--:-- Sean Rameswaram: Everyone's talking about balloons and UFOs in the sky, but when you talk to people who investigate all the creepy ways we spy on each other, you know what they're concerned about? Spyware.
--:-- Sean Rameswaram: The spyware industry is booming, and it's getting way more sophisticated. Like, there now exists technology that can hack somebody's phone without them even needing to click some deceptive link.
--:-- Sean Rameswaram: There are other more powerful tools that the Chinese government and other governments around the world have access to gain data, not only about the U.S. government and missile silos, but about individuals and their behaviors and their personal lives.
--:-- Sean Rameswaram: And these are just as important for the discussion as surveillance tools of a government to spy on other governments. Spyware. Everywhere. All at once.
--:-- Sean Rameswaram: Coming up on Today Explained. Support for Today Explained comes from the FIFA World Cup, of all things. The FIFA World Cup 26 is coming to North America next summer.
--:-- Sean Rameswaram: It is the ultimate celebration of sports and culture. You can get closer to the beautiful game with a hospitality package, closer to the action, the best seats, the best suites, closer to match day and that world-class food.
--:-- Sean Rameswaram: and that world-class entertainment closer to the experience of a lifetime. Book a hospitality package at fifaworldcup.com slash hospitality.
--:-- Sean Rameswaram: Support for this show comes from strawberry.me. Be honest. Are you happy with your job? Or are you stuck in one you've outgrown? Or never wanted in the first place?
--:-- Sean Rameswaram: Sure, you can probably list the reasons for staying. But are they actually just excuses for not leaving? Let a career coach from strawberry.me help you get unstuck.
--:-- Sean Rameswaram: Discover the benefits of having a dedicated career coach in your corner. Go to strawberry.me slash unstuck to claim a special offer.
--:-- Sean Rameswaram: Today Explained, Sean Ramos for him. When you want to talk about spyware, you want to talk to Mark Mazzetti. He's an investigative reporter for the New York Times.
--:-- Sean Rameswaram: With all the balloons buzzing around and the UFOs being shot down from the sky, We asked him what's at stake with spyware, which he seems to take a lot more seriously.
--:-- Mark Mazzetti: What's at stake is the privacy of every single person who carries around a smartphone, and that is billions of people.
--:-- Mark Mazzetti: And I think a lot of times when you're talking about hacking and cyber war, there is this abstract quality of, you know, one giant computer hacking another giant computer or a nuclear reactor in Iran.
--:-- Mark Mazzetti: Things that have really big stakes, but it's, I think, hard to get people's heads wrapped around it.
--:-- Mark Mazzetti: But if you think about how this weapon works, it's able to invade the phone of every single person carrying one around, and that's most people these days.
--:-- Mark Mazzetti: And what's on people's phone? It's your entire life. It's your messages. It's your photos. It's your videos. It's your chats.
--:-- Mark Mazzetti: It's things that you have deleted already are still accessible to some of these tools. And so it's a new way to think about surveillance.
--:-- Mark Mazzetti: If you think back 10 years and you think about the Edward Snowden disclosures, we were talking about bulk surveillance carried out by the U.S. government, millions and millions of phone calls and metadata stored on giant computers.
--:-- Mark Mazzetti: This is targeted surveillance. So it's individual people who are targeted by whomever bought these tools.
--:-- Mark Mazzetti: But in that way, it's much more relatable. People can understand the power and what's at stake by sort of explaining that everyone potentially is a target.
--:-- Sean Rameswaram: So what are the most sophisticated tools out there right now? Help us understand what this market looks like.
--:-- Mark Mazzetti: Well, for a long time, there was pretty much one company that had a near monopoly on this tool. And the company is called NSO, and it's an Israeli firm.
--:-- Mark Mazzetti: They made a hacking tool called Pegasus. Early part of the 2010s was when Pegasus was developed and they started marketing it.
--:-- Mark Mazzetti: And what Pegasus offered was this zero-click hacking technology. What that means is you don't have to get a phishing link on your email or text and you click on it thinking it's one thing, but it's actually someone trying to invade your phone.
--:-- Mark Mazzetti: The main challenge for spyware is to find a vulnerability in the targeted phone, particularly as modern smartphone security protection techniques have developed significantly.
--:-- Mark Mazzetti: Pegasus managed to advance this capability considerably to be able to penetrate various kinds of smartphone.
--:-- Mark Mazzetti: This is a technology that you don't have to do anything and it can invade your phone and start extracting every bit of data on the phone.
--:-- Mark Mazzetti: The user receives a call from an unknown caller through the internet and the phone gets hacked even without answering the phone call.
--:-- Mark Mazzetti: After that Pegasus spyware is installed on the targeted phone, taking full control of the device.
--:-- Mark Mazzetti: It's effectively a very powerful wiretap.
--:-- Mark Mazzetti: It can also be used to spoof messages, to read encrypted messages.
--:-- Mark Mazzetti: In fact, a lot of the inspiration or the driving force for this type of service, this type of technology, comes from the fact that a lot of people are using end-to-end encrypted communications for chat messages.
--:-- Mark Mazzetti: It can turn on the microphone, turn on the camera, and also investigate emails that are on that device as well.
--:-- Sean Rameswaram: There's one thing I can kind of sort of give as a relatable anecdote here, and that was sort of how NSO got started.
--:-- Sean Rameswaram: I think a lot of us have dealt with our IT staff in our company. And sometimes when you're having a problem with your laptop, your IT staff will remotely get into your laptop and work on it.
--:-- Sean Rameswaram: And this was actually how NSO got its start This sort of very mundane technology tool which allowed remote access to laptops by IT firms then they sort of re-engineered it.
--:-- Sean Rameswaram: And well, there's a lot more powerful ways to use this that could be coveted by government users.
--:-- Sean Rameswaram: And that was the ability to remotely access people's smartphones.
--:-- Sean Rameswaram: Now, of course, 2010 was really when smartphones were beginning to take off.
--:-- Sean Rameswaram: Of course, the iPhone was introduced not long before that.
--:-- Sean Rameswaram: And so this is when NSO started seeing its market for its products explode.
--:-- Sean Rameswaram: But NSO eventually becomes a pretty controversial cybersecurity outfit, yeah?
--:-- Mark Mazzetti: Yes, that's right.
--:-- Sean Rameswaram: So NSO starts marketing itself to governments around the world as a law enforcement and intelligence gathering tool for spy services and police services.
--:-- Mark Mazzetti: So if you buy this tool, Pegasus, you can chase bad guys, you can go after terrorist networks, you can bring down pedophile networks, you can get drug kingpins.
--:-- Mark Mazzetti: And that was very alluring for governments.
--:-- Sean Rameswaram: And the first big client, the NSO got, was the government of Mexico.
--:-- Mark Mazzetti: And famously, Pegasus was used in the capture of the notorious drug kingpin El Chapo.
--:-- Sean Rameswaram: It's been reported that Mexican authorities used Pegasus to capture drug lord Joaquin Guzman, better known as El Chapo, by tapping the phones of a few people he talked to while he was on the lam.
--:-- Sean Rameswaram: But in a case we've seen time and time again, they've used it for its own law enforcement intelligence gathering purposes, but governments, including the Mexican government, began using it, expanding the use of Pegasus to go after human rights activists, journalists, dissidents.
--:-- Sean Rameswaram: It was this powerful tool that could be used for good effect, but could be dramatically abused by governments.
--:-- Sean Rameswaram: The Mexican government was the sort of first case of that.
--:-- Sean Rameswaram: And then we started seeing this model play out over the course of a decade.
--:-- Sean Rameswaram: Jamal Khashoggi thought the messages he sent to fellow Saudi dissident were secure, cloaked in WhatsApp security.
--:-- Sean Rameswaram: Instead, the messages were an open book.
--:-- Sean Rameswaram: So was the entire phone, allegedly infected by Pegasus, a powerful piece of malware from the Israel-based NSO group.
--:-- Sean Rameswaram: It led to one scandal after another.
--:-- Sean Rameswaram: And to your question, this is kind of how NSO and Pegasus got this notorious reputation.
--:-- Sean Rameswaram: And how long is it before the U.S. relationship with this software, with this firm becomes adversarial?
--:-- Sean Rameswaram: I mean, it takes 10 years or so.
--:-- Sean Rameswaram: As we reported, the U.S. government was quite interested in this technology.
--:-- Sean Rameswaram: In 2018, the FBI purchased a license for Pegasus and installed it in a facility the FBI uses in New Jersey to sort of test it out, see it, A, kind of like see how it works and see how adversaries might use it.
--:-- Sean Rameswaram: But over time, as we reported, the FBI began to consider, well, how might we use it? How could we use Pegasus to go after our targets? How could we use the fruits of Pegasus in our investigations?
--:-- Sean Rameswaram: How would we represent in court that someone was arrested with the use of spyware?
--:-- Sean Rameswaram: It's not until the end of 2021, so it's the first year of the Biden administration, when the White House announces The U.S. has blacklisted an Israeli company that makes Pegasus spyware, which has allegedly been used by governments to hack into the phones of political rivals, journalists, activists, and lawyers.
--:-- Sean Rameswaram: It puts NSO and another Israeli tech firm called Candiro on a Commerce Department blacklist, which means that no American tech firms can do business with those two Israeli firms.
--:-- Sean Rameswaram: The idea was to kind of starve those firms.
--:-- Sean Rameswaram: So, you know, if you're Amazon or you're Dell and you would normally sell to NSO to keep NSO afloat, laptops, cloud storage, microchips, what have you, they're now banned from selling to NSO.
--:-- Sean Rameswaram: They announce that there's going to be further steps taken to sort of rein in some of these weapons.
--:-- Sean Rameswaram: The Congress also acts to restrict American government use of foreign spyware.
--:-- Sean Rameswaram: The nature of these foreign spyware tools makes them exceptionally hard to track and combat.
--:-- Sean Rameswaram: And that's precisely why the United States needs to put a greater emphasis on this threat.
--:-- Sean Rameswaram: So it's not the National Security Agency developing its own hacking tools.
--:-- Sean Rameswaram: It's the National Security Agency buying off-the-shelf commercial spyware by Israeli firms or firms from another country because they pose potential counterintelligence risks.
--:-- Sean Rameswaram: So what do I mean? If the American government buys an Israeli software, there's concern that if it's installed in U.S. government networks, there might be some kind of backdoor Trojan horse that could allow that foreign government to sort of burrow into American computers and extract information.
--:-- Sean Rameswaram: This is the concern inside the U.S. government right now.
--:-- Sean Rameswaram: So the Biden administration comes in.
--:-- Sean Rameswaram: They say these tools are really dangerous.
--:-- Sean Rameswaram: They can be used for nefarious purposes.
--:-- Sean Rameswaram: And that's the end of the United States' use of foreign spyware? If only.
--:-- Sean Rameswaram: It's not because the United States has kind of been both arsonist and firefighter in this whole drama.
--:-- Sean Rameswaram: On one hand, they're trying to put out the fires that have been spreading around the world with the use of these tools, but they're also using it.
--:-- Sean Rameswaram: This is the tension that I think is inherent in the story.
--:-- Sean Rameswaram: More tension, more Mark, in a moment on Today Explained.
--:-- Sean Rameswaram: Support for Today Explained comes from Chime.
--:-- Sean Rameswaram: Nobody likes fees and complicated banking, says Chime.
--:-- Sean Rameswaram: And Chime gets that says Chime Chime is a financial technology company that says they understand that every dollar counts
--:-- Sean Rameswaram: So when you set up direct deposit through Chime they say you get access to fee features such as free overdraft coverage getting paid up to two days early with direct deposit so much more
--:-- Sean Rameswaram: Chime says with qualifying direct deposits, you can be eligible for free overdraft up to $200 on debit card purchases and cash withdrawals.
--:-- Sean Rameswaram: Plus, they say you don't need to worry about monthly fees or maintenance fees.
--:-- Sean Rameswaram: You can work on your financial goals through Chime today.
--:-- Sean Rameswaram: You can open an account in two minutes at chime.com slash explained.
--:-- Sean Rameswaram: That's chime.com slash explained.
--:-- Sean Rameswaram: Chime feels like progress.
--:-- Sean Rameswaram: Chime is a financial technology company, not a bank.
--:-- Sean Rameswaram: Banking services and debit card provided by the Bancorp Bank N.A. Or Stride Bank N.A. Members FDIC.
--:-- Sean Rameswaram: Spot me eligibility requirements and overdraft limits apply.
--:-- Sean Rameswaram: Timing depends on submission of payment file.
--:-- Sean Rameswaram: Fees apply at out-of-network ATMs.
--:-- Sean Rameswaram: Bank ranking and number of ATMs according to U.S. News and World Report 2023.
--:-- Sean Rameswaram: Chime checking account required.
--:-- Sean Rameswaram: Why shop at Burlington?
--:-- Sean Rameswaram: Maybe it's the deals that are new each time you drop by.
--:-- Sean Rameswaram: Maybe it's the brand names you'll be shocked Burlington has in store.
--:-- Sean Rameswaram: Or maybe it's the quality of the items, the amazing selection, and the newest trends.
--:-- Sean Rameswaram: If you like to save but also like to stay in style, Burlington is your answer.
--:-- Sean Rameswaram: And the question you'll be asking yourself is, why go anywhere else?
--:-- Sean Rameswaram: Burlington. Deals. Brands. Wow.
--:-- Sean Rameswaram: Today Explained, we are back with Mark Mazzetti, Washington correspondent at the New York Times.
--:-- Sean Rameswaram: A minute ago, he told us the United States is trying to play both arsonist and firefighter in the fight against spyware.
--:-- Sean Rameswaram: Sure, they've sworn off NSO Group, but what about its competitors?
--:-- Sean Rameswaram: We asked, Mark, how many options are out there now for nations that want to do this kind of hacking?
--:-- Mark Mazzetti: Well, there's enormous opportunity around the globe for this kind of technology because I think as we've also seen with weapons proliferation over time, if you squeeze in one area, there's going to be proliferation in others.
--:-- Mark Mazzetti: So I think what we saw with the Biden administration's crackdown on NSO and another firm, Kandiro, experts say, well, that's good.
--:-- Mark Mazzetti: You know, that's potentially a good step. But don't think that this isn't going to just create opportunities for others.
--:-- Mark Mazzetti: So what we've seen in another case is there's a firm called Intelexa, which is run by a former Israeli general.
--:-- Mark Mazzetti: And it has been wrapped up in a scandal in Greece.
--:-- Mark Mazzetti: Where the government is facing mounting pressure over a phone tapping scandal, it's alleged that the spyware software called Predator was planted on people's mobile phones, including journalists and the leader of an opposition party.
--:-- Mark Mazzetti: I should say that the Greek government has denied this, but there has been mounting evidence public that at least some elements of the Greek government had some knowledge of the use of Predator.
--:-- Mark Mazzetti: So the reason why this is, I think, is significant is one of the things we've reported on is that the Israeli government kept a really tight control over where Pegasus, the original tool, got exported.
--:-- Mark Mazzetti: And in a way, the Israeli government saw this as a weapon like any other, as a sort of tool of the state.
--:-- Mark Mazzetti: It would sell to governments like India, like Panama, like Mexico.
--:-- Mark Mazzetti: And gradually what you saw was those governments turn their foreign policy more towards Israeli interests when they had been either against Israel or neutral.
--:-- Mark Mazzetti: Now, in the current context, as Israel and the Israeli government, you know, might lose some control, others enter the vacuum.
--:-- Mark Mazzetti: So when I brought up Intalexa and this former Israeli general, he's operating outside of Israel.
--:-- Mark Mazzetti: The Israeli government doesn't have control over whom Intalexa sells its products to.
--:-- Mark Mazzetti: And so you're seeing these weapons kind of get out into the wild.
--:-- Mark Mazzetti: And, you know, however you think of whether Israeli control of those weapons was a good or bad thing, now we're seeing, you know, that sort of regime break down.
--:-- Mark Mazzetti: And I think we're seeing a future where everyone's scrambling to get control of their own versions of these powerful tools.
--:-- Sean Rameswaram: How is the United States playing the arsonist and the firefighter in this moment?
--:-- Sean Rameswaram: How are they using these tools at present?
--:-- Sean Rameswaram: How do we know?
--:-- Mark Mazzetti: Well, the DEA is using a tool. It's called Graphite.
--:-- Mark Mazzetti: It's made by an Israeli firm called Paragon.
--:-- Sean Rameswaram: And we put this question to the U.S. government, put it to the White House and said, OK, you on one hand said NSO and its ilk are bad and it's dangerous to have the proliferation of these weapons.
--:-- Sean Rameswaram: And yet another part of the U.S. government is using a very similar tool.
--:-- Sean Rameswaram: So what gives?
--:-- Mark Mazzetti: And, you know, the answer is, well, in this case, this other company, Paragon, which makes graphite, hasn't had its tools used or abused for bad effects.
--:-- Mark Mazzetti: It hasn't been used against human rights activists, journalists, et cetera, the way Pegasus has.
--:-- Mark Mazzetti: So, you know, we're monitoring closely.
--:-- Mark Mazzetti: But for right now, the U.S. government still can use this.
--:-- Mark Mazzetti: So, you know, it's not as if the U.S. government has taken a firm, hard-and-fast stance against using this.
--:-- Mark Mazzetti: It's, in fact, sort of carved out at least one example where it's okay for the U.S. government to use it.
--:-- Sean Rameswaram: You know, the names of these companies and these tools all sound like they could be villains in sci-fi movies or... Yeah, every firm sounds like a Bond movie.
--:-- Sean Rameswaram: Yeah, it's like Graphite over at Paragon and Pegasus over at NSO Group and Intelexa.
--:-- Mark Mazzetti: I want you to know this is nothing personal.
--:-- Mark Mazzetti: It's purely business.
--:-- Sean Rameswaram: What do these firms have in common and what makes them different?
--:-- Mark Mazzetti: Well, I think that the fascinating thing about this particular sector is how much it was dominated and still to a large degree is dominated by Israel.
--:-- Mark Mazzetti: As I said, you know, sort of NSO sort of got the ball rolling here.
--:-- Mark Mazzetti: But what you found was a cadre of experts who came out of the Israeli military with these very special skills to do offensive hacking.
--:-- Mark Mazzetti: People do their required mandatory military service in Israel and then go out into the workforce as former spies and military people in the United States do and they try to see where their skills are marketable
--:-- Mark Mazzetti: What they found was they came out into the market at a time when there was a demand for what they did inside the military.
--:-- Mark Mazzetti: So Israel kind of, in a way, cornered the market with NSO, Kandiru, other firms to do offensive hacking and a very specific kind of hacking, which is targeting people's mobile phones.
--:-- Mark Mazzetti: The example I've used of Intellexa, again, is not inside of Israel, but it's made up of a lot of former Israeli military hackers and a former top general who Israel can no longer control.
--:-- Mark Mazzetti: So I think that's the one sort of unifying thread of these companies.
--:-- Sean Rameswaram: Now, I shouldn't say it's all Israeli because there's been another example of a firm based in the United Arab Emirates called Dark Matter.
--:-- Sean Rameswaram: It's since changed its name.
--:-- Sean Rameswaram: And one of the interesting things about Dark Matter was that they recruited a lot of American hackers, former NSA, former CIA people to come to the UAE and basically develop that technology to, you know, run offensive hacking operations against alleged enemies of the UAE.
--:-- Mark Mazzetti: So it's not just the Israelis that are doing this.
--:-- Mark Mazzetti: There's a lot of Americans who have had these skills they learned in the U.S. government and the spy services who are then, you know, become sort of cyber mercenaries.
--:-- Sean Rameswaram: Now, I should say, you know, the U.S. government is trying to, the best they can, crack down on Americans going overseas and sort of selling their services to foreign governments because, you know, the American government sees this information they hold in their heads kind of as proprietary.
--:-- Sean Rameswaram: You know, you learned this in the U.S. military, the CIA, the NSA.
--:-- Sean Rameswaram: You can't just sell it to a foreign government, but it's very difficult to control.
--:-- Sean Rameswaram: It's one hand to say, okay, you can't go sell a tank to a foreign government.
--:-- Sean Rameswaram: But it's another thing to say, well, you can't go sell knowledge you have in your head.
--:-- Sean Rameswaram: It's much more difficult to regulate.
--:-- Sean Rameswaram: Is all that to say that there are no rules around this kind of technology?
--:-- Sean Rameswaram: The rules are murky.
--:-- Sean Rameswaram: And yes, I would say there are rules that are trying to be developed to govern, to regulate how people use this kind of information that they gained in the military and the intelligence services of the United States and what they can do with it once they're out.
--:-- Sean Rameswaram: But it's not something that people can easily agree on.
--:-- Sean Rameswaram: And I think that it's going to be very difficult to certainly have any kind of international regimes governing this type of activity.
--:-- Sean Rameswaram: Going back to the phenomenon of the fact that governments around the world are very eager for this information.
--:-- Sean Rameswaram: They're eager for this knowledge.
--:-- Sean Rameswaram: One of the interesting things about these tools is it's had what we've called this sort of democratization effect.
--:-- Sean Rameswaram: It's democratized spying.
--:-- Sean Rameswaram: These very advanced surveillance tools once were in the hand of a very small number of wealthy advanced countries.
--:-- Sean Rameswaram: But now that it's available commercially to buy sort of off the shelf, governments around the world, small governments, poor governments, you know, they all basically have access to similar tools.
--:-- Sean Rameswaram: And, you know, this democratizing of spying is not necessarily a good thing.
--:-- Sean Rameswaram: I'm glad this story has a happy ending in which we're all doomed.
--:-- Sean Rameswaram: Let's hope not.
--:-- Sean Rameswaram: But I think that raising attention to this is important because I think that we're still at the beginning of this.
--:-- Sean Rameswaram: And I don't want to draw an analogy too far, but sort of the birth of nuclear weapons in the atomic age created around it a whole set of rules about when would possibly anyone ever use them.
--:-- Sean Rameswaram: They were so powerful that basically people decided, well, basically you couldn't use them.
--:-- Sean Rameswaram: Every man, woman, and child lives under a nuclear sword of Damocles, hanging by the slenderest of threads, capable of being cut at any moment by accident or miscalculation or by madness.
--:-- Sean Rameswaram: The weapons of war must be abolished before they abolish us.
--:-- Sean Rameswaram: Now you have this class of weapons that are so easy to deploy, with so little consequences for the government that deploys them, they're in some ways almost more dangerous because they can proliferate so easily.
--:-- Sean Rameswaram: Now, of course, this has happened for decades, right? Wiretapping has gone on for a long time.
--:-- Sean Rameswaram: Governments have used surveillance powers and abused surveillance powers for a very long period of time.
--:-- Sean Rameswaram: I think that what's different here, of course, is the ease with which they can do it.
--:-- Sean Rameswaram: And that in many cases, there aren't real repercussions.
--:-- Sean Rameswaram: And we've still, to my knowledge, only known of governments using and deploying these tools.
--:-- Sean Rameswaram: But is there a scenario down the road where you saw criminal organizations, corporations, private individuals having access to this for non-government use?
--:-- Sean Rameswaram: I don't think it would be out of the question at all.
--:-- Sean Rameswaram: And I think that's where the awareness of the power of these tools is important and to have real discussions about where this is going.
--:-- Sean Rameswaram: Mark Mazzetti, Washington investigative correspondent for The New York Times.
--:-- Sean Rameswaram: His latest opus on spyware, written with the help of a few colleagues, is called How the Global Spyware Industry Spiraled Out of Control.
--:-- Sean Rameswaram: Our program today was produced by Amanda Llewellyn.
--:-- Sean Rameswaram: It was edited by Matthew Collette, fact-checked by Laura Bullard, and buttered up one last time by Efim Shapiro.
--:-- Sean Rameswaram: It's Today Explained. Thank you.
