Read on Twitter
BREAKING: @Microsoft @Google @Cisco @LinkedIn @github @VMware & @InternetAssn joining the @WhatsApp v. #NSOGroup case w/an Amicus brief THREAD 1/
2. Brief begins with #NotPetya attack. Says: Shows how dangerous and damaging it can be when attack tools proliferate. Notes number of states that can develop such tools v. limited & NSA still protected by longstanding principles of sovereign immunity from liability...
3. ...court must decide whether to "radically expand" risks from attack tools by immunizing private spyware developers. If even NSA couldn't keep #EternalBlue from leaking, what chance is there that tools made & used indiscriminately won't spiral out of control.
4. As more govs. purchase sophisticated hacking tools the risk of proliferation spiraling out of control and threatening all of our security grows & is compounded because some of them are more likely to engage in "riskier behaviors".
5. [Editorializing for a tweet] interesting rebuttal to the common spyware dev. narrative that hacking tools are designed to be used 'surgically' and hence always under control by giving a real life case of 'surgical' tools being repurposed to take down a whole country.
6. Argument A1. Giving NSO & peers immunity would increase the number of Gov customers, fueling the proliferation of spyware & create large-scale systemic risk w/potential for disaster. Liability must be used to deter this business model that depends on violating US law.
7. A2: Expanding immunity to spyware devs will result in more newly discovered exploits flowing towards private actors & away from mechanisms used to ensure the security of society (e.g. Vulnerabilities Equities Process etc).
8. Argument B: Spyware devs & customers don't always have have good security. Tools can and do get stolen. Or reverse engineered. Some Govs may narrowly prioritize their interests above cybersecurity ecosystem and act and in ways that harm whole internet.
9. C: #NotPetya = tip of iceberg of kind of systematic harm to come from conferring immunity on spyware industry. Can take years to fix vulnerabilities & get implants off networks & devices. Some damage, like stolen materials, cannot be undone.
10. KEY TAKEAWAYS: #NSOGroup framed case as "public safety vs. privacy." The amicus shifts the frame by arguing that allowing companies like NSO to be exempt from liability is itself a serious threat to public safety.
11 'cont'd... this Amicus does *exactly* what you want from such a filing. Credible actors helping the court to understand the wider stakes of the case beyond the specific legal arguments.
