NSO Group’s Pegasus Spyware Used Against US State Department Officials

NSO Group’s descent into Internet pariah status continues. Its Pegasus spyware was used against nine US State Department employees. We don’t know which NSO Group customer trained the spyware on the US. But the company does:

NSO Group said in a statement on Thursday that it did not have any indication their tools were used but canceled access for the relevant customers and would investigate based on the Reuters inquiry.

“If our investigation shall show these actions indeed happened with NSO’s tools, such customer will be terminated permanently and legal actions will take place,” said an NSO spokesperson, who added that NSO will also “cooperate with any relevant government authority and present the full information we will have.”

Posted on December 13, 2021 at 6:16 AM66 Comments


Peter A. December 13, 2021 7:14 AM

US government uses Pegasus to spy on someone – good
US government is spied on by someone using Pegasus – bad

Ted December 13, 2021 7:42 AM

I apologize for going broad before I go specific here. But I just learned of a good book through a recent ‘On Point’ podcast.

The podcast episode was titled ‘Why the U.S. is cracking down on international spyware.’

Steven Feldstein was one of the guests. He is a senior fellow at the Carnegie Endowment for International Peace. He is also the author of the 2021-published book “The Rise of Digital Repression.”

I just stated reading the book.

What I found interesting at the start was this:

There is a growing consensus that the world is experiencing a “third wave of autocratization.”

[…] 92 countries or 54 percent of the world’s population currently live under authoritarian rule.

I don’t think the risks of autocratization are being overstated. Technology offers a HUGE (and to many an irresistible) platform on which to express their highly-competitive drive for dominance.

I also think it helps to have some context as note-worthy stories continue to pepper the news.

***Does anyone else recommend any good books or podcasts on these topics?

Citizen Lab’s John Scott-Railton is also an important guest on the episode, with much good information to share.


Humdee December 13, 2021 10:25 AM


I have been saying for the last decade that we have entered a new age of autocracy. It is vital to grasp, however, that this autocracy is not based in traditional notions of dominance such as a monarchy, noblism, etc. Rather it hearkens back to the ancient Roman notion of the Praetorian Guard. I was unsurprised to find in the bowels of the organizations sponsoring 1/6 an organization that included just that name. Trump fancies himself an Augustus but in reality he is more Claudius. Putin represents the vanguard of this historical movement. It is a new world order based upon “what have you got on me;” a rule based upon fear rather than aspirations.

America dodged a bullet this past winter but never mistake the battle for the war. Trump failed for now but he or others will try again, make no mistake. The purveyors of surveillance capitalism such as Facebook and Apple don’t give a crap who their masters are so long as they can return value to their shareholders. Everyone needs to grasp that Bitcoin and other cryptocurrencies are not a bet on the future of America, they are a bet upon what will happen in the West when a democratic America is no more and the dollar cannot maintain its status as a reserve currency. A new kind of autocracy needs a new kind of currency; Bitcoin is it.

The historical movement is much deeper and broader than “digital repression”. That’s just a tool of the trade.

Clive Robinson December 13, 2021 10:39 AM

@ Bruce, ALL,

We don’t know which NSO Group customer trained the spyware on the US. But the company does.

Does it realy matter, due to the old “If not Peter then Paul” principle.

That is it was inevitable it was going to happen the only question in reality is,

“Why has it taken so long?”

It’s a logical result of having such a market exist, people aquire product, people use product. The fact it gets used by people A on people B is fairly irrelevant especially when people B have been doing similar not just on people A and C through Z but also on citizens of B as well…

The things most people have not twigged though is,

1, This is an arms race.
2, The war started last century.

The war may not be directly kinetic, but it’s definitely being faught.

Most here are aware that NOBUS does not work with back doors because,

“As any enginer knows, any exploit is a total exploit”

People have not realised that NOBUS is a compleatly false idea that is,

“As any observer of history knows, any idea with utility becomes a global idea, you can not stop it”.

The best you can hope for is a slim lead, but as technology improves that lead gets slimmer and slimmer, untill it’s gone.

Like it or not the market for such products as NSO supply is high, between 10-20% of the population in Western Nations would by and use such software on each other without the blink of an eye…

It’s just the way that “aberrant people” think and behave, worse they also believe they are “entitled” to do so…

Winter December 13, 2021 10:40 AM

“Rather it hearkens back to the ancient Roman notion of the Praetorian Guard.”

Nah, simply 1920/1930’s fascism and 1950/1960’s apartheid/segregation. White males feeling entitled to their dominant position and using violence to force it upon the rest of society.

Ted December 13, 2021 10:46 AM

@William Entriken

Including the players’ manual for Shadowrun



The historical movement is much deeper and broader than “digital repression”. That’s just a tool of the trade.

Good point. But it’s here now. And for some it’s really bad.

Did you see our conversations this last weekend? Repressive government puts camera in toilet?

“The Pegasus Project: Life for Khadija Ismayilova in Azerbaijan’s Digital Autocracy”


Impossibly Stupid December 13, 2021 12:18 PM


I don’t think the risks of autocratization are being overstated.

I don’t think they can reasonably be called risks. It’s the people who want this, and they tend to find the rulers that will give it to them. And it’s nothing new; even Hitler was democratically elected. Don’t focus on the leaders when it’s the followers who are the larger problem.


Everyone needs to grasp that Bitcoin and other cryptocurrencies are not a bet on the future of America, they are a bet upon what will happen in the West when a democratic America is no more and the dollar cannot maintain its status as a reserve currency.

Were that true, cryptocurrencies would move in opposition to the western economy. It does not appear to be doing that, so pick a new thesis. Try this one: the rise of digital assets are just a further sign of late-stage capitalism, because inequities have resulted in few people having any hope left for establishing real wealth.


White males feeling entitled to their dominant position and using violence to force it upon the rest of society.

Yes, that’s why no women have supported or voted for any of the recent crop of white male authoritarians… Anyone who still thinks the patriarchy is part of the problem is part of the problem. Same goes for racism. The real problem is that too few people are introspective enough to see what is awful in themselves, and thus fail to recognize it in the people around them.

And so we can circle back to the actual topic at hand: the NSO Group. I see no reason why they wouldn’t be surrounded by awful people. It doesn’t even matter where the targets might be located. It’s all about the mindset of who could possibly be their customer.

Ted December 13, 2021 12:28 PM


From the Reuters Article:

hit U.S. officials either based in Uganda or focused on matters concerning the East African country

So do we postulate that it was the Ugandan government that placed the spyware?

Wasn’t it @Izzy who posted the WaPo article that had a tweet from Ugandan politician Norbert Mao? That tweet:

When you wake up to a threat notification from @Apple that your iPhone is being targeted then you know that cyber terrorism from state sponsored cyber terrorists is real.


I like this later tweet from him:

Thank you @cnni for bringing @TimothyDSnyder to speak to us about threats to democracy today. What was said about Orwell’s 1984 by a reviewer can be said of @TimothyDSnyder’s work: His work “…has made us desire freedom more earnestly (and) loathe tyranny with such fullness.”


Wikipedia said this on the Ugandan government:

Transparency International has rated Uganda’s public sector as one of the most corrupt in the world. In 2016, Uganda ranked 151st worst out of 176 and had a score of 25 on a scale from 0 (perceived as most corrupt) to 100 (perceived as clean).


Freezing_in_Brazil December 13, 2021 1:25 PM

@ Hummdee


blockquote>Bitcoin and other cryptocurrencies are not a bet on the future of America, they are a bet upon what will happen in the West when a democratic America is no more and the dollar cannot maintain its status as a reserve currency. A new kind of autocracy needs a new kind of currency; Bitcoin is it.

Agreed. Considering that what lies ahead is a technological dystopia, Bitcoin seems quite a natural fit for it.

Every way you look at the global pandemonium you talk about, you can see the signature of social media. The current state of affairs can be directly mapped to the rise of the “web 2.0“, notably social media. It is the source of all current cultural and political conflicts and misunderstandings, besides the decline in scientific thinking and the explosion of superstition. It is necessary to act quickly against further deterioration of the social environment. There is no doubt that social media is the primary cause of the collapse of public dialogue and eventually the collapse of democracy itself. We need to contain them, somehow. Contain Meta. Contain the mediating algorithms of human interactions. Is is already late, but we still can rebuild what has been lost. We have must act NOW.

Ted December 13, 2021 2:21 PM

Did you guys see this from Slashdot?

“Spyware Firm NSO Mulls Shutdown of Pegasus Unit, Sale of Company”

“The prospective new owners include two American funds that have discussed taking control and closing Pegasus, one of the people said. Under that scenario, the funds would then inject about $200 million in fresh capital to turn the know-how behind Pegasus into strictly defensive cyber security services, and perhaps develop the Israeli company’s drone technology, one of the people said.”


What do you all think of this? Strictly defensive? What does that even mean?

Clive Robinson December 13, 2021 3:55 PM

@ Ted,

What do you all think of this? Strictly defensive? What does that even mean?

Horse apples…

Think of it as,

“malware -v- Antivirus”

Nobody buys the defencive AV software unless there is a very real malware threat at quite significant level.

NSO is in effect a big pusher of “malware” and it’s been very profitable for them as it was a lucrative niche market with eye wateringly expensive product with few direct costs so very high return.

As we know AV software is almost given away these days and even then people just don’t buy it…

After all do you have AV software on your phone or other Smart Devices? Probably not, few do and they would not want to pay more than a couple of bucks for it “through the store”.

But AV software is a tale of two sides… For AV to work it is said it has to get into the very heart of your device, and effectively own it. It is in effect little diferent to malware or ransomware in where it gets in only the payloads differ slightly.

Which means AV software adds significant vulnerability vectors to your device as well as “ET Phone Home” loading of files upto the “mother ship” etc. Remember what was said about Kaspersky AV and the Russia state allegedly looking over it’s shoulder?

Hence the latest “want” by the West’s Guard Labour is not for “golden key front doors”, “NOBUS backdoors” or what ever they call then today. No they want full unfettered “end point access”. That is full access on your system to run file scanning and the like just ad AV software does. That “Cop-tag” CSAM system Apple is talking about is just the very thin leading edge of what the Guard Labour want.

After all working at what is below the OS level, it gets access to everything the user does.

Have a search back about the CarrierIQ software that was sending every key press back to their Internet based servers in “plaintext” as I said at the time, I would have thought the NSA was sitting at the “first upstream router” doing “collect it all”.

As a trove of inteligence there is very very little difference between spyware and what CarrierIQ were doing, and when you throw in the file scanning and upload features of AV software… It’s the “total surveillance” wet dream of the Guard Labour…

Have a think about it, it’s almost certainly comming to the next over priced Smart Phone or Device you might buy, with Apple being just that little bit more honest about it than others will be…

But you can be certain of one thing if money can be made from selling that sort of “back door” access then NSO will get into it because that’s the soul of their organisation to get maximum value out of stolen privacy, be it directly or as a facilitator.

If I was “being evil” rather than “thinking how” to be evil, it’s what I would do.

Think “hinky” then maybe you can stay ahead, or atleast keep it on your shoulders…

vas pup December 13, 2021 3:59 PM

The technology helping keep women safe on the streets

“At the University of Bath, researchers are trying to solve the problem of safety products which are difficult to physically activate. They are developing a women’s smart watch app called Epowar which would automatically send alerts if it senses the user is in distress – by monitoring heart rate and body motion.

Co-founder, student E-J Roodt, said the idea came to her while jogging in a badly-lit park, and worrying about the risk of an attack.

“When I saw that smart watches were being used to detect heart attacks I thought, well, maybe that technology could be applied to women’s safety,” she said.

Although the sample size is small, the app uses artificial intelligence to recognize distress, and responds if a user is attacked when walking or running alone.”

“Founder of the bSafe app for smartphones, Rich Larsen, believes his technology could help bring about prosecutions.

It has an emergency alarm feature which is voice-activated. It then automatically starts live-streaming video and audio to chosen contacts, and records everything that is happening.

Mr Larsen said: “These recordings could be used in evidence in court cases – like rape – which are often hard to prove.”

“Paladin, the national anti-stalking advocacy service, says tech firms need to do more to protect victims if tech is misused.

Rachel Horman-Brown, chairwoman of the charity, said: “Many victims are tracked and monitored through their phones or tablets by spyware.

“So actually stalkers don’t even need to physically get a tracking device on the victim to be able to monitor them.

===> [still only talking, not action]”Spyware is concerning as it can enable a stalker to switch on the camera on a victim’s mobile phone, so that they can see and hear what is happening. They can also read and send text messages from the victim’s phone, as well as tracking their whereabouts.”

Clive Robinson December 13, 2021 5:05 PM

@ Ted,

The history of Uganda is a long and sorry one and there was even a film “The King of Scotland” about one of it’s leaders in the 1970’s who many believe was a cannibal.

Bad as it sounds today, it is actually an improvment. However technology appears to be now turning the clock back.

In the past as a dictator or tyrant what you could do was limited by others a point Stalin understood hence his purges.

Technology now alows the sort of surveillance by just a handfull of people that only very very few were subject to half a century ago due to the human resources required.

It was why people could escape Erich and Margot Honecker’s East Germany and it’s eventual fall at the end of the 1980’s as those large numbers of “human resources” effectively turned on the regime[1]. With modern technology the human resources needed are minimal and don’t need to be that smart. So they can be selected for loyalty rather than ability and they in turn can be better watched by technology.

I suspect the fall of East Germany is the last we will see of that type of social liberation. Simply because of technology, in those faux cries of freedom from terrorism early this century, we have built around us not a Castle we can defend, but a Prison in which we are observed thus can be oppressed in every thought and deed.

[1] I have a lump of concrete with spray paint on it, that came from the Berlin wall, knocked out with a rather nice West German hammer, to remind me of what can happen if society is alowed the freedom to act.

Ted December 13, 2021 5:17 PM


But AV software is a tale of two sides…

Beautifully said Clive. I was doing a little search on NSO and came across another Lawfare podcast that discusses Apple’s lawsuit against NSO.

It’s sort of a follow up on Lawfare’s Lubin-Kerr podcast, with some semi-interesting commentary. (Hearing a candid plan-of-approach from Apple’s lawyers would probably be the most interesting.) I am a little frustrated that I don’t understand some+ of the details, but oh well.

However they said much the same thing you did (ie: a tale of two sides) as Apple helped provide law enforcement with access, but then these vulns were later exploited by various groups. And how.

But you can be certain of one thing if money can be made from selling that sort of “back door” access then NSO will get into it

I only hope that a Democratically-aligned coalition (generally speaking) secures access to the Pegasus infrastructure and nails down it’s Flagrant (with a capital F) violations, and keeps it out of the hands of parties who work against our collective interests.

It will be interesting for many to watch I’m sure. The money, and the mechanics, and the drones(?), etc.

Thanks much for your thoughtful response! So greatly appreciated 🙂

Rational Security 2.0: “Apple Bites Back”
‘What might this mean for the future of private sector hackers?’

Ted December 13, 2021 5:38 PM


The history of Uganda is a long and sorry one and there was even a film “The King of Scotland”

Movies and podcasts are a nice change-up from reading. That sounds like a really interesting movie to watch. I was just listening to a bit of Steven Feldstein talking about his book (‘The Rise of Digital Repression’).

He also mentions Uganda, but I couldn’t quite concentrate enough to get all the details.

I don’t know if there will be any quasi-connections to what he talks about and what recently came out in the news in Uganda?

a Prison in which we are observed thus can be oppressed in every thought and deed.


I have a lump of concrete with spray paint on it, that came from the Berlin wall, knocked out with a rather nice West German hammer, to remind me of what can happen if society is alowed the freedom to act.

Yay! My dad somehow got one of those too. It would be special on so many levels for so many people 🙂

ResearcherZero December 13, 2021 10:27 PM

Operatives from Nations States have been buying access to our phone systems and gaining access to our exchanges for quite a long time, so who would of thought that an industry based on selling 0day and privatised surveillance software could go wrong?

I think it was Ronald Reagan who said, “There’s only one part of the world and one philosophy where they have to build walls to keep their people in.”

The clever thing about these walls is that you would hardly notice they are there. The sleek and beautiful design of these shiny devices that keeps our attention transfixed, can be built for less than 1% of labor costs.

“We” has the distinction of being the first novel officially banned in the Soviet Union. Zamyatin’s D-503 is an engineer in a society obsessed with metrics and numbers, living in a time when people literally live in glass houses and are utterly disconnected from nature.

We by Yevgeny Zamyatin (English Translation)

lurker December 13, 2021 11:17 PM


Nah, simply 1920/1930’s fascism and 1950/1960’s apartheid/segregation.

It goes way back beyond the Romans. My reading of Genesis 4:3-5 says it’s a compiler bug. As a bizarre involution fascism and apartheid thought their methods would get rid of the problem.

The Bloomberg story talks of selling off the Pegasus operation, but NSO is bred from hydra, new heads will sprout. All systems, software or governance, devised by humans will have bugs. Get used to it.

Peter A. December 14, 2021 1:41 AM

@vas pup: re: women’s smart watch safety app

What a disgrace! What about men? Aren’t men in danger too in the new Lowly Britain, where carrying a sharpened pencil in public is punishable by life imprisonment? And what about non-hexadecimal etc.?

Ted December 14, 2021 4:55 AM

@lurker, Winter, ALL

My reading of Genesis 4:3-5 says it’s a compiler bug.


The Bloomberg story talks of selling off the Pegasus operation

Yeah Bloomberg said… ”[fresh capital would] turn the know-how behind Pegasus into strictly defensive cyber security services, and perhaps develop the Israeli company’s drone technology”

I don’t really get this, but John Scott-Railton previously tweeted something about NSO Group changing the conversation to drones when the heat turned up on their operations.

Apparently they had been set to deliver the following presentation at a ISS World event on Dec 8:

“Setting Standards in Cyber Technology & Defense”

But when the story broke about about them having spyware on the phones of US state dept. personnel, they changed the presentation to:

“A New Era: Strategic Drone Attacks”

This ISS World Europe event is the same event where FinFisher and BT Security are presenting.

Does anyone see any other eye-catching group presenting at this event?



Wannabe Tech Guy December 14, 2021 7:22 AM

@ Peter-“US government uses Pegasus to spy on someone – good
US government is spied on by someone using Pegasus – bad”
Yes that’s it!

Ted December 14, 2021 7:29 AM

About Uganda…

The book ‘The Rise of Digital Repression’ is 344 beautiful pages. So it will take me a while to nibble through it.

However, in the meantime, there was an interesting tidbit about Uganda.

An excerpt:

“A 2019 investigative report by the Wall Street Journal provides an eye-opening example. Reporters found that Huawei technicians in both Uganda and Zambia helped government officials spy on political opponents.

This included “intercepting their encrypted communications and social media, and using cell data to track their whereabouts.”

Not only did Huawei employees play a “direct role in government efforts to intercept the private communications of opponents,” but they also encouraged Ugandan security officials to travel to Algeria so they could study Huawei’s “intelligent video surveillance system” operation in Algiers.103

Uganda subsequently agreed to purchase a similar facial recognition surveillance system from Huawei costing $126 million—subsidized by Chinese state loans.104


I really don’t know how to put this in the context of the US state dept officials being spied on by NSO. But they level of technical aggression and the ubiquitousness of it still surprised me.

I guess I’ve been out of the loop for a bit. Also did you all hear Kim Kardashian passed the baby bar? Human rights should be getting a boost. She likes that kind of thing.


JonKnowsNothing December 14, 2021 9:02 AM


Movies are not history. Documentaries may contain some history but not all history.

Books are good reads. Some books may contain interesting stories, histories, science and may be entertaining and even educational.

Not all movies and not all books are safe to read. Your reading privileges depend on your location and sometimes your nationality. There are some of both that can land you in a big soup bowl of bother.

Your browsing history and reading habits are well documented. 10,20,40,50 years from now some of that may be problematic. Some of it might be lethal.

Curiosity didn’t really kill the cat.

An old story tl;dr

A farmer and his wife had a new born baby and they left the baby under the watchful eyes of their cat while they worked in the fields.

When they returned and opened the door, the saw the cat sitting in the cradle with blood dripping downs it’s face and licking the side of the baby’s head where the baby had an ear chewed off.

The farmer and his wife, flew into a rage and immediately bludgeoned the cat to death for attacking the baby.

When they closed the door, they saw a dead rat with the baby’s ear in its mouth.

Ted December 14, 2021 9:37 AM


Documentaries may contain some history but not all history

I think that’s a good point. There is a lot that is said. And there is a lot that is not said. As @SpaceLifeForm would say: No signal is signal.

I was listening to Mr. Feldstein talk about his book. And he talks about Rodrigo Duterte (president of the Philippines) and a lot of the communication ‘shaping’ that goes on his country.

Even if these recountances are not ‘the whole truth and nothing but the truth’ at least it’s one place to start. It’s probably good to get a lot of different perspectives.

So, yes, I think that is a very good point.

Clive Robinson December 14, 2021 9:53 AM

@ Ted,

Look into the history of IBM and you will see a lot worse.

And IBM are almost saints in comparison to many US corps.

One IBM trick was, if they were not making a huge over priced sale, because a manager had a sensible head on his shoulders. They would find out who his manager was and phone him up, and denigrate the manager who was not saying “yes”. If that failed they would go to the very top of the company and basically tell him that all the managers were causing his company to be uncompetative or some other nonsense… Any lie no matter how big was used to get a sale…

So there was a reason for the “Snow White and the Seven Dwarfs” monica IBM sales reps go given.

But then look at US “Chemical companies” and after poisoning the US got kicked out abroad to kill with cancer and worse… Look up the likes of Bophal disaster where Union Carbide, poisened over a half million people killing over 20,000 of them with the rather nasty chemical”methyl isocyanate” a cyanide that is considered highly toxic and has a very low LD50 LC50 and significant long term effects there is no known antidote. It can be used as a “chemical warfare agent” and is classified as either a “tearing agent” or “choking agent”. In effect Ubion Carbide tried “walking away” from the disaster with ludicrous claims of “sabotage” rather than negligent managment and cost cutting on maintainance. But when you consider the number effected the payment made by Union Carbide was small very small indeed…

Some one mentioned Pinochet the other day, well it was US metal Corps through the CIA that put him in charge and kept him there, not the first or the last time…

For years the CIA at the behest again of politically affiliated corporations tried to assasinate Castro in Cuba with increasingly ludicrous plots. On involved cyanide capsules smuggled in “face cream” such was the CIA competence that they failed to check if the capsules would disolve in the face cream… To which the answer was “yes, easily so”…

The list is long and the news is comming out that Australia has been doing similar to the CIA thoigh probably not as well…

Denton Scratch December 14, 2021 12:08 PM

hit U.S. officials either based in Uganda or focused on matters concerning the East African country

Uganda is in West Africa.

Ted December 14, 2021 3:08 PM

@Clive, SpaceLifeForm, ALL

And IBM are almost saints in comparison to many US corps.

What do you think about this presentation / company at ISS World?

Wednesday, 8 December 2021
Intelligence IoT: Networked Tactical Intelligence
Presented by Ateros

I can’t find anything yet on Ateros, but there is a company called Aternos? Did they mean Aternos?


vas pup December 14, 2021 3:10 PM

When the government hides spy cameras on your land, fight back in court

“Although the case is proceeding in state court under the authority of the Tennessee Constitution, the central claims point to a nationwide problem. Starting about 100 years ago, federal courts began chipping away at the Fourth Amendment to the U.S. Constitution, which guarantees “the right of the people to be secure in their persons, houses, papers, and effects.”

One of the first setbacks came in 1924 during Prohibition, when the Supreme Court held that government agents could hide on private land to see if someone was brewing or selling alcohol. In one fell swoop, all constitutional protections for most private land in America vanished. The focus shifted to narcotics during the War on Drugs, but the “Open Fields Doctrine” has remained in effect.

The so-called “Third-Party Doctrine” represents another setback. This judge-made law, which the Supreme Court invented in 1976, strips away Fourth Amendment protections for any information that a person voluntarily turns over to third parties.

Examples include bank deposits, debit card transactions, telephone numbers and website addresses. Essentially, anyone who lives in the modern world must waive Fourth Amendment rights.

Many business owners also lose protections at work. Code enforcers typically need a warrant to inspect warehouses and backroom areas closed to the public, but the Supreme Court created an exception to the warrant requirement in 1970 for what it called “closely regulated” industries.

he high court has applied the exception to just four industries with long histories of rigorous government oversight: liquor, firearms, mining and junkyards. But lower courts have expanded the narrow exception to the breaking point.

Local and state regulators now use the “Closely Regulated Industry” excuse to look for civil code violations at all manner of ordinary businesses, including restaurants, day cares, construction sites, credit unions, pawnshops, banks, health care facilities, nursing homes, insurance offices, grain silos, truck yards, taxidermy shops and even rabbit breeding facilities.”

Read the whole article! It is just remind me how NKVD said in Russia: You have Constitution, but we have our instructions.
Unfortunately, latter always prevail.

Ted December 14, 2021 3:31 PM

@Clive, SpaceLifeForm, ALL

Re: ISSWorld

Also is it ‘bad’ to enter this space?

From an Atlantic Council report ‘Surveillance Technology at the Fair: Proliferation of Cyber Capabilities in International Arms Markets’

This paper analyzes active providers of interception/intrusion capabilities within the international surveillance market, cataloguing firms that have attended both ISSWorld (i.e., the Wiretapper’s Ball) and international arms fairs over the last twenty years.1 This dataset mostly focuses on Western firms and includes little on Chinese firms, due to historical under-attendance of Chinese firms at ISSWorld.


Clive Robinson December 14, 2021 5:44 PM

@ Ted,

Also is it ‘bad’ to enter this space?

The technology works irespective of the use.

The use is ultimately chosen by a “Directing mind” and would probably be considered either “good” or nessecary by their point of view.

However others point of view might be that the use is bad or unnecessary.

Take this Uganda -v- US issue.

From the US perspective,

1, Listening to Ugandan officials by the US is not just “good but necessary”.

2, Ugandan officials listening in to US officials is not just “unnecessary but also bad”

The opposit view point almost certainly applies from the Ugandan point of view.

But importantly though the US is claiming various things, it is almost a foregone conclusion that the US were attacking Ugandan officials confidential communications long befor the Ugandans attacked US officials communications.

So ask yourself which is right the US or the Ugandan’s or are they both wrong?

That is the point, the god/bad view is “human” not “technical” and very much based on the individuals point of view…

But of a more practical note and one that should always be uppermost in peoples mind,

1, If the laws of physics allow, then people will try and eventually succeed in turning it into a usable technology.

2, Once a technology is available it will get used, and right or wrong, good or bad, is irrelevant to that decision.

That is the practical reality of the world we live in. And it’s not just the US that has been caught out, Australia has as well, as have nearly all Western Nations one way or another.

So now knowing that any and all technology will be used without refrence to ethical or moral standards. So the question arises can you make technology adhere to only “good” behaviour as in the three Robotic Laws thought up by Isaac Asimov?

Simple answer “Of course not”…

Ted December 14, 2021 6:02 PM

@Clive, ALL

Okay thank you 🙂

Then, to start, it looks like Ateros is an associate sponsor of the ISSWorld – Europe. It does SIGNIT solutions, it looks like. For homeland security and law enforcement, it says.

And, this is going to be awkward, but NSO Group is the Europe lead sponsor. Um yeah.

I missed that ISSWorld has conferences in Europe, North America, the Middle East and Africa, Asia, and Latin America.

Is the sponsor for all of these: TeleStrategies, Inc in McLean, VA?

There are more conferences scheduled for next year!


Also part of NSO Group’s company description says:

Our product portfolio, with its target centric and service provider independent technology, enables government agencies to identify targets, locate their whereabouts, and covertly gather valuable intelligence without compromising user service or experience.

Um, yeah. No one wants to have their user service or experience compromised. That would be bad.

Clive Robinson December 15, 2021 1:24 AM

@ Ted,

No one wants to have their user service or experience compromised. That would be bad.

Joking aside, actually it would be bad very bad for those who are watching.

“They” call it “tipping off” others might call it “spotting a peeping tom”. Either way the result is the same, the target of attention as a minimum changes their behaviour and at the very least does the equivallent of “draw the curtains”. If not like the father of a teenage daughter comes after those peeping-toms with the equivalent of a “base ball bat to knee cap them”.

The real point of surveillance is not to be seen watching, so you can go on watching as long as you like taking advantage of what is unknown by the target. With time comes knowledge, which builds into power over the target in one form or another.

Those who participate in being the watchers are not normal people. They fall into two basic types, those that have little or no empathy thus can not or chose not to see the harm they do. And those that rate higher on the narcissistic, sadistic and sociopathic scales. With those who lack or can subsume empathy making “useful idiots” for those who are up the scales, and most likely higher in the hierarchy unless bestial in nature.

We know from revelations forced in court about under cover officers in the UK Met Police, they would think nothing about decieving their way into romantic and physical involvment with their targets of observation. Often having children with the women, knowing full well they would just “walk away”, or have the women jailed etc and the children thrown into the care system etc. This was not just condoned by senior officers but actively encoraged. Worse the current head of the Met Police was only to well aware of what was going on. But Cresida Dick is a “political favourite” because at the very least she turns a blind eye if not actively condons such behaviours as long as it gets her political masters objectives achieved. Oh and her political masters Mrs May and Ms Patel who likewise would have been aware of exactly what was being done to those women by the surveillance officers…

Were these women who were abused “criminals”? Of course not, they were in the main people who were lawfully protesting the immoral or unlawfull behaviours of those in power.

Ted December 15, 2021 5:11 AM


Of course not, they were in the main people who were lawfully protesting the immoral or unlawfull behaviours of those in power.


I think you nailed why trying to ‘audit’ a system while 1) having less power than a transgressor and 2) living in a no-holds-barred surveillance state can be so fraught with problems.

I am trying to go back and better understand the surveillance environment so that I can make sense of the ISS World conference website in particular.

I had thought such ‘independent’ (and potentially highly-abusive) surveillance companies/ecosystems would have been far more hidden, but I didn’t know that:

… over 70 percent of the budget of the United States Intelligence Community is earmarked for payment to private firms. (Wikipedia)

I still feel like seeing the ISS World website is something I shouldn’t be able to see. I don’t know why I haven’t heard more analysis on this from the MSM.

The website appears to offer services from firms that have received harsh public criticism like: NSO Group, Candiru, FinFisher, Cellebrite, Mollitiam, and so on. And ISS World lists them with nary a shade of alarm.

Plus there are firms listed – that I personally know less about – but are categorized as ‘irresponsible proliferators’ of interception/intrusion technologies by organizations such as the Atlantic Council.

Some of these firms include: ClearTrail (used by the UK Police), Memento Labs (formerly Hacking Team), RCS (mentioned on here on SoS), Verint (which is now Cognyte), and on and on.

I, again, am trying to get more context for these observations. It feels like I am walking along and continuously get sucked into a trench of mud, and have to wiggle out time and time again.

I grabbed a copy of Nicole Perlroth’s book (‘This Is How They Tell Me the World Ends: The Cyberweapons Arms Race’). Do you have any thoughts on this book? Of course, this blog (SoS) is one of the best.

I was trying to read the Atlantic Council report on Cyber Arms Fairs, but my eyes got super heavy, and I conked out.

Again, I’m just really surprised I hadn’t ever seen a conference like ISS World before. I have no idea how it’s going to change up with NSO Group potentially being dissolved. There are so many questions.

As always, thanks so much for your thoughtful responses. Having these discussions with you is priceless 🙂

Ted December 15, 2021 6:22 AM

And Nicole Perlroth responds to John Scott-Railton:

As John points out, Magnitsky follows you. Wouldn’t matter if NSO execs sell Pegasus and pivot to “Palantir 2.0” as they’ve floated.


John Scott-Railton:

3/ NSO has floated trial balloons about a sale.

Prospect of Global Magnitsky Act sanctions on horizon will chill interest immediately.

Moreover, GMA sanctions follow people.

Even if NSO execs dissolve & re-form company w/new name… they’re still liabilities for investors.

Winter December 15, 2021 7:24 AM

“Magnitsky follows you.”

And this is not a US-only law, the EU, Canada, Latvia, Kosovo, and the United Kingdom have their own versions. I do not think the group has a future. Its employees might move on, but I think the current investors will lose their money (and more?).

Ted December 15, 2021 8:02 AM

Hi @Winter

And this is not a US-only law, the EU, Canada, Latvia, Kosovo, and the United Kingdom have their own versions.

Oh wow. Interesting. I had no idea. I wonder if they will follow suit. With some of the new ‘hardened’ UK IoT regulations coming out, it would seem absurd to allow a nasty swath of interception/intrusion technology to exist in the same space.

And that would only be one more stone on the scale for taking action. Clotheslining the egregious human rights abuses with the Global Magnitsky Act is a real big daddy step in the right direction.

You don’t happen to remember what some of those other laws were, do you?

Also, so sorry, but I didn’t include the link to the original Reuter’s article before. Here it is:

Their letter sent late Tuesday and seen by Reuters also asks for sanctions on top executives at NSO, the United Arab Emirates cybersecurity company DarkMatter, and European online bulk surveillance companies Nexa Technologies and Trovicor.


Winter December 15, 2021 9:00 AM

“You don’t happen to remember what some of those other laws were, do you?”

Not really. Here is a link to the EU one:

Ted December 15, 2021 9:43 AM


Re: the ‘EU Magnitsky Act’

Aka the EU Global Human Rights Sanctions Regime (EUGHRSR)

That’s awesome!!

It does sound very, very similar to the US version of the Magnitsky Act.

I was reading a bit more about the ‘EU Magnitsky Act,’ and if I read it right, it looks like the Dutch government was really the one who pushed for the Magnitsky law on the EU level. If so, that’s pretty impressive.

Also, more on the EU law:

On 7 December 2020, the European Union passed[28] the European Magnitsky Act,[29] which will allow the organization to “freeze assets and impose travel bans on individuals involved in serious human rights abuses”.[30]

Among the criteria for sanctions are: genocide, crimes against humanity, torture, slavery, extrajudicial killings, arbitrary arrests, or detentions.

Good work Dutch government.



JonKnowsNothing December 15, 2021 10:26 AM

@Clive @Ted @All

re: The real point of surveillance is not to be seen watching, so you can go on watching as long as you like taking advantage of what is unknown by the target.

This goes for all the civilian spy-cams that are installed not just on front doors with RingerBells but the ones installed in bathrooms, showers, dressing rooms, locker rooms and toilets. One small hole to view it all.

Upskirting has been declared legal in many countries too. Sometimes the camera is on the top of the shoe or a conveniently placed phone camera near where someone sits. Locations are anywhere there are people standing or sitting. Makes for a lot of places.

  I wonder if folks are Upskirting kilts? Maybe that’s how the count who’s got on YFronts and who goes Traditional-Comando (1).

Historical lawsuits of such cameras included the locker rooms, showers and toilets of large mining corporations. When the female staff came off shift to clean up, the cameras watched every aspect of personal hygiene. It was a minor scandal at the time, a horror to the women discovering they had been viewed and filmed for years and big guffaw from their male co-workers.

Much has been written recently about “the male gaze”.

Now with trail cameras, portable, small, self contained, infrared or laser triggered, auto-uploading you can not only watch the turkeys and deer gathering at sites which will make it convenient to kill them as there’s not so much hiking in the fresh air since you can Go Direct, these can be installed anywhere.

Although if you are watching something less than legal or potentially embarrassing to your career, best go collect the SD Card directly rather than risk it along the internet paths.


  1. Old Joke tl;dr

There is nothing worn under the kilt…

It’s all in perfect working order..

Clive Robinson December 15, 2021 7:36 PM

@ JonKnowsNothing,

Re upskirting

Way to many treat it as a joke, or childish behaviour and see it as “arrested development”. Therby alowing people to get away with what is very preditory behaviour.

As such it is not random these people seek out their victims just as stalkers do.

There is not as much data on the psychological profiles of such people as we should have, simply because it is mainly a modern phoneme enabled by technology.

More traditional “locker room bullying” is known to destroy lives, and the use of mobile phones has enabled much much worse behaviours. In the UK teenage girl gangs have turned it into physical violence to “go one better” than rivals etc.

Those who bully in what ever way have personality defects that should be of concern to others. It is in effect a “power lust” that is basically uncontrolled, and generally these things tend to go one way and result eventually in violence.

As for kilts they come in old style and modern. Old style is said to be twelve yards of broad cloth and to put it on requires it to be laid out on the ground folded in hand width (4inch) pleats with a broad belt underneath, this takes around eight yards of cloth. You then roll yoursef into it and belt it in place with the top about two inches above the waist and the bottom below the knee. The remaining cloth aranged over the shoulder in such a way as to alow it to be spread out to provide weather protection. Oh and at night you use it to make your bed.

This idea has carried forward, the “great coat” issued to soldiers in WWI is an example of the same thing, in that it was rolled up and carried on the person either around them or their pack. In cold or inclement weather it became protection and at night bedding to sleep in.

The modern army poncho and liner set acts in a similar way and can form “tentage” as well such as a lean to to provide shade in hot climates when resting up.

As for “is anything worn under the kilt” as far as I’m aware it always has been. Very few people would want broad cloth that was made on cottage looms up against their skin, even though it had been “proofed with lanolin etc obtained when boiling the wool.

But there is also the sanitary side an undershirt of length is moderately easy to keep clean soap can be made with potash and fat, and if made of flax can make extrodinarily fine linen that most can have against their skin without issue. There was an old chant of “Kiltie kiltie always got a cold bum, never had a warm bum” that children used to call out to those in traditional atire, but that is not true when you have what is in effect three layers of heavy broadcloth hanging around you.

As for “under pants” as such they are a fairly modern invention and were seen as “unclean” for various reasons. However men have worn support to keep things out of the way for much longer than written records, Henry VIII is credited with making the codpiece fashionable, however the reason was probably to do not so much with support but the pain of STDs. The history of underware is to some quite fascinating as it says a lot about society and it’s moors at various times. Supprisingly to many day to day underware has often been more expensive than outer clothing. As linens were only washed two to three times a year due to the labour and resources required, people often had large quabtaties of underware so it was a considerable expense. To my knowledge from knowing a young lady who worked in the field both the Royal Palace at Hampton Court and V&A museum in South Kensington London has whole groups that deal with “linens through the ages” in their various forms, and they do have displays and exhibitions based around them from time to time with talks and lectures.

Lucy Worsley is “The Curator of the Royal Palaces” charity who has done much to bring history to life, and is quite knowledgeable on the subject of underware through the ages and has on several occasions brought it into her television programs,


JonKnowsNothing December 15, 2021 9:36 PM

@Clive, #Ted, @All

re: Magnetic anchored tiny camera

A new prototype detachable wireless laptop/pc camera with a magnetic footer. Sticks to anything that can hold a magnet.

If you don’t have a magnetic surface you can get those “business card magnet” blanks which have sticky on one side. Normally the sticky is for the paper business card overlay. Or you can use those no-stick-stick-ups, some which have a low profile, used to hang posters without damaging the walls.

It also includes a microphone.

A thousand and one places you can stick it….


Wireless webcam prototype pops out of its base and sticks to anything magnetic.

h ttps ://a rstechni ca.c o m/gadgets/2021/12/dells-magnetic-wireless-webcam-might-help-you-forget-about-that-infamous-nose-cam/

Ted December 15, 2021 10:11 PM

@JohnKnowsNothing, Clive, All

Re: Concept Pari magnetic wireless camera

Is it just being demoed right now? Looks neat. It’s weird (or novel) to think you could attach it right on the screen of a compatible monitor display.

There was a Tom’s guide article that said “Not surprisingly, the webcam will only work with monitors made by the company.” I guess that’s Dell?

Since it’s WiFi I don’t know how someone would set all that up? I didn’t see a technical manual, but maybe they will publish one if the product goes to market.👍

JonKnowsNothing December 16, 2021 12:45 AM


Tech History: Google GlassH****

Ultra tiny pin size cameras. Fit everywhere. You will never know they are there unless the installer messes up. Like leaving bits of sawdust on the floor or leaving the red “video recording” LED enabled …


http s:// en.wikipedi a.o rg/wiki/Pinhole_camera

h ttps://en .wikip edia.o r g/wiki/Camera_obscura

h ttp s://e n.wi kipe dia. org/wiki/Smart_glasses

h ttp s://en. wikip edia.org /wiki/Ray-Ban_Stories

  • The glasses, announced in August 2020 and released on September 9, 2021.
  • compatible with IOS and Android; IOS 13 and Android 8.1
  • They support Bluetooth 5.0
  • connect to Wi-Fi 802.11ac

Clive Robinson December 16, 2021 2:55 AM

@ JonKnowsNothing, SpaceLifeForm, Ted, ALL,

You will never know they are there unless the installer messes up.

Not quite, remember “red eye” in photos with flash, “lamping for rabbits” at night, or “cats eyes in the road” as your headlights hit them?

They all are a result of 180 degrees internal reflection that occurs when an image is focused on a reflective surface.

The same holds true of even tiny cameras…

So a pair of glasses with forward facing bright LEDs just to the side of your eyes will enable you to walk around a room and spot the “twinkle” of the cameras red eye…

Such glasses are sold to those who work with small objects like jewelers, watchmakers, hobby machineists that make small locos and the like, maker electronics for surface mount assembly, etc, etc,

Even one of those “head lamps” worn low over the nose will work.

Or you could spend $300 on a “Spy Camera Detector” they work in a similar way optically but in the near IR and some have ISM band receivers that search for video line/frame/interlace frequencies.

Remember a camera needs high bandwidth communications and to get any given range it needs to put out something like 32 times the power of an audio only bug.

Ted December 16, 2021 7:42 AM

From Google Project Zero‘s Ian Beer:

Today we’re publishing a detailed technical writeup of FORCEDENTRY, the zero-click iMessage exploit linked by Citizen Lab to the exploitation of journalists,
activists and dissidents around the world.



A retweet comment from @DAlperovitch

Wow. Just wow. This NSO zero-click iMessage exploit is the most impressive attack code I’ve ever seen. A whole computer architecture built out of a few logic operators… in an EXPLOIT!

The talent of the individuals who came up and developed this technique is beyond impressive

SpaceLifeForm December 16, 2021 4:02 PM

@ Ted

It is impressive, no doubt.

But, it was only step one in the chain. Further steps involved attacking the GPU, which Project Zero says will have a report on soon. Recent patches for iOS reflect this. The fix descriptions are opaque. Four that deal with the GPU.

Ted December 16, 2021 4:55 PM


Further steps involved attacking the GPU, which Project Zero says will have a report on soon.

Omg, there’s more? We’re talking about the FORCEDENTRY exploit, right?

Imma need this to ping around on Twitter for a while. It doesn’t look like there are any podcasts out on it yet. A few ‘60 Minutes’ type specials would be good too.

Where did you bravely see the mention about the GPU?

Clive Robinson December 16, 2021 7:13 PM

@ Ted, SpaceLifeForm, ALL,

With regards,

“The talent of the individuals who came up and developed this technique is beyond impressive”

Not sure why…

They talk about XORing two glyphs to produce a data map, well if you look back on this blog I call them “data shadows” and use them as a way to have passwords and KeyMat in Core RAM that you can not find by examining the core RAM you need two other pieces of information that is held in CPU registers not Core RAM.

As for building your own CPU, that takes me back to the earky 1980’s when I used to design ALU’s and state machines to implement RTL that in turn had microcode on top.

However whilst some of the ALU’s were over 400bit’s wide other ALU’s traded clock cycles for bus width.

Back then you had the state of the art 22V10[1] “Programble Array Logic”(PAL) that were tiny “fuse” programable logic chips from AMD. I was considered a bit of a whiz kid back then with the logic transformations and I could beat the “tools” more often the tool designers would have liked.

Any way I used them with shift registers to design what were 1 bit ALU’s that shifted data upto 64bits wide through. One usefull trick was “bytewide instructions” you would do “maths” such as “serial adders” and shifts. They had a high throughput but a high latency. So if you were doing a “digital filter” you got the required through put but not at the eye wateringly expensive price of a 32bit width CPU that the likes of DEC would not give you much change out of $10,000 back then… You just got delay, which in most cases did not matter.

So yes designing a 1bit ALU, not a problem you can do it with about 25 gates[2] for the core, but then you need additional function select and shift control and SR latches. But 60-120 NAND or NOR gates would do it.

I must admit that whilst it was “bread and butter work” back then, my little grey cells are not what they were, but give me a couple of days and I could give you a logic diagram for a 1bit serial CPU core, a couple of days more for a microcode ROM and state machine.

It’s upto you as to how long to make the shift registers but actually if you realy want to make life hard… Yes I can give you a Turing machine which does not realy care about how long data is provided you use the right type of bit stream coding.

But if you are going to do that an alternative might be “Study BrainF##k”,


But, for those with slightly longer memories, do you remember when it was shown that Intel’s x86 memory manager faukt handeking was “Turing Compleat” thus gave a “ghost CPU”. The reason being the MMU had to do two different memory models so it had “extra features”,


So it’s all been done before but ICT peps have no memory for even “living history”… ={

[1] We are talking 4 decades ago and the original 22V10’s are long gone appart from in a few engineers “odds and sods boxes” I still have a couple of tubes of them. Whilst blindingly fast for their time they would be creaky at best now. However there were and still are “pin compatible” 22V10 chips one such was the GAL22V10 which you can read about,


[2] At college/uni they show you a half adder as an XOR gate with an AND gate for the carry, around which they add another XOR gate an AND and an OR gate to make a full adder.

What they don’t tend to tell you is those AND gates used for carry come for free in the XOR gate which is made with for NAND gates. Thankfully rather than have me use words, Wikipedia has pictures,


The next trick is to work out how to add the minimum number of gates to give you AND/NAND, OR/NOR, INV/XOR, SET/CLR logic operations.

SpaceLifeForm December 16, 2021 7:14 PM

@ Ted, Clive, ALL

Silicon Turtles

The patches were for the software that interacts with the GPU driver.

There are probably other patches that have not been disclosed.

All modern exploits these days abuse the GPU and it’s driver.

The software driver can be reverse engineered, and any bugs in the GPU Silicon and/or the driver can be used as an exploit angle, because it has root and the Silicon is not patchable in the delivered product.

Your Root of Trust is not in the Silicon.

Ted December 16, 2021 9:57 PM

@SpaceLifeForm, Clive, ALL

The patches were for the software that interacts with the GPU driver.

The only patch that I saw in Google’s post was CVE- 2021-30860 (for iOS 14.8 on September 13, 2021.) Is this the same patch you are talking about?


It looks like Google’s Project Zero worked with Apple’s Security Engineering and Architecture (SEAR) group for the technical analysis of FORCEDENTRY.

I wonder why Google posted the analysis and not Apple? Also from Google:

We are aware that NSO sells similar zero-click capabilities which target Android devices; Project Zero does not have samples of these exploits but if you do, please reach out.

When you say:

All modern exploits these days abuse the GPU and it’s driver.

Are you thinking that the CoreGraphics (framework) is the GPU and it’s driver? Do you have a link for more info on that? From Google’s post:

Most of the CoreGraphics PDF decoder appears to be Apple proprietary code, but the JBIG2 implementation is from Xpdf, the source code for which is freely available.

And about JBIG2:

If you used the scan to pdf functionality of a device like this a decade ago, your PDF likely had a JBIG2 stream in it.

I think someone on Twitter summed it up well:

Turning a one pass renderer into a logic execution environment, then building a computer architecture on top of that? Mind blown.

Some of the programming is miles above my head. I wonder if this analysis will open the door for copy-cat exploits.

Also from Google:

… the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.

lurker December 16, 2021 10:18 PM

@Ted, @SLF, All

This grumpy old man says the only clever thing about the iMessage zero-click was getting the ducks in line: they were lurking in the iMessage swamp all the time. Jumping a sandbox? Aw, c’mon… Call something else a .gif and then process it according to content? You had it comin’ to ya Apple. Wasn’t it dandy of someone to put all that loose logic in the JBIG2 decoder? That is probably the prizewinning part: wiring it up to run the exploit in a single “image” pass.

Am I missing something when I think this could have been avoided by “sanitize your input”? Oh wait, that’s what they’re saying over on the java logging thread…

Ted December 16, 2021 10:46 PM

@lurker, SpaceLifeForm, ALL

Am I missing something when I think this could have been avoided by “sanitize your input”? Oh wait, that’s what they’re saying over on the java logging thread…

Lol! A thousand tiny feet in the door. 😆😟

Clive Robinson December 17, 2021 4:38 AM

@ Moderator,

Can you check the “pending”, lidt please, I posted a comment about building very simplr ALU’s and CPU’s and minimal instruction Turing compleate languages.

I gave a link to “brain####” on Wikipedia which is a minimal instruction language and I am wondering if it got caught in my post by the “naughty word” filter.


I did not name the language… From Wikipedia with the naughty four letter words replaced with ####

“Müller designed Brain#### with the goal of implementing the smallest possible compiler,[3] inspired by the 1024-byte compiler for the FALSE programming language.[4] Müller’s original compiler was implemented in machine language and compiled to a binary with a size of 296 bytes. He uploaded the first Brain#### compiler to Aminet in 1993. The program came with a “Readme” file, which briefly described the language, and challenged the reader “Who can program anything useful with it? :)”. Müller also included an interpreter and some quite elaborate examples. A second version of the compiler used only 240 bytes.[5]”

John December 17, 2021 6:53 AM


I notice retroforth.org is still alive and well and doing non-trivial stuff like hosting its own webpage.

Very small, Fun to write, easy to debug, difficult to understand code you did not write.


Fernando Ponce December 17, 2021 9:11 PM

Crazy software for sure. Spyware will continue to increase in effectiveness and abundance.

SpaceLifeForm December 18, 2021 1:33 AM

Just a flesh wound



Ted December 18, 2021 2:41 AM


That was an interesting article about Oregon’s PERS being financially linked to NSO Group.

The article said that Novalpina (a private equity fund) had acquired a majority share of NSO Group. Then Novalpina became so dysfunctional that investors replaced the fund’s governance with Berkeley Research Group.

According to the article:

As of two months ago, Berkeley Research Group had not been granted clearance by the Israeli government to receive any sensitive information about NSO Group, the Guardian newspaper reported.



Ted December 18, 2021 6:03 PM

@SpaceLifeForm, Clive, ALL

Just a flesh wound

Haha yeah.

Lawsuits, the Entity List, Acts of Congress, and the unrelenting light of day from Citizen Lab

As a sentient being would say… Ouch.

From the Bloomberg article about Jefferies, who resigned as NSO’s loan agent:

Jefferies was the lead underwriter alongside Credit Suisse Group AG on around $500 million of loans that were issued in 2019 to finance a buyout of the company orchestrated by management and European private equity firm Novalpina Capital.

You’ve got to think other spyware companies aren’t feeling so unnoticed right now. Boop.

SpaceLifeForm December 18, 2021 6:56 PM

@ Ted, Clive, ALL

Credit Suisse is one of the fingers of the Invisible Hand of the Marketplace.

Not the thumb, nor index finger.

Clive Robinson December 21, 2021 2:34 AM

@ lurker, Ted, SpaceLifeForm, ALL,

With regards,

“Wow. Just wow. This NSO zero-click iMessage exploit is the most impressive attack code I’ve ever seen. A whole computer architecture built out of a few logic operators… in an EXPLOIT!”

Well, XKCD, cuts to the point 😉


Jerome December 28, 2021 6:40 AM

Hi, a very good article, this is a very interesting and informative post for people who do not fully understand what a lawyer does, and therefore I advise you to find a lawyer who can protect your rights. And nowadays it is very difficult to find a good lawyer. I can recommend Paul Mankin to you.

Leave a comment


Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.