BREAKING: NSO Group liable for #Pegasus hacking of @WhatsApp users.
Big win for spyware victims.
Big loss for NSO.
Bad time to be a spyware company.
Landmark case. Huge implications. 1/ 🧵
2/ In 2019, 1,400 @WhatsApp users were targeted with #Pegasus.
WhatsApp did the right thing & sued NSO Group.
NSO has spent 5 years trying to claim that they are above the law.
And engaged in all sorts of maneuvering.
With this order, the music stopped and NSO is now without a chair.
3/ Today, the court decided that enough was enough with NSO's gambits & efforts to hide source code.
Judge Hamilton granted @WhatsApp's motion for summary judgement against the #Pegasus spyware maker.
The judge finds NSO's hacking violated the federal Computer Fraud & Abuse Act (#CFAA), California state anti-fraud law #CDFA, and was a breach of contract.
What happens next? The trial proceeds only on the issue of resolving damages stemming from NSO's hacking.
4/@WhatsApp suing NSO Group was a huge deal at the time.
We at @citizenlab & our peers in civil society had been investigating & surfacing a pile of #Pegasus abuses since 2016. Journalists, dissidents, truth-tellers, scientists, lawyers..
But nobody was taking action & NSO was flying high.
11/ Even as NSO has a bad time, other spyware companies like #Paragon present themselves as 'different' & 'approved' to try and break into the US market & grab market share.
I think their goal is to get enough contracts with countries like the US that it's hard to regulate them.
Be skeptical of their claims.
Seems like some are already falling apart.
They want to put secret hacking tools in the hands of American cops & police forces around the world.
You should demand oversight & action from Congress to stop this toxic industry from nesting in the US.
Today's ruling also raises questions about how legally safe it is for a company to sell & run hacking services targeting US-based platforms & their users.
3/ We got a tip about a single bit of #Paragon infrastructure & my brilliant colleague @billmarczak developed a technique to fingerprint some of the mercenary spyware infrastructure (both victim-facing & customer side) globally.
#Paragon's carefully constructed image of being a clean mercenary spyware company that wasn't susceptible to abuses has been replaced by a more familiar tale of...
Abuses...
And #Italy is now saddled with an unfolding crisis around spyware abuse.
VPN advertising is the most common source of security misinformation that I encounter.
By far.
So many people misplace their trust in dubious consumer VPN products.
The industry is a scourge.
VPNs don't do most of the things that podcasters imply they do.
Security:
Coffee shop attacks on unencrypted logins are a thing of a decade ago.
VPNs won't stop even the dumbest spyware & phishing.
Privacy:
Advertisers still know it's you when you turn on a VPN... they use many other identifying signals from your device, like your browser & advertising IDs. Those don't change when you turn on a VPN.
Trust:
A lot of VPN companies are shady.... and the industry is consolidating fast around some questionable players with concerning histories.
When you turn on a VPN you entrust all of your data to those companies.