Huh, it looks like suing a state-sponsored malware manufacturer doesn't prevent them from continuing to hijack your devices. Live and learn, I suppose.

Suing is hardly the same as having the suit decided, grow up.

Okay. Let's assume they do have the suit decided, and they rule in Apple's favor. What next?

“ NSO says its intrusion system cannot work on phones with U.S. numbers beginning with the country code +1.”

Seems like they just need to add a similar patch for apple ids for emails ending in “state.gov”. Not sure why this is such a big deal.

Come on, think about it. Doesn't work for phone numbers starting with +1? So, anyone who buys the right sim card is immune? A team of professional hackers can't find the if-else in the attack binary that enforces that to disable it? They're selling software to cybersecurity teams on the assumption that they can't crack it?

Time to go back to rotary phones

Is there a timetable when Apple plans to stop using memory-unsafe languages to avoid memory-bugs? If not, how can the amount of zero-days stop with constant development?

biggest issue here isn't memory safety but the dumpster fire of imessage format that calls out to privileged parts of the system

I'm suspicious of any messaging system that has ties into rich media / embedded-in-chat content. I even wish I could disable URL previews, gifs, and inline images in Signal.

I didn't know it was possible to disable URL previews in iMessage[1] until I read this comment. Does toggling this setting only prevent the preview from displaying or does it prevent the fetch altogether? I wish there were a way to white list the URL previews for certain contacts rather than turning it off all or nothing.

[1]https://discussions.apple.com/thread/7677834

You do know that memory-safe languages are developed using memory-unsafe languages, and eventually execute the binary code on the actual CPU?

Most memory-safe languages I've used self-host their compiler and standard library (i.e. they're written in the language itself).

In a public response, NSO has said its technology helps stop terrorism and that they've installed controls to curb spying against innocent targets. For example, NSO says its intrusion system cannot work on phones with U.S. numbers beginning with the country code +1.

So the point is to stop terrorism and to do that they've immediately ruled that all Americans aren't terrorists. That doesn't seem like a good metric of determining if someone is a terrorist, and makes me doubt their other controls are any better.

NSO has repeatedly shown that their statements are pretty much worthless. It's just damage control. I wouldn't put any stock in the "we avoid +1 numbers" to even be real.

Seriously, they're pretty much the Mark Zuckerberg of their industry.

That is not fair to Mark Zuckerberg.

I‘d rather compare Zuckerberg to the Sackler family who knew how addictive and harmful their painkiller Oxycotin was, yet ignoring all evicence, making billions of dollars. Zuckerberg knows how bad Facebook and Instagram is, how harmful to individuals and society alike, yet ignoring that and making billions.

Edit: Replaced „social media“ with „Facebook and Instagram“

So I just have to buy a US phone to evade detection from NSO? And why didn't that logic work for US State Dept phones?

I'm honestly of the opinion there is nothing that NSO can say that isn't outright lying. This isn't a normal company in anyway.

I remember reading that some Russian (private sector) computer viruses did not attack computers whose language and locale were set to Russia. It's never about ethics. It's always about making as much money as possible without pissing off powerful people and entities.

Reminds me of how some ransomware looks for if your default keyboard language is Russian. If so then it exits, doing nothing.

OK, so the best way to protect privacy is to get US-based phone number and install Russian keyboard as a default.

These people are in for a world of hurt, the State Department tells the CIA what to do.

State Department tells the CIA what to do

Your broader point is correct, but no, it doesn't. The CIA is an independent agency [1]. It reports to the DNI [2].

[1] https://en.wikipedia.org/wiki/Independent_agencies_of_the_Un...

[2] https://en.wikipedia.org/wiki/Director_of_National_Intellige...

Yes, but who dictates where and how they can play overseas?

who dictates where and how they can play overseas?

The Director and Deputy Director of the CIA.

Funny enough this reminds me of the ransomware that doesn't work if a cyrillic keyboard is installed. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

I'm waiting for the day that the US declares a foreign corporation as an "enemy combatant", as they have done with foreign citizen wahabbist jihadis and US citizens such as Anwar Al-Awlaki.

Given the extent and depth of US-Israeli cooperation and ties, the precedeing theoretical is probably going to remain in the realm of theoretical.

Didn't they get pretty close with Huawei when the previous president issued an executive order in response to state spying fears that:

* banned the sale of any of their phones or networking products in the US

* banned US companies selling product to Huawei

* cut funding to wireless carriers using Huawei equipment

...and then pressured allied countries to do the same?

The investigation into Huawei was going on for many years prior to 2016. It's not exactly an initiative of the previous president.

I sat in briefings about Huawei and ZTE in 2007. Regretfully can't say more.

Are you personally upset about the clear intelligence failures and extrfiltration of protected information?

I've grown up watching this unfold and I'm shocked that the power groups seem to be so ineffectual at times that it's laughable(but that may be by design...)

It's an absolute shitshow from top to bottom. The people who know what they're doing in intelligence/counter-intelligence agency infosec/netsec (and within major DoS and DoD contractors) have been fully aware and ringing the alarm bells for years. The technologically unsophisticated politicians have been mostly ignoring it.

how much of the ignorance is willful?

NSO's PE investors are big-time American and British funds.

Just sayin'.

According to Wikipedia, NSO is owned by by its two founders Omri Lavie and Shalev Hulio and Novalpina Capital. According to Sky News Novalpina Capital is getting liquidated and their stake in NSO will be sold to a third party: https://news.sky.com/story/pegasus-spyware-owner-novalpina-t...

Right. I can’t tell if you’re agreeing with me or not. :)

Prior to Novalpina, it was Francisco Partners.

Point being, NSO has received huge amounts of money from the kind of people who, well, YCombinator founders seek out.

Yes, but it is not Francisco Partners now so it appears there is no "big-time American fund" involved and the British one appears to want to get rid of its stake.

From the side-lines this thread looks like:

- md: X and Y are deeply involved in this company

- yiu: No they are not. X cleanly destroyed all the papers and officially ask we don’t talk about them. Y is a bit late but will finish cuting ties in a minute now.

That's pretty much what they did with NSO, which is getting the Huawei treatment:

https://www.theregister.com/2021/11/03/us_sanctions_spyware/

reportedly, this has created havoc on NSO, since for instance none of the cloud providers can sell services to them to host their zero-days, among other logistics headaches. Their recently hired CEO resigned.

What's the consequence for destabilizing governments worldwide? Logistics headaches? Got it.

The NSO guys are in it purely for the money. IIRC there was a deal on the cards for some investors to buy the company that fell apart because of the sanctions, so the NSO founders can no longer cash out.

As for destabilizing governments, they are doing the opposite, they are helping authoritarian governments worldwide crack down on journalists and dissidents, or murder them in the case of Saudi Arabia and Jamal Khashoggi. Reportedly, after the Khashoggi murder, NSO yanked the Saudi account but was forced to reinstate it by Netanyahu who was pursuing diplomatic relations with them.

The episode of Darknet Diaries on NSO was very informative.

https://darknetdiaries.com/episode/100/

I knew about Israeli security consultancies putting out stringrays and phone cracking tools, but I did not know about NSO. He has a good interview with one of the lead devs.

I'm waiting for the day that the US declares a foreign corporation as an "enemy combatant"

It’s particularly interesting to watch as the company is based in a country that is a very close ally.

Ignorant question: is Israel literally an ally of the US? I know they are not in NATO or 5 Eyes, and I don't think they have some other close agreement, like US and Japan.

Israel is a client state of the USA. They are America's enforcers in the Middle East.

That's factually wrong. Israel is it's own full state.

They have had consecutive Memorandi of Understanding that promise security collaboration and funding. The current one is a 20 year treaty that promises $38B in spending and expires in 2036.

They have had consecutive Memorandi of Understanding

Memoranda, AFAICT?

I thought the exploited holes were patched by iOS at some point. How are these phones still getting hacked?

People are notoriously bad at keeping their devices up to date, with some even intentionally disabling updates. This can be prevented by the IT department having MDM profiles with strict update enforcement in place, but I don’t have much hope that the IT department of any given US government office is particularly capable or competent.

Seems like not-the-smartest move for Israel to mess with one of the few powerful entities that desires its continued existence

This is just another incident in a long list that goes back decades of Israel getting carte blanche to do whatever they want to the US with little to no repercussion. The most famous probably being USS Liberty (https://en.wikipedia.org/wiki/USS_Liberty_incident)

Why would Israel be allowed to do whatever they want?

NSO Group said in a statement on Thursday that it did not have any indication their tools were used but canceled the relevant accounts and would investigate based on the Reuters inquiry.

Why would they cancel accounts without knowledge of wrongdoing?

And simultaneusly:

- not have any indication their tools were used

- canceled the relevant accounts

Which "relevant" accounts if NSO's tools weren't used?

I think it's pretty clear by now that they have 100% visibility into the entire exploitation chain for all of their customers. Their "official statements" mean nothing.

Well since they do the exploitation on behalf of customers, yes?

NSO is very popular with governments that don't have robust domestic intelligence because all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone.

all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone.

You have a source for this? I genuinely want to know if they make it that simple

My thought was that the customer runs the server provided by NSO. I though the web form is running off of a webserver in a building owned by the customer.

Presumably the full accusation is "Entity ABC used NSO tools for XYZ". So the reaction was to cancel ABC's account while NSO investigates whether ABC actually did use the tools for XYZ, or whether ABC was only using them for other (approved) purposes.

Regardless, NSO rules over international law.

No, it means that NSO takes customer complaints seriously, especially a customer as important as the US. They operate under Israeli legal jurisdiction, and probably have an existing relationship with US firms, public and private, and I don't think the Israelis would hesitate to take whatever action the US wanted, because it benefits them to "play nice" and be cooperative. It kinda sucks for them in this case because chances are this is evidence of in-fighting between US agencies, and NSO tools are in the middle.

FWIW "international law" is its own thing and doesn't work like normal law; in truth every nation by default "rules over international law". When was the last time you saw an "international law" trial or saw a nation punished?

Aside from that obvious contradiction - this also indicates that the tools they deploy are either NSO hosted or use a licensing system to run.

There was a recent Darknet Diaries episode that reported evidence that at least some of the NSO tools are hosted services.

I can't imagine something like this not being in the cloud. The potential for a customer to give their local NSA/8200 the tool to figure out the 0days used is too large

Pegasus is only as good as its 0days are secret

Couldn’t you hack your own phone and somehow log traffic to get the exploit used?

Remember that this group's tools have been used to murder journalists, which they are unapologetic about.

Dead journalists can't close them down, but the US government can.

I think that remains to be seen.

that remains to be seen

Oh man, for purely comical purposes I would love to see NSO actually believe that.

In principle, America could drop Hellfire R9X sword missiles through the cars of every NSO employee. In practice, would American politicians have the nerve to go to war with NSO, when NSO probably infected all their phones years ago? How much dirt do they have on American politicians?

So you think because NSO breached a few state department phones that they have the deep dirt on every sitting congress member?

You think the iceberg is coincidentally only as deep as what we've presently heard? That we didn't have the full story yesterday, but today we definitely do?

Well I hope you're right, but I don't think you are.

In principle, America could drop Hellfire R9X sword missiles through the cars of every NSO employee.

The next step isn't to blow them up, the next step is to sue them.

I just assume the IDF and Shin Bet would like to be the only ones who blow up civilians in Israel, but I can't think of a single reason why the Israeli government would oppose an extradition request if they were presented with evidence of cyber-whatever.

can't think of a single reason why the Israeli government would oppose an extradition request

Because they want to foster such companies, and not deter people from founding them by showing them that they will be extradited to the US?

I can't think of a single reason why the Israeli government would oppose an extradition request if they were presented with evidence of cyber-whatever.

If an American company would get caught doing the similar, would US allow extradition request of those people to some other country?

I can't think of a single reason why the Israeli government would oppose an extradition request if they were presented with evidence of cyber-whatever.

Except the really obvious detail that most normal countries won’t extradite their citizens? Israel loosened up their laws on this a bit after the Sheinbein affair, but extraditing resident-citizens remains a rather unlikely prospect.

Really, all you need is a subtle suggestion to the Israeli government that the hundred billions or so dollars they receive from the US every year might be impacted by continued NSO bad publicity.

that number is way off, and the money they "receive", is specifically for use with US defence contracts and deals.. Its like Disneyland giving you Disneydollars.. You can only spend them at Disneyland.. It is a way for the US military-industrial complex to stay afloat.. And it is a drop in the bucket for Israeli Defence spending, and would make little difference if they took it out.

Why would they cancel accounts without knowledge of wrongdoing?

I’m not saying that they don’t have that knowledge, and I really don’t mean to offend or be rude, but if the US government asks something of you, you tend to comply wether it’s reasonable or not.

I think it’s naive to think of ourselves as living in a just world. Post 9/11 the CIA abducted European citizens with the knowledge of our governments. In more recent years, here in Denmark we had a rather huge scandal when it was revealed that changing governments had allowed American intelligence services direct access to the backbone of our national internet. The list goes on.

Its of course unfortunate, but the world we live in is basically a huge turd of authoritarian bullshit where the users and customers have no actual enforceable rights.

I mean, even on a much smaller and much more harmless scale, just consider how many times you’ve read about someone losing their Google account here on HN.

I think it’s naive to think of ourselves as living in a just world.

The US military entered a foreign nation without their knowledge or authorization, abducted a resident, took the resident out to sea, placed a bag over their heads, put concrete shoes on that resident, and then dumped them overboard with no witnesses other than the "Seal Team" carrying out the order.

No trial. No witnesses. Only abduction, seclusion, and murder.

That's not justice. Those are Mafia Tactics. ___

Does this remind anyone of anything? A Mr. Al. A Mr. Al Capone perhaps? That's right. One of the world's most infamous gangsters, mobsters, crimelords, did this very thing to individuals that Capone didn't want talking to the press, the government, or anyone else that would listen.

This is mob-boss behavior, and the US Government does this now.

Oh, how about the unlawful imprisonment of 100s of detainees at Guantanamo Bay in Cuba?

Secret courts, whose authority is far-reaching with no citizen oversight whatsoever.

Yeah the US Federal Government, since 9-11, is a bunch of mobsters with guns. There is no difference in the way our Federal Government acts now, and how 1920s and 1930s mobsters act.

Any human being that doesn't recognize the similarity is deluding themselves into believing so.

How did you learn about this incident which had no witnesses?

This was in response to acts of war and unprovoked attacks against the United States mainland with both military and civillian targets by an individual who had made a specific declaration of war against the U.S.: https://scholar.dickinson.edu/faculty_publications/277/

Comparing that speific case to failure to follow proper criminal procedure and rule of law is disengenuous to the extreme. There are many criticisms which can be made of the US response to (and other actions after) the 9/11 attacks. The assassination of the leader of the irregular forces aligned against the US is not one such. Numerous other instances would have made for a vastly stronger argument.

The fact is that there is no clear dividing line between acts of war and criminal acts --- recognised among other ways in the phrase "war crimes" itself (which might be applied both by, and against, the United States).

The situation in Guantanamo is far more valid.

The case of drone warfare and strikes another instance.

It's worth noting that the US is hardly alone in these tactics, and that irregular and extrajudicial killings are in fact a major element of the considerations in the case of Al Qaeda, at least some of the Guantanamo detainees, and drone strikes.

The real world is messy.

That said, I'd disagree with your conclusion on lack of difference, moralising, invective, and hyperbole notwithstanding.

This was in response to acts of war and unprovoked attacks against the United States mainland with both military and civillian targets by an individual who had made a specific declaration of war against the U.S.

Since when do individuals wage "war" on nation-states?

(And no, if the only counter-examples you can come up with are 18th-century pirate chiefs and tiny Carribbean islands you've failed. We're talking 21st-century USA here.)

Comparing that speific case

Which "specific" case? The GP mentioned hundreds of Gitmo prisoners, several of which have later been shown to be completely innocent victims of mistaken identity.

to failure to follow proper criminal procedure and rule of law is disengenuous to the extreme.

If anything is "disengenuous to the extreme" here it seems to be your defense of the USA's recent practices.

What I wrote was "acts of war" and "specific declaration of war" by the individual in quesiton, with a link to the citation. If you have any issue with established historical fact, that's your own concern.

Decapitating a specific cult of personality has been an effective method of eliminating it. Which also proved successful in the case of AQ.

(Yes, there are new emergent threats and groups, including several previously associated with AQ. I also said that the real world is messy.)

The specific case I was discussing, and I really hope I'm not so vague in my dotage that this wasn't crystal clear, was the 2 May 2011 attack on Osama bin Laden's compound resulting in his death.

What I defended was a specific instance, while acknowledging concerns and issues in other areas. Both you and imbchillyb are displaying a lack of such naunce. The US is vast and contains multitudes, some defensible, some not. It cares little for what I have to say.

Refreshing your memory: https://forum.iwethey.org/forum/post/8257/

obLRPD: Powered by sporks.

The specific case I was discussing, and I really hope I'm not so vague in my dotage that this wasn't crystal clear, was the 2 May 2011 attack on Osama bin Laden's compound resulting in his death.

Nope, certainly not crystal clear: You were replying to a post that mentioned, among other things, the Guantanamo internment camp, and airily said "this" case. I saw no specification there of which case, exactly, that was supposed to be.

Yes, the USA may be vast and contain multitudes, but even you talk about "the US": In the end there is only one of it, and when the USA as a nation-state does stuff then it's the USA, singular, as a nation-state that gets discussed and criticized. Just like here. I hope I'll never get so fuzzy in my dotage that I'll let sich disingenuous attempts at obfuscation slip by.

Hm... Pseudo-helpful hint/ reminder; feels like about 50/50 past and current posters. I'd already concluded neither extreme of Box or Ash, for rather obvious linguistic reasons. Been considering alumni like RM, DRL, KMS et al, but this feels more like currents such as RC, SK, or SA. Or perhaps AG; I notice that his recipe -- besides the formal declaration being severely watered down -- was pretty much what the US (singular, as a nation-state) went with.

I don't have your email; you have mine.

I've told you specifically what I was referring to, and you are continuing to dispute what I was telling you. The same vagueness applies to imchillyb's comment, yet you seem to find no fault with that.

Concisely: AQ runs Afghanistan, now.

So, it was difficult to finish your comment.

My understanding is that it's the Taliban, and a cursory check of credible references supports this. That's a group formally alligned with AQ, but distinct from it, again, via credible references.

Other active entities include the Islamic State (ISIL / Daesh), and various organisations largely funded / supported and/or organised around Iranian, Syrian, and Palastinian interests.

Please note that this is not an area of personal expertise.

I don't understand the focus on NSO in these stories. If U.S State Department personnel in Uganda were shot from an M-16, would the headline mention "an American arms manufacturer"? No, because it's ridiculous.

For better or worse, NSO's product is a weapon. How is it any different from an M-16? Where is the outrage towards the people who used this weapon against the State Department?

It's my understanding that NSO runs centralized command and control servers that their "clients" are granted access to, for both the on-device payload installation and also data exfiltration.

They do not give the software to their clients to go use somewhere in the world fully independently (self hosted payload dropper, C&C, etc)

They're a direct participant in the network traffic. Unlike a dumb purely offline piece of hardware like a M4 rifle or similar.

U.S. weapons manufacturers receive a lot of criticism too, both domestically in the U.S. and internationally.

The comments here focus on NSO because the story is about what NSO did. This is computer tech kind of community so you’re going to see more computer weapon stories here than stories about improper use of rifles.

The U.S sells super sophisticated weapons such as attack drones, F-15s or nuclear submarines. The tech behind these things is probably super interesting and there's a lot of software involved. If you look at the comments here, around 90% of them don't care about the tech at all but focus on bashing Israel. This isn't a tech story.

It would certainly be a news story if someone used a U.S. built submarine to attack the U.S. State Department.

Unlike an M-16, hacks can be conducted remotely, they can be used to plant evidence, conduct blackmail, and lots of other things where most people would never know a hack was involved.

Also, there's outrage towards NSO because Israel is supposedly an American ally. Israel needs American support, and yet Israel freely allows Israeli corporations to sell services American enemies. And this isn't an isolated company--there are other Israeli hacking companies that target Americans, such as Black Cube.

In National Security contexts, the "get angry at the weapon seller" response is very strongly correlated with how advanced (in technology, power, and scarcity) the weapon is perceived to be.

For an "average soldier" weapon, such as an M-16 - $Company isn't likely to catch much grief - unless they're selling a considerable quantity of them, or to an extremely notorious buyer. Similar for a cyberweapon - but an "everyday" one, which wouldn't be a big surprise for a C-list ransomware group to use.

Vs. NSO's stuff seems to be the sort of top-tech goodies which A-list nation states use to maintain & enjoy their A-list status. Whether any actual harm results from this incident... publicly letting a bunch of "the wrong sorts" into that exclusive clubhouse is getting NSO into really deep do-do with "the regulars".

Speak plainly. Are you suggesting this is a company being unfairly singled out just because it's Israeli?

It being Israeli is definitely a big part of why this story is so huge. Why do you think it's making huge headlines then - what's your theory? The fact that 8 American diplomats got their phones hacked?

I'm in agreement with you. I don't see any indication that the Israelis specifically made this weapon to target US interests, nor do I see any indication that the Israelis are discriminating between the US and any other nation, nor do I see anything that leads me to believe that we aren't potentially using this ourselves against other nations.

Fuck NSO, for sure. But I'm just not sure Israel should be held accountable for the actions of a private corporation with no apparent political motivations, just as in your M-16 example.

The Israeli state regulates the export of NSO Group's software. So yeah, they do have some responsibility here.

https://www.haaretz.com/israel-news/tech-news/israel-will-re...

Unlike a firearm which has no intelligence or software, NSO retains significant control over their product.

U.S drones and F-15s don't have software?

It's more like a PMC ala Wagner than selling an M-16. They essentially run the technical side of operations and provide the talent.

For better or worse, NSO's product is a weapon. How is it any different from an M-16? Where is the outrage towards the people who used this weapon against the State Department?

It is highly unlikely that NSO group actually gives out their exploits, based on what we know about previous exploitations that have become known. It's more like they offer an interface to execute their exploits on a given target. The fact that they can block entities from using their service, after having had access to it (like they supposedly did in this case), very strongly supports this hypothesis. Hence they're offering a service, to use weapons for (or rather, in the name of) some (government) entity that pays them money to do so.

Imagine bombing-as-a-service, as an instance. That's much more like it, and your argument doesn't hold in that case.

The Israel government gets a pass for anything they do. Whether it is lying about nukes or what they've done to Palestine. NSO is a feather in their cap.

Why are you conflating Israel (a state) and NSO (a fully private company, owned by American private equity at some point)?

The Israeli Ministry of Defense licenses the export of Pegasus to foreign governments, but not to private entities.

https://en.wikipedia.org/wiki/NSO_Group#Pegasus

These export controls for weapons exist in much of the western world. Once granted a license, Israel has no legal say in how the product is used by the end user.

It’s all very routine and standard, not sure why people need basic explanations of what government export regulation is when the discussion is on Israel.

Please don't virtue signal, or state flame wars, or use this to posture some kind of agenda.

Please do not take HN threads further into generic flamewar hell. It's not what this site is for, and it destroys what it is for.

We detached this subthread from https://news.ycombinator.com/item?id=29432721.

Why not flag the article itself? There's nothing technical to be discussed here. If the article was talking about the technology, that's one thing, but its talking about state-sponsored espionage. Flagging my post is a bit like closing the barn door after the horses have left the building.

Slapping down the NSO doesn't fix the problem. We should be glad we even know that their software exists, imagine if it was completely hidden from the public? The problem is that Apple needs to fix this. Security is an arms race, and the more visibility we have into where it is weak, the better for everyone. To paraphrase the motorcycle repair episode of Winter Steele, "You are stronger now for having been fixed." IMHO.

I don't think most Apple customers know or care so despite being ostensibly "privacy focused" Apple doesn't have much of an incentive to take action.

Great commentary. The US is hopefully looking into why these employees are using iPhones + local SIM. And if that has been approved in the past, maybe re-think that

Imagine that sinking feeling in the NSO offices. Uncle Sam's coming...

You sure about that?

As an American, it's becoming harder for me to muster sympathy for an entity that actively discovers and exploits technological flaws to use against their adversaries while simultaneously purposefully not alerting the manufacturers in order to correct the flaws so they can continue to exploit them and then those flaws are subsequently discovered by others and used against them. Poor you.

While I find it interesting that focus in comments appears to be on Israel, NSO and the complicated ( or not really that complicated if you look at it from a different angle ) relationship between them and US. I did not see a mention a broader discussion of, you know, hoarding zero days, exploits and whether using those can be worse than conventional weaponry.

The reason I find it interesting is because it is clear that US government supports Israel ( and NSO ) practically unconditionally ( recent vote on Iron Dome being a more amusing example of bipartisanship ).

Why is Reuters, an old guard by any account, concerned? Or are they simply following what sells and government is really at odds with its people when it comes to policy in ME.

Arguably, this is the real use case Pegasus was designed for. A government (Uganda) that does not have a large and mature civil service that would support a G7 level technical domestic intelligence agency went to market for the tools of one (NSO), so they can keep tabs on foreign intelligence agents (state department staff) in their country. I am not a fan of NSO at all, but this case sounds like they're providing sovereignty or statecraft as a service to a government that prefers to buy instead of build their security capability.

When the game is defined as a competition for how to break its rules in the most unexpected ways and with the fewest consequences, Uganda appears to have joined in with aplomb. To me it's the first time an NSO story doesn't seem like a scandal.

The "oh, but everyone is doing it!" argument. I don't for a second believe that other countries install spyware on foreign diplomats and other peoples phones. What NSO and the Israeli government is doing is rotten to the core and unless you have evidence of the contrary you cannot assert that other actors are doing the same thing.

I know you're joking but for anyone that's not in on the joke:

https://www.bbc.com/news/world-europe-24690055

Wow! You found one instance of the US spying on a friendly government. That totally justifies NSO leasing spyware to authoritarian third world regimes! Carry on folks, nothing to see here.

It doesn't justify it, but if we're going to take a stance against spyware, we have to take a stance against all spyware. That includes the home-rolled stuff that the NSA pushes out to Apple and Google.

No, we don’t.

What makes that kind of hypocrisy okay?

It seems if Israel is receiving money from the US government and Israel controls the usage of NSO group weapons that are being targeted at the American government then there are problems yea?

Wait, you were actually being serious? How about this one: https://www.theguardian.com/world/us-embassy-cables-document... / https://en.wikipedia.org/wiki/Spying_on_United_Nations_leade...

Please state which of these examples involve spyware or cut the snark.

Kind of? It seems like the main use case isn't a country that needs the tools of state-on-state spying; it's a country that needs the tools of Chinese-style domestic surveillance of the political opposition. In most cases where US persons have been targeted with NSO software, it's as part of operations against domestic dissidents, including in this case, where most of the usage was against Ugandan protesters.

This is a typical "shadow government" symptom. You have forces working within the government that 1) have their own agendas; 2) have connection to international communities, usually military-intelligence ones; 3) have almost zero regulation; 4) even many high ranking government officials don't know about them because they are brotherhood-like closed circles.

This reminds me of Operation Gladio or Propaganda Due but domestic. Same playbook, different players.

3) have almost zero regulation;

What would shadow government regulation look like?

Maybe stop funding them, for a start?

Congressional oversight used to be a thing.

Snowden showed the NSA lied to congress. No heads rolled.

Imagine all the dirt the NSA has on congress.

Imagine how much society would improve if all the dirt got aired.

Hiding this information is trading the wellbeing of the country for the NSA's own internal goals and power.

Imagine how much society would improve if all the dirt got aired.

Depends on the dirt. Some of it might be private and personal stuff, such as infidelity. That type of stuff, while blackmailable, doesn't really benefit the public much.

The public's elected representatives being easily blackmailable is obviously of great concern to the public, I don't know why you're downplaying this.

Everyone has dirty laundry they would prefer not be aired, and if they don't then their friends, family, or partners do. I don't think we want to live in a world where absolute moral purity (as determined by the most vocal, biased critics of a given person) is required to hold public office.

Don't believe representatives are elected because of their integrity and their willingness to serve.

They represent groups of interest. And being blackmailable is, in my opinion, a handy leash to keep them in check, for those groups which propose the candidates

The public is not concerned with corruption until they feel affected by it.

remember when the cia interfered with the congressional investigation of their torture program, by getting the FBI to investigate senators for viewing the documents that the CIA provided them, and spying on the senate investigation activities, and then nothing happened

https://www.cnn.com/2014/03/18/politics/cia-senate-dispute-f...

https://www.reuters.com/article/us-cia-senate-idUSKBN0KN2Q82...

I can believe there are shadow organizations that lack oversight. In fact, it seems likely.

But that these shadow organizations are maintaining power by surveiling and blackmailing congress people is a whole other ballgame and seems highly unlikely to me.

For one, it's likely that not every Congressperson has some deep dark secret that makes them blackmail-able. And pissing off the only group of people that could cut your funding and expose your shadow organization as well as bring oversight is not the group that you want to be pissing off.

I think game theory would indicate that your only chance of maintaining a shadow organization in the US gov for any length of time is going to be secrecy and maybe some heavily funded lobbying.

For one, it's likely that not every Congressperson has some deep dark secret that makes them blackmail-able.

I'd be more than willing to bet that they do. "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." and that only covers "honest" men who wouldn't have illegal coordination with PACs, bribes with lobbyists, personal communications filled with racism, or evidence of sexual activities that might upset their base. When "6 lines" becomes a record of everything you've ever done online, all of your communications, your GPS coordinates and the data of anyone around you it's going to get easier to find a noose around your neck.

Even if there managed to exist a single person in congress who wasn't screwing over the American people somehow for personal gain, or didn't have some skeleton in their closet they didn't want exposed to voters/campaign contributors when a group is capable of compromising your system and inserting whatever offensive material they want to use against you it's incentive enough to back off.

But that these shadow organizations are maintaining power by surveiling and blackmailing congress people is a whole other ballgame and seems highly unlikely to me.

Why is it so hard to believe that a few powerful indivisuals at the top, with common interests and agendas, are banded together?

There's no official organization but a few indivisuals that streer things their way because they can.

Politics is a funny business. I have spent alot of time dealing with political people ranging from staffers to actual officials.

Many are very well meaning public servants, others careerists, some are… insane on various scales. Politics is a business with uncertain outcomes where “friends” are important and personal stakes are high.

From a blackmail perspective, you have people like the bartender turned member of congress who got their GED to run who are obvious puppets with a wheelbarrow of odious behavior behind them. But even the most boring congressman has a legal escrow account with irregularities, a kid with emotional problems that caused trouble, a campaign finance violation, etc.

I don’t think there is a shadow cabal, but some executive branch entities wield tremendous power.

AOC is an obvious puppet?

From a blackmail perspective, you have people like the bartender turned member of congress who got their GED to run who are obvious puppets with a wheelbarrow of odious behavior behind them.

I'd like to visit the Museum of Counterproductivity in the area of your brain that downgraded Bobert from business owner to bartender.

Why would heads roll?

Congress has blocked inquiries into their split loyalty as far as them having multiple citizenship in other countries. If you were McDonald's board of directors would you allow someone to be on both the McDonald's board and Wendy's?

Congress isn't personally harmed by a surveillance state unless you consider they may all be being blackmailed but that is another conversation. In fact mass surveillance widens the barrier to new entries into politics as they can use whatever dirty they find and give it to federally funded media mouthpieces.

This week we saw articles of sexual crimes against children being swept under the rug to "protect our country" do we really think that congress would actively pursuit this line of inquiry?

It's difficult, you have to break down those brotherhoods who will fight to death to be "independent". And then you have to find a way to prevent them from spawning again. I don't have any idea how to do it properly.

I'd expect if we lived in the sort of society that would execute the head of the NSA for treason or something similar when the Snowden revelations came out, it would have societally beneficial chilling effect on intelligence organization brazenness.

Unfortunately, it seems intelligence is mostly immune from liability, and lack of consequences lets the rot fester.

Once the system is setup who is in control is going to be irrelevant. I believe the best approach is to educate the citizens so that 1) They follow scientific methods; 2) They are more resistant to advertisement/propaganda; 3) They are keen to corruption and willing to protest.

Implying that Israeli spying on the US is some fringe "shadow government" sub-group of the Israeli government is strange given a long, long history of high profile Israeli spying incidents against the US.

https://en.wikipedia.org/wiki/Lawrence_Franklin_espionage_sc...

https://en.wikipedia.org/wiki/Jonathan_Pollard

https://en.wikipedia.org/wiki/Ben-Ami_Kadish

https://en.wikipedia.org/wiki/Jack_Parsons_(rocket_engineer)

Then there's the time they stole nuclear material from us https://en.wikipedia.org/wiki/The_Apollo_Affair

Then there's the time they slaughtered several dozen US navy and NSA personnel with repeated attacks on an unarmed vessel because they didn't like that we were watching them: https://en.wikipedia.org/wiki/USS_Liberty_incident

By saying "shadow government" I mean groups within the US government that has connection to say NOS.

Again I don't have concrete proofs so I could be 100% wrong. But reading world history especially cold war history makes me be sceptical to certain things.

The USS Liberty incident happened 52 years ago.

because they didn't like that we were watching them

That is the American conspiracy theorist interpretation of the incident that (understandably) also gained traction among a few of the survivors. The Israelis disagree.

It was most likely a case of mistaken identity. Just like friendly fire incidents. Friendly fire incidents happen all the time, including between US forces in the recent Iraq and Afghanistan conflict.

The survivors said that the pilots were waving at them before they carried out the attack

can you provide the source?

Have you tried to look and had no luck?

The Liberty was also very far from where the Americans had told the Israelis where it would be. Finding the ship there was unexpected and calls to confirm its identity were not being answered.

Israeli pilot to IDF war room: This is an American ship. Do you still want us to attack?

IDF war room to Israeli pilot: Yes, follow orders.

Israeli pilot to IDF war room: But sir, it’s an American ship - I can see the flag!

IDF war room to Israeli pilot: Never mind; hit it.

https://archive.md/KNYBR/again?url=https://www.haaretz.com/u...

Then there's the time they stole nuclear material from us https://en.wikipedia.org/wiki/The_Apollo_Affair

On a related note, JFK was trying to shut down Israel's nuclear weapons program in the months before his murder.

https://www.jewishvirtuallibrary.org/kennedy-letter-to-ben-g...

I'm sure he was conducting a lot of international policy initiatives in the months before his assassination

Why would the tail wag the dog? America benefits so much from all the R&D (in e.g. encryption) that can't happen on US soil. They are not our enemy in any way :)

https://en.wikipedia.org/wiki/Report_to_the_Secretary_on_the...

https://www.nybooks.com/articles/2001/09/20/the-truth-about-...

The US spies on its European allies all the time, and I'm sure they spy on Israel too, so that's not super surprising.

As for the USS Liberty, some do argue that it was intentional, but both the Israelis and Americans ended up agreeing that it was a mistake. The US is no stranger to such mistakes either, even more egregious ones like when they killed close to 300 civilians aboard a regular passenger flight following an approved route and in contact with ATC (Iran Air 655).

In the end both the US and Israel are amoral states that act only according to their economic and strategic interests and I feel that this unites them. I wish it didn't, though.

And the European allies spy on the USA, rinse and repeat.

I don’t think so. If they do, it is either a) not nearly on they same scale, or they b) are way more competent about it and less likely to get caught.

Given the general incompetence of governments in general (Europe is no exception) I doubt it is (b).

If you can't prove that you probably shouldn't make such unqualified statements. There is plenty of proof for the opposite, afaik none whatsoever for the reverse.

Everyone spies on everyone else.

Reminder that France vacuumed up messages on Enrochat after deploying malware globally, and they have clear text messages from users in any arbitrary country and have not disclosed what they will do with it or what they have.

https://www.vice.com/en/article/3aza95/how-police-took-over-...

The specific claim here is that EU countries spy on the US. I do not believe they have that capability, so if you have some proof that would come in handy.

Just to clarify, you're asking for evidence of secret foreign intelligence operations?

Establishing mere capability is pretty trivial: they have diplomats in the United States who can talk to people.

They officially decided it was a mistake, as it did neither government any good to officially announce that it was intentional. But the sailors that were on the ship say otherwise.

They officially decided it was a mistake, as it did neither government any good to officially announce that it was intentional. But the sailors that were on the ship say otherwise.

How would the sailors on the ship being attacked be able to know anything like that (e.g. know if the Israeli pilots thought they were attacking an Egyptian ship or an American one)?

e.g. know if the Israeli pilots thought they were attacking an Egyptian ship or an American one

The sailors would know because they have access to the same information that you do, but a greater incentive to actually do the reading. The Israeli pilots knew it as a US ship, their radio traffic questioning their attack orders - after visually identifying the USS Liberty as a US ship, was recorded and the transcripts widely known about. This happened several times, so unless the Israeli command center had the memory of a goldfish - they intentionally kept sending attack aircraft until they eventually got a pilot to pull the trigger. Why would they do such a thing? Because the US wasn't onboard with the Israeli preemptive strike and they didn't want a signals intelligence boat tipping off the Egyptians. Israel doesn't appear to reciprocate the fond feelings expressed by American politicians - the mere idea of the "Samson Option" is proof enough of that.

This happened several times, so unless the Israeli command center had the memory of a goldfish - they intentionally kept sending attack aircraft until they eventually got a pilot to pull the trigger. Why would they do such a thing?

To that point, it's worth noting here friendly fire incidents happen all the time in war, as well as attacks against neutral parties. For instance: the US has bombed its own troops probably more times than anyone can count, and it also bombed the Chinese embassy in Belgrade and shot down an Iranian airliner. Why would they do such things? Honestly, it's plausible they they may actually have had the memory of a goldfish, at least occasionally.

The Israeli government had strong incentive to do this, and accounts on the ship were that this was clearly intentional. Why is this so hard for you to believe?

Anyone who doesn't think the USA and Israel don't spy on each other 24/7 is living in a dream world. Israel is an ally but I don't think that they are our friends.

There is nothing supporting the theory or conclusion

What are you trying to suggest? It's just a typical reflexive reactive response to any comment that the government acts in ways other than presented to you by corporate media.

It only takes 3 minutes of google searches or even a daily scan of Hacker News to see endless examples of government corruption and malfeasance. Government employees are only human after all, and there are millions of them. To think this sort of activity ends once you become an agent of the government is absurd.

Government employees are only human after all

This weekend I was traveling and I put the stray $20 from my pocket in the bin at the TSA checkpoint. An agent quickly pulled it out and handed it back to me. He then said "a lot of good people work here, but they're still human". It's kind of wild that we endure that level of complacency here in the States.

That's a pretty weird statement, if one of his colleagues would swipe cash that travelers put in the bins then they should fire their ass and move them to the 'not good people' column. Stealing isn't something that defines you as human.

I think pretty much everyone has stolen something before, right?

That says more about you than it does about humans in general.

True, but what I've done should say a lot about humans in general right? I'm told I'm human, after all.

5) many high ranking government officials do nothing about this because they're being blackmailed by the spooks.

Tinfoil hat territory? Sure. Plausible and possible? Sure.

I think it is more likely that 5) many high ranking government officials have sympathetic views with said forces and don’t mind the “occasional incident” as long as said forces are working towards their common goal (whatever that goal might be; but it is probably Islamophobia, settler colonialism and exploitative capitalism).

What happened to the “spooks” that hacked the intelligence oversight committee computers? You know, the people who are supposed to watch them?

I know some spooks called the Church of Scientology.

I seriously have no damn clue what those buggers have gotten up to that they’ve bullied the government into leaving them alone.

“Shadow government” = “Deep state”?

They're both somewhat vague phrases that are heavily context-dependent and have somewhat different connotations, but yes.

There's nothing wrong with the phrase "deep state". If you're concerned about associations with Trump (which I think you should not be), you can use a former Obama official's favored term, "the blob". Both, and many other similar phrases, are common in the foreign policy literature.

I think the first time I heard the phrase "shadow government" was in connection to Iran-Contra, where it described Oliver North and the small group in charge or those operations, but it's a phrase with many uses. I can't remember when I first heard of the "deep state", but I'd be fairly certain it was before Trump or anyone connected to him started using it.

Regardless of the terminology, the supposed "deep state" is often a fill-in for one's own personal misunderstanding of institutional momentum and basic functions of the government.

"The Government" isn't really a single institution, but a surprisingly loose collection of various institutions that all have some level of momentum guiding the direction they move in. It's critical to note that these institutions may have interests that harshly conflict with one another. Even the intelligence community, insular as it is, cannot be thought of as a monolith, but as various institutions with various priorities, some which conflict with the interests of other government institutions.

When the government does something we dislike politically, or does something we don't understand, it's "the deep state" or "the shadow government" which betrays a deep misunderstanding of what the government is. There's no central, shadowy cabal controlling the affairs of "the government" from behind the scenes, the various institutions that comprise the government maintain momentum and do what is in furtherance of their particular interests.