Best Infosec-Related Long Reads for the Week of 5/25/24
NSO Group founder is thriving following his ouster, Rwandan leaders targeted by Pegasus, Austria's spy agency raided by Moscow-led operation, Insights from the most prolific LLM jailbreaker, Novel Espionage Act brought against Chinese drone photographer
Metacurity is pleased to offer our free and premium subscribers this weekly digest of the best long-form (and longish) infosec-related pieces we couldn’t properly fit into our daily news crush. So tell us what you think, and feel free to share your favorite long reads via email at info@metacurity.com.
AFTER PEGASUS WAS BLACKLISTED, ITS CEO SWORE OFF SPYWARE. NOW HE’S THE KING OF ISRAELI AI.
In the Intercept, investigative journalist Georgia Gee examines how Shalev Hulio, founder of Israel’s NSO Group, has bounced back from his ousting as CEO of the infamous spyware company to found a new cybersecurity company called Dream Security, invest in a dark web monitoring company called Intel Eye and established an academic arm at Israel’s Ben-Gurion University of the Negev called “The Institute.”
The launch of The Institute at Ben-Gurion University was itself marked by confusion. An article in the Jerusalem Post announcing the initiative described it as a partnership with the Israel Defense Forces’ elite cyberspying unit, known as 8200. NSO’s founders — including Hulio — and many of its employees are veterans of 8200.
Days after the initial article ran, however, all of its references to 8200 were scrubbed without any notice.
An IDF spokesperson told The Intercept, “The IDF in general and Unit 8200 in particular do not take part in the aforementioned program.” (Shmuel Dovrat, a spokesperson for Ben-Gurion University, said The Institute had not been in touch with the Jerusalem Post after the initial publication, but said, “I’m glad that they changed it because of the wrong information.”)
According to a press release, The Institute will bring together AI luminaries and run training programs and research, with Hulio and other Dream employees among its leaders. In the coming year, The Institute’s research laboratories will strengthen Israel’s hand in the tech world by collaborating with actors across the industry, according to a report in a U.K. tech news site.
“Through hard work born out of love and commitment to the state of Israel, we have built a team of the best entrepreneurs, investors and leading companies in the world to help Israel become a global leader in artificial intelligence,” journalist Sivan Cohen Saban, The Institute’s CEO, said at the launch event on May 8.
On hand at the launch, according to coverage, were officials from global firms like Microsoft and General Motors, as well as top-tier Israeli politicians, like Herzog, the president. (A spokesperson for GM told The Intercept they could not confirm the company’s attendance.)
Pegasus in Rwanda: Sister of presidential candidate, high-ranking Rwandan politicians added to spyware list
Investigative journalists working on the Rwanda Classified project, published jointly by 17 media outlets and coordinated by Forbidden Stories, revealed how Anne Rwigara, the late sister of presidential Rwandan candidate Diane Rwigara, and several Rwandan former ministers, including the former justice minister Tharcisse Karugaramawas, were selected as targets of NSO Group’s Pegasus spyware.
Rwanda’s alleged use of spyware to track dissidents didn’t stop at its own borders. In 2021, the Pegasus Project revealed that the phone of Carine Kanimba, the daughter of human rights defender Paul Rusesabagina, had been infected with Pegasus spyware in Belgium. Past reporting from the Financial Times documented Pegasus use against dissidents in Belgium, the UK and South Africa.
Other potential targets revealed at the time included Gatera Gashabana, a lawyer who represented the Rwigara family, as well as a journalist who covered the case against Diane and her mother Adeline.
Grady Vaughan, a researcher at the NGO Freedom House, which has studied Rwanda’s transnational repression, explained that this type of surveillance is typical of authoritarian regimes. “A lot of times spyware is used to find out where someone lives, and then their family members may be harassed,” he said. “Ultimately, this may lead to a physical assault or assassination.”
Rwanda, for its part, has officially denied using Pegasus. But multiple Israeli intelligence sources confirmed to Forbidden Stories’s partner Haaretz that the country had signed a contract by 2017, with the participation of a Rwandan police officer. According to those sources, the contract was either ended or not renewed in 2021. (A Rwandan government spokesperson declined to comment on questions sent by the consortium. The Rwanda National Police did not respond to our request for comment.)
In an email, NSO Group, which sells Pegasus, insisted that its technology is “only sold to vetted intelligence and law enforcement agencies” for use “to prevent crime and terrorist attacks.” While NSO cannot confirm or deny specific customers, a spokesperson added: “We would like to emphasize that NSO has had no active clients in Rwanda since 2021.”
Scott-Railton of Citizen Lab, which first identified Pegasus activity in Rwanda in June 2017, confirmed that the watchdog had not seen recent Pegasus activity. “We see no evidence indicating that Rwanda is a current customer,” he said.
Putin hijacked Austria’s spy service. Now he's going after its government
Politico EU’s Matthew Karnitschnig tells the story of how a Moscow-led operation conducted an armed incursion into Austria’s domestic intelligence service BVT, seizing confidential data and sensitive documents under the direction of JGRU-linked Jan Marsalek, the fugitive former chief operating officer of the collapsed payment processing firm Wirecard, and then-Interior Minister Herbert Kick, who now heads the pro-Russia Freedom Party (FPÖ), the most popular party in the country.
Marsalek had good reason to undermine the BVT. [Senior BVT official Egisto] Ott, his trusty source within the agency, had just been suspended, following a tip from the CIA that he had forwarded work emails to his private account. The authorities had yet to find a smoking gun, but they were closing in.
With the clock ticking, Marsalek made a risky move. In November 2017 he forwarded [former FPÖ leader Johann] Gudenus a confidential BVT case number, encouraging him to get his hands on the file and falsely claiming it held sensitive information the agency had collected on the FPÖ.
By the time the FPÖ took control of the interior ministry at the end of 2017, the party’s leadership was convinced the BVT was actively trying to undermine it.
In January 2018, Peter Goldgruber, the newly installed No. 2 official at the interior ministry who reported directly to Kickl, told a prosecutor who handled corruption cases that he had been ordered to “clean up” the ministry, according to notes the prosecutor took on the meeting. His first target: the BVT.
Goldgruber encouraged the prosecutor to pursue a case against the agency’s leaders on the basis of the information contained in Marsalek’s dossier. Though the accusations were vague, a key witness had come forward: Martin Weiss. Ultimately, the prosecutor signed off on a raid.
The next task was to find police officers to carry out the operation. All of the country’s elite units had ties to the BVT leadership, meaning there was a great risk the agency would catch wind of the raid before it happened. Goldgruber settled on Commander Preiszler, a local FPÖ politician who ran a special street-crime unit.
Spying, hacking and intimidation: Israel’s nine-year ‘war’ on the ICC exposed
The Guardian’s Harry Davies and Bethan McKernan, and the +972 Magazine and Local Call journalists Yuval Abraham and Meron Rapoport expose how Israel has run a secret war against the International Criminal Court (ICC), deploying its intelligence agencies to surveil, hack, pressure, smear and allegedly threaten senior ICC staff to derail the court’s inquiries under the direction of Prime Minister Benjamin Netanyahu’s close ally Yossi Cohen.
According to multiple current and former intelligence officials, military cyber-offensive teams and the Shin Bet both systematically monitored the employees of Palestinian NGOs and the Palestinian Authority who were engaging with the ICC. Two intelligence sources described how Israeli operatives hacked into the emails of Al-Haq and other groups communicating with Bensouda’s office.
One of the sources said the Shin Bet even installed Pegasus spyware, developed by the private-sector NSO Group, on the phones of multiple Palestinian NGO employees, as well as two senior Palestinian Authority officials.
Keeping tabs on the Palestinian submissions to the ICC’s inquiry was viewed as part of the Shin Bet’s mandate, but some army officials were concerned that spying on a foreign civilian entity crossed a line, as it had little to do with military operations.
“It has nothing to do with Hamas, it has nothing to do with stability in the West Bank,” one military source said of the ICC surveillance. Another added: “We used our resources to spy on Fatou Bensouda – this isn’t something legitimate to do as military intelligence.”
Legitimate or otherwise, the surveillance of the ICC and Palestinians making the case for prosecutions against Israelis provided the Israeli government with an advantage in a secret back channel it had opened with the prosecutor’s office.
An interview with the most prolific jailbreaker of ChatGPT and other leading LLMs
The Verge’s Carl Franzen interviewed Pliny the Prompter, who has been jailbreaking or removing the prohibitions and content restrictions on leading large language models (LLMs) such as Anthropic’s Claude, Google’s Gemini, and Microsoft Phi since last year, allowing them to produce to produce interesting or even dangerous responses.
Pliny even launched a whole community on Discord, “BASI PROMPT1NG,” in May 2023, inviting other LLM jailbreakers in the burgeoning scene to join together and pool their efforts and strategies for bypassing the restrictions on all the new, emerging, leading proprietary LLMs from the likes of OpenAI, Anthropic, and other power players.
The fast-moving LLM jailbreaking scene in 2024 is reminiscent of that surrounding iOS more than a decade ago, when the release of new versions of Apple’s tightly locked down, highly secure iPhone and iPad software would be rapidly followed by amateur sleuths and hackers finding ways to bypass the company’s restrictions and upload their own apps and software to it, to customize it and bend it to their will (I vividly recall installing a cannabis leaf slide-to-unlock on my iPhone 3G back in the day).
Except, with LLMs, the jailbreakers are arguably gaining access to even more powerful, and certainly, more independently intelligent software.
But what motivates these jailbreakers? What are their goals? Are they like the Joker from the Batman franchise or LulzSec, simply sowing chaos and undermining systems for fun and because they can? Or is there another, more sophisticated end they’re after? We asked Pliny and they agreed to be interviewed by VentureBeat over direct message (DM) on X under condition of pseudonymity.
The Unusual Espionage Act Case Against a Drone Photographer
In Wired, Jordan Pearson details how the United States Department of Justice is quietly prosecuting a novel Espionage Act case involving a drone, a Chinese national, and classified nuclear submarines under a World War II-era law that bans photographing vital military installations using aircraft,
On January 5, 2024, Fengyun Shi flew to Virginia while on leave from his graduate studies at the University of Minnesota and rented a Tesla at the airport. His research focused on using AI to detect signs of crop disease in photos. Shi’s subject that week wasn’t plants, however, but allegedly the local shipyards—the only ones manufacturing the latest generation of Navy carrier ships in the country, and nuclear submarines as well.
According to an affidavit filed by FBI special agent Sara Shalowitz in February, a shipyard security officer alerted the Naval Criminal Investigative Service to Shi’s actions. The affidavit alleges that on January 6, Shi was flying a drone in “inclement weather” before it got stuck in a neighbor’s tree. When Shi, who is a Chinese citizen, approached the neighbor for help, he was questioned about his nationality and purpose for being in the area. The unnamed resident took photos of Shi, his license plate, and his ID, and called the police. The affidavit alleges that Shi was “very nervous” when questioned by police and “did not have any real reasons” for flying a drone in bad weather. The police gave Shi the number for the fire department and said he would need to stay on the scene. Instead, he returned the rental car an hour later and left Hampton Roads, Virginia, abandoning the drone.
When the FBI seized the drone and pulled the photos off its memory card, they discovered images that special agent Shalowitz said she recognized as being taken at Newport News Shipyard and BAE Systems, which is a 45-minute drive away. The affidavit states that on the day Shi took the photos, the Newport News Shipyard was “actively manufacturing” aircraft carriers and Virginia class nuclear submarines.
“Naval aircraft carriers have classified and sensitive systems throughout the carriers,” the affidavit states. “The nuclear submarines present on that date also have highly classified and sensitive Navy Nuclear Propulsion Information (‘NNPI’) and those submarines even in the design and construction phase are sensitive and classified.”
