After chiding Apple on privacy, Germany says it uses Pegasus spyware | Hacker News Reader

After chiding Apple on privacy, Germany says it uses Pegasus spyware

appleinsider.com

51 pointsmiles22 comments

"Germany says" nothing. The BKA (~FBI) dealt with Pegasus and the digital comittee chairman (legislative, not even part of the executive branch) critizised Apple.

So, in summary: Two people contradict each other. So what? Isn't this normal?

I feel this headline is just clickbait to make up a connection to apple while painting the criticism as hypocritical.

So wait, if all western governments have this (I doubt it's just germany) and are using it, and it works as advertised, then aren't the politicians worried about all being hacked themselves by each other's governments? Isn't there one sane operator who would like to instead report these zero days and then have a (more) secure device them self?

I’ve heard it claimed that governments consider spying on allies to be normal, even useful. Makes it easier to know what political doors are open and which are closed.

No idea how true that really is, but it’s at least a more optimistic and hopeful view of things than the idea each government is supremely arrogant and thinks its own defence team can hold back everyone else’s offensive teams, which is closer to my own personal expectation of what’s going on.

Bruce Schneier's written a few times on the subject of what the NSA should do, when coming across a powerful exploit. This can be a surprisingly complex calculus when you're thinking solely strategically and not specifically about privacy or ethics as goals in of themselves. https://www.theatlantic.com/technology/archive/2014/05/shoul...

In this article, Schneier suggests that if the US and China have an iPhone exploit, and exploits are very rare, then the US should disclose and patch it because it's likely that China has the same exploit. But if exploits are not very rare, then the US should not disclose the one it knows because China probably knows a different one, so the US would lose its capability to spy on China but China would still be able to spy on the US. His conclusion, though, is different, and argues for erring on the side of patching bugs.

Non state actors with fairly limited budgets seem to be able to get exploits all the time and fairly powerful ones at that.

It probably means that exploits are considerably less rare since there are multiple private exploit for hire vendors that target iPhones these days.

Would NSO be using one or a couple of powerful exploits this whole time, or would Apple have figured these out by now and fixed?

Basically, is it secrecy keeping it working or are they just staying ahead by continuously developing new exploits?

Apple fixes them and they find new ones, one of the reasons they are successful is because they seem to be able to “guarantee” long term access.

I feel like it shouldn't be surprising that law enforcement and spy agencies would have a different view on privacy vs that of regulatory agencies and customer advocates... Similarly, a public defender and a prosecutor will have very different views on significant issues even if they both happen to get paid via tax dollars.

Treating "Germany" as one monolithic entity that can thereby be accused of hypocrisy, is a childish oversimplification.

Nations are composed of myriads of groups, people, interests - some support gov't surveillance, and some who don't.

In this case, Bundestag's Digital Agenda committee chairman, declared Apple to be on a "dangerous path", whereas the Federal Criminal Police Office (BKA) purchased access to NSO Group's Pegasus spyware.

It is no more surprising to see these two units taking opposite positions than if we were to learn that Donald Trump and Joe Biden had opposite views on some topic.

The title and conclusion of this article is uninteresting.

It's already ignoring the fact that Apple is a privately held US company and Germany a sovereign nation. Those are just fundamentally different things.

Apple (& BigTech) make money from lax privacy laws. When governments are not abusing the same weak privacy laws while using such spywares, they are generally working to protect national interests. (Usually when a government spies on you, for whatever reason, they follow due process of the law).

There's a lot of difference in being spied on by a corporate vs government. When abusive, it's a different kind of exploitation. But the solution to both is the same - strong privacy laws.

How does Apple make money from lax privacy laws?

When privacy laws are weak in a country, Apple can collect more user data without their consent. The more data they have on a user, the better they can monetise it.

Monetize it how, though? Like how exactly does Apple make that money?

Google just paid Apple $15 billion to be the default search engine on ios platform.

Let's assume that lax privacy laws of a particular country allow data sharing between Google and Apple, and they've negotiated a data sharing agreement in their contract. This means Apple can now have access to all search queries of any user who uses the Google search engine. Let's also assume that Apple has access to the users browsing history (they do if you enable Safari / iCloud tabs with iCloud) and weak privacy laws allow them to use this data however they want.

With just a user's browsing history and search data, Apple can get a lot of insights into the user's personal and professional interests.

Once it builds these kind of profiles, they can now use it in various ways:

- Show you ads in apps / websites based on your interests. (Apple has an advertising network).

- Promote paid apps that match your interest to tempt you to pay for it. (Apple has an App store).

- Increase the price of apps that Apple thinks you may be interested in, based on your personal data. (Apple gets a percentage from every paid app).

and so on ... there is a lot of other ways to exploit such user data - e.g. Apple uses the credit card data user provide it get the user's financial credit score. They collate this data, along with other data points, to price their products ("hey, we have a lot of rich users, let's price our product higher" or "some of our users our from middle income group - let's ask AT&T to create a financial package so that they can buy our costly phones and pay in installment"). Heck, with Apple Pay, I won't even be surprised if they even know everything you buy from them.

> Google just paid Apple $15 billion to be the default search engine on ios platform.

But that happens even with Mozilla Fire Fox and people seem to be okay with it.

The context of the discussion was about collection and monetisation of user data in the absence of strong privacy laws, with specific reference to Apple. Hence the reference to the Google - Apple deal. (And Mozilla and Apple have different business models and thus users have different perceptions about them vis privacy).

Strong privacy laws can’t stop a government, because a government can repeal or modify them on a whim. Or make it so you can’t actually face prosecution if you violate them no matter what the theoretical penalty is.

For an example of why governments can’t be trusted to obey their own laws, the North Korean constitution has clauses ‘guaranteeing’ the freedoms of speech and assembly, freedom of press, freedom of religion, and achieves none of these things.

I was obviously talking about democracies and not authoritarian regimes. I can understand people being cynical of democracies too, but I am not.

Do you count the USA as a democracy? Because what Snowden revealed was ruled to be illegal and unconstitutional, and without him breaking the law to reveal it, nobody would’ve even known it was happening much less ruled on it. We simply don’t know what else is being done and kept quiet by warning people that nobody else will be able to get away with what Snowden managed to do.

The UK similarly, with the extra twist that the court ruling it illegal was the ECtHR, whose jurisdiction the UK government keeps making noises about leaving: https://www.bbc.com/news/uk-45510662 and https://www.bbc.com/news/uk-politics-eu-referendum-36128318

(ECtHR: the court, ECHR: either the court or the convention the court interprets)

Yes, I do consider the US a democracy. Democracies experience highs and lows too, as leaders and generations changes. It doesn't mean there is no hope for it, or that the people are weak.

Snowden broke US laws to reveal something he saw as unjust. That's standing up for democratic values and rights. That's how you make people aware about something and a movement emerges. (And why even you and me are now discussing privacy laws).

He may be persecuted and even hounded for it. History tells us that has always been how it is. Gandhi spent nearly 7+ years in jail protesting against British imperialism and demanding freedom for India. India's first Prime Minister spent around 8000+ days in jail (nearly 8 years) during India's freedom struggle ...

"And, my friends, in this story you have a history of this entire movement. First they ignore you. Then they ridicule you. And then they attack you and want to burn you. And then they build monuments to you." - Nicholas Klein, Union leader

Then what you want is strong democracy, strong courts, strong press freedom, and strong whistleblower rights — very different from merely having strong laws.

I mean, the literal reason I went straight to DPRK is that they have the laws without the foundations to make them relevant.

Reply on news.ycombinator.com