Members of this organization need to be pursued as criminals. Internal reform of a criminal organization is a sick joke. They're all accessories to murder; changes to company policy don't change that.
If their government is intent on protecting them from prosecution, then extralegal retributive action taken by an competing spy agency could be suitable payback. Unfortunately that assumes the existence of a competing spy agency that isn't equally morally bankrupt.
> Members of this organization need to be pursued as criminals
Not sure why this is being downvoted. NSO and its employees willfully facilitate criminal violations of CFAA, among other laws. (They have received payment in U.S. dollars, making the question of jurisdiction trivial.)
Given the heinousness of some of the crimes they've aided and abetted, many against American citizens, most Americans would be on board with arresting their employees on arrival to the America or our allies.
Providing tools that could be used to violate the CFAA is not the same thing as violating the CFAA. There are several US companies that do this. There is nothing illegal about it as long as you don’t sell to countries on sanctions lists.
Their customers are far too inept to use their tools, if you can even call them that given that they are specialized for just about every target (group). It's one thing to make a cruise missile but another entirely to sell it with a preloaded flight path and a consultant on hand to help you press the button.
Knowingly assisting organizations that target human rights activists and reporters, and assisting the incarceration and murder of those targets makes you a criminal.
They are criminal accessories to gross human rights violations and murder, and should be prosecuted as such.
That's an interesting comparison. But one difference is that bombs and guns can be used against any target (any human, animal, building), as well as non-violent targets such as for practice, competition, entertainment, or for intimidation (e.g. mutually assured destruction).
Whereas Pegasus was designed to exploit a specific WhatsApp vulnerability, and to interact specifically with WhatsApp's servers. And NSO had paid support relationships with the organizations doing the attacking.
Another difference is that NSO employees themselves had to reverse engineer and exploit the vulnerability during development (possibly illegal under the CFAA). This action also violated WhatsApp's terms of service. There's no parallel to this with guns and bombs.
Another difference is that according to the complaint, NSO-operated servers talked to the exploited devices. So this wasn't just a tool that NSO handed over to governments to be used (like guns and bombs) and then was uninvolved in, it was a service that NSO operated, and governments issued commands to the service telling it who to attack.
The Hacker Team, a similar Italy based outfit were hacked to death several years ago. Seemed quite fitting. Talking about legalities when they supply governments (India is still a democracy btw) sounds naive.
If their government is intent on protecting them from prosecution, then extralegal retributive action taken by an competing spy agency could be suitable payback. Unfortunately that assumes the existence of a competing spy agency that isn't equally morally bankrupt.