Saudi Arabian Telco Asks Pro-Privacy Researcher To Help Them Spy On Citizens, Hilarity & Then Seriousness Ensues

from the perhaps-google-the-person-you're-contacting-first dept

Via Chris Soghoian, we learn that a Saudi Arabian telecom company (one of just two) contacted well-known pro-privacy researcher Moxie Marlinspike recently to see if he might help them intercept communications from a variety of popular communications apps, including Twitter, Viber, Line and WhatsApp. Curious about what they wanted, Marlinspike emailed with them a bit, and then published what he was told — including the fact that they later told him they very quickly and easily figured out how to intercept WhatsApp communications. Eventually, he told them that he wouldn’t work with them, and the guy he was communicating with told him by not helping the Saudi government intercept communications, he was helping the terrorists:

I know that already and I have same thoughts like you freedom and respecting privacy, actually Saudi has a big terrorist problem and they are misusing these services for spreading terrorism and contacting and spreading their cause that’s why I took this and I seek your help. If you are not interested than maybe you are on indirectly helping those who curb the freedom with their brutal activities.

From there, however, Marlinspike goes on into a very interesting discussion, well worth reading, about changes in the hacker/security community lately and the lucrative business of selling 0day exploits (often to governments) rather than publishing them and getting things fixed.

Forgetting the question of legality, I hope that we can collectively look at this changing dynamic and perhaps re-evaluate what we culturally reward. I’d much rather think about the question of exploit sales in terms of who we welcome to our conferences, who we choose to associate with, and who we choose to exclude, than in terms of legal regulations. I think the contextual shift we’ve seen over the past few years requires that we think critically about what’s still cool and what’s not.

Maybe this is an unpopular opinion and the bulk of the community is totally fine with how things have gone (after all, it is profitable). There are even explicitly patriotic hackers who suggest that their exploit sales are necessary for the good of the nation, seeing themselves as protagonists in a global struggle for the defense of freedom, but having nothing to do with these ugly situations in Saudi Arabia. Once exploits are sold to US defense contractors, however, it’s very possible they could end up delivered directly to the Saudis (eg, eg, eg), where it would take some even more substantial handwaving to think that they’ll serve in some liberatory way.

Exploits will be exploited. Helping anyone to make use of them means that eventually they’re going to get exploited by others in ways you might not agree with.

Filed Under: , , , , , , ,
Companies: mobily

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Saudi Arabian Telco Asks Pro-Privacy Researcher To Help Them Spy On Citizens, Hilarity & Then Seriousness Ensues”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Re: Re:

If we had a terrorist problem maybe I would be ok with some of the spying that has gone on.

But we do not have a terrorist problem.
In the US more people die in vehicle related accidents each year than have ever died from terrorists.

Anyone afraid of terrorists should be horrified to walk across the street since they are more likely to get run over by a bus than ever be bothered by a terrorist.

When will the TRANSPORTATION SAFETY Administration do something about all these vehicular deaths each year?
We clearly need safer cars and streets!

Malor (profile) says:

Considering that there always seem to be arms dealers, no matter what horrors are inflicted, I figure Moxie is pretty much pissing in the wind. It’s a damn shame, and I wish it weren’t so.

But, if you are a security researcher, and you are selling exploits to governments, don’t kid yourself. You are a modern arms dealer, and you are probably going to be getting people killed, very possibly people you would like.

Going off on a bit of a tangent: this is another reason why I get so frustrated with the Linux kernel devs for treating security with such a cavalier attitude, actively going out of their way to hide security problems in the kernel. In the modern world, people’s lives depend on the security their systems claim to provide.

I can’t help but wonder if someone’s deliberately vague commit has ended up causing people to be imprisoned, tortured, or even killed, because the bad guys figured out the security implication, but the good guys didn’t.

Code security matters. It matters a lot.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...