Surprise: NSO Group Pegasus Is in the News Again
July 28, 2022
On July 27, 2022, the winger wonder Pegasus cast a shadow over the desks of the House Intelligence Committee. The flapping of the mythical creatures wings could not be stilled. Gavel pounding, heavy breathing from lobbyists in the gallery, and convoluted statements by elected leaders did not cause the beastie to fly away. Nope. Pegasus with its NSO Group logo branded on its comely haunch was present. Even mythical creatures can leave behind a mess.
And it appears as if the mess is semi-permanent and odiferous.
“We’re Likely Only Seeing the Tip of the Iceberg of Pegasus Spyware Use Against the US” states:
US lawmakers heard testimony from Citizen Lab senior researcher John Scott-Railton; Shane Huntley, who leads Google’s Threat Analysis Group; and Carine Kanimba, whose father was the inspiration for Hotel Rwanda and who was, herself, targeted by Pegasus spyware. This, of course, is the now-infamous malware that its developer, Israel’s NSO Group, claims is only sold to legitimate government agencies — not private companies or individuals. Once installed on a victim’s device, Pegasus can, among other things, secretly snoop on that person’s calls, messages, and other activities, and access their phone’s camera without permission.
I like the Hotel Rawanda reference. Younger elected officials may not know much about intelware, but they definitely know about the motion picture in my opinion. Hutus Tutsis and a big box office. A target of Pegasus. Credibility? Yep.
The hearings continue of July 28, 2022. According to the article:
Schiff called NSO’s software and similar eavesdropping tools “a threat to Americans,” and pointed to news reports from last year about cellphones belonging to US diplomats in Uganda being compromised by Pegasus. It is my belief that we are very likely looking at the tip of the iceberg, and that other US government personnel have had their devices compromised, whether by a nation-state using NSO’s services or tools offered by one of its lesser known but equally potent competitors,” Schiff said.
Google — the go to source for objective information — is allegedly tracking 30 firms “that sell exploits or surveillance capabilities to government-backed groups.
Just 30? Interesting, but, hey, Google knows surveillance cold I suppose.
A handful of observations:
- NSO Group’s Pegasus continues to capture attention like a Kentucky Derby winner which allegedly has banned substances rubbed on its belly. Some of those rub ons have a powerful scent. Even a boozy race track veterinarian can wince when checking a specific thoroughbred’s nether region.
- The knock on effect of NSO Group’s alleged management oversight means that scrutiny of intelware companies is going to spotlight the founders, funders, and stakeholders. I think this is like a deer standing on railroad tracks mesmerized by the bright white light heading down the rails at 60 miles per hour. In the train versus deer competitions in the past, trains hold a decided advantage.
- Individual companies in the specialized software business face an uncertain future.
How uncertain?
Regulations and bans seem to be on the menus in a number of countries. Also, there are a finite number of big dollar contracts for specialized software and smaller firms are going to have to get big fast, sell out to a larger company with multiple lines of law enforcement, defense, and intelligence revenue, or find a way to market without marketing “too well.”
And the “too well”?
Since NSO Group’s spotlight appearances, smaller intelware companies have had to be very careful abut their sales and marketing activities. Why? There are reporters from big time newspapers nosing around for information. There are online podcasts which have guests who talk about what specialized software can do, where the data originate, and how a “food chain” of information providers provide high value information. There are the tireless contributors of Twitter’s #OSINT threads who offer sometimes dumb and less frequently high-value nuggets about specialized services vendors. Finally, there are the marketers at specialized services firms themselves who use email blasts to tout their latest breakthroughs. Other small specialized software vendors prowl the niche law enforcement and intelligence conferences in search of sales leads. In some cases, there are more marketers than there are individuals who can license a data set, an analytics package, or the whole enchilada needed to monitor — how shall I phrase it — comprehensively. These energetic marketers learn that their employer becomes a journalist’s subject of interest.
Net net: When I reflect on the golden years of specialized software and services marketing, testing, and deploying, I have one hypotheses: NSO Group’s visibility has changed the game. There will be losers and a very few big winners. Who could have foreseen specialized software and services working like a bet on the baccarat tables in Monaco? Who anticipated NSO Group-type technology becoming “personal” to the US? I sure did not. The light at the end of the tunnel, once the train clears the deer, is that the discipline of “marketing without marketing too much” may become mainstream in France, Germany, Israel, Switzerland, and the US. I hear that train a-comin’ do you?
Stephen E Arnold, July 28, 2022
Academics Can Predict Crime: What about Close Enough for Horseshoes Accuracy?
July 6, 2022
I have no phat phaux phrench bulldog in this upcoming academic free-for-all. I read “Algorithm Predicts Crime a Week in Advance, But Reveals Bias in Police Response.” Yellow lights flash.
The article is a summary of a longer research paper published by wizards at the University of Chicago, an outstanding institution located in a safe, well-lit, and community-oriented area of Chicago. Home of the Bears and once the literal stomping grounds of the P Stone Nation. (And, Yes, I am intentionally leaving part of the gang’s name out of my reference. Feel free to use the full gang name yourself.)
The write up says:
Data and social scientists from the University of Chicago have developed a new algorithm that forecasts crime by learning patterns in time and geographic locations from public data on violent and property crimes. The model can predict future crimes one week in advance with about 90% accuracy.
Predicting crime a week before the incident or incidents sounds like an application of predictive analytics. I think there was an outfit which started at Indiana University which came up with something similar. That system attracted some attention and some skepticism.
But humans are curious and applying mathematical recipes to available data is for some an interesting way to pursue grants, publicity, and maybe some start up funding.
But 90 percent. That begs the question, “What about that other 10 percent?” How low does the model go for acceptable outputs? Maybe 60 percent confidence? Maybe lower?
The write up continues:
Previous efforts at crime prediction often use an epidemic or seismic approach, where crime is depicted as emerging in “hotspots” that spread to surrounding areas. These tools miss out on the complex social environment of cities, however, and don’t consider the relationship between crime and the effects of police enforcement.
I know I have mentioned Banjo (now SafeX AI) and the firm’s patents. Some of these patent documents provide useful summaries of some of the algorithms used in predictive models. What’s strikes me as important about math-centric outputs is that methods are useful — up to a point. I have a canned lecture which identifies the 10 most used mathy methods and identifies how the data sets going in can be poisoned by an intentional actor. The culprit can be smart software generating data in the manner of AI synthetic data systems or by humans working for a government funded entity in St. Petersburg, Russia.
However, there have been a few high hurdles predictive systems have to jump over in a clean, fluid manner; for instance:
- Identifying and filtering certain data. Bad data can have a significant impact of the outputs. My recollection is that analysis of a predictive system in California revealed wide variation in the collection of data and the consistency of the data from both humans and automated sources
- Refining actionable outputs. Some of these outputs are often wide of the mark. This means that scarce resources may be deployed on a wild goose chase or investigation of actors who are not “bad” or involved in an incident
- Real time not correlating with the past. Numerous contextual issues arise in real time, and predictive systems operate in what I call a time disconnected mode. For those on the pointy end of the stick, this time variance can create a situation in which the predictive outputs are not just a few degrees off center, they are orbiting around a beach club in Bermuda.
If you want to read the entire academic “we have cracked this problem” article, navigate to this link. You will have to pay to read this remarkable article.
Stephen E Arnold, July 6, 2022
AT&T Innovation: I Thought Banjo Anticipated This Functionality
May 11, 2022
I read “AT&T Will Use Phone Location Data to Route 911 Calls to the Right Responders.” I thought that Banjo (now SafeXai) described a similar function. I thought I read a Banjo patent or two referencing the firm’s systems and methods. Despite this historical thought, I noted this statement in the article:
The company says it’ll be the first US carrier to “quickly and more accurately identify where a wireless 911 call is coming from using device GPS and hybrid information.” That’ll allow it to route the call to the correct 911 call center (public safety answering point or PSAP) which can then “dispatch first responders to the right location faster…
Banjo changed its name, but before its management shift, the company filed and obtained a number of forward-leaning patents. I recall that one of them provided a useful shopping list of off-the-shelf technologies used in smart software. If anyone is curious, the Banjo patents referencing what I think is a similar notion include US10585724, “Notifying entities of relevant events”, US10582343, “Validating and supplementing emergency call information,” and several others. I recall reading patents held by AT&T which reference this capability. I wonder how many firms can use mobile data to provide useful services to first responders, law enforcement, and intelligence entities. Once a system and method are disclosed, individuals can replicate or exploit some systems.
Collecting data via an app’s software is made more useful with real-time data from other collection points. The value of cross-correlation of data is quite high. I find it interesting that basic LE and intel methods continue to poke their nose through the heavy cloud cover over certain interesting systems and methods. I do long for the days when certain information was secret and kept that way.
Stephen E Arnold, May 11, 2022
NSO Group Knock On: More Attention Directed at Voyager Labs?
April 12, 2022
Not many people know about Voyager Labs, its different businesses, or its work for some government entities. From my point of view, that’s how intelware and policeware vendors should conduct themselves. Since the NSO Group’s missteps have fired up everyone from big newspaper journalists to college professors, the once low profile world of specialized software and services has come to center stage. Unfortunately most of the firms providing these once secret specialized functions are, unlike Tallulah Bankhead, ill prepared for the rigors of questions about chain smoking and a sporty life style. Israeli companies in the specialized software and services business are definitely not equipped for criticism, exposure, questioning by non military types. A degree in journalism or law is interesting, but it is the camaraderie of a military unit which is important. To be fair, this “certain blindness” can be fatal. Will NSO Group be able to survive? I don’t know. What I do know is that anyone in the intelware or policeware game has to be darned careful. The steely gaze, the hardened demeanor, and the “we know more than you do” does not play well with an intrepid reporter investigating the cozy world of secretive conferences, briefings at government hoe downs, or probing into private companies which amass user data from third-party sources for reselling to government agencies hither and yon.
Change happened.
I read “On the Internet, No One Knows You’re a Cop.” The author of the article is Albert Fox-Cahn, the founder and director of STOP. Guess what the acronym means? Give up. The answer is: The Surveillance Technology Oversight Project.
Where does this outfit hang its baseball cap with a faded New York Yankees’ emblem? Give up. The New York University Urban Justice Center. Mr. Fox-Cahn is legal type, and he has some helpers; for example, fledgling legal eagles. (A baby legal eagle is technically eaglets or is it eaglettes. I profess ignorance.) This is not a Lone Ranger operation, and I have a hunch that others at NYU can be enjoined to pitch in for the STOP endeavor. If there is one thing college types have it is an almost endless supply of students who want “experience.” Then there is the thrill of the hunt. Eagles, as you know, have been known to snatch a retired humanoid’s poodle for sustenance. Do legal eagles enjoy the thrill of the kill, or are they following some protein’s chemical make up?
The write up states:
Increasingly, internet surveillance is operating under our consent, as police harness new software platforms to deploy networks of fake accounts, tricking the public into giving up what few privacy protections the law affords. The police can see far beyond what we know is public on these platforms, peaking behind the curtains at what we mean to show and say only to those closest to us. But none of us know these requests come from police, none of us truly consent to this new, invasive form of state surveillance, but this “consent” is enough for the law, enough for the courts, and enough to have our private conversations used against us in a court of law.
Yeah, but use of public data is legal. Never mind, I hear an inner voice speaking for the STOP professionals.
The article then trots through the issues sitting on top of a stack of reports about actions that trouble STOP; to wit, use of fake social media accounts. The idea is to gin up a fake name and operate as a sock puppet. I want to point out that this method is often helpful in certain types of investigations. I won’t list the types.
The write up then describes Voyager Labs’ specialized software and services this way:
Voyager Labs claims to perceive people’s motives and identify those “most engaged in their hearts” about their ideologies. As part of their marketing materials, they touted retrospective analysis they claimed could have predicted criminal activity before it took place based on social media monitoring.
Voyager Labs’ information was disclosed after the Los Angeles government responded to a Brennan Center Freedom of Information Act request. If you are not familiar with these documents, you can locate at this link which I verified on April 9, 2022. Note that there are 10,000 pages of LA info, so plan on spending some time to locate the information of interest. If you want more information about Voyager Labs, navigate to the company’s Web site.
Net net: Which is the next intelware or policeware company to be analyzed by real news outfits and college professors? I don’t know, but the revelations do not make me happy. The knock on from the NSO Group’s missteps are not diminishing. It appears that there will be more revelations. From my point of view, these analyses provide bad actors with a road map of potholes. The bad actors become more informed, and government entities find their law enforcement and investigative efforts are dulled.
Stephen E Arnold, April 12, 2022
Some Cellebrite Customers Revealed
March 11, 2022
This headline from Apple Insider should not be surprising, but it is bound to shock some individuals: “Most US Cabinet Departments Have Bought Cellebrite iPhone Hacking Tool.” The Intercept reported that fourteen out of the fifteen US Cabinet Departments purchased Cellebrite, technology designed to unlock Apple iOS.
Cellebrite is a common tool law enforcement, government agencies, military personnel and bad actors use to unlock iPhones. It is globally used. All of the major US Cabinet Departments, sans one, are not the only government entities that use Cellebrite:
“The Intercept claims that Federal purchasing records and Cellebrite securities documents seen by the publication, also show that several other federal agencies. Government buyers of Cellebrite include:
- Centers for Disease Control and Prevention
- Department of Agriculture
- Department of Education
- Department of Veterans Affairs
- Housing and Urban Development
- Social Security Administration
- US Agency for International Development
- US Fish and Wildlife Service
In those securities filings, the Cellebrite company reported having over 2,800 government customers in North America.”
Cellebrite has other major clients, including six out of the ten largest oil refiners and six out of then largest pharmaceutical companies. Cellebrite is a tool used by those with money and power. The bigger question is if the so-called “good guys” are using it for good or if they use Cellebrite in the same manner as the bad actors.
Whitney Grace, March 11, 2022
Clearview Aims to Collect Every Face, and More
March 4, 2022
Chances are, Clearview already has a record of your face. In fact, reports Silicon Republic, “Clearview AI Plans to Put Almost Every Human Face in its Database.” At least that is what it has told its investors, according to documents obtained by The Washington Post. Writer Leigh Mc Gowran reports:
“Clearview AI, which describes itself as ‘the world’s largest facial network’, has built a database that currently holds more than 10bn ‘publicly available facial images’ taken from the web. It works with customers such as law enforcement agencies to compare facial data against its database. The US-based company has said this database is the ‘largest known of its kind in its industry’. A financial presentation the company created last December goes further than this publicly available statement. In this document, Clearview claimed it already has 11 times more facial recognition data than any government or non-government entity today. The facial recognition company claimed to be ‘achieving rapid international expansion’. It said it has more than 3,000 security and law enforcement customers in the US, including the FBI and ICE, according to documents shared by Washington Post tech reporter Drew Harwell on Twitter. … Clearview’s technology roadmap goes even further, with plans to develop services such as licence plate recognition, movement tracking and contactless fingerprint recognition. Last month, Clearview AI announced that it was awarded a US patent for a facial recognition capability that performed ‘nearly flawlessly’ in vendor tests.”
It sounds like the company is on a roll. All this despite increased regulatory pressure in several countries. The ACLU and authorities in Australia, Canada, and the UK have all taken action of one sort or another against the company. Meanwhile, mass biometric surveillance in general is being challenged in the EU. A couple companies have reversed course on the technology—Meta (formerly known as Facebook) pledged to delete the facial recognition data it had collected, and IBM promised to jettison its facial recognition and analysis software. For those firms, however, creepy AI was just part of the mix. Such software is Clearview’s entire game, and it seems determined to forge ahead with no regard for attempts to rein it in.
Cynthia Murrell, March 4, 2022
NSO Group: Dominoes, Anyone? Anyone?
March 1, 2022
In December 2021, the Zuckbook outfit released a report called “Threat Report on the
Surveillance-for-Hire Industry.” If you want to read this 17-page document, navigate to this url. If the document is disappeared, well, that’s life.
I wasn’t going to write about the banning of these intelware vendors’ firms:
- BellTroX
- Black Cube
- Bluehawk CI
- Cobwebs Technologies
- Cognyte
- Cytrox
And, according to the Zuck’s experts, a couple of Chinese outfits were in the list. I don’t want to hazard a guess, so let me say there are more than two of these types of firms chugging away in the Middle Kingdom.
A flurry of reports surfaced last week, including a report from My QtoA. You can read the summary at this link.
My take on this Zucking of specialized software and services firm is that I really want to ignore the impact NSO Group has had on a much needed and necessary market sector. What is unfortunate is that the Wild West, cowboy, and Silicon Valley “let’s get rich” mentality has diffused into what once was a secret carefully husbanded by government agencies.
Well, obviously, quite a few people, including bad actors, know about Pegasus and something about how it functions. The zero click compromising of a mobile device popped up in a recent phone call with a fellow who operated a trash hauling service. There you go. That’s diffusing if yo8u ask me.
Has the craziness caused by digital Marshal Dillons and their sidekick Chesters stopped? Probably not.
Another knock on that has not exhausted its momentum is the chatter at certain conferences about waiting for the storm to blow over. Yeah, hopeful and optimistic as the dominoes continue to topple. Perhaps the cowboys will hit the bunk house and think about something other than becoming rich and buying discounted yachts once owned by Russian oligarchs.
Stephen E Arnold, March 1, 2022
NSO Group: Now Taking Legal Action to Protect Its Image
February 28, 2022
I am not sure how long this story will be online with legal eagles from media and the intelware company NSO Group taking flight. The story is “NSO Sues Israeli Paper after Explosive Articles on Police.” [Note: The estimable Associated Press may remove the MFTV 9 story or put it behind a paywall where great content should thrive.] The original story whipped up a buzz saw of chatter about one of the more high profile surveillance systems. The Pegasus brand has been trampled by the plodding mules ridden by individuals unaware of the specialized software and services business, their customers, and the unreasonable effectiveness of zero click exploits.
The write up states that NSO Group went to court and demanded that the Calcalist be held to account for a story which is allegedly not true.
And what does NSO Group want? About $300,000 US dollars.
This is an interesting story with security and political implications. But the Kosher Mehadrin margarine on the kubaneh is the charity angle. Is that a PR move by NSO Group?
What’s fascinating to me is that the NSO Group has found a way to remain in the news despite recent events in Ukraine, financial turmoil in financial markets, and the headline making mask wearing thing.
Is this helping or hurting the intelware and policeware vendors? From what I hear, the NSO Group’s PR generating activities has not had a significant impact on vendors based outside of Tel Aviv. Israeli vendors find that some of their MBA-inspired enthusiasm for expanding their market share has been dialed back.
A bigger problem for specialized services and software companies is that knowledge has diffused widely so that start ups operated by good actors and maybe less good actors are popping up. Plus, some of the once secret systems and methods are creeping into the open source software environment.
Maybe secrecy has some value when it comes to government related activities?
Stephen E Arnold, February 28, 2022
Information Allegations Directed at Some Law Enforcement Entities
January 26, 2022
Before the advent of modern technology, police states were limited in the amount of surveillance they could conduct. As technology advances, the amount of information police can extract from people’s devices is as scary as science fiction. El Poder Deportivo explains a frightening surveillance tool US police are now using: “AI-Driven People Surveillance: US Cops Reportedly Utilizing Invasive Tool To Grab Candidates’ Social Media Marketing, Pornhub and Tinder.”
Police in Michigan are using a tool called SocialNet that captures data from social media and other pertinent Web sites. ShadowDragon is responsible for inventing SocialNet. Unfortunately or fortunately, depending on your political stance, Michigan is not the only state that is ShadowDragon’s customers. Massachusetts and the US Department of Immigration are on that list.
Law enforcement officials are not broadcasting they are using SocialNet, but the information it is in use is available after a little detective work. Michigan nor ShadowDragon admit what agencies are using SocialNet, but documents show that it was purchased through a third party called Kaseware.
Local and state governments spent a lot of money on the SocialNet application. Authorities are also whitewashing their justification for purchasing and using SocialNet.
It is not surprising that US police are using advances tools to collect people’s personal information. Law enforcement and governments have been doing that for centuries. The bigger question to ask if the US police are collecting the information lawfully or illegally?
“Likening ‘predictive policing’ to ‘AI-driven racial profiling and society surveillance,’ the United states Civil Liberties Union (ACLU) Michigan workplace observed that ShadowDragon tools broken the “basic right to confidentiality.” In a number of tweets, the ACLU required the usage of such hardware https://datingmentor.org/escort/pomona/ to finish.”
SocialNet will probably be used in both positive and negative ways. It will capture plenty of evidence to put bad actors behind bars as well as hinder individuals who the governments do not like. In the wake of the NSO Group’s publicity tsunami, more specialized software vendors are likely to be subject to scrutiny.
Whitney Grace, January 26, 2022
ShadowDragon Profiled by Esteemed Tech Expert Kim Komando
January 13, 2022
This is an interesting turn of events. Policeware vendor ShadowDragon has been profiled by computer guru-ette Kim Komando on her Tech Refresh podcast episode, “Software Tracking Everything You Do, New iPhone, Alexa on Wheels.” The video’s description reads:
“Have you heard of ShadowDragon? It collects data from 120 major sites going back a decade. Yes, 10 years of info about YOU. Plus, the iPhone 13 and iOS 15 are here, along with Amazon’s new smart home gear, including Astro, the Echo on wheels.”
Yes, we have heard of ShadowDragon. The security company mines data from more than 120 social-media websites, archives results for a decade, and shares the information with its law-enforcement clients around the world. ShadowDragon boasts its software can take an investigation down “from months to minutes.” The podcast starts discussing the company at timestamp 13:05, warning one would have to refrain from social media altogether to avoid its reach. The inclusion seems to support our prediction that reporters are becoming more aware of, and reporting more on, such specialized service vendors. This will make it harder for such firms to keep their generally preferred low profiles. Based in Cheyenne, Wyoming, ShadowDragon was founded in 2015.
For those curious, that podcast episode also discussed the newest iPhones, covered some weird news stories, and reviewed smart floodlights, among other wide-ranging topics. Their coverage of Amazon’s Astro home robot caught the attention of this Alexa-wary writer—apparently the device is so thirsty to identify folks with facial recognition it will (if left in “patrol” mode) follow guests around until it can identify them. It also, according to Motherboard, tracks everything owners do.
Cynthia Murrell, January 13, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
