Think tank report labels NSO, Lazarus as 'cyber mercenaries' Cybercrime gangs like the notorious Lazarus group and spyware vendors like Israel's NSO should be considered cyber mercenaries – and become the subject of a concerted international response – according to a Monday report from Delhi-based think tank Observer Research Foundation (ORF). Author Fitri Bintang Timur argued the term …
No, the article was about the private groups that operate with governments to help generate that abuse. NSO is an example of such a thing. The governmental abuse is the result, and private actors are one of the components that generates the result. Both need to be handled. I do think they made a mistake naming Lazarus as one of these because it's not independent of North Korea's government, but the rest of the examples are private and most often work with multiple governments, and probably other groups as well no matter how many times they try to claim otherwise.
Can you explain to me how NSO forces its clients to abuse the tools? Do you think that NSO forces all its clients to abuse the tools, or do they only force some of their clients to abuse the tools? Can you also explain how the manufacture of the saw used to cut up Jamal Khashoggi after he was murdered forced KSA to abuse him?
"Can you explain to me how NSO forces its clients to abuse the tools?"
You're just being stupid now. They make tools whose entire purpose is to abuse people. They're not forcing anyone to abuse them. Governments who want to commit some abuses go looking for tools that make it possible, and NSO is rewarded well for having made such abusive software. NSO forces none of its clients to abuse the tools, and all its clients are committing abuses with them.
I'm not sure what point you'd like to make, but you're not arguing it well. First, NSO had nothing to do with the article's content (wrong) and now, they're just tool manufacturers (wrong).
You were the one suggesting that the availability of the NSO tool makes governments abuse the tool - I'm asking questions to try to understand why you think that. Personally, I think you are putting the cart before the horse. A government who abuses the NSO tools is going to abuse whatever tools are available to them, even the manufactures of something as simple as a saw, for example. The story is about governmental abuse. Anybody who wants to make NSO the centre of the story is deflecting the focus away from the actual problem. What is the motivation for that deflection?
I will try one more time. Governmental abuse is one problem. The availability of tools for that abuse is a different problem. You can have governmental abuse without those private companies if the governments themselves write it, and that would be, or rather is, bad as well. Since those private providers of intentionally abusive tools distribute them to more governments, it tends to enable more abuses because the cost of developing them is spread around. The governments concerned would have been willing to commit abuses anyway, but the tools make it easier for them to do so and to have stronger effects when they do.
If I was trying to "deflect", I wouldn't keep saying that governments are committing abuses, as I have in both preceding posts. Meanwhile, I have yet to see any real point from you, other than somehow deciding that NSO and its ilk are unimportant. They are contributors to the problem, and thus we discuss them.
So the story is really about governmental abuse, but that's boring, so the Reg threw in NSO's name to generate some clicks.
Not really.. NSO is just one of the more notorious. Article makes some good points given the way infosec is increasingly being weaponised by both state and non-state actors. Some of the tech is covered by export controls, some isn't, but the problems seem more about the application. It seems much like regulation of PMCs, or espionage in general. Cyber attacks can be very damaging, but seem to exist in a bit of a grey area wrt international laws and the laws of war.
Ah! Cyber-mercenarism does surely better explain the Lazarus Blacksmith's use of DLang (from Dec. 11 article) given North Korea's rather low apparent level of tech adoption (except for hypersonic missiles). It is particularly sad when compared to South Korea's many high-tech achievements and generally much more comfortable lifestyle. All this to desperately hang on to an obsolete political system where dictatorship of the proletariat has long ago degenerated into dictatorship of the life-long dictator.
In any instance, cyber mercenaries might want to insist on being paid in US dollars (like Javier Milei?).
Yes, I'm sure some high-minded organisations will issue harshly-worded reprimands to those nasty, evil cyber-mercenaries. That'll show 'em! /s
This is the problem. Recently 'Russia' attacked a Ukrainian mobile network, shutting it down. There's an ongoing armed conflict between the two, so communications infrastructure is fair game. The Russian state may have used their own resources, or contracted it out. Ukraine has also been conducting cyberattacks against Russian infrastructure. Where it gets blurry is if say, Russia or Ukraine contracted say, NSO for services, especially if companies like NSO are under some control or regulation from their states, and those states aren't parties to the conflict.
For independents, or hactivists, national laws also apply. So if I hacked either Russia or Ukraine, I could be prosecuted under UK's Computer Misuse Act. It gets a bit murky I guess if I'm caught but not prosecuted given I'm attacking another state. The US has a law I can't remember that can be used to prosectute anyone trying to usurp their State Department's monopoly on foreign policy. But other than that, and possibly national espionage acts it seems to be down to strongly worded reprimands. So the UN's been voting to try and stop Israel destroying Gaza, and Israel says 'Nope'. UN Resolutions are pretty meaningless, unless UN members decide to take action.
When the Ukraine-Russia conflict started though, various nations warned that cyberattacks could/would be viewed as acts of aggression. But then what? WW3? Or a possibility could be bringing charges at the ICC, but then many of the beligerents don't recognise the ICC. We live in interesting times though, and it's always been an issue I guess with 'international law', which doesn't really exist except for a bunch of agreements and treaties that may or may not be acted on.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
