Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple sues NSO Group to curb the abuse of state-sponsored spyware

apple.com

Post reply on HN
Print view View original

201–210 of 477 posts

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#201

Post by freejazz »

ethbr0 wrote: post #159
xxpor wrote: post #127

Earlier quoted context omitted.

>they're relying on the CFAA and especially the claim that the access to the users' device was not authorized by that user. What's their theory of standing to sue over damage to their customers? Edit: the main point is this (from the CFAA count): Defendants’ actions caused Apple to incur a loss as defined by 18 U.S.C. § 1030(e)(11), in an amount in excess of $5,000 during a one-year period, including the expenditure…

18 U.S.C. § 1030(e)(11) https://www.law.cornell.edu/uscode/text/18/1030 "(11) the term “loss” means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of servic…

They'd have to prove that Apple was negligent to sell software with flaws, but that's gonna be tough considering that much software has flaws.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#202

Post by einpoklum »

*Apple VP of SW Engineering: "Apple devices are the most secure consumer hardware on the market"*

... except for how Apple sends a copy of all of your data that passes through their servers to the NSA. No, I'm not espousing a conspiracy theory, this has been brought to light by Edward Snowden's revelations. Now, we don't know how much of the data on Apple phones gets sent to Apple's servers, so it's not literally everything on your phone, but at least everything that's backed up remotely, and possibly more.

So, pot calling the kettle black.

---

*"to curb the abuse of state-sponsored spyware"*

Note that Apple is not saying "to prevent", only "to curb". But even worse than that, they're saying "curb abuse", not "curb use", as though that type of state spying is not inherently abusive.

---

*"State-sponsored actors like the NSO Group spend millions of dollars on sophisticated surveillance technologies without effective accountability. That needs to change,"*

Apple has a larger R&D budget than most world states. In fact, Apple themselves probably spend more money on sophisticated surveillance technologies than half the world's states combined. Certainly if we count things like dynamic image analysis from all those cameras on phones and cars and such. Why is it an unaccountable foreign corporation better than a government? They're both pretty bad.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#203

Post by einpoklum »

tzahifadida wrote: post #129

If you think that israel is doing anything not sanctioned by the US government you are mistaken. In Israel NSO cant make a move without 7 agencies regulating it. This is considered a weapon sale. The same weapons the US are sponsoring israel and buy them from israeli industry. There is no way NSO will fail from this. So eula or whatever these are matters between states for national security interests.

Actually, the US allows Israel quite a bit of leeway in its underhanded weapons and security services trade. There was that time when Israel almost sold AWACS systems to China:

https://nationalinterest.org/blog/buzz/israel-wont-sell-awac...

so, the sale didn't go through due to US pressure, but the point is that Israel not only contemplated it, but was going to carry it through.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#204

Post by VWWHFSfQ »

jjcon wrote: post #195
shmatt wrote: post #146

Earlier quoted context omitted.

Yes, the many US government 3 letter agencies would love to have full read access to every single iPhone in the world. It doesn't mean Apple needs to comply, or that doing so without a search warrant is legal in California

>the many US government 3 letter agencies would love to have full read access to every single iPhone in the world They 100% already do

Baseless speculation is not useful here. Especially when it's toned as some kind of truth.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#205

Post by AnthonyMouse »

eganist wrote: post #175
phkahler wrote: post #167

Earlier quoted context omitted.

>> They are just using the EULA as the basis for claiming jurisdiction. IANAL but it's always seemed to me that if I reject the terms of a EULA then the EULA doesn't apply to me. Pushing the "button" does not mean anything because only the EULA gives it meaning and I reject that. 50 years from now if someone is doing software archaeology and they go to install some software from a long gone company, who does clicking…

> 50 years from now if someone is doing software archaeology and they go to install some software from a long gone company, who does clicking the button form an agreement with? Will it be legal to try that software? Can existing software companies list people they have click-through agreements with? These things seem like a bad joke in practical terms. I mean, this seems pretty easily addressed: I can't sign a contra…

There are some practical problems with this.

Suppose that Small Co sells the assets of a business unit to Big Co. Do you now have a contract with Small Co. or Big Co.? Small Co. no longer has the rights to the software. Big Co. may not agree to the terms of the old license.

Suppose someone dies and their assets go to their heirs. Do you now have a contract with the heirs?

What if there are no heirs, so the assets go to the government? Do you now have a contract with the government? I can think of some fun terms to add to a software license from someone on their deathbed if that's the case.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#206

Post by ethbr0 »

freejazz wrote: post #201
ethbr0 wrote: post #159

Earlier quoted context omitted.

18 U.S.C. § 1030(e)(11) https://www.law.cornell.edu/uscode/text/18/1030 "(11) the term “loss” means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of servic…

They'd have to prove that Apple was negligent to sell software with flaws, but that's gonna be tough considering that much software has flaws.

Agreed. I'd assume that's what the large number of words related to "Apple demonstrates an outstanding security record, etc etc" is aimed at. And it's a fair argument: nothing is bugless.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#207

Post by AnthonyMouse »

LogonType10 wrote: post #162
brutal_chaos_ wrote: post #147

Earlier quoted context omitted.

Nit (maybe moot): > 4) Apple incurred damages […] from expenses related to mitigating the hacking of their users. This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway. Put another way, that also sounds like the corporate open source push, "We love open source because we don't have to support it, the community will!"…

>This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway. No, read again, this only refers to damages from unlawful activity. "White hat hackers" need not fear.

Assuming they're lawyers who know every law and don't get skewered by something like DMCA 1201.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#208

Post by SQueeeeeL »

AnthonyMouse wrote: post #205
eganist wrote: post #175

Earlier quoted context omitted.

> 50 years from now if someone is doing software archaeology and they go to install some software from a long gone company, who does clicking the button form an agreement with? Will it be legal to try that software? Can existing software companies list people they have click-through agreements with? These things seem like a bad joke in practical terms. I mean, this seems pretty easily addressed: I can't sign a contra…

There are some practical problems with this. Suppose that Small Co sells the assets of a business unit to Big Co. Do you now have a contract with Small Co. or Big Co.? Small Co. no longer has the rights to the software. Big Co. may not agree to the terms of the old license. Suppose someone dies and their assets go to their heirs. Do you now have a contract with the heirs? What if there are no heirs, so the assets go…

I like how suddenly the intense legal minuate are the most important details of a system as if we're in a contract law class, as opposed to the obvious point that in general these agreements are fairly obvious

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#209

Post by suthakamal »

I think the most important part of this announcement (I cried genuine tears of joy when I read it) is that Apple is committing to give Citizen Lab whatever they need. That kind of internal access to Apple's people and infrastructure is tremendous.

I've never heard anyone but a despot (or vendor to despots) claim anything untoward about Citizen Lab, it sure seems like they're genuine "good" folks. They do great work, and they'll do better with support and access. The announcement makes it sound like Apple is willing to offer similar support to other good actors. I imagine Apple putting the word out will yield a few more.

It raises - again - the question of what we expect from big companies vs governments, and questions of sovereignty. Where's the line between supporting good work and cyber vigilantes (if it's not a thing today, it will be, and what will society's place be with respect to them)?

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#210

Post by ethbr0 »

kmonsen wrote: post #193
ethbr0 wrote: post #191

Earlier quoted context omitted.

In what sense?

In the sense that new laws are really difficult to do in the age of polarization. So instead the executive branch issues orders and the judiciary interprets laws in creative ways.

H.R.3684 (aka "Infrastructure Investment and Jobs Act" aka "INVEST in America Act" aka "the Infrastructure Bill") passed the House 221/201/8 [0] and the Senate 69/30/1 [1].

Admittedly not the best numbers, but not terrible either.

[0] https://clerk.house.gov/Votes/2021208

[1] https://www.senate.gov/legislative/LIS/roll_call_lists/roll_...

Post reply on HN