Live data from Hacker News

UK Government Officials Infected with Pegasus

citizenlab.ca

351–360 of 381 posts

Re: UK Government Officials Infected with Pegasus

#351
post #28

Earlier quoted context omitted.

> Disclaimer : I am a Newcastle fan As-salamu alaykum I reckon the fans of rival clubs will absolutely terrorize you with taunting going forth.

That is par of the course, you are always taunted no matter what your team is or isn’t doing . I would rather be taunted and be in the conversation rather than fade away as a once good club .

> fade away as a once good club

Newcastle were good once? ;-)

Re: UK Government Officials Infected with Pegasus

#352
post #65

Earlier quoted context omitted.

Shots fired! I had to look them up. Today I Learned about one of the earliest football paintings in the world: https://en.wikipedia.org/wiki/Sunderland_A.F.C.#/media/File:... That is pretty neat actually. I don't really follow football but I do enjoy the shit talking. This seems like a fun team to root for actually :)

USA chiming in here to point out that the name of the sport is pronounced "soccer".

To be clear, the above was meant as satire. Maybe not a good example of the form though.

Re: UK Government Officials Infected with Pegasus

#353
post #14

Earlier quoted context omitted.

> And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable.

Could these agencies enumerate some phone models / sw versions that are vulnerable to Pegasus and just blast email the govt folks "if you got one of these it's vulnerable, upgrade to new hardware or software { list of phones without known vulnerabilities here }"?

Well, what if the lists got leaked, and the secret services no longer can spy on the electorate with these tools? /s

Re: UK Government Officials Infected with Pegasus

#354

There is a point being totally missed in this thread and that is the UK government basically ignore all security common sense and do absolutely incomprehensible things like discuss national security over WhatsApp and Zoom, as a British citizen, in my eyes this absolutely amounts to treason as they're knowingly potentially giving away state secrets, anyone else would be instantly jailed. UK government and any departme…

The problem isn't a technological one arguably though, and that's why all purely technical solutions are probably doomed to failure.

A huge part of the reason senior government figures around the world often choose to use WhatsApp or Zoom is to avoid or reduce exposure to the statutory recording requirements using the "official" comms channel would entail. The UK in particular has had serious chilling effects on government due to the fear that email or official communications will later embarrass you following publication under Freedom Of Information laws. This isn't a hypothetical - FoI journalism is a real thing in the UK and a source of a huge number of stories that can embarrass the Government of the day.

As long as the official channels are subject to strong public disclosure laws that allow the media relatively easy access to many government communications, politicians will seek devices that allow them to communicate "privately" even if that means adopting less secure devices and services. The "threat" they see is FoI/embarrassment in press a lot of the time, not the State level Cyber attacker.

I'm not defending this practice, but I can understand why it happens. I've even seen NHS employees (state employed drs in the UK health service) avoid saying things in meetings for fear of the later FoI reveal if the meeting minutes are published.

Re: UK Government Officials Infected with Pegasus

#355
post #230

Earlier quoted context omitted.

> Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable. I hear you, but I would contest that they're not at liberty to ignore them. If pizza delivery drivers consent to obligations to carry issued and configured devices while on duty by what exceptionalism is Downing Street excused? Secondly, I'd say that they may make themselves unprotectable, but…

I don't think you really want a world where the security services can overrule the elected government, rather than the other way round. However, I'm not one to defend either MI5 or Johnson here. MI5 routinely surveil anyone to the left of the Tory party as being some kind of dissident. The Johnson government is notorious for ignoring any kind of rules, restraint, or best practice. If they had something to say about i…

> I don't think you really want a world where the security services can overrule the elected government, rather than the other way round.

Well said, and excellent point. But I would like to live in a world where security services could professionally, and in good faith, advise other public servants, who would professionally, and in good faith heed that advice. As I understand it that fits the actual job description for all parties.

A world in which public servants are adversaries, in which intra- and inter-institutional trust has totally broken down seems to be the fruits of the misadventure, over-reach and disrespect for the Rule of Law in all quarters.

Re: UK Government Officials Infected with Pegasus

#356

Earlier quoted context omitted.

The difference is NSO control the Pegasus servers. They know who is using their tools and who is being targeted. This isn’t the same as untraced weapons.

I'm not challenging your assertion, I'm genuinely looking for backing evidence here. Do you have evidence that NSO knows who is being targeted by the tools they sell?

What "evidence" are you looking for? Proof that humans manage the NSO servers?

Re: UK Government Officials Infected with Pegasus

#357
post #337

Earlier quoted context omitted.

> It was also running windows… Nothing wrong with this choice. The rest of your point still stands though.

It’s just that windows is quite a bit more complex and vulnerable compared to much simpler and security focused OSs like a BSD back then or maybe Alpine Linux these days.

That's the point of the system I described. Vulnerabilities of the automated system don't matter. You verify the manual result and the digital result are the same.

Re: UK Government Officials Infected with Pegasus

#358

I'm surprised this isn't a major diplomatic incident between the UK and Israel too, since the Israeli intelligence company was supposedly "closely monitoring how their customers were using the software" or akin to that. Like, yeah, blame the UAE mostly for this but let's also have a discussion about why this was sold to anyone who would pay with no oversight at all. Western countries need to do better.

> Western countries need to do better Yeah, I agree. The western nations which built their lead through brutal colonialism and presently maintain that lead with neo-colonialism structures where brutal governments (Saudi Arabia, Israel, UAE) do the dirty work which they (western countries) ostensibly condemn. How about this: let’s have the western countries leave the world alone. Let’s have the western countries aband…

And affect my style of living? No thanks, I'll stayas i am and keep my blind eyes turning.

Re: UK Government Officials Infected with Pegasus

#359
post #305

Earlier quoted context omitted.

We would need some voting system where each person can verify that their vote was properly counted, something like this: secure end-to-end verifiable e-voting system using zero knowledge based blockchain: https://eprint.iacr.org/2018/466.pdf

We should never consider any voting system that is not simple to the point of being almost-trivial. Anything even slightly more complex than necessary will lead to accusations of cheating which are enough to create massive instability - even when they are provably false. We see this even with the current election systems! Since there's no simple way to explain 'blockchain' to non-tech people, any voting system using…

> Anything even slightly more complex than necessary will lead to accusations of cheating

The zero-knowledge proof avoids that...

Even with paper ballots, there's no way to verify that your vote was counted.... as far as I know

Re: UK Government Officials Infected with Pegasus

#360
post #62

I'm surprised this isn't a major diplomatic incident between the UK and Israel too, since the Israeli intelligence company was supposedly "closely monitoring how their customers were using the software" or akin to that. Like, yeah, blame the UAE mostly for this but let's also have a discussion about why this was sold to anyone who would pay with no oversight at all. Western countries need to do better.

The current home secretary, Priti Patel, was forced to resign from her previous (lesser) role as Minister for International Development for secretly (and thus illegally) meeting with Israeli diplomats. https://www.bbc.co.uk/news/uk-politics-41923007 It is completely unsurprising that there is little care shown by our government.

Also unsurprising in view of even more egregious incidents from the past: Shai Masot, the Israeli embassy official at London, caught on camera in 2017 talking about 'hitlist' of members of parliament, including Foreign Office Minister Sir Alan Duncan, a vocal supporter of Palestinian state [0]. And that led to a slap on the wrist. A comparison of reactions to related incidents involving different parties is revealing [1].

[0] https://www.haaretz.com/israel-news/israeli-embassy-rep-caug...

[1] https://www.middleeastmonitor.com/20220214-espionage-is-a-di...

Post reply on HN