Senator Wyden demands deep probe into NSO Group after spyware-hacking toolkit offered to American cops
(2020/05/13)
- Reference: 1589407025
- News link: https://www.theregister.co.uk/2020/05/13/senator_calls_for_congressional_investigation/
- Source link:
A prominent senator has called for “aggressive oversight” into the sale of the NSO Group's hacking-and-spying tools to police forces in America.
Senator Ron Wyden (D-OR) was reacting to Vice's [1]discovery of a brochure by the US subsidiary of the controversial NSO Group, called Westbridge Technologies, that pitched its Pegasus technology, rebadged as Phantom, to a police force in San Diego, California. This is despite the NSO Group [2]claiming in court filings two weeks ago that it had no US operations.
“Government hacking is among the most invasive forms of surveillance - tracking someone’s movements, turning on their webcam and microphone, or accessing photos and other sensitive data on a phone or computer,” Wyden said in a statement to The Register .
“These tools are ripe for abuse, for example, by a law enforcement officer to spy on an ex. Congress must conduct aggressive oversight into the proliferation of these spying technologies and their use by state and local agencies.”
The reference to spying on an ex-partner relates to [3]claims that an employee of NSO Group who was caught using the firm’s technology to spy on a woman they were interested in romantically. The employee was fired.
Spyware slinger NSO to Facebook: Pretty funny you're suing us in California when we have no US presence and use no American IT services... [4]READ MORE
NSO Group has become synonymous with state-sponsored spying thanks to its software being used by a number of authoritarian governments to stamp out dissent. The Pegasus/Phantom tool was reportedly used by Saudi Arabia to target and ultimately murder journalist Jamal Khashoggi. It may also have been used to hack the phone of Amazon CEO Jeff Bezos.
Now only use it for good things, ok?
NSO says its spyware should only be used to combat terrorism or serious crime, but it has repeatedly been discovered on the phone of journalists, activists, and political dissidents across the globe. Facebook is also [5]suing the Israeli company for targeting users of its WhatsApp messaging service.
Typically, a device is infected with the surveillance-ware via a software vulnerability exploit. For example, a booby-trapped message, when opened on a phone, exploits a weakness in the device's applications or operating system to trigger the execution of code smuggled inside the message, leading to the installation of the malware.
In the case of Jeff Bezos, a [6]WhatsApp chat message from the Crown Prince of Saudi Arabia, Mohammad bin Salman, with a video that he said was some kind of promotional video for telecommunications is suspected to be the route by which the spyware was downloaded onto his phone.
Once Pegasus/Phantom is on a phone or computer, it can track location, read texts, emails and social media posts, download videos and photos held on the device and turn on its camera and microphone. The risk posed by the software is such that the United Nations representatives have repeatedly condemned its use.
The fact that NSO Group is now specifically peddling its wares to US police forces – albeit through a different company and product name – is alarming given the enormous resources often available to America's cops and limited oversight and accountability.
A US police force should require a warrant to use the software, especially given recent Supreme Court decisions over the contents of mobile phones, but, again there is little or no insight into whether that is happening and what uses the technology is being put to.
There have been numerous examples of where local police forces have used computer tools made available to them in highly inappropriate ways, the most memorable perhaps being when police in Maryland used controversial cellphone-tracking technology that is intended only for the most serious crimes to track down a man who [7]stole $50 of chicken wings . ®
Sponsored: [8]Choosing A Low-Code Vendor
[1] https://www.vice.com/en_us/article/8899nz/nso-group-pitched-phone-hacking-tech-american-police
[2] https://www.theregister.co.uk/2020/05/01/nso_whatsapp_california/
[3] https://www.vice.com/en_us/article/bvgwzw/nso-group-employee-abused-pegasus-target-love-interest
[4] https://www.theregister.co.uk/2020/05/01/nso_whatsapp_california/
[5] https://www.theregister.co.uk/2020/05/01/nso_whatsapp_california/
[6] https://www.theregister.co.uk/2020/01/22/saudi_bezos_phone_hack/
[7] https://www.theregister.co.uk/2016/05/04/cops_deploy_antiterrorist_tech_against_50_chickenwing_thief/
[8] https://go.theregister.co.uk/tl/1936/-8579/choosing-a-low-code-vendor?td=wptl1936
Senator Ron Wyden (D-OR) was reacting to Vice's [1]discovery of a brochure by the US subsidiary of the controversial NSO Group, called Westbridge Technologies, that pitched its Pegasus technology, rebadged as Phantom, to a police force in San Diego, California. This is despite the NSO Group [2]claiming in court filings two weeks ago that it had no US operations.
“Government hacking is among the most invasive forms of surveillance - tracking someone’s movements, turning on their webcam and microphone, or accessing photos and other sensitive data on a phone or computer,” Wyden said in a statement to The Register .
“These tools are ripe for abuse, for example, by a law enforcement officer to spy on an ex. Congress must conduct aggressive oversight into the proliferation of these spying technologies and their use by state and local agencies.”
The reference to spying on an ex-partner relates to [3]claims that an employee of NSO Group who was caught using the firm’s technology to spy on a woman they were interested in romantically. The employee was fired.
Spyware slinger NSO to Facebook: Pretty funny you're suing us in California when we have no US presence and use no American IT services... [4]READ MORE
NSO Group has become synonymous with state-sponsored spying thanks to its software being used by a number of authoritarian governments to stamp out dissent. The Pegasus/Phantom tool was reportedly used by Saudi Arabia to target and ultimately murder journalist Jamal Khashoggi. It may also have been used to hack the phone of Amazon CEO Jeff Bezos.
Now only use it for good things, ok?
NSO says its spyware should only be used to combat terrorism or serious crime, but it has repeatedly been discovered on the phone of journalists, activists, and political dissidents across the globe. Facebook is also [5]suing the Israeli company for targeting users of its WhatsApp messaging service.
Typically, a device is infected with the surveillance-ware via a software vulnerability exploit. For example, a booby-trapped message, when opened on a phone, exploits a weakness in the device's applications or operating system to trigger the execution of code smuggled inside the message, leading to the installation of the malware.
In the case of Jeff Bezos, a [6]WhatsApp chat message from the Crown Prince of Saudi Arabia, Mohammad bin Salman, with a video that he said was some kind of promotional video for telecommunications is suspected to be the route by which the spyware was downloaded onto his phone.
Once Pegasus/Phantom is on a phone or computer, it can track location, read texts, emails and social media posts, download videos and photos held on the device and turn on its camera and microphone. The risk posed by the software is such that the United Nations representatives have repeatedly condemned its use.
The fact that NSO Group is now specifically peddling its wares to US police forces – albeit through a different company and product name – is alarming given the enormous resources often available to America's cops and limited oversight and accountability.
A US police force should require a warrant to use the software, especially given recent Supreme Court decisions over the contents of mobile phones, but, again there is little or no insight into whether that is happening and what uses the technology is being put to.
There have been numerous examples of where local police forces have used computer tools made available to them in highly inappropriate ways, the most memorable perhaps being when police in Maryland used controversial cellphone-tracking technology that is intended only for the most serious crimes to track down a man who [7]stole $50 of chicken wings . ®
Sponsored: [8]Choosing A Low-Code Vendor
[1] https://www.vice.com/en_us/article/8899nz/nso-group-pitched-phone-hacking-tech-american-police
[2] https://www.theregister.co.uk/2020/05/01/nso_whatsapp_california/
[3] https://www.vice.com/en_us/article/bvgwzw/nso-group-employee-abused-pegasus-target-love-interest
[4] https://www.theregister.co.uk/2020/05/01/nso_whatsapp_california/
[5] https://www.theregister.co.uk/2020/05/01/nso_whatsapp_california/
[6] https://www.theregister.co.uk/2020/01/22/saudi_bezos_phone_hack/
[7] https://www.theregister.co.uk/2016/05/04/cops_deploy_antiterrorist_tech_against_50_chickenwing_thief/
[8] https://go.theregister.co.uk/tl/1936/-8579/choosing-a-low-code-vendor?td=wptl1936
"should only be used to combat terrorism or serious crime"
Pascal Monett
No contradiction there. Being a journalist is a serious crime in most dictatorships.
Oh really?
“These tools are ripe for abuse, for example, by a law enforcement officer to spy on an ex. Congress must conduct aggressive oversight into the proliferation of these spying technologies and their use by state and local agencies.”
Well, welcome to 2020! Here's your standard brochure of all the hottest places to hear "No shit!", and this is a bracelet for VIP members. You show this at the door and the bouncer says: "Yeah, we know. We all fucking know. Where the hell have you been?".
How about this: when you guys in congress say stuff like this, and then act like fucking adults afterwards and take actions or follow through on proposed soutions that aren't just shrugs, hopes, prayers, and commiserative let's-do-fuck-alls, people will start to act like your indignation means something.