 15, 2024 @10:33PM (#64949503)
    Purchase the software. Give it the phone numbers of the executives, board members, and employees of NSO. See what response you get. This will tell you if NSO controls, or at least knows, who is targeted. If you actually get any real data, I'd suggest that this would be one of the rare times where doxxing is appropriate.
    • Nah, that could just as easily be a pre-programmed blacklist of numbers that it wouldn't process. Also, the idea that an automated process dependent on data entry by the user isn't controlled by the one who set it in motion is more than a bit silly.

      • The first sentence is correct. Let's examine the second using a more consumer-oriented form of spyware called "Amazon Alexa," which is fairly representative of the business model used by big tech companies.

        Let's see: Alexa is an automated process, check. Alexa is dependent on data entry by the user, check. The user sets the "automated process... in motion" by speaking a voice command.

        Okay, so far so good. Now, there's one more condition left: does the user control Amazon Alexa? Uh, no. By law and in practic

  • Glad to see more remember too! Don't forget, they have exploit injection at factory some places too. You did a great job with the write up.
  • by kmoser ( 1469707 ) on Saturday November 16, 2024 @01:33AM (#64949681)
    When a 14-year-old writes an exploit that lets you hack into anyone's phone, he gets busted. When a company does the same thing, they get customers.
    • Re: (Score:2, Insightful)

      Please cite exactly which laws were broken in this case.
      • I'm Canadian, under the Criminal Code of Canada there are several sections which apply to "hacking", here's an easy one:
        Section 184: Any person who knowingly intercepts a private communication, by means of any electro-magnetic, acoustic, mechanical or other device, is guilty of an indictable offence carrying a maximum penalty of five years' imprisonment.

        • Wow... just wow. Using a thin glass cup to listen to a conversation through a solid wooden door would count as hacking in Canada.

          • While no one will be prosecuting your grammy for listening at the door while the family squabbles, if a company rigged rooms to listen in on business negotiations they may well find out what their fucking around with glass cups has achieved.
            As they should.

      • In the US, the Computer Fraud and Abuse Act. (Because most devices interact with the Internet, they count as a "protected computer" under the law.) Specifically, 18 U.S.C. 1030(a)(5), 18 U.S.C. 1030(a)(6), 18 U.S.C. 1030(a)(7), and 18 U.S.C. 1030(a)(8).

        But notably only if the US government or it's law enforcement agencies are not performing an investigation into said protected computers. That's allowed under 18 U.S.C. 1030(f).

        TL;DR: It's illegal if NSO was to hack an iPhone of a US citizen (or even
  • | "To make its case, WhatsApp was allowed by Judge Phyllis Hamilton to make its case"

    maybe they could have made their case if the Judge had made its case to make the case..

  • Ok (Score:5, Insightful)

    by Bahbus ( 1180627 ) on Saturday November 16, 2024 @04:16AM (#64949821) Homepage

    And, a spokesperson for humanity said in a statement: "Gil Lainer is an uneducated moron who doesn't even understand the words coming out of his mouth. Not to mention that both NSO Group and the Israeli government are terrorist organizations and cannot be trusted with anything."

Hackers are just a migratory lifeform with a tropism for computers.

Working...