Or maybe regulations for development and trade of computer viruses are lower in Romania and there's less paperwork to make one without risk of another government wanting to claim the works, like it would happen in other cheaper countries, China or India.
Well, EU does have a lot of initiatives pushing for a 'single digital market' without borders/barriers; Romania is (has to be) treated as a domestic supplier.
You have to agree to not export state malware for your university? Seems a bit intense to me; I don't remember doing anything like that for my university. It's nice that they have English translations of the laws, though.
State malware wasn't the problem. It was the authorisation defining which customers are OK and which aren't. They would have only been mostly morally bankrupt if they'd stuck to the list.
It's like with weapons export - in general, in most countries you can manufacture and sell military-grade weapons abroad, however, you must obtain a permit from your government which will vet which of your foreign customers are acceptable and which would go against the government political interests and thus are taboo.
It's not a surprising sentence if you consider how states perceive cyberspace: malware-as-munition. Just as German companies cant export guns, bombs or other military hardware without authorization, same goes for state-developed malware.
"state malware" is quite a weird grouping of terms. I understand people find "exported" to be the most disturbing word in "exported state malware" but not for me.
It's been known since at least 2014 that this company has been selling software to regimes that violate human rights, squash freedom of information, and monitor pro-democracy activists.
It's taken a long time but it's good to see that the wheels of justice have finally caught up with this scummy mercenary company. It is dirtying the name of the information security field, and engineers who have worked for them or similar surveillance software should be ashamed.
The quote is from a fake account run by the hackers. There is (at least to my knowledge) no indication that they're antisemites. Doesn't make the situation better, though.
It does if that's the only standard you apply in choosing to whom you deliver a product. If you sell to despotic regimes and not to Israel, you're criticism of Israel is anti-semitic.
This argument seems very similar to the argument that not all Trump supporters are racists but (practically) all racists are Trump supporters.
There is a very difficult line to tread here, to me it feels like any inference between the state of Israel and the Jewish faith is itself somewhat anti-semitic, or at least it should be. However, the International Holocaust Remembrance Alliance definition itself does it so I am probably wide of the mark.
I think such generalizations are almost always false. Plenty of people oppose Israel for purely political reasons, not because they dislike Jews. Many American racists don't support Trump either - I doubt that for example black supremacists, who are just as racist as their white counterparts, like him very much.
How is antisemitism a religion? Judaism is. Anti-judaism... is, logically, against the judaism, but not all religions, so even anti-judaism won't qualify.
What does being against unlawful colonization of territories have to do with antisemitism? Being against Israel as a nation has NOTHING to do with being against Jews (which is only part of the Israeli population) and it's called antizionism.
How else would you explain antizionist Jewish orthodox communities?
> What does being against unlawful colonization of territories have to do with antisemitism?
If you'd sell to Turkey, Saudi-Arabia & co and then say "we have some standards, we won't sell to Israel", yeah, you'd not be against colonization, occupation etc, you'd be against Israel specifically for other reasons.
Israel enjoys a special status through it's relationship (partnership) with Western powers. It also enjoys power. I agree that Turkey's genocide against Armenians is evil. It's taken too long to acknowledge that. I'm not too clear on the Saudi Arabia accusation, but I think you're referencing Yemen.
Still, imagine you're German and you've received an education, growing up, completely condemning the evil that the WWII Nazis committed against the Jewish people. Imagine that to refute the history of that evil is, in fact, a crime — a crime of speech and ideology. Then imagine learning that the Jewish state made available by partitioning land has grown, considerably, since its initial allocation post-WWII. Imagine learning that the growth exactly resembles of actions of WWII Nazis against Jews, only now by Zionist Jews against Palestinians.
Israel has all the makings of a great country. In my mind, it has succeeded thoroughly. Despite my above criticism, I wish it success. I hope it makes humanitarian strides to acknowledge its wrongdoing and make reparations. I'd only point out that its specific actions against Palestinians did happen and continue to happen today and it is an evil. If you're German, you might feel especially emotional about it, given the shared history.
I don’t have to “imagine” what you’re describing, as I’m in the same situation.
But, unlike you, I don’t despair at the (mild) cognitive dissonance you’re describing. The Holocaust, and its uniqueness, are fact. Israel’s behavior towards Palestinians today is reprehensible. These are neither incompatible, nor does the latter diminish the former.
We can expect more from Israel than, say, Sudan, because it is a democracy, relatively rich, and part of “the west”. To instead use the Holocaust to place additional burdens on them is cynical. So stop whining about your youth. It was probably terrible, but the Jews weren’t involved in that. And, unlike many of them, you got to survive to adulthood.
You're challenging a perspective that I don't hold. I want to avoid talking past each other.
I think one can appreciate that the FinFisher group has done terrible things and is working against a free, democratic society. I do not really want to defend them, so I think it's important to say that up front. I took aim at the idea that "they must also be anti-semites because they specifically criticized Israel." I do not want the criticism of Israel to be the bar we set for the anti-semitism accusation.
> Imagine learning that the growth exactly resembles of actions of WWII Nazis against Jews, only now by Zionist Jews against Palestinians.
If you learn that anywhere, I think you're talking to antisemites. It's really not the same, it's not similar beyond "a state does stuff, Nazi Germany was a state, Israel is a state, so it's the same", but that's not a useful comparison.
> If you're German, you might feel especially emotional about it, given the shared history.
I'm German, I don't feel especially emotional about it, and I often do feel like that the obsession with Israel is more about "see, the Jews are doing it too, we're not so bad" and less about "what a terrible thing". Exactly because most people are very upset about Israel doing stuff and completely ignore far worse things being done by others.
As for Turkey: you don't need to go back to the Armenian Genocide. Turkey still occupies parts of Cyprus, is de-facto annexing parts of Syria and is working closely with what has been formerly known as ISIS, currently sending them to Azerbaijan to fight against Armenia.
The point is: if a vendor would say "we don't sell to Israel because of ethics" but sells to countries that are ethically far worse, their problem obviously isn't ethical in nature. Their problem would be Israel. Nevertheless, FinFisher didn't, so it's hypothetical. They probably didn't sell to Israel either, because Israel has no need to buy, having a strong security industry with lots of vendors for offensive tools.
> If you learn that anywhere, I think you're talking to antisemites
I'm sure I've spoken to anti-semites in my life, but your accusation is merely begging the question. I learned the history largely from a book titled "The Ethnic Cleansing of Palestine."
You need not support the actions political party of the Zionists to support Israel or the Jewish people the same that you need not support the actions of any other political party, say the far-right of the United States, in order to support the country or its people. And you needn't publicly enumerate your disgust for all atrocities by all peoples in order to denounce the single action of a single people.
Anyway, I think you're right about feeling suspicion over "see, they did it, too." I won't defend anti-semites for being anti-semitic, and I won't condemn all anti-zionists as anti-semites. I think this is where our differences on the matter arises.
I haven't read that book, but I assume that it does not actually compare the holocaust with the Arab-Israeli conflict, because that would be ludicrous. The Arabs attacked Israel with the intent of destruction (and genocide, most plausibly) and lost the war. One consequence was the mass exodus of Arabs who, correctly or not, assumed the victorious Israelis wouldn't treat them kindly. I'm sure plenty of terrible things happened during those wars, but to say they are the same or similar to the holocaust can only be done when you don't know the history. A hint for starters: the Jews did not invade Germany with the intent to destroy it.
> And you needn't publicly enumerate your disgust for all atrocities by all peoples in order to denounce the single action of a single people.
Your credibility would be much better if you did though. If the police completely ignored crimes committed by white people and vigorously enforced the law against black people, wouldn't you question their motives?
For clarification, the Israeli-Palestinian conflict is a more narrow view of the Arab-Israeli conflict. Exiled Palestinians were unwelcome to neighboring Arab states. I think you should read the book because your assumption is incorrect about its content.
This is cheeky of me, but... A hint for starters: the Zionists did invade Palestine with the intent to destroy it. The Zionist movement in Israel did not respect the partitioning of Palestine set up by UN Resolution 181. Zionists committed mass murder against the Palestinians even outside of typical warfare — there were significant civilian casualties. There is no need to equivocate the criticism that "what Zionists are doing to Palestinians is similar to what Nazis did to Jews" to a very different claim that "the Holocaust and the Nakba are wholly the same."
We are horrified that Israel would commit ethnic cleansing against another group of people. It is especially horrific given they did so immediately after having been dealt the same atrocity at the hand of Nazis.
You can narrowly criticize Israel for these historical and present-day actions, and you gain credibility by standing firmly on that point.
Because my response seems to have gained some traction, I will offer you a couple more sources. I don't require or expect you to purchase and read the aforementioned book, but I hope you will look over the following:
> There is no need to equivocate the criticism that "what Zionists are doing to Palestinians is similar to what Nazis did to Jews" to a very different claim that "the Holocaust and the Nakba are wholly the same."
I think they are in the same area of related-to-reality-ness. Are civil wars usually bloody and terrible? Yes. Is it reasonable to compare that to the holocaust? No.
> We are horrified that Israel would commit ethnic cleansing against another group of people. It is especially horrific given they did so immediately after having been dealt the same atrocity at the hand of Nazis.
Is it? It's not to me. Quite the contrary: having just barely survived the murderous intentions of somebody who was aftery our life will probably have you very vigilant and possibly overly defensive against the murderous intentions of another group that's after your life.
> You can narrowly criticize Israel for these historical and present-day actions, and you gain credibility by standing firmly on that point.
You can totally criticize Israel for the treatment of the Arabs. Yet when you fail to criticize others for similar treatment of other Arabs (or the same Arabs, even, in the case of Fatah and Hamas), it suggests that your issue with Israels treatment isn't a question of ethics, but of ethnics. That is: had mass-immigration to Palestine from Turkey happened, and had these Turks declared a new state and everything else had happened exactly the same way, you wouldn't criticize them, because they aren't Jews.
And if you would: why would you limit your criticism to Israel, and not apply it to all offenders? "Oh, but you must start with one", sure, sure, but why start with the smallest one that offends much less than others and focus on decades ago instead of today? And why join ranks with terrible governments in doing so, who mock the very idea of human rights? That just doesn't make sense to me in a way of "I'm really equally against all bad things, I've just chosen to be vocal about this particular one for no specific reason whatsoever".
I said above, "And you needn't publicly enumerate your disgust for all atrocities by all peoples in order to denounce the single action of a single people." I'm happy to criticize each other group's wrongdoings; I needn't do so in a single breath.
I object to the conflation of anti-zionism with anti-semitism. On a second order, I care about Zionists' crime carrying out ethnic cleansing of Palestinians in Palestine.
It is an ugly perspective, to me, that we should concern ourselves with the Zionists' ethnic cleansing of Palestinians only after we have solved all other problems.
Anyway, check out the three sources. I think you have an interest in the matter.
> I'm happy to criticize each other group's wrongdoings; I needn't do so in a single breath.
You'll be the one-in-a-million exception then, in my experience. Most declare that they would, but never will, given the chance.
> It is an ugly perspective, to me, that we should concern ourselves with the Zionists' ethnic cleansing of Palestinians only after we have solved all other problems.
Meh, I don't even think ethnic cleansing actually applies (not least because Palestinians aren't an ethnic group, they're a cultural group). But even more so: that's not what I said. What I'm saying is that there's a suspicious focus on Israel that turns into willful ignorance and self-imposed blindness when it comes to other things. That heavily suggests it's not actually about what Israel does, but rather about the fact that it's Israel doing it.
They don't sell to Israel not because they are ethical, but because Israel is by itself #1 producer of spyware and sells to all kinds of dictatorships too.
However, I don't see any hope that malware exports will be curbed ahead of conventional weapons exports. Ultimately, weapons can be exported under pretty liberal rules.
Even if there are controls (like there are on weapons), the existence of a robust weapons market means that weapons are usually available to any regime (or less) that can pay for it. Certain weapons (ICBMs, tanks, jets) are actually controlled, but these tend to be weapons (1) without a robust market (2) that potentially challenge an exporters military power (3) really expensive.
The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. We're losing at this.
> The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries.
That's hard to do though. Germany has their attempt with the infamous laws around "hacker tools", which place a lot of legal insecurity on any serious security work. "Rouge malware vendors" would already be operating illegally, and a state sanctioned developer that provides the state with malware can't be considered a mercenary, I think.
I'm not convinced regular law enforcement badly needs malware to investigate, but I also don't see why they'd not get that tool (with court orders and solid procedures) if we allow them to do other kinds of surveillance. From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.
>>* From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.*
There is a danger that comes from thinking of these problems as theoretical. They aren't. We have a history, a present. History (germany knows this more than most) is that a surveillance-centric law enforcement is the basis for a repressive regime. The stasi wasn't a coincidence. The present shows us that state surveillance is on the rise. Again germany makes a fine example. Already repressive regimes (like Belarus, currently) give us an easier to grok understanding of the mechanics.
It's easy for us to agree that it's bad to supply these to bad regimes. If Lukashenko uses german software operated by german mercenaries (I believe this is a precise definition of the term) to find and arrest his dissenters, germans will feel that this company is bad. That's easy. But, that company can migrate and I doubt export bans would have denied Luka much or changed the game meaningfully in Belarus. It's effectively symbolic.
What is more important is for germans to ban their own governments from doing this, or at least strictly restrict it to counter-terrorism. If any police department can hire mercenaries to "do cyber-policing," we get to stasi situations quickly.
Unlimited power is a bad thing, a dangerous thing.
"Factual evidence exists for the fact that the suspects, who at the point in time relevant for the criminal complaint were CEOs or staff members of Elaman GmbH, FinFisher GmbH, or FinFisher Labs GmbH, have made themselves liable to prosecution because of deliberate violations against the obligation to obtain licences for dual-use software in accordance with section 18 para. 2 no. 1 and section 18 para. 5 no. 1 Foreign Trade and Payments Act (Außenwirtschafts- gesetz, AWG) by exporting the surveillance software FinSpy to Turkey during the period between October 2016 and July 2017 without having previously obtained the required licence from the [German] federal government."
State malware:
"FinSpy is highly developed spyware which, according to the company’s own description on its website, is sold exclusively to governments for the purposes of strategic intelligence and criminal prosecution,"
This is not an old case, it has been submitted only recently, as is clear from the date mentioned here:
"The companies are neither so large nor is the number of potential FinSpy customers so high that it would suggest itself to decide about and carry out exports without the knowledge of the CEOs. The fact that the federal government, according to the information it gave on 19 June 2019, has not issued an export licence for intrusion software requiring a licence since January 2015 additionally either suggests that the export of such software is not routine business, which would support all the more that the CEOs knew about it, or that numerous additional exports violating the export provisions have taken place in recent years, above and beyond the business deals with Turkey."
There are many companies that deal in (and sometimes operate) cyberweapons and spyware, usually with governments as (often malicious) clients. Some examples besides FinFisher/FinSpy are NortonLifeLock (Symantec, Blue Coat Systems), Groupe Bull (Amesys), DarkMatter Group, Endgame, Gamma Group, NSO Group, Zerodium.
There has previously already been some discussion on NSO Group's "Pegasus" Spyware and how it's being used in terrifying ways. This is a frightening 8-part series by Citizen Labs about the abuse of "Pegasus" in Mexico 2017-2019: https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware...
Here's a category of articles on the citizenlab.ca web site described as "Investigations into the prevalence and impact of digital espionage operations against civil society groups": https://citizenlab.ca/category/research/targeted-threats/
54 comments
[ 4.3 ms ] story [ 112 ms ] threadClassic Bavaria.
Romania, China and India.
I talked with people from the east of EU and while they like the money, they aren't always treated well by the western companies.
Guess, that's why I always overreact when I see outsourcing to the east.
Wow.
[1]: https://www.gesetze-im-internet.de/englisch_awg/index.html [2]: https://www.gesetze-im-internet.de/englisch_awv/index.html
State malware wasn't the problem. It was the authorisation defining which customers are OK and which aren't. They would have only been mostly morally bankrupt if they'd stuck to the list.
They were hacked and their client list was leaked, to which they responded "we have some integrity. We don't sell to Israel". (https://www.zdnet.com/article/top-govt-spyware-company-hacke...)
It's taken a long time but it's good to see that the wheels of justice have finally caught up with this scummy mercenary company. It is dirtying the name of the information security field, and engineers who have worked for them or similar surveillance software should be ashamed.
The quote is from a fake account run by the hackers. There is (at least to my knowledge) no indication that they're antisemites. Doesn't make the situation better, though.
There is a very difficult line to tread here, to me it feels like any inference between the state of Israel and the Jewish faith is itself somewhat anti-semitic, or at least it should be. However, the International Holocaust Remembrance Alliance definition itself does it so I am probably wide of the mark.
How else would you explain antizionist Jewish orthodox communities?
If you'd sell to Turkey, Saudi-Arabia & co and then say "we have some standards, we won't sell to Israel", yeah, you'd not be against colonization, occupation etc, you'd be against Israel specifically for other reasons.
Still, imagine you're German and you've received an education, growing up, completely condemning the evil that the WWII Nazis committed against the Jewish people. Imagine that to refute the history of that evil is, in fact, a crime — a crime of speech and ideology. Then imagine learning that the Jewish state made available by partitioning land has grown, considerably, since its initial allocation post-WWII. Imagine learning that the growth exactly resembles of actions of WWII Nazis against Jews, only now by Zionist Jews against Palestinians.
Israel has all the makings of a great country. In my mind, it has succeeded thoroughly. Despite my above criticism, I wish it success. I hope it makes humanitarian strides to acknowledge its wrongdoing and make reparations. I'd only point out that its specific actions against Palestinians did happen and continue to happen today and it is an evil. If you're German, you might feel especially emotional about it, given the shared history.
But, unlike you, I don’t despair at the (mild) cognitive dissonance you’re describing. The Holocaust, and its uniqueness, are fact. Israel’s behavior towards Palestinians today is reprehensible. These are neither incompatible, nor does the latter diminish the former.
We can expect more from Israel than, say, Sudan, because it is a democracy, relatively rich, and part of “the west”. To instead use the Holocaust to place additional burdens on them is cynical. So stop whining about your youth. It was probably terrible, but the Jews weren’t involved in that. And, unlike many of them, you got to survive to adulthood.
I think one can appreciate that the FinFisher group has done terrible things and is working against a free, democratic society. I do not really want to defend them, so I think it's important to say that up front. I took aim at the idea that "they must also be anti-semites because they specifically criticized Israel." I do not want the criticism of Israel to be the bar we set for the anti-semitism accusation.
If you learn that anywhere, I think you're talking to antisemites. It's really not the same, it's not similar beyond "a state does stuff, Nazi Germany was a state, Israel is a state, so it's the same", but that's not a useful comparison.
> If you're German, you might feel especially emotional about it, given the shared history.
I'm German, I don't feel especially emotional about it, and I often do feel like that the obsession with Israel is more about "see, the Jews are doing it too, we're not so bad" and less about "what a terrible thing". Exactly because most people are very upset about Israel doing stuff and completely ignore far worse things being done by others.
As for Turkey: you don't need to go back to the Armenian Genocide. Turkey still occupies parts of Cyprus, is de-facto annexing parts of Syria and is working closely with what has been formerly known as ISIS, currently sending them to Azerbaijan to fight against Armenia.
The point is: if a vendor would say "we don't sell to Israel because of ethics" but sells to countries that are ethically far worse, their problem obviously isn't ethical in nature. Their problem would be Israel. Nevertheless, FinFisher didn't, so it's hypothetical. They probably didn't sell to Israel either, because Israel has no need to buy, having a strong security industry with lots of vendors for offensive tools.
I'm sure I've spoken to anti-semites in my life, but your accusation is merely begging the question. I learned the history largely from a book titled "The Ethnic Cleansing of Palestine."
https://en.m.wikipedia.org/wiki/The_Ethnic_Cleansing_of_Pale...
You need not support the actions political party of the Zionists to support Israel or the Jewish people the same that you need not support the actions of any other political party, say the far-right of the United States, in order to support the country or its people. And you needn't publicly enumerate your disgust for all atrocities by all peoples in order to denounce the single action of a single people.
Anyway, I think you're right about feeling suspicion over "see, they did it, too." I won't defend anti-semites for being anti-semitic, and I won't condemn all anti-zionists as anti-semites. I think this is where our differences on the matter arises.
> And you needn't publicly enumerate your disgust for all atrocities by all peoples in order to denounce the single action of a single people.
Your credibility would be much better if you did though. If the police completely ignored crimes committed by white people and vigorously enforced the law against black people, wouldn't you question their motives?
This is cheeky of me, but... A hint for starters: the Zionists did invade Palestine with the intent to destroy it. The Zionist movement in Israel did not respect the partitioning of Palestine set up by UN Resolution 181. Zionists committed mass murder against the Palestinians even outside of typical warfare — there were significant civilian casualties. There is no need to equivocate the criticism that "what Zionists are doing to Palestinians is similar to what Nazis did to Jews" to a very different claim that "the Holocaust and the Nakba are wholly the same."
We are horrified that Israel would commit ethnic cleansing against another group of people. It is especially horrific given they did so immediately after having been dealt the same atrocity at the hand of Nazis.
You can narrowly criticize Israel for these historical and present-day actions, and you gain credibility by standing firmly on that point.
Because my response seems to have gained some traction, I will offer you a couple more sources. I don't require or expect you to purchase and read the aforementioned book, but I hope you will look over the following:
[1] https://en.wikipedia.org/wiki/1948_Palestinian_exodus [2] https://www.aljazeera.com/features/2017/5/23/the-nakba-did-n...
I think they are in the same area of related-to-reality-ness. Are civil wars usually bloody and terrible? Yes. Is it reasonable to compare that to the holocaust? No.
> We are horrified that Israel would commit ethnic cleansing against another group of people. It is especially horrific given they did so immediately after having been dealt the same atrocity at the hand of Nazis.
Is it? It's not to me. Quite the contrary: having just barely survived the murderous intentions of somebody who was aftery our life will probably have you very vigilant and possibly overly defensive against the murderous intentions of another group that's after your life.
> You can narrowly criticize Israel for these historical and present-day actions, and you gain credibility by standing firmly on that point.
You can totally criticize Israel for the treatment of the Arabs. Yet when you fail to criticize others for similar treatment of other Arabs (or the same Arabs, even, in the case of Fatah and Hamas), it suggests that your issue with Israels treatment isn't a question of ethics, but of ethnics. That is: had mass-immigration to Palestine from Turkey happened, and had these Turks declared a new state and everything else had happened exactly the same way, you wouldn't criticize them, because they aren't Jews.
And if you would: why would you limit your criticism to Israel, and not apply it to all offenders? "Oh, but you must start with one", sure, sure, but why start with the smallest one that offends much less than others and focus on decades ago instead of today? And why join ranks with terrible governments in doing so, who mock the very idea of human rights? That just doesn't make sense to me in a way of "I'm really equally against all bad things, I've just chosen to be vocal about this particular one for no specific reason whatsoever".
I object to the conflation of anti-zionism with anti-semitism. On a second order, I care about Zionists' crime carrying out ethnic cleansing of Palestinians in Palestine.
It is an ugly perspective, to me, that we should concern ourselves with the Zionists' ethnic cleansing of Palestinians only after we have solved all other problems.
Anyway, check out the three sources. I think you have an interest in the matter.
You'll be the one-in-a-million exception then, in my experience. Most declare that they would, but never will, given the chance.
> It is an ugly perspective, to me, that we should concern ourselves with the Zionists' ethnic cleansing of Palestinians only after we have solved all other problems.
Meh, I don't even think ethnic cleansing actually applies (not least because Palestinians aren't an ethnic group, they're a cultural group). But even more so: that's not what I said. What I'm saying is that there's a suspicious focus on Israel that turns into willful ignorance and self-imposed blindness when it comes to other things. That heavily suggests it's not actually about what Israel does, but rather about the fact that it's Israel doing it.
> Denying the Jewish people their right to self-determination, e.g., by claiming that the existence of a State of Israel is a racist endeavor.
> Applying double standards by requiring of it a behavior not expected or demanded of any other democratic nation.
[1] https://www.holocaustremembrance.com/resources/working-defin...
However, I don't see any hope that malware exports will be curbed ahead of conventional weapons exports. Ultimately, weapons can be exported under pretty liberal rules.
Even if there are controls (like there are on weapons), the existence of a robust weapons market means that weapons are usually available to any regime (or less) that can pay for it. Certain weapons (ICBMs, tanks, jets) are actually controlled, but these tend to be weapons (1) without a robust market (2) that potentially challenge an exporters military power (3) really expensive.
The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. We're losing at this.
That's hard to do though. Germany has their attempt with the infamous laws around "hacker tools", which place a lot of legal insecurity on any serious security work. "Rouge malware vendors" would already be operating illegally, and a state sanctioned developer that provides the state with malware can't be considered a mercenary, I think.
I'm not convinced regular law enforcement badly needs malware to investigate, but I also don't see why they'd not get that tool (with court orders and solid procedures) if we allow them to do other kinds of surveillance. From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.
There is a danger that comes from thinking of these problems as theoretical. They aren't. We have a history, a present. History (germany knows this more than most) is that a surveillance-centric law enforcement is the basis for a repressive regime. The stasi wasn't a coincidence. The present shows us that state surveillance is on the rise. Again germany makes a fine example. Already repressive regimes (like Belarus, currently) give us an easier to grok understanding of the mechanics.
It's easy for us to agree that it's bad to supply these to bad regimes. If Lukashenko uses german software operated by german mercenaries (I believe this is a precise definition of the term) to find and arrest his dissenters, germans will feel that this company is bad. That's easy. But, that company can migrate and I doubt export bans would have denied Luka much or changed the game meaningfully in Belarus. It's effectively symbolic.
What is more important is for germans to ban their own governments from doing this, or at least strictly restrict it to counter-terrorism. If any police department can hire mercenaries to "do cyber-policing," we get to stasi situations quickly.
Unlimited power is a bad thing, a dangerous thing.
https://freiheitsrechte.org/home/wp-content/uploads/2019/11/...
Some quotes:
"Factual evidence exists for the fact that the suspects, who at the point in time relevant for the criminal complaint were CEOs or staff members of Elaman GmbH, FinFisher GmbH, or FinFisher Labs GmbH, have made themselves liable to prosecution because of deliberate violations against the obligation to obtain licences for dual-use software in accordance with section 18 para. 2 no. 1 and section 18 para. 5 no. 1 Foreign Trade and Payments Act (Außenwirtschafts- gesetz, AWG) by exporting the surveillance software FinSpy to Turkey during the period between October 2016 and July 2017 without having previously obtained the required licence from the [German] federal government."
State malware:
"FinSpy is highly developed spyware which, according to the company’s own description on its website, is sold exclusively to governments for the purposes of strategic intelligence and criminal prosecution,"
This is not an old case, it has been submitted only recently, as is clear from the date mentioned here:
"The companies are neither so large nor is the number of potential FinSpy customers so high that it would suggest itself to decide about and carry out exports without the knowledge of the CEOs. The fact that the federal government, according to the information it gave on 19 June 2019, has not issued an export licence for intrusion software requiring a licence since January 2015 additionally either suggests that the export of such software is not routine business, which would support all the more that the CEOs knew about it, or that numerous additional exports violating the export provisions have taken place in recent years, above and beyond the business deals with Turkey."
Interesting read.
There has previously already been some discussion on NSO Group's "Pegasus" Spyware and how it's being used in terrifying ways. This is a frightening 8-part series by Citizen Labs about the abuse of "Pegasus" in Mexico 2017-2019: https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware...
Here's a category of articles on the citizenlab.ca web site described as "Investigations into the prevalence and impact of digital espionage operations against civil society groups": https://citizenlab.ca/category/research/targeted-threats/
German Made State Malware Company, FinFisher, Raided