2/ I'd say the joint statement on commercial #spyware is unprecedented.
A few years ago spyware like #Pegasus was was treated as a human rights issue.
But the dizzying speed of proliferation made big problems for governments, forcing them to prepare positions & action.
3/ The statement's commitment guardrails for accountable domestic #spyware use is important.
But devil will be in the implementations. Civil society will be watching.
(Note: issue wasn't covered in White House Spyware Executive Order on Monday, so nice to see USA commit here)
4/ Export control commitments on #Spyware. Again, important.
Worth noting, several signatories have a complex history on surveillance tech export...
So transparency about license granting & denials will be essential for accountability & to ensure commitment has teeth.
5/ Tracking & information sharing. Maybe public shaming? Norms? Again, important.
The mercenary #spyware industry has hidden from researchers & victims.
Let's hope it's harder for them to hide from governments.
6/ Commercial #spyware proliferation is now a global problem. Whether it's sold to autocrats, or to more 'democratic' governments in the EU... that wind up abusing it
But a key driver? Investment firms in the US & elsewhere. Good to see the joint statement speak to this.
8/ Spyware proliferation went too far & did too much harm.
Result? Governments are waking up & have started taking action.
But this is also a reminder of all the progress still needed on many fronts, like domestic accountability, oversight & transparency from every signatory.
9/ It remains puzzling to me as I read the joint statement on #Spyware that some EU countries are notably missing (where is #Germany?).
It also puts into stark relief that the EU Parliament's efforts on Spyware have a long way to go.
I hope there is some pressure to catch up!
β’ β’ β’
Missing some Tweet in this thread? You can try to
force a refresh
2/ Companies like Paragon (founded in Israel, former Israeli intelligence ppl, recently sold to a US owner) make hacking American technology companies their business model.
And then selling these capabilities to foreign governments.
How can this be?
3/ Honestly it is astonishing that a company that works tirelessly to hack & undermine the security of American products is now US-owned.
The missing factor: building contracts with the US government & lobbying.
The goal of these contracts, I believe, isn't just profit. It's getting protection & building government dependency on their technology.
WHOA: Predator spyware discovered in π΅π°#Pakistan.
+ a leak shows zero-click infections via... ads.
Yikes.
Here are some more damming revelations as Intellexa, the shady, sanctioned spyware supplier gets exposed by @AmnestyTech & partners.. /1
2/ First, a mercenary spyware myth has just been busted.
Because the leak shows an Intellexa employee directly accessing a customer deployment.
Prior to the #PredatorFiles leak, spyware companies basically always claimed they couldn't access customer deployments & didn't know what was going on there.
They used this to avoid responsibility & claim ignorance when faced with abuses.
3/ And it gets crazier. The leak shows Intellexa casually accessing a core backbone of Predator deployment of a government customer.
Seemingly without the gov's knowledge.
Suggests that Intellexa can look over their shoulder & watch their sensitive targeting.
NEW: π¨π³Chinese hackers ran massive campaign by tricking Claude's agentic AI.
Vibe hacking ran 80-90% of the operation without humans.
Massive scale (1000s of reqs/sec).
Agents ran complex multi-step tasks, shepherded by a human.
Long predicted. Welcome to the new world.
Fascinating report by @AnthropicAI 1/
2/ The old cybersecurity pitch: unpatched systems are the threat.
The next generation concern might be unpatched cognition.
The attacker jailbroke the cognitive layer of @anthropic's Claude code, successfully convincing the system of false intent (that it was a security exercise)
3/ One of the key points in @AnthropicAI's report is just how limited the human time required was to run such a large automated campaign.
Obviously powerful stuff, highlighting the impact of orchestration.
And concerning for the #cybersecurity world for all sorts of reasons, ranging from attack scale, adaptability & cost reductions...