This is a 69 minutes podcast episode, I'm not in a position to listen to all of it and try and pick out the relevant details. A lot of links are provided, but again - which of those are relevant here? Skimmed through some of them, and they don't even touch on this specific issue at-all?
As I've mentioned before, I'm not challenging your assertions - I'm looking for credible proof that NSO can tell, at any given moment, which specific people are being targeted by the clients/governments to which NSO is licensing its' software.
https://www.theguardian.com/world/2020/apr/29/whatsapp-israe...
—-
According to WhatsApp’s filing, NSO gained “unauthorised access” to its servers by reverse-engineering the messaging app and then evading the company’s security features that prevent manipulation of the company’s call features. One WhatsApp engineer who investigated the hacks said in a sworn statement submitted to the court that in 720 instances, the IP address of a remote server was included in the malicious code used in the attacks. The remote server, the engineer said, was based in Los Angeles and owned by a company whose data centre was used by NSO.
NSO has said in legal filings that it has no insight into how government clients use its hacking tools, and therefore does not know who governments are targeting.
But one expert, John Scott-Railton of Citizen Lab, who has worked with WhatsApp on the case, said NSO’s control of the servers involved in the hack suggests the company would have had logs, including IP addresses, identifying the users who were being targeted.
“Whether or not NSO looks at those logs, who knows? But the fact that it could be done is contrary to what they say,” Scott-Railton said.
In a statement to the Guardian, NSO stood by its earlier remarks. “Our products are used to stop terrorism, curb violent crime, and save lives. NSO Group does not operate the Pegasus software for its clients,” the company said. “Our past statements about our business, and the extent of our interaction with our government intelligence and law enforcement agency customers, are accurate.”
The reason I bring that up is that it's precisely the service you might offer if you wanted more plausible deniability. I still don't consider this hugely complex stuff.
You say that, but UK export law imposes a bunch of conditions, including that you're not knowingly facilitating resale to embargoed countries. And the legality of exports to Saudi Arabia has been litigated - it's legal, but only just.
Both the UK and Israel have export law, complete with conditions and legal frameworks for enforcement. It surely reduces the possibility of weapons ending up in the wrong hands, but it doesn't eliminate it completely. Regardless, it still doesn't imply that the manufacturers themselves or the jurisdictions they are incorporated in should somehow bear blanket responsibility for misuse.
Cyber-weapons and spying are particularly complex from this perspective, because it can be difficult to draw the lines on what constitutes as "misuse". Especially when the operator of the weapon is part of a government (a law-enforcement agency, for example), and when the victim is a citizen of a foreign jurisdiction.
With this out of the way, we're only really left with the "legal, but immoral" argument. I'm not going to argue against that (mainly because this is where things get very subjective and nuanced) - but I will say that the bar for holding an entire government accountable by invocation of "major diplomatic incidents" should be higher than that.
Oh, yes they would. And they do. Quite fucking happily, too.
The UK itself is one of the largest weapon exporters in the world, exporting to many countries in the Middle East with dubious human rights track records. The UK government can't possibly know what happens with every single pistol, bullet, missile or drone they sell (if they could, nobody would be buying):
[1] https://commonslibrary.parliament.uk/research-briefings/cbp-... [2] https://en.wikipedia.org/wiki/UK_arms_export
A private Israeli company is exporting weapons to the same countries the UK does, and when those weapons get used inappropriately, you're then "surprised this isn't a major diplomatic incident between the UK and Israel".
By the same account, are you suggesting that there should be a major diplomatic incident between every country in the world and the UK/USA every time they catch terrorists somewhere around the world using either UK/USA built-or-designed firearms?
There wouldn't be any diplomatic relationships left then:
[3] https://en.wikipedia.org/wiki/List_of_most-produced_firearms