UK Government Says Clearview Owes It $23 Million For Violating Privacy Laws

from the your-business-is-no-longer-welcome-here-but-we'll-still-cash-your-check dept

Well, it couldn't happen to a more deserving shitheel. Clearview, the tech company with 10 billion facial recognition images and zero shame, has now been uninvited from the largest portions of the British Empire.

In February of this year, the Canadian government officially asked Clearview to get off its lawn following an investigation by the country's Privacy Commission. The Commission concluded Clearview's modus operandi -- scraping images and personal data from hundreds of websites -- violated the nation's privacy laws. By that point, Clearview had already pulled out of the Canadian market, but not before allowing the Royal Canadian Mounted Police to test drive its product. (This test driving was also determined to be illegal.)

Nine months later, the Australian government did the same thing, coming to many of the same conclusions. Local laws were ignored by Clearview when it scraped the web for personal info, cutting Australian residents out of the consent loop. The Australian government told Clearview to get the hell out, to which Clearview responded that it did nothing wrong and that it had stopped selling to Australian government agencies months before, when the investigation was initiated.

That left the county seat of the British Empire (so to [very colloquially] speak), the United Kingdom itself. As Natasha Lomas reports for TechCrunch, the UK government is offering an incentive plan to Clearview to hasten its exit.

Controversial facial recognition company Clearview AI is facing a potential fine in the UK.

It has also been handed a provisional notice to stop further processing of UK citizens’ data and to delete any data it already holds as a result of what the Information Commissioner’s Office (ICO) described as “alleged serious breaches” of national data protection law.

If Clearview wants to do business with the UK, it will need to pay up front. And it will have to change its collection procedure -- one that makes the generous assumption that anything posted on the open web is Clearview's for the taking scraping. Not only will Clearview be expected to delete existing data gathered on UK citizens and alter its intake processes, it will need to open up its wallet and give the UK government what it wants before proceeding.

The Information Commissioner’s Office (ICO) has today announced its provisional intent to impose a potential fine of just over £17 million [$23 million USD] on Clearview AI Inc – a company that describes itself as the ‘World’s Largest Facial Network’. In addition, the ICO has issued a provisional notice to stop further processing of the personal data of people in the UK and to delete it following alleged serious breaches of the UK’s data protection laws.

Much like Australia and Canada, the UK government says data privacy laws were broken by Clearview when it gathered UK residents' info without their knowledge or consent. The ICO also points out further violations, including the gathering of data without a "lawful reason" and deciding it was entitled to hold onto any scraped data indefinitely, even when 99.9% of what Clearview has collected has nothing to do with current or past investigations by law enforcement or national security agencies.

$19 million isn't exactly pocket change for Clearview. Unlike other tech companies, it's not sitting on massive amounts of VC funding. It's also difficult to say whether Clearview is even profitable at this point. While it has received some capital infusions from investors, its valuation is only $130 million, which doesn't exactly suggest the company is poised for exponential growth.

And its future isn't going to get any rosier if it keeps getting told to leave the country by major free world governments who would give Clearview a veneer of respectability as customers, but are instead delivering even more PR and legal headaches to a company that has done nothing but generate negative press since its exposure. If this keeps up, the only entities Clearview will be able to sell to will be ones that further harm its reputation, turning it into the NSO Group of the facial recognition world. You might be able to make a comfortable living selling to the dregs of international society to aid and abet oppression. But why the fuck would you want to?

Filed Under: facial recognition, privacy, uk
Companies: clearview

YouTuber Has 150 Anime Reviews And 'Let's Draws' Hit With Copyright Claims All At Once

from the surprise! dept

As has been a hot topic of discussion of late, YouTube has a copyright enforcement problem on its hands. To be fair, this problem has existed for some time, but due to some recent transparency from YouTube itself over how often it receives claims and enforces them, the scale of this problem is becoming more widely known. In YouTube's minor defense: this is difficult challenge to overcome. The platform operates internationally, which means that it often finds itself attempting to navigate the nuances of copyright laws throughout the world. Still, to say it's not a problem would be silly. And, frankly, YouTube's creative community is becoming more and more vocal about it.

Take Mark Fitzpatrick, for instance, the operator of the Totally Not Mark YouTube channel. Fitzpatrick releases a video a week covering mostly anime topics, primarily either reviews of anime shows or episodes, alongside some let's draws for anime images and characters. He has had this channel for several years and has well over half a million subscribers. This is all fairly straightforward fair use stuff. And, yet, Mark was slammed with a series of copyright claims on 150 of his videos over the course of a day or so, resulting in those videos being taken offline.

YouTuber Mark Fitzpatrick of Totally Not Mark has made a name for himself with his manga and anime videos on YouTube. His reviews edit together montages from whatever he’s reviewing or critiquing as he expounds his thoughts in voice over. Mark says his use of copyright material is fair. Toei Animation, it seems, disagrees, and have filed copyright claims on 150 of his videos.

“Over the last twenty-four hours, I’ve sat back in disbelief, shock, and sorrow as my life’s work has been unfairly ripped away from me,” begins Mark in his response video to Toei and YouTube, which, as of writing, has over 400,000 views. “Two nights ago, I received an email notifying me that fifteen of my videos had been copyright claimed and block by Toei Animation,” Mark continues. “One hour later, that number rose to twenty-eight. And when I woke up this morning, it had reached a total of 150 videos that my audience can no longer see and that I can no longer monetize.” All the videos in question were either for Dragon Ball or One Piece, both of which Toei animates. Note that a handful of those videos did not feature any anime clips, but rather, were how-to-draw explainers.

As a result, something like 3 years worth of his work just went poof! Along with a significant chunk of his company's revenue. This despite Fitzpatrick noting that Toei has actually asked him to do some work in promoting its content directly in the past!

Now, you may be asking how this happens when fair use or fair dealing is a thing. After all, Fitzpatrick operates out of Ireland, where fair dealing is part of the law. Except the claims are coming from a company based out of Japan where there is no such provision in the law and, as we've discussed ourselves, copyright law has morphed into an absolute restrictive monster. And Japanese law may be where YouTube's proverbial head is at.

In his response, Mark says that he ensures that he and his employees adhere to policy regarding fair dealing and fair use as outlined by YouTube, his own country, and other countries. This maybe true; however, copyright law in Japan is...different. I’m no lawyer, but as attorney Keiji Sugiyama explained in a presentation at Fordham University, Japanese copyright law does not have a general fair use provision like the United States.

Instead, Japan has moral rights for any type of work. Sugiyama notes that while the Japanese Copyright Law does lack a general fair use provision, there are certain legal cutouts to allow for parody and private use, as well as for reproductions for schools and libraries.

But not commentary or limited use for things like a let's draw, it seems. And there is the problem.

Again, it's not an easy problem to solve, but multi-billion dollar a year companies aren't supposed to only get softballs pitched down the middle of the strike zone. The platform very much needs to figure out how to enforce copyright claims fairly in situations where the uploader is abiding by his or her country's laws, but not by the laws of the country where the content originated. Put another way: were Toei an American or Irish animation company, this would be a simple problem to solve by counterclaiming it under fair use.

But in this case? Well, it seems the end result due to YouTube is that an Irish uploader must abide by Japanese copyright law. And that can't seriously be the world anyone wants.

Filed Under: anime, content id, copyright, dmca, mark fitzpatrick, takedowns

Disrupting Spycraft: Always-On Surveillance Is Prompting Massive Changes In Covert Operations

from the move-fast-and-break-your-own-stuff dept

The spies are back to complaining that the always-on digital world and the omnipresence of surveillance devices (both public and private) is making it difficult to do spy stuff.

Last January, sources were telling Yahoo that it's no longer enough to carry around a few fake documents to get past customs and engage in spycraft -- not when the cover identities are bereft of the digital detritus generated by simply existing in a connected world. And it's difficult to move about unobserved when every street light, business, and front porch has a camera attached to it, monitoring activity 24/7/365.

The report also noted that online access to a large variety of information also made it more difficult to engage in covert activities. Russian counterintelligence agents were apparently able to sniff out CIA agents working in US embassies by looking for things like prior postings in certain countries, pay bumps for hazardous work, or mismatches in salary for employees with similar titles. Some of this investigative work could be achieved by utilizing open source information gleaned from government sites and professional-oriented platforms like LinkedIn. Data from the massive Office of Personnel Management hack likely filled in the rest of the details.

It isn't all losses, though. The same surveillance apparati that made it difficult for covert operatives to maintain cover also made it easier for them to track their targets. But the overall tone of the report was that undercover work needed to undergo an extensive overhaul or it would be rendered almost entirely useless.

It's been almost two years since that report was released. Since then, surveillance tech has become even more ubiquitous, with governments and private citizens alike installing more cameras and monitoring other people's movements and activities more frequently.

The complaints from agencies utilizing covert surveillance haven't changed, though. What used to be extremely difficult is now almost impossible, according to this report from the Wall Street Journal. (alt. link here)

Operatives widely suspected of working for Israel’s Mossad spy service planned a stealthy operation to kill a Palestinian militant living in Dubai. The 2010 plan was a success except for the stealth part—closed-circuit cameras followed the team’s every move, even capturing them before and after they put on disguises.

In 2017, a suspected U.S. intelligence officer held a supposedly clandestine meeting with the half brother of North Korean leader Kim Jong Un, days before the latter was assassinated. That encounter also became public knowledge, thanks to a hotel’s security camera footage.

Last December , it was Russia’s turn. Bellingcat, the investigative website, used phone and travel data to track three operatives from Moscow’s FSB intelligence service it said shadowed and then attempted to kill Russian opposition politician Alexei Navalny. Bellingcat named the three. And published their photographs.

The CIA has its own issues, as the new director (William Burns) admitted during his February confirmation hearing. He said the CIA's bread-and-butter covert work was "much more difficult" to perform but expressed confidence the agency would find some way to work around these millions of inconveniences.

If packing a bag with a handful of aliases and their corresponding paperwork no longer works in a world where every cover story needs to be backed by a fleshed-out online existence, the solution might be to do away with the fakery. Instead of adopting personas as needed, agents will be expected to exist as someone else -- something that requires far more dedication and commitment than playing a small part for a few months or years to gather intelligence.

Crossing international borders under an assumed name is rapidly becoming yesteryear’s tradecraft, because of biometrics like facial recognition and iris scans, several former officials said.

“It’s more difficult for intelligence officers to masquerade under alias,” said a retired Western intelligence officer who estimated he had nine false identities during his career, and credit cards for each.

More spying will be done in “true name,” meaning the spy won’t pose as someone else, but “live their cover” as a businessperson, academic or other professional with no obvious connection to the U.S. government.

There will be no more coming in from the cold. Always-on surveillance is leading to always-on spycraft. Another alternative -- one already in use -- is the use of teams to perform covert work, with one handling the actual legwork while the rest of the team steers the operative clear of surveillance cameras in the area.

Something approaching schadenfreude comes from reading reports like these, where the early adopters and pioneers of surveillance tech are now realizing there's too much surveillance tech standing between them and their work. Pervasive surveillance has made citizens around the world aware lives can no longer be lived largely unobserved. A wealth of personal data only clicks away makes anonymity almost impossible.

And there's a layer of irony on top of the schadenfreude: the same governments that felt they needed thousands or millions of cameras to keep an eye on their citizens are finding out that massive surveillance systems are capable of exposing their own secrets to their adversaries. There's no rolling it back, either. The difficulty level of covert human intelligence operations is only going to keep increasing.

Filed Under: always on, cia, spycraft, surveillance

Daily Deal: PlayStation Plus 5-Year Subscription Stackable Code Bundle

from the good-deals-on-cool-stuff dept

Take your PlayStation experience to the next level with PlayStation Plus! Connect with an enormous online community of gamers to compete in PS classics like Star Wars: Battlefront, Uncharted, and many more. If that's not reason enough to pull the trigger, the subscription also delivers an epic monthly collection of free games, in a library that is constantly expanding. Topped off with exclusive discounts, this membership pays for itself on day one. This bundle includes 5 separate one year subscriptions which can be stacked to give you 5 years of service or can be shared with friends and family. The bundle is on sale for $219.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

Yet Another Study Shows Mainstream Media Is A Key Vector In Spreading Misinformation

from the again-and-again-and-again dept

The common "accepted knowledge" these days among many is that the rise of disinformation and conspiracy theories must be driven by social media, and Facebook in particular (with Twitter and YouTube right behind). This theory has always seemed a bit bonkers, and we've pointed to multiple detailed, data-driven studies that showed that cable news was a much bigger driver of misinformation than social media. Specifically, it found that conspiracy theories and misinformation and the like didn't actually "go viral" until after it appeared on cable news.

So, it's good (but not at all surprising) to find yet another study pointing out the same thing. This one, first highlighted by MediaPost, involved a big survey exploring the spread of conspiracy theories -- and found that the mainstream media is often the biggest vector, rather than social media.

Contrary to popular opinion, we found that while technology (and social media specifically) has a role to play in perpetuating CTs, our data suggests that this is not the only source of information about CTs, and often not the main one either. People are more likely to say they heard about some CTs from a ‘mainstream’ news source (such as TV or a broadsheet or tabloid newspaper) than they are from a social media channel. We therefore need to be careful about locating technology as the source of the problem and indeed as the sole focus for possible solutions

In fact, the study notes:

“Our findings suggest that this highly effective disinformation campaign, with potentially profound effects for both participation in, and the legitimacy of, the 2020 election, was an elite-driven, mass-media led process. Social media played only a secondary role.”

Again, none of this says that conspiracy theories aren't spread on social media, because of course they are. But increasing evidence suggests they don't really catch on until the mainstream media gets involved, with TV News being a key vector and newspapers -- both "broadsheets" and "tabloids" -- playing a role as well. And yet, almost no one wants to explore the differing role among these other sources, and many people are solely focused on social media -- perhaps because it's new, and it's always easy to blame the "new" thing.

But it won't get to the root of the problem, and actually can serve to mask the real problems.

Filed Under: cable tv, internet, misinformation, newspapers, social media, tv news

FCC Gets Its First Permanent Female FCC Boss Ever

from the that-took-a-while dept

The US Senate this week approved a new five-year term for Federal Communications Commission Chairwoman Jessica Rosenworcel, making her the first permanent FCC chair in agency history. Technically the first female chair was Mignon Clyburn, who temporarily served as interim chair before Tom Wheeler was appointed boss back in 2013. Rosenworcel's term was set to expire at the end of the year, raising some concerns that her re-nomination would stall, leaving the GOP with a 2-1 FCC majority at Biden's FCC.

While that scenario was avoided, Rosenworcel's appointment still leaves the agency gridlocked at 2-2 commissioners, and incapable of having a voting majority on any policy issue of substance. If you recall this was quite by design; the GOP rushed to appoint Trump ally Nathan Simington to the commission late last year in a quick appointment process that took less than 30 days. This was at the behest of the telecom and media sectors, which very much don't want the Biden FCC rolling back any of the Trump-era deregulatory favors, whether that's net neutrality or media consolidation rules.

To that end, telecom giants like AT&T, hand in hand with Rupert Murdoch, are now focused on blocking Biden's other FCC pick, Gigi Sohn, from being appointed to the FCC so Rosenworcel can't actually use her Democratic majority. That has involved pushing the false claim through trusted news outlets that Sohn wants to "censor conservatives," despite absolutely zero evidence that's actually true.

This being the post-truth era (especially in the GOP), that doesn't seem to matter. Saule Omarova, a Cornell Law School professor and Biden's pick for comptroller of the currency, backed out of her nomination this week because the banking industry was worried she might actually hold them lightly accountability for something. The banking industry in turn got the GOP to run a campaign accusing Omarova of being a "communist" because she was born in the Soviet Union:

"Some lobbyists, including the incoming chairman of a group representing community bankers and the chief executive of another group that focuses on big banks, also shared a Wall Street Journal editorial suggesting that Ms. Omarova’s Soviet childhood meant that she could not be trusted."

The U.S. press being generally feckless, countless outlets (especially access-obsessed beltway outlets like Politico) spilled ample ink over countless paragraphs stenographing false GOP claims, often without bothering to inform readership they weren't actually true.

Telecom giants like AT&T, hand in hand with Rupert Murdoch, are now attempting the same thing with Sohn because they're terrified of any regulator that might actually hold them accountable for anticompetitive behavior. Both telecom and media giants were spooked by the appointment of Lina Khan to the FTC, and Biden's 9 month delay in announcing his FCC picks gave them ample time to generate farmed opposition to Sohn. Sohn can still be appointed without GOP support, but not if telecom can pressure swing voters like Manchin and Sinema into balking at the pick.

That's a much steeper hill to climb, given Sinema, despite her tendency to throw wrenches in the cogs of Biden's Congressional agenda, has yet to oppose a major nomination. AT&T and Rupert Murdoch know this, but likely want to just delay Sohn's appointment, narrowing the window a Democratic FCC majority can implement any real reform. From the dismantling of FCC consumer protection oversight to the elimination of longstanding (and traditionally bipartisan) media consolidation rules, there were an endless parade of favors doled out to both companies during the Trump era they'd very much like to hold on to for as long as possible, if not permanently.

Filed Under: fcc, gigi sohn, jessica rosenworcel

Controversial Facial Recognition Company Calls Out Clearview, Demands It Ditch Its Database Of 10 Billion Scraped Images

from the Pots,-kettles-yelling-'black'-at-each-other dept

Clearview has burned its bridges inside the facial recognition tech industry. Despite it being largely morally malleable, the industry as a whole appears to have cut ties with CEO Hoan Ton-That's startup, which relies on more than 10 billion images scraped from the web to generate a database for its customers to match faces with.

The company played it fast and loose upon rollout, handing it out to whoever seemed interested, inviting them to run searches against photos of friends and family members. The "give it a spin" invitations were handed out to government agencies as well, inviting cops to play image roulette with Clearview's ever-expanding database.

To date, the efficacy of Clearview's AI remains untested. Clearview did finally volunteer to have the National Institute of Science and Technology (NIST) examine its product for accuracy but only allowed it to run a one-to-one test -- the kind that would, for instance, allow a phone user to unlock their phone via facial recognition.

This is not the product Clearview sells. Clearview sells one-to-many matching, relying on images and other personal info scraped from the internet. This practice has alienated the internet. It has also gotten Clearview kicked out of two countries and served with multiple lawsuits. Consequently, other facial recognition tech companies are cursing Clearview both over and under their breath as the company somehow manages to remain viable in the face of months of negative press coverage.

Persona non grata status apparently applies to even other controversial facial recognition tech companies. AnyVision spent some time in the media spotlight for being used by the Israeli military to surveill Palestinians. It managed to take down Microsoft with it (albeit temporarily), exposing the tech giant's pinky-swear-rejection of enabling abusive surveillance to be the lip service it was. AnyVision doubled down on its first mistake(s) by threatening to sue news agencies that reported on this factual development.

AnyVision resurfaced a couple of years later as the company behind pervasive surveillance systems deployed by Texas public schools. AnyVision appeared to be good at what it did. It matched faces per school hot lists and let administrators know any time those faces were detected. A little too good, perhaps. The system racked up 164,000 "hits" during its seven-day test run, returning as many as 1,100 matches for a single student.

AnyVision is back. Sort of. It has rebranded as Oosto, divested itself of some of its more problematic deployments, and is now taking shots at Clearview.

Back in September, it argued that facial recognition companies selling to government agencies should offer customers a blank database -- one the end users could fill with mugshots and persons of interest. This was a clear shot across Clearview's bow. Clearview's main selling point is its scraped database of 10 billion images. AnyVision also forwarded this suggestion to a number of government bodies, including the UK's Surveillance Commissioner and the NIST.

It's always good to be wary of private companies pleading for the government to regulate them more. It often means incumbents are looking for better ways to stave off competition by helping enact rigorous guidelines that upstarts can't afford to implement. And AnyVision's suggested "fixes" for facial recognition tech obviously aims to exclude Clearview from the government market in multiple countries, making it that much easier for the rebranded company to find customers in need of controversial tech that at least won't be as controversial as Clearview.

The war of words continues, albeit behind a paywall:

Oosto (formerly Anyvision) has called out Clearview AI, stating "that biometrics should be deployed with empty databases" in a recent release, referring to the US company's practice of scraping billions of photos from social media to use in its database.

Clearview has offered a rebuttal, but until this one is scraped from its host, we won't know exactly how it defended itself. But it seems clear even from this very truncated exchange of ideas that AnyVision believes Clearview is bad and Clearview believes it is good… making it a minority of one. But one thing is clear: if Clearview gets out of the scraping business it's less likely to make enemies of governments, private citizens, and its competitors in the market. But if Clearview hasn't changed its practices following a year of caustic press coverage, it's unlikely to do so just because a competitor is waving its revamped Gadsden flag in front of any regulatory agency that will listen to it.

Filed Under: facial recognition
Companies: anyvision, clearview

Report Showcases How Elon Musk Undermined His Own Engineers And Endangered Public Safety

from the first-do-no-harm dept

For a long time now, it's been fairly clear that consumer safety was an afterthought for some of the more well known companies developing self-driving technology. That was made particularly clear a few years back with Uber's fatality in Tempe, Arizona, which revealed that the company really hadn't thought much at all about public safety. The car involved in the now notorious fatality wasn't even programmed to detect jaywalkers, and there was little or no structure at Uber to meaningfully deal with public safety issues. The race to the pot of innovation gold was all consuming, and all other considerations (including human lives) were afterthoughts.

That same cavalier disregard for public safety has been repeatedly obvious over at Tesla, where the company's undercooked "autopilot" technology has increasingly resulted in a nasty series of ugly mishaps, and, despite years of empty promises, still doesn't work as marketed or promised. That's, of course, not great for the public, who didn't opt in to having their lives put at risk by 2,500 pound death machines for innovation's sake. Every week there's new evidence and lawsuits showing this technology is undercooked and dangerous, and every week we seemingly find new ways to downplay it.

This week the scope of Elon Musk's failures on this front became more clear thanks to a New York Times piece, which profiles how corner cutting on the autopilot project was an active choice by Musk at several points in the development cycle. The piece repeatedly and clearly shows that Musk overstated what the technology was capable of for the better part of the last decade:

"As the guiding force behind Autopilot, Mr. Musk pushed it in directions other automakers were unwilling to take this kind of technology, interviews with 19 people who worked on the project over the last decade show. Mr. Musk repeatedly misled buyers about the services’ abilities, many of those people say. All spoke on the condition of anonymity, fearing retaliation from Mr. Musk and Tesla."

Musk's bravado, and the exaggeration of the sophistication of Autopilot, helped encourage some customers to have too much trust in the product or actively misuse it. Constantly pushing undercooked software and firmware updates without proper review also created safety challenges. But the article tends to focus heavily on how Musk repeatedly undermined his own engineers through stubborn decisions that undermined both overall safety and engineer expertise, like Musk's unyielding belief that full automated driving could be accomplished with just cameras, and not cameras and radar (or other detection tech):

"Within Tesla, some argued for pairing cameras with radar and other sensors that worked better in heavy rain and snow, bright sunshine and other difficult conditions. For several years, Autopilot incorporated radar, and for a time Tesla worked on developing its own radar technology. But three people who worked on the project said Mr. Musk had repeatedly told members of the Autopilot team that humans could drive with only two eyes and that this meant cars should be able to drive with cameras alone."

The article also makes it clear that employees that were overly happy to please Musk's whims only tended to make the overall quality and safety issues worse. And when employees did challenge Musk in a bid to improve quality and safety, things very often didn't go well:

"In mid-2015, Mr. Musk met with a group of Tesla engineering managers to discuss their plans for the second version of Autopilot. One manager, an auto industry veteran named Hal Ockerse, told Mr. Musk he wanted to include a computer chip and other hardware that could monitor the physical components of Autopilot and provide backup if parts of the system suddenly stopped working, according to two people with knowledge of the meeting.

But Mr. Musk slapped down the idea, they said, arguing it would slow the progress of the project as Tesla worked to build a system that could drive cars by themselves. Already angry after Autopilot malfunctioned on his morning drive that day, Mr. Musk berated Mr. Ockerse for even suggesting the idea. Mr. Ockerse soon left the company."

None of this is particularly surprising for folks who have objectively watched Musk, but it does catalog his erratic bravado and risk taking in a comprehensive way that makes all of it seem notably more concrete. For a man whose reputation is one of engineering savvy, the report repeatedly showcases how Musk refused to actually listen to his own engineers. There's little doubt Musk has been innovative, but the report does a fairly solid job showcasing how a not insubstantial portion of his near-deified reputation is more than a little hollow.

Filed Under: autonomous vehicles, elon musk, safety, self-driving
Companies: tesla

Apple Notifies More Victims Of NSO Malware Hacking Attempts

from the [extremely-1960s-Batman-splash]-THWART!!! dept

Apple's announcement that it was suing Israeli malware purveyor NSO Group for targeting iPhone users was coupled with another, equally dismaying (I mean, for NSO…) announcement: it would be informing targets of malware anytime it detected a suspected intrusion.

Actually, this may be more of a concern for NSO's customers. After all, they're still paying the same licensing fees even if their targets are being warned of hacking attempts. It can't make them happy and -- since it appears many of NSO's customers like to target non-terrorists and non-criminals -- there's really nothing they can do about it. Local entities may be sworn to secrecy with court orders (if those are even obtained) but there's nothing preventing Apple from alerting users that malware might be present on their phones.

Given the long list of seemingly inappropriate targets for NSO's Pegasus spyware -- which includes journalists, activists, dissidents, government critics, political figures, religious leaders, lawyers, ex-wives, etc. -- Apple's policy is the Right Thing To Do. NSO's customers agree to use the spyware to target terrorists and dangerous criminals. They clearly don't do that. If NSO won't stop them (and it won't [until very recently]), this is one way to mitigate the damage.

And so the disclosures have flowed. A Polish prosecutor who dared to offend the ruling party in that country was one of the first notified by Apple's new program. Since then, the floodgates have opened, potentially ruining the surveillance plans of several governments. Here's Carly Page for TechCrunch, rolling out the details on Apple's unwelcome mat.

Apple has sent threat notification alerts to victims of state-sponsored hackers in Thailand, El Salvador and Uganda, just hours after filing a lawsuit against Israeli spyware maker NSO Group.

At least six Thai activists and researchers who have been critical of the government have received the notification, according to Reuters, including Prajak Kongkirati, a political scientist at Bangkok’s Thammasat University, researcher Sarinee Achananuntakul and Thai activist Yingcheep Atchanont of the legal monitoring group iLaw. Citizen Lab, which tracks illegal hacking and surveillance, identified in 2018 a Pegasus spyware operator active within Thailand.

Also on the list: the president of the Democratic party in Uganda (the same nation where US State Dept. employees were targeted) and a dozen employees of El Salvador newspaper, El Faro, which has long been a critic of that country's government.

None of the people listed are legitimate targets for this powerful spyware. NSO has claimed for years its exploits only target the worst of the worst. And for roughly the same number of years, investigations and leaks have shown governments are using the spyware to target critics and political opponents who only pose a threat to their power, rather than public safety or national security.

Fortunately, there's another entity watching these people's backs. Prior to Apple's notification program, it took in-depth research by entities like Canada's Citizen Lab to discover the source of hacking and properly attribute it to NSO malware. Apple presumably can make these determinations much faster, heading off future interception and eavesdropping.

If NSO doesn't like it, it can suck it. It chose to sell to governments with long histories of targeting critics and violating human rights. Its customers can likewise suck it. They've given themselves an infinite amount of leash and NSO's exploits have let them take full advantage of this. Even a minimal amount of thwarting of nefarious doings is welcome in a world where the powerful go unpunished and unchecked far too often.

Filed Under: hacking, malware, pegasus, surveillance
Companies: apple, nso group