It's going to be hard to keep software out of the wrong hands. Perhaps it would be better to ensure everyone is using secure/encrypted/private communication and services.
The general population may need to organize this, despite selfish corporations and the politicians they fund.
If your entire business model is to sell covert intrusive software to powerful entities, then the argument is irrelevant.
In my comment I meant to say that keeping software out of the wrong hands was ultimately not possible, and thought it would be better the give people more secure and more private means to communicate (something like pinephone, tor, matrix, etc).
Your first clause seems to agree with the first half of what I said (can't stop bad software), but then you said it was irrelevant. Maybe irrelevant to NSO, as long as they can get away with it? Or irrelvant to something else I said?
(I'm not opposed to going after NSO, also. Power to the people. But it seems many governments care about our data more than they care about our votes.)
Isn't NSO's whole shtick their software can get into and read everything from even the latest iPhones ( and probably Androids, I've only seen it stated for iOS though)? What good is a secure/encrypted service when the device you access it from is hacked and sends everything to the hacker?
I was kind of picturing people en-masse becoming upset with this stuff, and having real/better/open tools available for them when that happens - stuff like a slick pinephone running mastadon over matrix over tor, or something, etc.
I guess I threw that comment out there because it seemed like going after the metadata seller that crossed a line leaves all the other metadata sellers in business, and free to push the line further along. I was thinking it would better to address the root cause - giving people better security and privacy.
We shouldn't enable companies to sell cyber weapons to regimes who use them against innocent people. You can debate where that line is all you want, using it to murder journalists in other countries who are critical of your regime is across that line wherever you may draw it.
We also should encourage better privacy and security to protect everyone's communications and data.
We could split the difference and just assign liability for the ones done by serial murderers and people who show up asking for knives that are good for murdering. Knowing that your product is going to be used for some purpose and providing it anyway makes you an accomplice.
You cannot have it both ways, if you're going to sell the software to awful regimes who target people like journalists, you're responsible for the outcomes. The fact they found it was used on Khashoggi family phones would seemingly implicate them in the murder of a journalist. Did they kill him? Probably not. But if their software is being used by governments who did kill him, then they contributed.
I hope they get criminally held responsible for assisting in the murder of Khashoggi if they are found guilty and we need laws and norms to catch up to a place where this kind of business is more restricted/limited.