Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Facebook bans 7 'surveillance-for-hire' companies that spied on 50k users (npr.org)
206 points by authed on Dec 16, 2021 | hide | past | favorite | 78 comments


> NSO has said it sells its software to governments to combat terrorism and serious crime, and isn't responsible for how it may be misused.

Such bullshit. In the Nuremberg trials in the aftermath of the Second World War, several directors of IG Farben were held responsible for shipping the chemical Zyklon B to the SS which used it commit mass murder. The court rejected the defendants argument that they weren't responsible for how their product was used. Similarly, NSO and other spyware companies are responsible for how authoritarian regimes use their products to harass and endanger dissidents.


Indeed. Denial of responsibility is a feature of violent communication.

https://blog.chaddickerson.com/2018/10/29/nonviolent-communi...


I agree with the spirit of what you’re saying. My only quibble is where we draw the line when it comes to supplying software. Is Microsoft ultimately responsible for the nuclear deterrents that run on Windows XP?


They had to explicitly pass through the DoD certifications and contracts requirements, and probably had to implement some custom features on Windows for it.

So hes, they are.

Now, the question is: would you rather have lived the cold war without a nuclear deterrent in your country?

It's a harder question to answer.


You tech bros have seriously lost it at this point, haven't you.

You are literally comparing selling gas that was essentialy designed to mass murder people in camps, to selling a surveillance tool that can hack your precious iphones.


There's quite probably links to actual murders of dissidents by intelligence services, of which Jamal Kashoggi is just the most conspicuous example.

https://www.theguardian.com/world/2021/jul/18/nso-spyware-us...

(To get ahead of the whataboutery: at this stage anyone providing military aid to the Saudi government is complicit in their crimes, including the US and UK militaries and their involvement in the war on Yemen)


It doesn't matter where you are on the scale if the scale of "helping dictators with malicious intents".

Don't get me wrong, I don't think facebook or any big tech companies has any kind of moral upper hand, given they all spy on people, lie, engage in corruption, monopoly abuses, and so on. And they all have weapon dealers in their portfolio, which sell arms to the same people using pegasus.


> It doesn't matter where you are on the scale

imho it does. In the "IG Farben" example the managers were held accountable (correctly) because they should have known better, but not the ppl producing/packing/shipping some chemicals.


Facebook is a surveillance company, I guess they don't want other companies getting in on their action.


It's the same with posting advertising.

You can mark anything as spam except the ones paying Facebook for your attention.


Facebook is horrid imo but nothing like NSO or Black Cube


Facebook are much much worse.

An NSO, a Candiru or a weapons manufacturer provide tools to governments, who are at least in theory (but usually in practice) accountable to their people. Occasionally governments even act for the benefit of their people.

Facebook only acts for the benefit of Facebook, to the detriment of everyone else in society.


unless you pay them a fee.


50K users is a drop in the bucket. The issues are:

* Can MetaFace reliably detect such bad actors?

* Is their current technology, where users don't control their own data, compatible with protecting users privacy? In other words, isn't this exactly where we expected to end up when these technologies were first built?

* How can we trust that they don't just ban the ones they don't like and leave users to the mercies of the others?


It is not the users' data but Facebook's data about the users. And Facebook doesn't protect the the users' privacy but its assets.


Can you give an example of "the ones they don't like"? FB is in the data harvesting and aggregation business. Anyone using their data - without reciprocity - is unwelcomed. Full stop.

We're not users to FB anymore than a cow is family to a milk farmer. Of course they'll protect the farm, not because they're benevolent, but simply because it keeps the milk flowing and that product pays the bills.


> Can you give an example of "the ones they don't like"? FB is in the data harvesting and aggregation business. Anyone using their data - without reciprocity - is unwelcomed. Full stop.

Cambridge Analytica comes to mind. Facebook actively assisted them. Though the scandal caused many, many policy changes at Facebook, it is a historical case of Facebook assisting someone using their data to spy on their users.


I don't think CA was a liked, per se. FB needed a success story (of sorts). Without that the strength of the product would be suspect. As it is, CA's affect on the election isn't proven. That said, perception is reality. FB got the better end of the deal.


> As it is, CA's affect on the election isn't proven.

That's fairly irrelevant to the topic at hand, without saying anything about it, one way or the other.

Facebook has given away their data in the past, and gone so far as to provide special access for some clients over others. That is undisputed. There's no reason to believe that they may not do so again, in future, if they believe it to be in their interests.


Give away? Nothing is free. FB isn't in the donation business. There might not have been a transparent financial transaction, but that's not a proxy for "given away."

We're discussing FB, not the local pizza shop. Let's be realistic about their power and how they operate, etc.


> CA's affect on the election isn't proven.

That’s quite a dismissal. Is this even possible?

How would one go about proving or disproving such an effect?

From what I recall, CA was considered to be a military grade weapon by the UK gov which needed approve each case prior to export.

Promises were made that it would never be used domestically.

Based on this information, I would have to assume that CA is effective, generally speaking.


facebook used user data as an incentive for companies to build apps on their platform. at one point their ambition was to compete with iphone/android (they got as far as an android skin, but amazon and firefox were competing in this space as well, it wasn’t crazy to think they could do it)

if you want people running your OS, you need a good app store, and facebook’s whole thing was free apps (farmville and the like) - without traditional monetization, how could facebook attract big developers to fill their phone platform with apps and avoid the fate of windows phone?

well, when you use an app on facebook, you give the app permission to read your data, sometimes a lot of your data.

see this illuminating article, “What the fuck was facebook thinking” [0]. facebook can say truthfully they never sold anyone’s data, because they gave it away for free to anyone who would build an app to keep people on their platform.

[0] https://jamesallworth.medium.com/what-the-f-was-facebook-thi...


Do you already know the answer to that?

They can and choose not to, someone used their own 2012 tools they developed in a scientific paper (detection of Nazis)

Nobody controls their own data, it’s not FB it’s all data mined.

How can you trust Facebook? I refuse to use their rebrand, you don’t give trust, they earn it. Did Facebook earn your trust?

The proof they can detect is is they use it to advertise. https://www.latimes.com/business/technology/la-fi-tn-faceboo...

Nazis are pretty easy to detect (caste discrimination can be trained, anti Muslim sentiments are easy too, but this is a low hanging fruit).

Like Leary said, do they care?

Facebook obviously can do it, they’d rather sell ads and use the users as marketing data instead of removing them, until they need to virtue signal. I can’t find the paper but I doubt anything I said is a surprise. These tools are used to make money, not moderate.


I wonder how often if ever extreme groups eager to recruit use the ads served to them as a source of potential "proto-shibboleths" to look into. If the advertisers with their dearth of data could know, before even you do, what sort of stuff people like you tend to like, you could use them as a bleeding edge to go to events/locations associated with that thing to meet fellow sympathizers who could potentially be activated, or unmet fellow activists who just happened to be around.


There's an even bigger issue

*Do they actually care?

I think the answer is obvious given facebooks business model. The only issue is competition.


I doubt they care about solving it completely, but publicizing this is definitely good PR for them.


And I'm sure another 7 will take their place. Or the same 7 will change their name and rebrand, and sneak back in for a while.

The root of the problem is that Facebook provides an environment where this sort of activity is possible. But fixing that would hurt their profits, so they won't.



To be honest, it sounds like an extraordinarily interesting field to work in:

"This is a one-of-a-kind opportunity for someone who lives and breathes spying and espionage to become part of a world where wild fantasies of undercover operations become reality. If you think you have what it takes, we want to hear from you."

Unfortunately their opportunity is out of reach, as I'm not in the UK nor Israel -- and they're not specifically seeking technical skills, per se.


Uh.. Do you know that NSO group is widely suspected in helping authoritarian governments to target journalists?


Does the fact that some people take moral issue with the actions of a single company mean that the work done in that entire field can't be interesting? There's a reason people watch spy movies and why lots of little kids pretend to be special agents and spies when they're playing in the back yard. It's interesting to a lot of people.


Widely suspected is nothing but speculation, and intelligence agencies aren’t exactly moral. Apple cooperates with China, but do people care when they buy their products?

You’re going to have to give the names of the journalists targeted and the country instead of vague suspicions that you say are wide.



Neuromancer becoming reality. Unfortunately, it was a dystopian future.


Are you quite certain you don't work in public relations for NSO or a similar firm? This is suspicious and weird.


From the guidelines[0]:

> Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken.

As @GhettoComputers said: GP is just saying “hacking is fun”

[0]: https://news.ycombinator.com/newsguidelines.html


on further examination and since the account is brand-new/created for the purpose of just that one comment, I may have fallen for a satirical example of such.


“Hacking is cool” in longform isn’t eyebrow raising to me.


Reverse engineering and staying in IDA all day long is pretty boring


Drug dealing involves all the same risks without the moral detritus.


Not really, heroin has been laced with fentanyl analogs and even things it doesn’t synergize like in cocaine causing random deaths by knowingly selling (pre)cut chemicals isn’t morally neutral.


Devil’s advocate: great; If you’re high up in the heroin supply chain or simply secure your own source, you can save countless lives that would have been lost to fentanyl hotspots. Everyone says that legalization would be safer due to known purity, and you could label your bags with an ingredients panel showing their exact contents and purity levels.

What I actually think: Unfortunately if the casino and alcohol industries make 90% of their money from addicts I’m afraid the hard narcotics industry is even worse still. Traffic good drugs only if you have strong pro-social morals and want to sleep easy.


That’s assuming it doesn’t get cut along the way, and it doesn’t already destroy lives or cause overdose on its own.

It’s hard to see it as a moral matter, like all business it’s just sales. Knowing purity doesn’t prevent the OxyContin issues these are just dangerous drugs that are addictive to a lot of people and there is a non zero chance it’ll kill someone. Psychedelics can trigger schizophrenia and mushrooms are unpredictable, but the assumption is that it’ll give people insight. Alcohol is the most used date rape drug, so legalization and standardization isn’t even a solution except for its safety in the case of methanol.

Technology is known to be highly addictive as well.


Sorta depends on the drug, the drugs that you can make real money selling tend to ruin peoples lives.


Volume of “good drugs” can offset this, but addiction with high margins is the best model for making money. Fentanyl analogs are LSD dose size, not expensive, highly physically addictive and very deadly done without proper dosing.


In other news 7 'surveillance-for-hire` companies create arms length shell companies.


"Black Cube obtains legal advice in every jurisdiction in which we operate in order to ensure that all our agents' activities are fully compliant with local laws," it said.

In other words they looked for every loophole or underhanded way they could get the information while staying just on the side If legality.


Explain to me the difference between "finding a loophole" and "following the law."


Your like ironic actual point is well taken but I just wanted to note that even without the irony this is actually a very cool thought provoking question and I couldn't answer it at first.


One hint is that some jurisdictions, including France, have a law that says that merely breaking the spirit of the law is also illegal. Other countries, especially dictatorships, are less textbook about legal interpretation. In other words, if you wanna play with loopholes, do it in the US and similar countries.


That is wild. What is an example?


One is unregulated, the other is sanctioned. Uber found a loophole for bypassing taxi medallion requirements, and following the law is doing it by the book, renting/buying a medallion to ferry people with a vehicle.

Loopholes are common in the US, the spirt is: if nobody says it’s illegal, it’s not illegal (yet). It’s not uncommon for “loophole bypassers” to oppress others who could take advantage, after they themselves have already profited to prevent competition in the form of laws and regulations. This isn’t just a US phenomenon, it’s commonly used like the Indian Jati Varna system, Toyotomi Hideyoshi and classifying people by birth (he was a commoner), and seen now in the US so that only wealthy corporations can afford licensing, standards they set, and other costly additives that government is only happy to tax.


The difference is the spirit of the law but you are correct in that it is technically following the law. But breaking the spirit of the law garners you no public sympathy. So though we see possibly Black Cube didn’t break any laws and therefor are not liable, no body gives a shit that they were kicked off of Facebook.


All companies are based out of Israel… Just like NSO with Pegasus. Geez


My hated comment I thought the same thing , the site didn’t load completely for me, maybe you had the same issue. 4/7 are, there’s a brief mention of a Chinese site.

The focus is disproportionately on the Israeli firms which are often used by the US. The US armed and taught the Taliban, why are we blaming the Taliban instead of the CIA for giving us the problem? It’s like blaming constructors of a crude oil rig instead of the oil companies for making it.


I get so many random foreign people (ostensibly) wanting to connect with me on Facebook, who I dont know, I began to assume a good percentage of them are just bots or puppets (or "personas") trying to catfish me or inject further data-gathering probes into the Fb social network. LinkedIn has this phenomenon too, but there it feels like a percentage are just aggressive career-networkers. But on Facebook, its out of control and more obvious.


You can set it so that only friends of friends can send you friend requests


nice tip, thanks.

makes me suspect further thats why those puppets/catfishers try to friend people at random on Facebook and LinkedIn.

because once the initial suckers accept them in, they've breached the outer defenses of the social media web-o-trust. after that, they can try to friend more targets, but then have the benefit of being able to get past the "must be friends of friends" filter.


They will just rename/reform themselves. And there are other channels for spying on people.

This brings up the question: is there a good, realistic guide for a normal person on how to prevent being spied on?


Delete your Facebook account and use DNS and browser extensions to block facebook, instagram, and oculus domains.


You won’t like this but don’t use technology and especially the Internet. Your data is being mined by ISPs and linked to transactions, your mobile devices are triangulated so the know your location at all time, and expecting any privacy in a world that mines your data is impossible, especially since security actually means “hasn’t been hacked or don’t know if it’s been hacked yet”.

If you relocate, you can move to Japan, the culture is very privacy friendly. They don’t even tell spouses if they’ve seen a missing person. The culture shift is probably the easiest but immigration to Japan isn’t easy and they don’t allow dual citizenship.


Like how Facebook renamed itself to meta?


They probably lose 100k users a day.


Just in the nick of time ...


drop one ally


There should be a low that outside company can spy on any data that the hosting company can. The information is out there, why facebook should be the only one who can access it?



[flagged]


"Only" four for them are Israeli.


Thanks, I think the page didn’t load completely for me, and it had lots of info on the Israeli firms.

4/7 is a lot and there’s a lot of focus on it in the first parts. One is Chinese and there’s very little focus on it or info. I doubt this will have any significance, I’m not sure what spying means from the article. Are they just scrapers of public info or have friend requests that you’d share your info with publicly like the first image? Spying is ok when FB gets all the info, but it’s not ok if their ad revenue can be threatened or data they get on their own.

If you’re sharing info on Facebook it’s hard to take the words “spying” seriously unless you say Facebook is a spy too.


"Yeah, that's our racket!"


Maybe Facebook just wants to take out the competition.


Eliminating competition...


Only 7 forgot to pay their dues?


Ironic given Facebook's business model is to spy on users.


Seems like maybe there is some distinction to be made there.


They don't want any competition


> These ... companies ... try to trick them into handing over sensitive personal information so that the firms could install spyware on their devices

Could this be seen as anti-competitive behaviour by Meta?


Amazing.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: