As usual, I want to point out how silly these analyses are, because there is a whole ecosystem of companies (incl. several directly connected to major US defense contractors, and many more across the NATO countries) that provide exploit development and maintenance and implant technology. The only reason you hear about companies like Paragon is because they're comfortable being named; the ones you haven't heard about are more capable and more plugged in.
Every time a story on HN comes up about how bug bounties are underpaid and how much exploits are worth, I recite the bit about how serious grey-market vendors can run up the score on a serious vulnerability by (1) selling the same vulnerability to every IC/LEO agency in allied countries and (2) selling maintenance contracts to convert those agencies into recurring revenue. These are the companies I'm talking about when I say that. I'm never thinking of Paragon.
NSA isn't allowed to spy on US citizens. NSA is a US military organization under Department of Defense, and Posse Comitatus act makes it unlawful for the US military to act as a police force in the US.
One of the few good things revealed by Edward Snowdens leaks was the fact that the NSA has filters for intercepted communications to filter out comms from US citizens. This was in top-secret programs that had no reason to be publicly known, and yet the NSA still had these filters installed anyways, because everyone in the NSA understands that they're not a law-enforcement agency, because of Posse Comitatus.
> Posse Comitatus act makes it unlawful for the US military to act as a police force in the US.
Strictly speaking, that's not correct. The Posse Comitatus Act just changes the status of using the military as a police force from “allowed because any person or group can be deputized as a police at any time”, to “the US military can be used as a police force only under the laws specifically allowing and governing the US military as a police force.”
(Of course, the Posse Comitatus Act is a criminal law, which means in practice the primary mechanism for enforcing it is for the executive branch to arrest and prosecute offenders. This works tolerably well to prevent, say, a rogue sheriff calling up his buddy who happens to command an infantry company to come help out, but not particularly well to dissuade the President from directing the military for policing as a matter of Administration policy.)
In principal the courts can constrain the government based on it, as well, but it is noteworthy that the determination that the deployment was illegal in the case filed by the State of California almost immediately when courts were open after the initial LA deployment was announced on June 7 and before troops arrived on June 10 was just released, on September 2, nearly 3 months later. And is on hold for 10 days to give the government time to appeal. So, one might consider the courts to not be a meaningful constraint, here.
So what would you say about the PRISM and Upstream programs where metadata about millions of Americans was collected? Doesn't it seem as if they could target any US citizen by just pretending to target any foreigner they communicate with?
I mean that the US government could have laundered some of the tools it is not supposed to have developed against US citizens through Israeli companies. (We don’t have any evidence of this in this case)
I suspect Israel does whatever they want under the auspices of national security, gives “private” cybersecurity corporations latitude to circumvent international laws, then packages it all up to sell to the highest bidder.
It seems pretty unlikely that selling a zero-day to a state actor is a violation of international law, unless the vendor knows that state actor intends to use it to commit an internationally wrongful act.
Like at the very worst - selling "cyberweapons" would follow the same rules as selling actual weapons.
I don't super follow US politics, but i don't think we are at the point where ICE is comitting crimes against humanity - which i think is what would be required for this transaction to violate international law.
There are three main categories of entry into a device via zero-days: WhatsApp/Signal, SMS/MMS, and Firefox/Chrome/Safari. If these can be isolated, entering a device could become harder.
I already have two secure conclaves in my phone, and they're already used up for other apps, e.g. finance apps, etc. One of them uses Work Profile and the other uses Knox. I don't think that more such regions are allowed on non-rooted Android.
As for iOS, to my knowledge it doesn't allow for any such app segregation.
In general, we need stronger per-app isolation such that a zero-day affecting one app doesn't grant any access to anything else.
For all y'all Linux users: run your browsers in a container. You can isolate Firefox to just ~/downloads using Flatpak, it's really easy. Stops those pesky zero days from causing too much damage. Also everything just works.
I believe Flatpak is linux-only. There's a UI to edit Flatpak settings from KDE settings or you can use flatseal.
You can do tons of neat things with it. You can also cut off environment variables, cut off the x11 socket, only allow certain dbus channels, etc. You don't need a docker container or anything, Flatpak is a container technology.
Zero-day exploits for web browsers routinely compromise the entire system, even on MacOS. Even without admin access, the exploit can do significant harm.
The native permission system still works for limiting filesystem access. As for the kinds of things you're describing, I don't think containerization is an effective enough countermeasure. At least definitely not Docker, which includes a root daemon that can be made to run arbitrary commands. A VM, possibly with some of the host integration features disabled, is a better option but is more costly in terms of setup, usability, and power usage. For many, the cost far exceed the risk.
> [Paragon] has said that [...] it only does business with democracies. It has also said it has a no tolerance policy and will cut off government clients who use the spyware to target members of civil society, like journalists.
> Paragon also refuses to disclose who its clients are and has said it does not have insight into how its clients use the technology against targets.
The amount of companies actively using Israeli spyware like BrightData and Imperva is outstanding. All their data goes through their networks. I don't trust any government led site because they are all incredibly incompetent and corrupt. The United States is on their last legs.
I feel the key change we as civilians need is to move to a non-local stored detail. Where our devices are access points to decentralised mesh networked apps. These companies and governments have been proven time and time again to not obey appropriate measures for invalid reasoning.
All other things being equal, local storage is always going to be preferable to cloud storage, because the surface of attack is intrinsically limited by the need for having the physical device in hand.
Important story for sure, but this reporting is subpar IMO.
> When it is successfully deployed against a target, the hacking software – called Graphite – can hack into any phone. By essentially taking control of the mobile phone, the user – in this case, Ice – can not only track an individual’s whereabouts, read their messages, look at their photographs, but it can also open and read information held on encrypted applications, like WhatsApp or Signal. Spyware like Graphite can also be used as a listening device, through the manipulation of the phone’s recorder.
"When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)? Is there a background whistleblower between the lines here, or is this just paraphrasing the Wired reporting from last year?
> John Scott-Railton, a senior research at the Citizen Lab at the University of Toronto, who is one of the world’s leading experts on cases in which spyware like Graphite has been abused by governments, said in a statement that such tools “were designed for dictatorships, not democracies built on liberty and protection of individual rights”.
Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this).
> The US government has in the past resisted using spyware technology made outside the US because of concerns that any company that sells technology to multiple government agencies around the world represents a potential security risk.
Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming.
> “As long as the same mercenary spyware tech is going to multiple governments, there is a baked-in counterintelligence risk. Since all of them now know what secret surveillance tech the US is using, and would have special insights on how to detect it and track what the US is doing with it,” Scott-Railton said. “Short of Paragon cancelling all foreign contracts, I’m not sure how this goes away.”
...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it.
But how this goes away is: we learn how the exploit works and develop countermeasures.
The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen?
The discussion on the front page of HN yesterday on the thread, "We should have the ability to run any code we want on hardware we own" was refreshing and felt like the first real consensus we've had around here on this topic in several months. Specifically, it seems like we all now agree that our mobile devices have reached a combination of complexity and (state-assisted) corporate control that they are no longer safe for everyday use.
And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power.
I do not believe that there is an avenue for addressing this via institutional influence - the cited examples of Saudi Arabia, Italy, and the United States, despite having dramatically different configurations of state authority (and, probably in most people's minds, levels of legitimacy as states in the first place), all present identical attack surfaces in the face of "Graphite" and similar exploits.
The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat.
I don’t suppose anything a bit less-serious is available to normies?
I have a iphone that died on vacation and was set to backup only on WiFi (I’ve since changed that setting, haha, whoops) and has a couple days of photos stuck on it that weren’t backed up. It boots and makes noise but the screen is dead. Uncertainty about how broken it is has kept me from paying the not-cheap cost to get a screen replacement, and I haven’t found a way to read its data over a cable without unlocking via the screen first (which doesn’t work, and its touch-sensing capacity also seems to be dead, so blind input doesn’t do it, or else I could probably unlock it with a couple tries and get it to connect to WiFi it already knows and do its backup, but it won’t do that without being unlocked)
> "When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)?
This is not a research paper where the guardian needs to go into those details. Those details are known based on previous incidents/issues and general knowledge.[1]
> Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this).
Guardian articles are pretty short. They're not going to quote someone when all they are trying to get is that these are risky tools that invite abuse. So they interviewed an expert who could give a quote to that effect. Why is that shovelled in? This is very much "WHY" someone should care. It's a core tenant of journalism, don't just present what - but also some analysis for what it means.
> Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming.
Yeah, are they going to link to 30 different articles and so forth? Here you go, a quick reference: [2]
> ...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it.
Why does any of the quote sound cherry-picked? The context seems clear: other governments use this tool, if USG does too, then other governments know the capabilities. It's an intrinsic problem. Seems to be completely conveyed via the quotes, and that was presumably the reason to interview this additional person.
> The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen?
How this happens is WAY out of scope of the article. This is a general news article that is around 300 or so words. It's not a security bulletin or a tech focused article. Why do you expect these details? Can you give any other examples from say the LaTimes, BBC.co.uk, or any other similar news services?
> And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power.
This does seem implied. The quote "were designed for dictatorships, not democracies built on liberty and protection of individual rights" is really saying this, no? Like, it's saying exactly, this technology is a concern because it can be abused and is a tool for authoritarian countries and not democracies.
> The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat.
I agree with your premise here. In this case, the article that the USG is adopting these tools should be well alarming to you.
Well you're certainly correct, as a tech person i'm nonetheless always disapointed by mainstream media reporting on these things as the "how" and "what" bit is by far more interesting to me than anything in the article.
The actual article is pretty old news and uninteresting - yes US police have used spyware for "surveilence". This is not new by any means. Similarly a number of Israeli private companies have made a name for themselves selling spyware software on, lets say the grey market. This is well known by now.
The only interesting thing to know would be how this particular piece of software works.
Yeah I thought it was widely known that "deploy" could be as simple as sending a text message. The recipient did not even need to open in in the case of Pegasus.
So you're presuming that there is an exploit that allows a remote attacker to install "Graphite" via a text message? That is not stated here - or anywhere - as it was over and over again in the case of Pegasus (and similarly, the trumpets sounded when the patch was fixed a couple weeks later).
The reporting here is markedly more imprecise, and it's frustrating.
Other data collection/surveillance software from the Epstein circle include PROMIS (Robert Maxwell allegedly sold a backdoored version), Chiliad (FBI search software, Christine Maxwell, seems legit) and CargoMetrics (Ghislaine Maxwell's husband, maritime container tracking).
Allowing the population of an occupied territory to vote in elections of the occupying power is illegal under international law.
Generally speaking, in theory, the occupying power is supposed to be a care taker - they aren't supposed to take any action that integrates the occupied territory into the main territory. Allowing occupied territories to vote in the occupying power's elections is considered a form of integration. Doing so is considered acquiring territory via annexation, which is illegal under the UN charter.
(See for example Israel when the international community yelled at them for allowing people in Golan Heights to vote).
So the question is whether Israel is a democracy. If a state both maintains an occupation and denies the occupied population political rights, then it is not democratic (even if the dominant ethnic group and some others are allowed to vote).
At its core, democracy requires political equality. The governed people must have a meaningful say in who governs them and how. That is not present in Palestine due to Israeli occupation.
It allows Israelis to vote, including Jewish settlers in occupied territories, but it does not allow occupied Palestinians (many of whom live right next to settlers) to vote.
While your point about international law is technically correct, it is also a masterclass in deliberate evasion. You are not engaging with OP's argument, but you're using a legal footnote to sidestep the clear and openly stated intent of the system he's condemning. Leading human rights organizations like Amnesty International and Human Rights Watch have a precise legal term for this system, which is built on that very intent: apartheid. [1][2] "Israel is not, cannot be democratic based on Jewish superiority - No honest Israeli citizen can claim that the Palestinian citizens of Israel live as equal citizens in the State of Israel." [3]
This isn't a secret. Israeli officials have long been explicit that their policies are guided by the goal of maintaining demographic control. As Netanyahu declared, "Israel is not a state of all its citizens... but rather the nation-state of the Jewish people and only them." This driving intent is what gives rise to the entire apparatus of control. It is legally enshrined in constitutional law through the 2018 Nation-State Law, which reserves the right of self-determination for Jews alone. This legal supremacy is then enforced through a two-tiered justice system in the West Bank, where Israeli settlers are governed by rights-respecting civil law while their Palestinian neighbors are subjected to draconian military orders. This judicial separation, in turn, enables the physical re-engineering of the land: a state policy of systematic land dispossession confiscates Palestinian property for settlements, while a discriminatory planning regime makes it nearly impossible for Palestinians to build, leading to routine home demolitions. The ultimate result is the deliberate fragmentation of Palestinian life into disconnected enclaves, which B'Tselem calls 'territorial islands' carved up by walls, checkpoints, and permit regimes designed to sever social and political ties.
Your narrow focus on the procedural illegality of a vote under occupation law is a calculated deflection from this reality. The disenfranchisement of Palestinians is not an incidental legal problem, it is a fundamental and necessary pillar for maintaining this regime of apartheid. You are meticulously explaining the legality of the lock on the cage, while deliberately ignoring that the crime is the cage itself.
You're making a different argument then the person I am responding to.
The person I am responding to only said: "Hardly a democracy when it occupies Palestine, and Palestinians can't vote in Israeli elections." [Presumably they meant citizens of Palestine here, since Israeli citizens living in Israel who are ethically palestinian can vote]
Simply put, that is an unreasonable criticism as Israel is simply following international law. Other countries do the same. If they did not do this they likely would recieve criticism. People who don't like it should encourage the international community to change international law.
That doesn't mean that every possible criticism of Israel is unreasonable (in fact there are many reasonable criticisms you could make), only that the one i was replying to is unreasonable.
The rest of your post is irrelavent because its talking about arguments that neither I nor the person I was responding to made. That said, i think the way you are quoting is misleading, but that is neither here nor there.
You're right, I am making a bigger argument. That's because pbiggar's point about voting is impossible to understand without it. It's a symptom, and you are trying to discuss it while pretending the disease i.e a system of apartheid, as defined by international law, is "irrelevant". And this system isn't just a feature of the occupation. It is foundational to the state itself, a reality even zionists are forced to admit. As a Jerusalem Post op-ed concedes, "No honest Israeli citizen can claim that the Palestinian citizens of Israel live as equal citizens in the State of Israel."[0]
Your apologia that Israel is "simply following international law" is perverse. Everybody knows that Israel has never in its entire history, since its inception, ever given a fuck about international law, which makes your apologia extra comical. Furthermore, you are elevating a single procedural rule above one of the gravest prohibitions in the entire legal order, the crime against humanity of apartheid. The rule you cite is not a shield against this crime, it's a tool used to facilitate it. By forbidding political integration, the system enforces the very demographic separation required to maintain an apartheid state.
Your claim that "other countries do the same" is a baseless false equivalence that ignores the unique permanence and stated demographic goals of the Israeli apartheid system. And your deflection that we should "change international law" is an unserious diversion. The international community doesn't need to change the laws, it needs to hold these genocidal zionists accountable for violating the most fundamental ones that already exist. Your entire response is a performance of pedantry to avoid acknowledging a criminal reality which, for almost a century, has been inflicting hell upon the natives whose land zionists have been brutally colonizing with absolute impunity - culminating in the predictable conclusion of Genocide[1][2][3][4][5].
You are defending the apartheid system by pointing to a single, well-oiled gear, while deliberately ignoring that the entire machine is designed to make a mockery of international law.
Every Israeli is drafted when reaching adolescence age. Intelligent tech people end up in Unit 8200 (part of IDF). These young people end up with a plethora of experience, using it for their career or even security related startups, yet loyalty often lies with state of Israel.
The legal presence / country of a company very likely performing a genocide is very much relevant and ontopic. Look up the dark history of companies like IBM and IG Farben and the term "Wir haben es nicht gewußt".
Actually, nothing of this has ever been proven - it was claimed and repeated thousands of times - but nothing of this is considered a proof in the real world.
If you ignore any statement other than form the Israeli government then sure
> The world's leading association of genocide scholars has declared that Israel is committing genocide in Gaza.
> A resolution passed by the International Association of Genocide Scholars (IAGS) states that Israel's conduct meets the legal definition as laid out in the UN convention on genocide.
> Across a three-page resolution, the IAGS presents a litany of actions undertaken by Israel throughout the 22-month-long war that it recognises as constituting genocide, war crimes and crimes against humanity.
And then there’s
> B'Tselem and Physicians for Human Rights-Israel released separate reports on Monday based on studies of the past 21 months of conflict.
The organisations, which have been active in Israel for decades, said in a joint statement that "in these dark times it is especially important to call things by their name", while "calling on this crime to stop immediately".
Not a single one of these is even close to be a proof. All of them are just opinions of specific groups of people - most of them have their own agenda, so they can't even be considered to be unbiased opinions.
If we're talking about legal evaluation, then there is a strict formal procedure that collects and evaluates the evidence from both sides controlled by lawyers. And after the court comes to a final conclusion including appeals or whatever steps are provided by the legal system, then you may claim that something was proven.
For a scientific proof, the procedure is much more complex - basically you start with a claim and then you have to disprove or invalidate EVERY SINGLE opposite claim, fact or evidence. And there is actually no time limit here - scientists are still trying to disprove theories from the 17th century.
We are after legal proof, not scientific proof. Science is too slow to stop genocide from occurring and hold those accountable.
Netanyahu is wanted for warcrimes by ICC. Is he convicted? No, he is a suspect. Is he trying to avoid getting arrested? Yes, just like Putin. Both of these countries are likely to have recently commmited warcrimes.
After WWII and 'Wir haben es nicht gewußt' we set up international organizations to avoid this happening again. Unfortunately, not everyone recognizes these organizations but that is also a tell tale of their intentions.
there are a couple of problems with these "international organisations": first and foremost - they are created by the few former colonial powers who were never hold accountable for their own war crimes - but instead gave them the additional power to judge over their former victims (and the rest of the world).
the second point is - these organisations are used to cement the status quo - which is also created by the colonial powers and has absolutely nothing to do with the reality in the world - thus on one hand making all conflicts unavoidable and on the other hand mostly illegal.
the third point is - the rules are not applied to all countries in the same way - e.g. Turkey occupied half of Cyprus and displaced a large part of its population, Turkey is bombing innocent people in Syria, Turkey keeps refugees that originally headed to Europe under very inhuman conditions - not only there are no sanctions for that, Europe is basically funding all of this. As Russia occupied Georgia and annexed parts of it, there were no investigations, no sanctions, nothing. As China occupied Tibet, there were no sanctions but huge investments instead. And there are many more examples.
If you want to have an accepted legal system then it may not be biased and has to apply to everyone without exceptions - what we have at the moment is not even a joke. It's the opposite of a legal system.
Are you kidding me - of course it's not a proof. It's already in the description - they are not claiming that they have proven something - they just say it looks like something. It's not even an opinion.
You are dreadfully insistent on proof yet provide none of your own that there is no genocide, despite multiple credible organisations and experts, and the consensus of the international community, contradicting you.
I would say at this point given government statements and declarations and then actions that occur directly after prove they have broken international law
Just because a court hasn't said it doesn't mean that it isn't proven.
If, someone proves something, it's proven right then and there, even if it takes years for people to understand it, or for it to make its way into textbooks. This stuff really is very obvious.
most obvious things are often enough the mostly wrong ones - this is why everyone was sure for centuries that the Earth is flat or that the Sun and stars are orbiting the Earth. and this is why people invented specific protocols to ensure (or at least come close to) correctness of theories. these are called proofs.
and, for example - if you are using one specific LEGAL definition of a genocide then you have to prove LEGALLY, following the regular process. if you're not doing it, then it's per definition not a proof.
> this is why everyone was sure for centuries that the Earth is flat
Nope. There was a pretty smooth transition from "Nobody has ever wondered about this" to "All educated people know it's a ball shape" a very, very long time ago.
Eratosthenes comes up with a pretty good approximation both for how big the ball is, and how much its axis is off (you also if you think about it realise the planet must be spinning, that's why there's a day-night cycle)
Flat Earthers are a weird modern thing, they aren't somehow a remnant.
As usual, I want to point out how silly these analyses are, because there is a whole ecosystem of companies (incl. several directly connected to major US defense contractors, and many more across the NATO countries) that provide exploit development and maintenance and implant technology. The only reason you hear about companies like Paragon is because they're comfortable being named; the ones you haven't heard about are more capable and more plugged in.
Every time a story on HN comes up about how bug bounties are underpaid and how much exploits are worth, I recite the bit about how serious grey-market vendors can run up the score on a serious vulnerability by (1) selling the same vulnerability to every IC/LEO agency in allied countries and (2) selling maintenance contracts to convert those agencies into recurring revenue. These are the companies I'm talking about when I say that. I'm never thinking of Paragon.
Of course ICE has exploit and implant tech.
In some ways i think the most interesting aspect is that US federal government has to outsource its spyware.
Is it just that the NSA is unwilling (legally prevented?) to share their toys? Its hard to imagine they don't have capabilities like this.
NSA isn't allowed to spy on US citizens. NSA is a US military organization under Department of Defense, and Posse Comitatus act makes it unlawful for the US military to act as a police force in the US.
One of the few good things revealed by Edward Snowdens leaks was the fact that the NSA has filters for intercepted communications to filter out comms from US citizens. This was in top-secret programs that had no reason to be publicly known, and yet the NSA still had these filters installed anyways, because everyone in the NSA understands that they're not a law-enforcement agency, because of Posse Comitatus.
> Posse Comitatus act makes it unlawful for the US military to act as a police force in the US.
Strictly speaking, that's not correct. The Posse Comitatus Act just changes the status of using the military as a police force from “allowed because any person or group can be deputized as a police at any time”, to “the US military can be used as a police force only under the laws specifically allowing and governing the US military as a police force.”
(Of course, the Posse Comitatus Act is a criminal law, which means in practice the primary mechanism for enforcing it is for the executive branch to arrest and prosecute offenders. This works tolerably well to prevent, say, a rogue sheriff calling up his buddy who happens to command an infantry company to come help out, but not particularly well to dissuade the President from directing the military for policing as a matter of Administration policy.)
In principal the courts can constrain the government based on it, as well, but it is noteworthy that the determination that the deployment was illegal in the case filed by the State of California almost immediately when courts were open after the initial LA deployment was announced on June 7 and before troops arrived on June 10 was just released, on September 2, nearly 3 months later. And is on hold for 10 days to give the government time to appeal. So, one might consider the courts to not be a meaningful constraint, here.
They just feed it to GCHQ, no law against that.
If one of the Five Eyes are somehow forbidden to analyse something They just send it to one of the others where it is legal.
> Posse Comitatus act makes it unlawful for the US military to act as a police force in the US
No, we're allowing that now for some reason.
[flagged]
So what would you say about the PRISM and Upstream programs where metadata about millions of Americans was collected? Doesn't it seem as if they could target any US citizen by just pretending to target any foreigner they communicate with?
https://www.aclu.org/news/national-security/five-things-to-k...
> Posse Comitatus act makes it unlawful for the US military to act as a police force in the US.
Sure, but i dont think (ianal) that it prevents technology transfer.
Who says that isn’t happening?
It's implied by the fact that Ice had to obtain the spyware from israel
I mean that the US government could have laundered some of the tools it is not supposed to have developed against US citizens through Israeli companies. (We don’t have any evidence of this in this case)
[dead]
I suspect the nsa doesn't want to burn their 0 days on this.
I suspect Israel does whatever they want under the auspices of national security, gives “private” cybersecurity corporations latitude to circumvent international laws, then packages it all up to sell to the highest bidder.
It seems pretty unlikely that selling a zero-day to a state actor is a violation of international law, unless the vendor knows that state actor intends to use it to commit an internationally wrongful act.
Like at the very worst - selling "cyberweapons" would follow the same rules as selling actual weapons.
I don't super follow US politics, but i don't think we are at the point where ICE is comitting crimes against humanity - which i think is what would be required for this transaction to violate international law.
(1) Everybody outsources "spyware".
(2) NSA does not in fact have to outsource spyware (they may do it for convenience/situational logistics).
(3) US federal law enforcement and intelligence agencies all have multiple vendors for this stuff.
There are three main categories of entry into a device via zero-days: WhatsApp/Signal, SMS/MMS, and Firefox/Chrome/Safari. If these can be isolated, entering a device could become harder.
I wonder if those apps can be operated from a secure vault or conclave
Edit:
Something like this, but for phones
https://learn.microsoft.com/en-us/windows/security/applicati...
I already have two secure conclaves in my phone, and they're already used up for other apps, e.g. finance apps, etc. One of them uses Work Profile and the other uses Knox. I don't think that more such regions are allowed on non-rooted Android.
As for iOS, to my knowledge it doesn't allow for any such app segregation.
In general, we need stronger per-app isolation such that a zero-day affecting one app doesn't grant any access to anything else.
Seems like you have an android! I wrote my parent comment in context of an iPhone. Sorry for not clarifying earlier
https://grapheneos.org/features
(Microsoft and security are distinct concepts, btw.)
For all y'all Linux users: run your browsers in a container. You can isolate Firefox to just ~/downloads using Flatpak, it's really easy. Stops those pesky zero days from causing too much damage. Also everything just works.
Is there really a recommended Docker image for Firefox? And does it really work with a UI? Or did you mean to use Flatpak? Can it be run from a Mac?
I believe Flatpak is linux-only. There's a UI to edit Flatpak settings from KDE settings or you can use flatseal.
You can do tons of neat things with it. You can also cut off environment variables, cut off the x11 socket, only allow certain dbus channels, etc. You don't need a docker container or anything, Flatpak is a container technology.
I don't think you need to do anything for macOS. It already has a permission system for filesystem access.
Zero-day exploits for web browsers routinely compromise the entire system, even on MacOS. Even without admin access, the exploit can do significant harm.
The native permission system still works for limiting filesystem access. As for the kinds of things you're describing, I don't think containerization is an effective enough countermeasure. At least definitely not Docker, which includes a root daemon that can be made to run arbitrary commands. A VM, possibly with some of the host integration features disabled, is a better option but is more costly in terms of setup, usability, and power usage. For many, the cost far exceed the risk.
SMS is inherently plain text. I think a user would have to click on a link for an attack to work.
They have developed zero click exploits before
Link previews would do the trick, and let me confirm that the Google Messages app for SMS does show link previews with no way to disable them.
"Expressive animations" are yet another vector because their rendering can be exploited.
As for MMS, it is a known prominent risk.
> [Paragon] has said that [...] it only does business with democracies. It has also said it has a no tolerance policy and will cut off government clients who use the spyware to target members of civil society, like journalists.
> Paragon also refuses to disclose who its clients are and has said it does not have insight into how its clients use the technology against targets.
Well colour me convinced!
<removed by me>
The latter suggests it has no ability to know the former.
Yeah, that's what I was getting at.
The nature of the exploits is surely secret, but I wonder if Lockdown Mode is at all effective at blocking these attacks.
The amount of companies actively using Israeli spyware like BrightData and Imperva is outstanding. All their data goes through their networks. I don't trust any government led site because they are all incredibly incompetent and corrupt. The United States is on their last legs.
I feel the key change we as civilians need is to move to a non-local stored detail. Where our devices are access points to decentralised mesh networked apps. These companies and governments have been proven time and time again to not obey appropriate measures for invalid reasoning.
I don’t think what you are proposing is going to work!!
> Where our devices are access points
Then that would be your exposure
All other things being equal, local storage is always going to be preferable to cloud storage, because the surface of attack is intrinsically limited by the need for having the physical device in hand.
Important story for sure, but this reporting is subpar IMO.
> When it is successfully deployed against a target, the hacking software – called Graphite – can hack into any phone. By essentially taking control of the mobile phone, the user – in this case, Ice – can not only track an individual’s whereabouts, read their messages, look at their photographs, but it can also open and read information held on encrypted applications, like WhatsApp or Signal. Spyware like Graphite can also be used as a listening device, through the manipulation of the phone’s recorder.
"When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)? Is there a background whistleblower between the lines here, or is this just paraphrasing the Wired reporting from last year?
> John Scott-Railton, a senior research at the Citizen Lab at the University of Toronto, who is one of the world’s leading experts on cases in which spyware like Graphite has been abused by governments, said in a statement that such tools “were designed for dictatorships, not democracies built on liberty and protection of individual rights”.
Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this).
> The US government has in the past resisted using spyware technology made outside the US because of concerns that any company that sells technology to multiple government agencies around the world represents a potential security risk.
Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming.
> “As long as the same mercenary spyware tech is going to multiple governments, there is a baked-in counterintelligence risk. Since all of them now know what secret surveillance tech the US is using, and would have special insights on how to detect it and track what the US is doing with it,” Scott-Railton said. “Short of Paragon cancelling all foreign contracts, I’m not sure how this goes away.”
...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it.
But how this goes away is: we learn how the exploit works and develop countermeasures.
The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen?
The discussion on the front page of HN yesterday on the thread, "We should have the ability to run any code we want on hardware we own" was refreshing and felt like the first real consensus we've had around here on this topic in several months. Specifically, it seems like we all now agree that our mobile devices have reached a combination of complexity and (state-assisted) corporate control that they are no longer safe for everyday use.
And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power.
I do not believe that there is an avenue for addressing this via institutional influence - the cited examples of Saudi Arabia, Italy, and the United States, despite having dramatically different configurations of state authority (and, probably in most people's minds, levels of legitimacy as states in the first place), all present identical attack surfaces in the face of "Graphite" and similar exploits.
The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat.
I don’t suppose anything a bit less-serious is available to normies?
I have a iphone that died on vacation and was set to backup only on WiFi (I’ve since changed that setting, haha, whoops) and has a couple days of photos stuck on it that weren’t backed up. It boots and makes noise but the screen is dead. Uncertainty about how broken it is has kept me from paying the not-cheap cost to get a screen replacement, and I haven’t found a way to read its data over a cable without unlocking via the screen first (which doesn’t work, and its touch-sensing capacity also seems to be dead, so blind input doesn’t do it, or else I could probably unlock it with a couple tries and get it to connect to WiFi it already knows and do its backup, but it won’t do that without being unlocked)
Gotta say, you sound hypercritical.
> "When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)?
This is not a research paper where the guardian needs to go into those details. Those details are known based on previous incidents/issues and general knowledge.[1]
> Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this).
Guardian articles are pretty short. They're not going to quote someone when all they are trying to get is that these are risky tools that invite abuse. So they interviewed an expert who could give a quote to that effect. Why is that shovelled in? This is very much "WHY" someone should care. It's a core tenant of journalism, don't just present what - but also some analysis for what it means.
> Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming.
Yeah, are they going to link to 30 different articles and so forth? Here you go, a quick reference: [2]
> ...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it.
Why does any of the quote sound cherry-picked? The context seems clear: other governments use this tool, if USG does too, then other governments know the capabilities. It's an intrinsic problem. Seems to be completely conveyed via the quotes, and that was presumably the reason to interview this additional person.
> The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen?
How this happens is WAY out of scope of the article. This is a general news article that is around 300 or so words. It's not a security bulletin or a tech focused article. Why do you expect these details? Can you give any other examples from say the LaTimes, BBC.co.uk, or any other similar news services?
> And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power.
This does seem implied. The quote "were designed for dictatorships, not democracies built on liberty and protection of individual rights" is really saying this, no? Like, it's saying exactly, this technology is a concern because it can be abused and is a tool for authoritarian countries and not democracies.
> The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat.
I agree with your premise here. In this case, the article that the USG is adopting these tools should be well alarming to you.
[1] https://citizenlab.ca/2025/06/first-forensic-confirmation-of...
[2] https://www.federalregister.gov/documents/2023/03/30/2023-06...
Well you're certainly correct, as a tech person i'm nonetheless always disapointed by mainstream media reporting on these things as the "how" and "what" bit is by far more interesting to me than anything in the article.
The actual article is pretty old news and uninteresting - yes US police have used spyware for "surveilence". This is not new by any means. Similarly a number of Israeli private companies have made a name for themselves selling spyware software on, lets say the grey market. This is well known by now.
The only interesting thing to know would be how this particular piece of software works.
Yeah I thought it was widely known that "deploy" could be as simple as sending a text message. The recipient did not even need to open in in the case of Pegasus.
So you're presuming that there is an exploit that allows a remote attacker to install "Graphite" via a text message? That is not stated here - or anywhere - as it was over and over again in the case of Pegasus (and similarly, the trumpets sounded when the patch was fixed a couple weeks later).
The reporting here is markedly more imprecise, and it's frustrating.
Ehud Barak was on Paragon's board of directors. Barak also invested with Epstein in Carbyne:
https://www.jns.org/jns/benjamin-netanyahu/23/6/2/292333/
Other data collection/surveillance software from the Epstein circle include PROMIS (Robert Maxwell allegedly sold a backdoored version), Chiliad (FBI search software, Christine Maxwell, seems legit) and CargoMetrics (Ghislaine Maxwell's husband, maritime container tracking).
[flagged]
[flagged]
Hardly a democracy when it occupies Palestine, and Palestinians can't vote in Israeli elections.
Allowing the population of an occupied territory to vote in elections of the occupying power is illegal under international law.
Generally speaking, in theory, the occupying power is supposed to be a care taker - they aren't supposed to take any action that integrates the occupied territory into the main territory. Allowing occupied territories to vote in the occupying power's elections is considered a form of integration. Doing so is considered acquiring territory via annexation, which is illegal under the UN charter.
(See for example Israel when the international community yelled at them for allowing people in Golan Heights to vote).
So the question is whether Israel is a democracy. If a state both maintains an occupation and denies the occupied population political rights, then it is not democratic (even if the dominant ethnic group and some others are allowed to vote).
At its core, democracy requires political equality. The governed people must have a meaningful say in who governs them and how. That is not present in Palestine due to Israeli occupation.
It allows Israelis to vote, including Jewish settlers in occupied territories, but it does not allow occupied Palestinians (many of whom live right next to settlers) to vote.
While your point about international law is technically correct, it is also a masterclass in deliberate evasion. You are not engaging with OP's argument, but you're using a legal footnote to sidestep the clear and openly stated intent of the system he's condemning. Leading human rights organizations like Amnesty International and Human Rights Watch have a precise legal term for this system, which is built on that very intent: apartheid. [1][2] "Israel is not, cannot be democratic based on Jewish superiority - No honest Israeli citizen can claim that the Palestinian citizens of Israel live as equal citizens in the State of Israel." [3]
This isn't a secret. Israeli officials have long been explicit that their policies are guided by the goal of maintaining demographic control. As Netanyahu declared, "Israel is not a state of all its citizens... but rather the nation-state of the Jewish people and only them." This driving intent is what gives rise to the entire apparatus of control. It is legally enshrined in constitutional law through the 2018 Nation-State Law, which reserves the right of self-determination for Jews alone. This legal supremacy is then enforced through a two-tiered justice system in the West Bank, where Israeli settlers are governed by rights-respecting civil law while their Palestinian neighbors are subjected to draconian military orders. This judicial separation, in turn, enables the physical re-engineering of the land: a state policy of systematic land dispossession confiscates Palestinian property for settlements, while a discriminatory planning regime makes it nearly impossible for Palestinians to build, leading to routine home demolitions. The ultimate result is the deliberate fragmentation of Palestinian life into disconnected enclaves, which B'Tselem calls 'territorial islands' carved up by walls, checkpoints, and permit regimes designed to sever social and political ties.
Your narrow focus on the procedural illegality of a vote under occupation law is a calculated deflection from this reality. The disenfranchisement of Palestinians is not an incidental legal problem, it is a fundamental and necessary pillar for maintaining this regime of apartheid. You are meticulously explaining the legality of the lock on the cage, while deliberately ignoring that the crime is the cage itself.
[1] https://www.hrw.org/report/2021/04/27/threshold-crossed/isra...
[2] https://www.amnesty.org/en/latest/campaigns/2022/02/israels-...
[3] https://www.jpost.com/opinion/article-734439
> You are not engaging with OP's argument
You're making a different argument then the person I am responding to.
The person I am responding to only said: "Hardly a democracy when it occupies Palestine, and Palestinians can't vote in Israeli elections." [Presumably they meant citizens of Palestine here, since Israeli citizens living in Israel who are ethically palestinian can vote]
Simply put, that is an unreasonable criticism as Israel is simply following international law. Other countries do the same. If they did not do this they likely would recieve criticism. People who don't like it should encourage the international community to change international law.
That doesn't mean that every possible criticism of Israel is unreasonable (in fact there are many reasonable criticisms you could make), only that the one i was replying to is unreasonable.
The rest of your post is irrelavent because its talking about arguments that neither I nor the person I was responding to made. That said, i think the way you are quoting is misleading, but that is neither here nor there.
You're right, I am making a bigger argument. That's because pbiggar's point about voting is impossible to understand without it. It's a symptom, and you are trying to discuss it while pretending the disease i.e a system of apartheid, as defined by international law, is "irrelevant". And this system isn't just a feature of the occupation. It is foundational to the state itself, a reality even zionists are forced to admit. As a Jerusalem Post op-ed concedes, "No honest Israeli citizen can claim that the Palestinian citizens of Israel live as equal citizens in the State of Israel."[0]
Your apologia that Israel is "simply following international law" is perverse. Everybody knows that Israel has never in its entire history, since its inception, ever given a fuck about international law, which makes your apologia extra comical. Furthermore, you are elevating a single procedural rule above one of the gravest prohibitions in the entire legal order, the crime against humanity of apartheid. The rule you cite is not a shield against this crime, it's a tool used to facilitate it. By forbidding political integration, the system enforces the very demographic separation required to maintain an apartheid state. Your claim that "other countries do the same" is a baseless false equivalence that ignores the unique permanence and stated demographic goals of the Israeli apartheid system. And your deflection that we should "change international law" is an unserious diversion. The international community doesn't need to change the laws, it needs to hold these genocidal zionists accountable for violating the most fundamental ones that already exist. Your entire response is a performance of pedantry to avoid acknowledging a criminal reality which, for almost a century, has been inflicting hell upon the natives whose land zionists have been brutally colonizing with absolute impunity - culminating in the predictable conclusion of Genocide[1][2][3][4][5].
You are defending the apartheid system by pointing to a single, well-oiled gear, while deliberately ignoring that the entire machine is designed to make a mockery of international law.
[0] https://www.jpost.com/opinion/article-734439
[1] https://www.jewishvoiceforlabour.org.uk/article/prof-amos-go...
[2] https://jewishcurrents.org/a-textbook-case-of-genocide
[3] https://www.ohchr.org/en/press-releases/2024/11/un-special-c...
[4] https://www.amnesty.org/en/latest/news/2024/12/amnesty-inter...
[5] https://www.theguardian.com/world/2025/sep/01/israel-committ...
It's odd this has been downvoted. There isn't anything factually incorrect. All statements have been proven.
Because it has nothing to do with the story, perhaps?
I would say it is relevant as it shows that the company are potentially being dishonest about their intentions and marketing.
Every Israeli is drafted when reaching adolescence age. Intelligent tech people end up in Unit 8200 (part of IDF). These young people end up with a plethora of experience, using it for their career or even security related startups, yet loyalty often lies with state of Israel.
The legal presence / country of a company very likely performing a genocide is very much relevant and ontopic. Look up the dark history of companies like IBM and IG Farben and the term "Wir haben es nicht gewußt".
It speaks to the credibility of the people involved when they claim to protect journalists.
Actually, nothing of this has ever been proven - it was claimed and repeated thousands of times - but nothing of this is considered a proof in the real world.
If you ignore any statement other than form the Israeli government then sure
> The world's leading association of genocide scholars has declared that Israel is committing genocide in Gaza.
> A resolution passed by the International Association of Genocide Scholars (IAGS) states that Israel's conduct meets the legal definition as laid out in the UN convention on genocide.
> Across a three-page resolution, the IAGS presents a litany of actions undertaken by Israel throughout the 22-month-long war that it recognises as constituting genocide, war crimes and crimes against humanity.
And then there’s
> B'Tselem and Physicians for Human Rights-Israel released separate reports on Monday based on studies of the past 21 months of conflict. The organisations, which have been active in Israel for decades, said in a joint statement that "in these dark times it is especially important to call things by their name", while "calling on this crime to stop immediately".
What level of proof would you find acceptable?
Not a single one of these is even close to be a proof. All of them are just opinions of specific groups of people - most of them have their own agenda, so they can't even be considered to be unbiased opinions.
If we're talking about legal evaluation, then there is a strict formal procedure that collects and evaluates the evidence from both sides controlled by lawyers. And after the court comes to a final conclusion including appeals or whatever steps are provided by the legal system, then you may claim that something was proven.
For a scientific proof, the procedure is much more complex - basically you start with a claim and then you have to disprove or invalidate EVERY SINGLE opposite claim, fact or evidence. And there is actually no time limit here - scientists are still trying to disprove theories from the 17th century.
This is how things work in real world.
We are after legal proof, not scientific proof. Science is too slow to stop genocide from occurring and hold those accountable.
Netanyahu is wanted for warcrimes by ICC. Is he convicted? No, he is a suspect. Is he trying to avoid getting arrested? Yes, just like Putin. Both of these countries are likely to have recently commmited warcrimes.
After WWII and 'Wir haben es nicht gewußt' we set up international organizations to avoid this happening again. Unfortunately, not everyone recognizes these organizations but that is also a tell tale of their intentions.
there are a couple of problems with these "international organisations": first and foremost - they are created by the few former colonial powers who were never hold accountable for their own war crimes - but instead gave them the additional power to judge over their former victims (and the rest of the world).
the second point is - these organisations are used to cement the status quo - which is also created by the colonial powers and has absolutely nothing to do with the reality in the world - thus on one hand making all conflicts unavoidable and on the other hand mostly illegal.
the third point is - the rules are not applied to all countries in the same way - e.g. Turkey occupied half of Cyprus and displaced a large part of its population, Turkey is bombing innocent people in Syria, Turkey keeps refugees that originally headed to Europe under very inhuman conditions - not only there are no sanctions for that, Europe is basically funding all of this. As Russia occupied Georgia and annexed parts of it, there were no investigations, no sanctions, nothing. As China occupied Tibet, there were no sanctions but huge investments instead. And there are many more examples.
If you want to have an accepted legal system then it may not be biased and has to apply to everyone without exceptions - what we have at the moment is not even a joke. It's the opposite of a legal system.
It seems unwise to require centuries of investigation before we can start talking about an ongoing genocide.
That IAGS report lacks any credibility: https://www.timesofisrael.com/genocide-scholar-says-group-pu...
https://www.ohchr.org/en/press-releases/2024/11/un-special-c...
I'm curious what your angle here will be - that these events never happened, that these events don't constitute genocide, or that this isn't "proof."
Are you kidding me - of course it's not a proof. It's already in the description - they are not claiming that they have proven something - they just say it looks like something. It's not even an opinion.
You are dreadfully insistent on proof yet provide none of your own that there is no genocide, despite multiple credible organisations and experts, and the consensus of the international community, contradicting you.
Okay, so the third thing. You believe Israel is doing things that constitute genocide, but also that nobody has proved it.
I would say at this point given government statements and declarations and then actions that occur directly after prove they have broken international law
Not really - it may be sufficient for you to develop an opinion, but it definitely not a legal proof.
Just because a court hasn't said it doesn't mean that it isn't proven.
If, someone proves something, it's proven right then and there, even if it takes years for people to understand it, or for it to make its way into textbooks. This stuff really is very obvious.
most obvious things are often enough the mostly wrong ones - this is why everyone was sure for centuries that the Earth is flat or that the Sun and stars are orbiting the Earth. and this is why people invented specific protocols to ensure (or at least come close to) correctness of theories. these are called proofs.
and, for example - if you are using one specific LEGAL definition of a genocide then you have to prove LEGALLY, following the regular process. if you're not doing it, then it's per definition not a proof.
> this is why everyone was sure for centuries that the Earth is flat
Nope. There was a pretty smooth transition from "Nobody has ever wondered about this" to "All educated people know it's a ball shape" a very, very long time ago.
Eratosthenes comes up with a pretty good approximation both for how big the ball is, and how much its axis is off (you also if you think about it realise the planet must be spinning, that's why there's a day-night cycle)
Flat Earthers are a weird modern thing, they aren't somehow a remnant.
It's nice when people, countries, and organizations can collaborate to make the world safer.