Cyberwar for Sale - The New York Times

An excerpt from an extensive and timely reality check:

"The White House, C.I.A. and F.B.I. have all claimed that, based on classified evidence, they can trace the hacks of Podesta’s email account (and other hacks of people close to the Clinton campaign) back to the Russian government. But with the rise of private firms like Hacking Team, penetrating the email accounts of political opponents does not require the kind of money and expertise available to major powers. A subscription-based website called Insider Surveillance lists more than a dozen companies selling so-called ethical malware, including Milan-based Hacking Team, the German firms FinFisher and Trovicor and the Israeli company Nice. Compared with conventional arms, surveillance software is subject to few trade controls; a recent attempt by the United States to regulate it under a 41-country pact called the Wassenaar Arrangement failed. “The technology is morally neutral,” says Joel Brenner, a former inspector general of the National Security Agency. “The same program that you use to monitor your babysitter might be used by Bashar Assad or Abdel Fattah el-Sisi to keep track of whomever they don’t like.”

Hacking Team has fewer than 50 employees, but it has customers all over the world. According to internal documents, its espionage tool, which is called the Remote Control System, or R.C.S., can be licensed for as little as $200,000 a year — well within the budget of a provincial strongman. After it has been surreptitiously installed on a target’s computer or phone, the Remote Control System can invisibly eavesdrop on everything: text messages, emails, phone and Skype calls, location data and so on. Whereas the N.S.A.’s best-known programs grab data in transit from switching rooms and undersea cables, the R.C.S. acquires it at the source, right off a target’s device, before it can be encrypted. It carries out an invisible, digitized equivalent of a Watergate-style break-in."

Cyberwar for Sale - The New York Times