After Weeks Of Reports Of Misuse Of Its Exploits, NSO Group Considering Shutting Down Its Malware Service

from the if-you-can't-beat-'em,-quit dept

RIP NSO Group. Cause of death: investigative reporting.

It's probably too early to celebrate the demise of Israel's most infamous export, but it's looking like NSO is running out of options. The Israeli government recently (and drastically) reduced the number of approved governments NSO could sell its powerful Pegasus malware to, trimming down the permitted list from 102 countries to 37. That followed blacklisting by the US Commerce Department, which means American tech companies aren't permitted to sell exploits, hardware, or devices to NSO without securing a waiver they're unlikely to receive.

That followed weeks of revelations about how NSO customers were using its Pegasus spyware. According to multiple reports, governments and the occasional king were using NSO tools to target journalists, dissidents, government critics, religious leaders, US State Department employees, an ex-wife, an ex-wife's lawyer, and government officials.

I guess when it's no longer feasible to sell spyware to authoritarians and human rights violators, the only option is to default on your debts and shut down your most toxic product.

The NSO Group, the controversial technology company recently blacklisted by the United States over the illegal use of its spyware, is reportedly considering shutting down its Pegasus operation and selling the entire company to an American investment fund, Bloomberg reported on Monday.

The report, citing officials involved in the talks, said that there are two potential suitors for the embattled company, who have discussed a potential takeover and the shuttering of Pegasus unit, in exchange for a $200 million injection of capital and a pivot into strictly defensive cybersecurity services.

NSO needs the cash. It has millions in debt and whatever plans it had for paying it back have been severely curtailed with its blacklisting by the US government and its reduced customer base.

The U.S. restrictions put added pressure on NSO, which needs to pay back about $450 million in debt, just two years after a management buyout that valued the company at about $1 billion. Moody’s Investors Service said last month there’s an increasing risk the company will violate the terms of its loans.

The problem with ditching Pegasus is that it's NSO's most valuable product. This premium phone exploit accounts for half of NSO's business. Fifty percent of NSO is worth far less than the $200 million the company is hoping to obtain. Now that it's blacklisted, it can't purchase exploits or devices from the US, which means it will be extremely difficult to develop new hacking tools worth selling. There may be a market for defensive tech, but that's likely to be far less popular with foreign governments than zero-click exploits that can be deployed remotely.

Here's how it looks for NSO on the home front, as reported by Israeli newspaper Haaretz:

Defense officials think the sanctions could soon bring about the company’s collapse and a shutdown of its operations. The company depends upon constant innovation: It’s one Apple or Android cellphone update away from the failure of its products. If it doesn’t manage to hold onto the best personnel in the world, the kind who would continue to find vulnerabilities in the operating systems, they won’t have a product.

Senior officials have told Haaretz that the move by the United States has totally paralyzed the company’s future operations. “They’re not able to buy a pen at a Walmart store,” the officials quipped. If an American company wants to sell them products, it needs a special permit.

According to this report, the Israeli government believes its local tech companies are being unfairly targeted by US sanctions. The country is home to 19 companies developing offensive exploits, but so far the US has only blacklisted NSO Group and Candiru. The government appears to have been caught off guard by the sanctions handed down by the Biden Administration after having received much more support and cooperation from the previous president, Donald Trump.

The Israeli government may be reeling a bit from the last few months of negative press targeting NSO, but it really can't blame anyone else for the mess the company is in or the sanctions that have greeted the steady stream of reporting about misuse of its Pegasus spyware. It was directly involved with the sale of the malware to a number of known human rights abusers.

[I]n Israel it is acknowledged that oversight of contracts NSO entered into was too lax. The Netanyahu government gladly traded in spyware, with the Mossad reportedly assisting in the initial mediation of the transactions.

[...]

The company’s sales momentum over the past decade is closely linked to the diplomatic and intelligence-related steps that Netanyahu took, which improved relations with countries in various parts of the world, and where NSO’s technology often served as an asset that brought Israel to the table for the improvement of ties. In the past, Netanyahu ordered the defense establishment to advance offensive cybertechnology deals, and it appears he preferred that overly energetic oversight not be imposed on the deals or the parties to them.

Welp. The shitbirds have come home to roost, as the saying goes.

And if the Israeli government thinks the US Commerce Department overreacted, it won't be pleased with the latest demands from members of the federal government.

More than a dozen Democratic lawmakers have called on the Biden administration to sanction four cyber surveillance firms for "enabling human rights abuses" by "selling powerful surveillance technology to authoritarian governments."

The letter, led by Sen. Ron Wyden of Oregon and House Intelligence Chairman Adam Schiff of California, asks the Treasury Department to sanction Israeli spyware vendor NSO Group, Emirati cybersecurity firm DarkMatter and European surveillance firms Nexa Technologies and Trovicor -- as well as the firms' top executives.

This would go beyond the blacklisting already in place. The Global Magnitsky Human Rights Accountability Act allows the US president to sanction people and companies for human rights abuses. In this case, the abuses would have been aided and abetted by NSO, rather than participated in directly by NSO execs or employees. While it normally is used to sanction government officials, it has been used in the past to sanction private parties with ties to human rights abusers.

Whether or not sanctions ever arrive, it appears NSO's days are numbered. But there are still plenty of malware purveyors out there. And there are plenty of authoritarians willing to pay top dollar for spy tech that enables them to more efficiently oppress their countries' populations. The exploit market will remain lively. It just may be that one of the most recognizable names in the business will no longer be in business.

Filed Under: exploits, malware, pegasus, spyware, surveillance
Companies: nso group

Daily Deal: The 2021 All-in-One Computer Science Bundle

from the good-deals-on-cool-stuff dept

The 2021 All-in-One Computer Science Bundle has 11 courses to teach you the essentials of computer science. You'll learn about Java, C++, Ruby on Rails, Python, and more. It's on sale for $35.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

U.S. Prepares To Spend $42 Billion On A Broadband Problem It Can't Accurately Measure

from the hey,-good-luck-with-that dept

As we've noted, the recent infrastructure bill will deliver a record $65 billion to be spent on improving lagging U.S. broadband access. Roughly $42 billion will be used specifically to expand broadband coverage, mostly via state grants doled out by the National Telecommunications and Information Administration (NTIA). By any measure this is a good thing, and the investment should result in significant improvements in patchy, expensive U.S. broadband access.

The problem, as the Washington Post discusses this week, is the U.S. still can't seem to measure the scope of the problem it's trying to fix. U.S. broadband maps have been notoriously terrible for decades, and the FCC has deemed a census block "served" with broadband if an ISP claims that just one home in that census block can receive coverage. The result: an inaccurate and rosy picture of both broadband availability and competition, something that has long served entrenched telecom monopolies invested in maintaining that profitable status quo.

After decades of this, it only began to change in just the last few years, thanks to state lawmakers eager to grab their slice of the subsidy pie. That resulted in the Broadband Data Act, which directed the FCC to not only fix its flawed methodology, but funded the agency so it can do more to hold ISPs accountable for false coverage claims, and utilize a more extensive array of crowdsourced data in determining which areas do or don't have service.

The problem: most of those fixes are still several years away, and there are tens of billions of dollars that need to be spent now as part of a once in a lifetime opportunity to improve U.S. broadband. Not just the $42 billion from the infrastructure bill, but tens of billions more in subsidies that arrived as part of COVID relief and other efforts. As the Washington Post notes, it's hard to fix a problem you haven't measured, which has resulted in many states taking matters into their own hands:

"In the absence of new FCC data, many states have taken matters into their own hands. Tennessee, North Carolinaand others have started building their own maps as they tire of waiting for the federal government to produce its own, and as they develop strategies to deploy funds that became available for broadband deployment during the pandemic under the American Rescue Plan, a stimulus package passed in 2021."

But these state mapping efforts are hugely inconsistent. Maine, for example, has done a good job developing crowdsourced mapping data through the state's Connect Maine initiative. But for every state like Maine there are four states that have absolutely no idea what broadband reality looks like, in large part because their state legislatures and regulators are in the back pocket of regional monopolies like AT&T and Comcast.

Both companies have a long track record of fighting broadband mapping improvements (something the Post oddly doesn't mention). In part because a more accurate look at U.S. broadband competition and coverage gaps would only drive policy efforts to actually do something about it. But also because these companies have spent the better part of a generation hoovering up billions in broadband subsidies for networks they then notoriously only half deliver. More accurate broadband mapping would make it far easier to identify areas and states where billions of dollars have been wasted, and you certainly wouldn't want that.

There's one quote in the piece that stands out, and it's by Blair Levin, the architect of the Obama era broadband plan. I criticized that plan because like most U.S. government policies it failed to seriously tackle the real reasons U.S. broadband sucks: regional monopolization (lack of competition) and state and federal regulatory capture (corruption). As a result, it didn't truly shift the Overton window. Levin seems to think this massive investment means the U.S. will have zero broadband gaps in 3-5 years:

"Blair Levin, the director of the National Broadband Plan under the Obama administration, said he’s optimistic that in three to five years there will be almost no locations in the United States lacking an adequate broadband option. But he says it’s unlikely that an investment of this magnitude in high-speed Internet will ever be made again.

“This has been called a ‘once in a generation opportunity,’” Levin said. “I disagree with that. This is a once opportunity.”

Depending how generously you define "broadband" and "adequate" (does that mean expensive, capped, and throttled satellite and wireless? sluggish, expensive DSL from a company that refuses or upgrade or repair it?) it's certainly possible. But with nobody in DC (or the press for that matter) genuinely interested in tackling the real underlying cause of U.S. broadband dysfunction, there are just too many regions where powerful giants like AT&T are going to be able to inject themselves into the process, once again hoovering up money they don't deserve for networks they don't fully deliver. Probably without much penalty, if 30 years of U.S. history serves as a guide.

That's not to be too pessimistic about the transformative potential of this investment, mind you. Even if we miss on half of the effort it's still a record investment in U.S. middle mile and last mile broadband networks, and it's going to be a huge net positive for a long line of U.S. communities. But as somebody who has covered this sector for the better part of an adult life, I'll keep beating this drum until I see a genuine sea change: the real problem with U.S. broadband isn't money or technology. The real problem is the powerful regional monopolies that work tirelessly to hamper real competition, and the countless state and federal regulators and lawmakers who coddle and protect them. Refuse to fix that, and you're shooting yourself in the foot.

Filed Under: broadband, broadband mapping, competition, fcc, infrastructure

UEFA DMCA Blitz Has Kept A Traditional TV Station Delisted In Google For Months

from the shotgun-blast dept

There are two ways to go about using the DMCA as a content provider in order to keep copyright infringement at bay: the right and good way, or the bad and lazy way. The right and good way is to use DMCA takedown requests sparingly, to be very targeted in their use, and to do some minor legwork to ensure that the target is in fact an infringing actor. The wrong way is how most large companies go about it instead, which is to go on a DMCA blitz on multiple targets all at once, often timed around some big event or product release, and in a way that nearly always results in at least some collateral damage. These here Techdirt pages are littered with examples of the latter.

And now we can add one more such example to the list, where EU football league UEFA went on a DMCA blitz targeting pirate IPTV providers, only to end up also delisting Mega.tv from Google, despite it being a very legit traditional television channel.

American free-to-air TV network Mega.tv has had its homepage stripped from Google due to a dubious takedown request. The apparent mistake is tied to an overbroad DMCA notice sent on behalf of the European football organization UEFA. The issue has gone unnoticed for more than a year and persists today.

Mega.tv is a relatively small free-to-air TV station with headquarters in Miami and Puerto Rico. The company is owned by Spanish Broadcasting System (SBS) and is available in several U.S. states.

Why this free-to-air station was targeted is left open for speculation, but it's at least somewhat likely that it is because it has the word "mega" in its name and somebody thought that meant it was related to the much maligned cloud platform called Mega. But they're not related at all and there is no indication that the station has ever infringed UEFA's copyrights. Collateral damage, in other words, albeit collateral damage that has now existed for over a year. Trying to search the station's homepage on Google gets you nowhere, other than seeing that there is a result not showing due to a DMCA complaint.

That complaint is erroneous, however.

The notice in question alleges that Mega TV is an illegal IPTV service that’s “broadcasting UEFA audio-visual content without permission.” While we can’t confirm or deny that the network ever broadcasted EUFA content, it’s certainly not a pirate IPTV service.

This takedown request isn’t exactly new. It was sent to Google more than a year ago. This means that Mega.tv’s homepage has been unfindable in Google all this time.

And, hey, that kinda sucks, right? Because UEFA and its partners couldn't be bothered to actually look at who they were targeting and instead took some massive shotgun approach, at least one innocent bystander gets filled with DMCA buckshot.

And you can bet there will be no negative consequences for UEFA for all of this. In which case actors like this are essentially incentivized to take this approach.

Filed Under: copyright, dmca, eu, takedowns
Companies: mega.tv, uefa

How China Uses Western Influencers As Pawns In Its Propaganda War

from the chaos-and-suspicion dept

China's efforts to subdue the turkic-speaking Uyghurs in the Xinjiang region will be familiar to Techdirt readers. International awareness is increasing, too, not least thanks to the diplomatic boycott of the Beijing Winter Olympics that the US and other countries have announced. That presents an interesting challenge to the Chinese authorities: how to counter the growing evidence of pervasive surveillance and large-scale arrests of the Uyghurs. Using official outlets like China's Global Times is one way, but its articles are easily dismissed as crude propaganda. Much more interesting is the approach described by the New York Times, which looks at how China is helping Western YouTubers to report on the country:

The videos have a casual, homespun feel. But on the other side of the camera often stands a large apparatus of government organizers, state-controlled news media and other official amplifiers -- all part of the Chinese government's widening attempts to spread pro-Beijing messages around the planet.

State-run news outlets and local governments have organized and funded pro-Beijing influencers' travel, according to government documents and the creators themselves. They have paid or offered to pay the creators. They have generated lucrative traffic for the influencers by sharing videos with millions of followers on YouTube, Twitter and Facebook.

Typically, the Chinese government support comes in the form of free organized trips around China, particularly in Xinjiang. By showing the influencers a carefully sanitized image of life in the country, the authorities don't need to worry about negative stories. They simply make it easy for the YouTubers to present images of jolly peasants and happy city-dwellers, because that's all they are allowed to see.

One of the authors of the New York Times piece, Paul Mozur, noted on Twitter another important way that the authorities are able to help their influencer guests. Once produced, the China-friendly videos are boosted massively by state media and diplomatic Facebook and Twitter accounts:

One video by Israeli influencer Raz Gal-Or portraying Xinjiang as "totally normal" was shared by 35 government connected accounts with a total of 400 million followers. Many were Chinese embassy Facebook accounts, which posted about the video in numerous languages.

A new report from the Australian Strategic Policy Institute, "Borrowing mouths to speak on Xinjiang", has some more statistics on this practice:

Our data collection has found that, between January 2020 and August 2021, 156 Chinese state-controlled accounts on US-based social media platforms have published at least 546 Facebook posts, Twitter posts and shared articles from [China Global Television Network], Global Times, Xinhua or China Daily websites that have amplified Xinjiang-related social media content from 13 influencer accounts. More than 50% of that activity occurred on Facebook.

Mozur says that the use of Western influencers in this way also allows employees of Beijing-controlled media, like the journalist Li Jingjing, to present themselves as independent YouTubers. On Twitter, however, she is labeled as "China state-affiliated media". The Australian Strategic Policy Institute sees this as part of a larger problem (pdf):

labelling schemes adopted by some video-sharing and social media platforms to identify state-affiliated accounts are inconsistently applied to media outlets and journalists working for those outlets. In addition, few platforms appear to have clear policies on content from online influencers or vloggers whose content may be facilitated by state-affiliated media, through sponsored trips, for example.

According to Mozur, China's state broadcaster is actively looking for more influencers, offering bonuses and publicity for those who sign up. In the US, China's consulate general is paying $300,000 to a firm to recruit influencers for the Winter Olympics, ranging from Celebrity Influencers with millions of Instagram or TikTok followers, to Nano Influencers, with merely a few thousand. The ultimate goal of deploying these alternative voices is not to disprove negative stories appearing in Western media, but something arguably worse, as the New York Times report explains:

"China is the new super-abuser that has arrived in global social media," said Eric Liu, a former content moderator for Chinese social media. "The goal is not to win, but to cause chaos and suspicion until there is no real truth."

As if we needed any more of that…

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: china, influencers, propaganda, social media, surveillance, uyghurs

How Attacks On Section 230 Could Put Addiction Recovery Efforts At Risk

from the so-many-issues dept

We keep trying to highlight the pitfalls and dangers of attacking the problems seen on social media as if Section 230 is the cause of them, rather than the mirror highlighting societal problems that other policies have failed to fix or have exacerbated. We already have one strong example of how attacking 230 only makes societal problems worse with FOSTA, which has put sex workers' lives at risk, made it much harder for law enforcement to track down sex traffickers, and has done absolutely none of the things the backers of the law promised in terms of solving societal problems.

Now, other people representing the interests of more marginalized groups are beginning to speak out and warn about similar pitfalls. Ryan Hampton, a recovery advocate, who has written extensively on opioid addiction and recovery, has a very thoughtful opinion piece over at The Hill noting how Section 230 reform will be a disaster for harm prevention and recovery efforts. While I disagree when he refers to Section 230 as "obscure," he's correct that chipping away at it will cause tremendous harm to his efforts to help those in recovery and those seeking to deal with drug addiction.

Just as advocates urged Congress to rewrite Section 230 to prevent sexual exploitation—a similar campaign is underway to prevent drug sales and curb America’s soaring overdose death rate. Horrific stories involving young adults buying drugs on Snapchat and TikTok abound. Some parents and advocates want Section 230 rewritten to increase liability of social media companies for drug sales on their platforms. But efforts to clamp down on online drug sales through Section 230 carve outs are somewhat misguided. Without careful considerations, these reforms would endanger the recovery community and harm reduction advocates—and threaten to stifle productive speech that is critical for progress to combat the overdose crisis. Current proposed 230 carve-outs could undermine access to lifesaving resources, mandating takedowns of broad categories of content, and forcing vulnerable populations, including those navigating supportive services, off-platform. For criminalized communities, the risk for exploitation and harm offline is significant, and support and resources can be limited.

As Hampton explains:

Harm reduction efforts—and conversations—are often nuanced and specific to the individual, aiming to minimize harms of substance use. Blanket content bans, prescribed without consideration of context and nuance, could punish those seeking help—hamstringing legitimate, proven approaches to combatting overdoses.

Instead of broadly crushing free speech and pushing social media companies to eliminate our ability to share resources, the U.S. government should focus its efforts on things that work. To save lives, policymakers must develop a realistic national strategy to combat the overdose crisis, including implementing evidence-based prevention, harm reduction, treatment, and recovery support services on the community-based level. Don’t kill the conversation.

This is why we keep pointing out that so much of this debate really seems to be about politicians, who have failed to put in place policies to help solve underlying societal problems, now see attacking Section 230 as a convenient way to brush those problems (and their own failures to deal with them) under the rug. If no one can discuss these issues without fear of liability, maybe people will just forget what's actually happening?

It's good that people like Hampton are speaking up and calling out the very real human risks of attacking Section 230, and silencing speech, rather than dealing with the underlying problems. The question, though, is whether any policymaker will listen.

Filed Under: addiction, addiction recovery, fosta, health, information, section 230

More Info Leaks About The CBP's Counter-Terrorism Division's Targeting Of Journalists

from the rules?-we-don't-need-no-stinkin'-rules dept

For a few years now, information has come to light showing Customs and Border Protection (CBP) has been engaged in the sort of activity that's gotten other federal law enforcement agencies in trouble in the past: the targeting of journalists.

To be clear, no law enforcement agency -- federal or otherwise -- should target a journalist unless the journalist is suspected of criminal activity. Journalists' sources may be suspected of criminal activity from time to time, but that does not justify the direct targeting of journalists to identify their sources. The First Amendment -- as interpreted in multiple court decisions -- protects journalists and their sources. Federal agencies should know better and yet they far too frequently ignore these protections to hunt down leakers and whistleblowers.

The CBP has been at this for a while now. In 2019, leaked documents showed CBP had created a watchlist related to the immigrant caravan approaching the US border -- one that contained plenty of journalists, activists, and immigration lawyers. Shortly thereafter, it became apparent the rights-violating watchlisting was a multinational effort, with the Mexican government pitching in to keep an eye on these individuals on its side of the border.

An DHS Inspector General's investigation followed. It found plenty of targeting of journalists but decided that since the CBP never engaged in retaliatory activities against press members, there was no wrongdoing... for the most part. No harm, even if there was clearly a foul.

Another Inspector General's report -- one that hasn't been publicly released in unredacted form -- shows even more CBP targeting of journalists, something the agency apparently considered to be a normal part of its day-to-day counterterrorist operations.

A special Customs and Border Protection unit used sensitive government databases intended to track terrorists to investigate as many as 20 U.S.-based journalists, including a Pulitzer Prize-winning Associated Press reporter, according to a federal watchdog.

Yahoo News, which published an extensive report on the investigation, also found that the unit, the Counter Network Division, queried records of congressional staffers and perhaps members of Congress.

This Inspector General report has uncovered even more targeting of journalists and others the CBP should be steering clear of. But instead of steering clear, the CBP embraced its access of multiple databases to investigate journalists not suspected of any wrongdoing. Pattern and practice, as the civil rights lawsuits say.

Jeffrey Rambo, an agent who acknowledged running checks on journalists in 2017, told federal investigators the practice is routine.

"When a name comes across your desk you run it through every system you have access to, that's just status quo, that's what everyone does," Rambo was quoted by Yahoo News as saying.

Yahoo's extensive report contains much more information about the CBP and this agent's inappropriate use of the agency's multiple tools for tracking and investigating people.

[Jeffrey Rambo] worked at a secretive Customs and Border Protection division. The division, which still operates today, had few rules and routinely used the country’s most sensitive databases to obtain the travel records and financial and personal information of journalists, government officials, congressional members and their staff, NGO workers and others.

Lots of journalists, lots of abuse of the CBP's power. Zero accountability.

As many as 20 journalists were investigated as part of the division’s work, which eventually led to referrals for criminal prosecution against Rambo, his boss and a co-worker. None were charged, however.

Rambo refers to this as "vetting," although it's not clear what the vetting was supposed to accomplish, other than allowing him (and others) to compile large amounts of information about the people listed above. Agents pulled email addresses, photos from passport applications, and phone numbers. Names were run against multiple databases, including government terrorist watchlists. What did the CBP put in place to ensure these systems weren't abused by agents? Nothing, according to Rambo.

"There is no specific guidance on how to vet someone,” Rambo later told investigators. “In terms of policy and procedure, to be 100 percent frank there, there's no policy and procedure on vetting.”

Critics are calling it abuse. Rambo says abuse or not, it's standard operating procedure. There's nothing alerting agents this might be the wrong thing to do, even though it would seem apparent that targeting journalists, members of Congress, and activists might be unconstitutional and certainly isn't publicly acceptable.

And the CBP doesn't appear to believe there's anything wrong with this either. Its statement to Yahoo says things about "strict governance" and "best practices," claiming this is all part of its valuable national security work. It claims it has done nothing wrong.

“CBP does not investigate individuals without a legitimate and legal basis to do so,” the spokesperson added. “These investigations support CBP’s mission to protect our communities.”

Protect which community? The public at large? Or does it serve to protect the border control community from critical journalists and nosy Congressional reps? It might be little more difficult for the CBP to justify this sort of "vetting." This is no longer Trump's CBP -- one headed by a Commander-in-Chief who was openly hostile to both immigrants and journalists. That's not to say the Biden's CBP is completely distinguishable from Trump's CBP, but there appears to be more support from the Executive Branch when it comes to protecting the rights of journalists.

Filed Under: 1st amendment, 4th amendment, cbp, journalists, surveillance

Daily Deal: The Complete 2022 Microsoft Office Master Class Bundle

from the good-deals-on-cool-stuff dept

The Complete 2022 Microsoft Office Master Class Bundle has 14 courses to help you learn all you need to know about MS Office products to help boost your productivity. Courses cover SharePoint, Word, Excel, Access, Outlook, Teams, and more. The bundle is on sale for $75. Use the code Green20 to get an additional 20% off this and anything else in the deals store.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.