Israeli firm linked to WhatsApp spyware attack faces lawsuit | Hacker News Reader

Israeli firm linked to WhatsApp spyware attack faces lawsuit

theguardian.com

It seems like Facebook/WhatsApp would have known this exploit was being used in the wild. With FB’s engineering talent (and budget), you’d think that there would be automated systems to flag suspicious patterns of malformed/unexpected JSON going around.

Suing the company which developed a tool rather than the organization which used the tool seems strange.

I think there are three reasons it makes sense:

1. The company enabled several different organizations to spy on dissidents (it’s easier to sue one than many)

2. The company advertises its services to be used as such, and

3. It’s easier to sue a company than a country, and much easier to sue a company in Israel than to sue the UAE in a UAE court

I think it seems strange where we imagine that tools are neutral. But they aren't, necessarily, and especially if the organization/developers knew they were building something to be used unlawfully, it's reasonable to hold them accountable.

Taxi rides are generally neutral, too, but if someone hops into your taxi, asks you to drive to the bank and wait, and tells you outright that they're going to rob the place, that makes you a getaway driver with a taxi, not a taxi driver who happens to have a guilty client.

But did they make it for an unlawful purpose? Most countries have legal provisions to allow police or foreign intelligence to hack into phones. Could they have been selling these tools for those purposes and someone misused them?

And should they have stopped once it became known it got misused? All interesting questions for a court and the public to ponder.

Well that's partly why you file a lawsuit. If you have a reasonable belief that the answer to that is yes, a lawsuit provides a process for confirming whether and to what extent it's true.

Why is this strange? You sue the company making the tool then they tell you in court it's not them but rather entity X who abused it and give you the documents to prove it. Then you sue entity X.

I wonder how many agencies were aware of this vulnerability and have used it before any of this unfolded?

I am sick the “lawful authority” excuse.

In most of the countries involved in this, and plenty of others: hacking or arresting HRAs is lawful.

In some, slavery is lawful.

In general saying “we aren’t violating human rights because we’re not violating the law”, is not a meaningful arguments:

* slavery was (and in some places is) legal

* the holocaust was legal

* Japanese interment camps were legal

* the walk of tears (I think that was the name?) was legal

* the destruction of parihaka was legal

* gender discrimination: legal

* race discrimination: legal

Etc, etc

Legal does not mean “right”, and hiding behind that when your product is clearly being used against HRAs is a deliberate attempt to hide responsibility.

Amnesty International donation page: https://www.amnesty.org/en/donate/

Is this title gonna get censored too?

They should also sue some government agencies then, they are bunch of hypocrites.

Reply on news.ycombinator.com