NSO Made Millions Selling Phone Hacking Tools To The Princes And Kings Of The United Arab Emirates

from the handing-more-power-to-the-unassailably-powerful dept

NSO Group can't get a break. Too bad. It really doesn't deserve one. The inability of the Israeli exploit purveyor to escape this endlessly negative news cycle is entirely its own fault. And each passing day seems to uncover something new and nasty about the tech company, which has built its business by seemingly selling to whoever wants to buy, no matter how morally repugnant.

The company's malware has been deployed by a variety of repeat human rights offenders to target journalists, critics, dissidents, religious leaders, opposition parties, and the occasional heads of state of their allies. To its own critics, NSO has issued contradictions: it is not responsible for how its customers use its products and that it does everything it can to prevent misuse of its products. The contradiction is baked in: NSO says it pulls access for misuse while claiming it has no "visibility" into its customers' activities.

It also says it does not sell its powerful malware to private entities. But the fine line between public and private entities is never finer than in the United Arab Emirates, where the allied rulers of the area are also private citizens -- kings and princes with access to a whole lot of wealth and a whole lot of power.

A prince can claim to be a government official and still behave like a private citizen. Take Sheikh Mohammed bin Rashid al-Maktoum of Dubai. He's the king of Dubai. He's also in the middle of an extremely messy, somewhat public divorce from Princess Haya bint al-Hussein. His access to NSO's most popular phone exploit (Pegasus) allowed him to hack phones belonging to his ex, along with phones belonging to her legal reps.

But he's not the only UAE figurehead with NSO contracts. Israeli news agency Haaretz reports NSO has sold to other kings and princes who control parts of UAE: men who have plenty of private business that could benefit from a bit of phone hackery using tools obtained under the auspices of Official Government Business.

The Israeli cyber firm NSO sold its Pegasus mobile-phone hacking software to two different leaders of the United Arab Emirates – Abu Dhabi ruler Mohammed Bin Zayed and Dubai ruler Sheikh Mohammed Bin Rashid al-Makhtoum.

TheMarker has learned that the price each of these clients paid in dollars is a seven- to eight-figure number.

It's not that UAE doesn't have national security and law enforcement agencies that would make better homes for phone hacking tools. (I mean comparatively…) The UAE has a federal police force and a joint national security agency that's supposed to handle the sorts of things (serious crime, terrorist activity) NSO swears up and down its customers are using its exploits to combat.

So, why sell the princes and kings, who have few obligations to the people they rule over… you know, since they're rulers rather than elected officials? Apparently, the answer is because they have millions to spend on phone hacking tools and a company willing to exchange goods and services for money while pretending to hold its nose, cover its eyes and ears, and act all defensive when people ask the why in the almighty fuck are they selling exploits to the United Arab Emirates, much less its literal ruling class?

NSO says publicly (and a lot more frequently in recent months) that it takes a hard line on the abuse of its products to violate human rights. But it says that after years of selling to rulers with long histories of extremely severe human rights violations. Both things can't be true. And a cursory Google search would give NSO all the due diligence it needs to refuse to sell to rulers (and government agencies) located in places like Dubai and Abu Dhabi. (Not to mention others with the same cavalier attitude towards life and liberty.)

Recent revelations are forcing NSO to put its money where its mouth is. With every new report of violations and use by human rights violators, the company is now obligated to yank access and cancel contracts. I cannot imagine how uncomfortable it will be for the company to approach rulers who preside over areas where executions and disappearances of critics are commonplace. But suck it up, NSO. The best way to avoid having to tell brutal rulers their business is no longer welcome is to never welcome it in the first place.

Worse, the country NSO calls home may be partly to blame.

In some cases, including the sale of two systems to two separate rulers in the UAE, the Pegasus system was only sold following heavy pressure from the Israeli government, as part of the diplomatic warming between Israel and the UAE. Yet the system’s irregular use embarrassed NSO and caused the third bout of bad publicity the company has sustained since being blacklisted by the U.S. last week.

So, if the Israeli government feels any complicity in the current state of NSO affairs, it probably should send a couple of diplomats along to ensure the revocation of hacking power by NSO not only actually happens, but happens without part of the NSO sales force being disappeared for having the audacity to tell these half-patriarchy/half-oligarchy rulers to take their business elsewhere.

Filed Under: dubai, israel, malware, pegasus, spyware, surveillance, uae
Companies: nso group

In Latest Black Eye For NSO Group, Dubai's King Found To Have Used NSO Spyware To Hack His Ex-Wife's Phone

from the slumming-it-as-a-service dept

NSO Group has endured some particularly bad press lately, what with leaked data pointing to its customers' targeting of journalists, political figures, religious leaders, and dissidents. That its powerful spyware would be abused by its customers was not surprising. Neither were the findings from the leaked data, which only confirmed what was already known.

Despite this, NSO continues to make contradictory claims. First, it says it has no control (or visibility) as to how its customers use its products -- customers that include some notorious abusers of human rights. Second, it says that it cuts off customers who abuse its products to target people who only annoy their governments, rather than directly threaten it with criminal or terrorist acts.

Well, it's either one or the other. And if NSO is waiting for secondhand reports about abusive deployments to act, it really shouldn't be in the intel business. If NSO wants to stay above the fray, it could start by being a lot more selective about who it sells to.

If you're not selective, your customers will not only pettily target people (critics, activists, journalists, dissidents) the government doesn't like but will move on to the extreme pettiness of targeting people certain government officials don't like.

This latest nadir for NSO Group comes courtesy of court proceedings, which illustrates the danger of putting powerful cellphone exploits in the hands of the wrong people.

Dubai's ruler Sheikh Mohammed bin Rashid al-Maktoum ordered the phones of his ex-wife and her lawyers to be hacked as part of a "sustained campaign of intimidation and threat" during the custody battle over their children, England's High Court has ruled.

Mohammed used the sophisticated "Pegasus" software, developed by Israeli firm NSO for states to counter national security risks, to hack the phones of Princess Haya bint al-Hussein, half-sister of Jordan's King Abdullah, and some of those closely connected to her, according to the rulings.

That's the sort of thing you can expect to happen when powerful hacking tools are given to people who have never proven they're capable of handling power responsibly. Adding to the irony is the fact that the King's ex was tipped off by the wife of Tony Blair, who used to work as an outside legal adviser for NSO Group.

Now that this has been exposed, NSO is finally ready to take action.

Once the hacking was uncovered, NSO cancelled its contract with the UAE, Haya's lawyers said. The Israeli firm said it could not immediately comment on the case, but said it took action if it received evidence of misuse of Pegasus.

Well, duh (to use a technical term). But if NSO is so supposedly "proactive" why even sell to the UAE at all? It's not as though it has a long, storied history of respecting rights, much less those possessed by women who also happen to have angered the king? While I understand it might be difficult to promise investors steadily-increasing returns if you choose not to sell to questionable entities, it seems like a long run of bad press and government investigations might have the same effect on the bottom line. Or maybe NSO's investors are just as unconcerned about its partnerships with abusive governments as it is. Whatever the case is, it's led NSO to where it is now: a company best known for giving oppressive governments even more oppression options.

Filed Under: dubai, hacking, malware, pegasus, princess haya bint al-hussein, sheikh mohammed bin rashid al-maktoum, spyware
Companies: nso group

Wearing V For Vendetta Guy Fawkes Masks Declared Illegal In Dubai

from the self-defeating-actions dept

The evolution of the V for Vendetta Guy Fawkes mask from a clever element in a comic book and film to a meme and a global symbol of online and offline resistance has been quite remarkable. A highlight of that trend was earlier this year when MPs in the Polish parliament donned the masks in protest against ACTA, spurred on by massive street demonstrations against the treaty that had recently been held across Poland.

But if the mask has become a way of empowering and uniting protesters, aligning them with other movements around the world, it also becomes an obvious badge of dissent and rebellion, marking them out as a likely enemy of established power structures. It was thus probably only a matter of time before simply wearing a Guy Fawkes mask became grounds enough for the police to move in, as here:

Police officials in Dubai have warned against wearing a mask that symbolises opposition to state authority during any celebrations connected to National Day and declared it illegal.

Any person found wearing Guy Fawkes masks, also known as "Vendetta masks", risks police questioning as any object or action deemed to be instigating unrest or insulting the UAE is illegal, police officials said.

Of course, this simply strengthens the credentials of anyone wearing such a mask, whether in Dubai or elsewhere. And that, in turn, will encourage others around the world to adopt it as a symbol of protest, probably prompting more governments to declare it as "illegal", which will boost its iconic power yet further.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: dubai, free speech, guy fawkes mask, protest

ITU: Travel All The Way To Dubai... And Then We'll Decide If You Can Attend Our Meeting On Internet Governance

from the not-really-that-open dept

We've talked a bit about how the International Telecommunications Union (ITU) -- a part of the UN -- is getting ready for a big meeting in Dubai in December (the "World Conference on International Telecommunications" -- WCIT), where it will seek to put in place some new internet governance rules. There are significant concerns that the rules being discussed will favor certain governments and fracture the internet, by letting incumbent international telcos both tax internet usage and track all usage (potentially blocking anonymous usage). Part of the problem, of course, is that the ITU has been extraordinarily secretive.

In response to the criticism, the ITU is claiming that it will now be more open, including making the various draft plans publicly accessible. Still, it often looks like they're making empty gestures towards openness, rather than showing any real commitment towards it. Take, for example, the FAQ the ITU released (pdf and embedded below) about the WCIT, in which they say that the public is welcome to come all the way to Dubai... to find out if they'll be allowed in the meeting. Seriously.

CAN MEMBERS OF THE PUBLIC ATTEND WCIT-12?

At the opening of WCIT-12 the Secretary-General of ITU will propose that the public be allowed to be present at the conference venue, in line with the practical arrangements adopted at similar ITU conferences. A formal decision on admitting the public will be taken at a meeting of the heads of delegations on the first day of the conference. This would permit the public to attend plenary sessions and certain committee meetings. Webcasts of plenary sessions are also planned.

Got that? Fly to Dubai, show up, and then wait for them to take a vote on whether or not to let you in. If they decide not to let you in, then, um... well... I guess you can enjoy the world's largest shopping mall while a bunch of bureaucrats who don't understand the internet carve it up and break it apart next door. That's not exactly being "open" to the public, now, is it?

Filed Under: dubai, internet governance, itu, public, transparency, un

Why Does The Recording Industry Complain When It's Often Its Own Worst Enemy?

from the make-stuff-available dept

We received an interesting email recently from Bilal in Dubai, explaining just how difficult it is to purchase legal music online from the Middle East, and wondering why it is that the recording industry keeps complaining that not enough people are buying, when it does nothing to allow them to buy in large parts of the world:

I am a frustrated music listener, who is tired of hearing the music industry weep of low sales.

I've been living in the Middle East for the past 5 years, specifically Dubai, and apparently we are not worthy of buying music online as all the legitimate online music stores (iTunes, Amazon MP3, etc...) are not available in this region.

I don't understand how the music industry claims that it's suffering, and yet they forbid paying customers such as myself from buying their content. This region is not lucky enough to be part of the online music community, and I would like to know why. I always hear the answer that "the rights are not available", but the record labels are the rights owners, they control the switch! I hate to pirate music, but I don't have any other choice.

I'm guessing the answer has to do with the fact that the major labels likely have "sold off" the regional rights to third parties in these parts of the world. But it seems like they really should be doing something to get those services available globally. It's pretty ridiculous that it's so limited already.

Update: Worth pointing out: apparently iTunes did recently open in UAE, though its unclear how complete it is or why it took so long to open there. Update 2.... And, no. Turns out, despite the confusing article, the "store" in question is only for physical Apple products (iPhones/iPads). iTunes software is available but no music downloads.

Filed Under: copyright, dubai, licensing, regional rights, restrictions