Stage win: FinFisher is bankrupt

https://www.ccc.de/en/updates/2022/etappensieg-finfisher-ist-pleite

by hacka22 • 4 years ago

236 84 4 years ago

uniqueuid2• 4 years ago

I guess that's a justified case for Schadenfreude ...

But on a more serious note, the battle for transparency and accountability (and ultimately democratic resilience) relies a lot on the hard work by many, many NGOs (many of those listed towards the end of the article, such as the wonderful Citizen Lab from U of Toronto).

I find it scary that such important monitorial tasks are left to underfunded volunteers which may go away at any second. Well, the same applies to journalists to a certain degree ... In both cases, we need to care more about sustainable funding of these institutions.

ComodoHacker• 4 years ago

On the other hand, we need to strike a balance between "sustainable funding" (be it government or corporate) and true independence.

sva_3• 4 years ago

It appears like they're just going through a "rebranding"

https://mobile.twitter.com/Pingu/status/1469314222349852675

Quote from the OP article:

the public prosecutor's office wanted to secure the assets potentially obtained from an unlawful act by means of an asset freeze in order to be able to confiscate them if necessary. The group of companies escaped seizure through insolvency

So you know what's going on.

uniqueuid2• 4 years ago

It seems a bit more complicated - there's a great post from netzpolitik [1] (in German, unfortunately) listing all the gory details.

Again, all of this came to light because of the hard and persistent work of a whole bunch of NGOs (GFF, netzpolitik, CCC and so on).

[1] https://netzpolitik.org/2022/nach-pfaendung-staatstrojaner-h...

sva_3• 4 years ago

Good source. It sounds a bit like they were destroying the evidence with that move then. Like throwing a match into a gasoline-doused crime scene.

hacka22• 4 years ago

https://netzpolitik.org/2022/nach-pfaendung-staatstrojaner-h... (German) reads like it is more than a rebranding. But there are certainly new entrepreneurs who will fill the gap

actionfromafar• 4 years ago

Meet your new entrepreneurs. Same as your old entrepreneurs.

bjarneh7• 4 years ago

companies escaped seizure through insolvency

This is a strange arrangement that I guess most countries follow. Companies are legal entities, that can be sued and so on. But a company cannot go to jail (board members or stock owners don't typically go to jail either). These legal entities can also seize to exist (like in this example), and then there is nobody left to be held accountable... It seems like most countries treat companies better than humans.

nikanj• 4 years ago

Most countries also stop criminal & civil proceedings if the human in question ceases to exist

jacquesm5• 4 years ago

Big difference between board members and stockholders. Board members are liable to some extent stockholders almost never are, unless the business was specifically founded to facilitate crime. That's where the term Ultimate Beneficiary comes into play.

GameOfFrowns• 4 years ago

It appears like they're just going through a "rebranding"

IIRC the new company name, Vilic(i)us, describes the position of a "slave overseer" of Roman times. Unfortunately, I cannot find the wikipedia entry for it anymore (possible clean-up job of the new company?).

Edit:

Found it... https://en.wikipedia.org/wiki/Vilicus

spacemanmatt3• 4 years ago

why do we even tolerate malware companies

hnbad4• 4 years ago

Because this company was the developer of the "Staatstrojaner" malware government agencies used to hack into computer systems to investigate crimes. I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well.

As to why the German public tolerate it: because there wasn't sufficient pushback and the government doesn't care about a few protests as most people will eventually forget about it and move on.

spacemanmatt3• 4 years ago

Seems to me like the government should internally own their malware rather than tolerate a company that presumably sells to other governments or private entities. Mine was a rhetorical question of course.

zeepzeep4• 4 years ago

I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well.

As with every dystopic "anti-terror" measurement, this is correct.

freeflight3• 4 years ago

I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well.

This kind of stuff is always justified with "terrorism, pedophilia and organized crime", but once its in place it's usually overwhelmingly applied to much pettier crimes.

zeepzeep4• 4 years ago

Malware isn't bad, like guns, it depends on the one using it. There are legit uses, e.g. governments or simulations of real attacks.

allendoerfer• 4 years ago

Instead of writing a malware exploiting a bug to simulate an attack to defend against the exploit, you could have just fixed the damn thing in the first place.

someotherperson2• 4 years ago

Do we actually have any cases of governments using malware for good?

Guns aren't a great comparison because the use can (and usually is) wholly defensive or acts as a deterrent -- i.e if you are known to be armed then you'd be left alone.

Malware on the other hand is almost exclusively offensive and governments around the world almost exclusively use it for nefarious reasons (i.e NSO Group's clientele and published usages).

m12k• 4 years ago

I think nukes are a better analogy than guns. There's legitimate reasons why you might want your government to develop and own them, but there's no good reason that it should be legal for private companies or individuals to sell or buy them.

keikobadthebad• 4 years ago

It's called malware, because it IS bad.

denton-scratch• 4 years ago

There are legit uses, e.g. governments

I'm astonished that there are so many people here that are willing to defend government use of malware.

Malware is software deliberately designed to cause devices to malfunction. Since when is it legitimate for any government to deliberately break the property of a private citizen who hasn't been convicted of any offence, without at least a court order?

pelasaco2• 4 years ago

to avoid to have to ask for support in that area when your country is being invaded by another country maybe? https://www.theguardian.com/world/2022/mar/23/israel-ukraine...

Sporktacular• 4 years ago

? Allied states have provided intelligence support and tools to each other for centuries without needing companies to do that for them. The internet didn't change that, greed and regulatory capture did.

spacemanmatt3• 4 years ago

seems like we have a whole international alliance for mutual defense assurance

vaylian• 4 years ago

1) Because most people are blissfully unaware of these companies

2) Because a large portion of people who are not in 1) support it, because they believe it is used to spy on the bad guys™ and never consider that these tools have already been abused in the past and will be abused in the future.

Bayart• 4 years ago

For the same reason we tolerate any armament company : we need them.

amelius• 4 years ago

Why do we tolerate personal data brokerage companies?

oaiey• 4 years ago

That the CCC thanks Microsoft ... hell is freezing in multiple places ;)

perch56• 4 years ago

Good! Phineas Fisher will be pleased ;)

tom899• 4 years ago

They will continue under a new name and description. The success to this day is not remarkable. That software has not stopped criminals like Olaf Scholz and his buddies, nor has it protect a mayor of a city that was killed in his own house. So, its useless and unethical to think to automate prosecution. Too many false-positives and a bad success rate is not and can not be the goal to break basic rights. The real criminals are not the weed dealers next door and not the dumb neo-fascists, they gather everyday in the parlaments with their shady double income, their wrongdoings and promises broken every day. For what that software has brough revenue, the victims of the flood this summer, would enjoy golden handrails and faucets in their newly built homes.

ChuckNorris892• 4 years ago

they gather everyday in the parlaments with their shady double income, their wrongdoings and promises broken every day

You can add Ursula v.d.L. to that list.

I lost faith in all EU governments to do anything for the people.

OtomotO3• 4 years ago

Ultimate power corrupts ultimately...

okay, there are always exceptions to that rule, like e.g. Emperor Marcus Aurelius

cpach• 4 years ago

What did von der Leyen do?

raverbashing• 4 years ago

That software has not stopped criminals like...

Oh look, $method didn't stop $crimes where it is not relevant. Not surprising.

The real criminals are not the weed dealers next door and not the dumb neo-fascists, they gather everyday in the parlaments with their shady double income, their wrongdoings and promises broken every day.

Weed dealers given the current legislation are commiting a crime. One of the biggest gifts to the lack of prosecution of higher politicians are the infighting between smaller "liberal" parties. And their general naivity

Are the people that are opposed to this happy when adversaries have hacked Germany?

You're free to protest at the nearest Extinction Even protest and pretend the "green's" anti-nuclear push has nothing to do with the latest events

btw "criminals like him (O.S.)"? sounds like either an AfD apologist or Linke supporter.

kristiandupont• 4 years ago

criminals like Olaf Scholz and his buddies

Seriously?

lavela• 4 years ago

It is suspected that he is involved with the Cum-Ex scandal, but to what extent remains unknown. He made very questionable (non-)statements in that regard though.

spupe2• 4 years ago

I didn't know about this company before, but a cursory search suggests they were only based in Germany, not used by the German government. Title is misleading, especially as it is not the original title of the article, and Germany has in fact prosecuted them.

That said, good riddance. We desperately need accountability for malware coming from state actors.

coriny• 4 years ago

You might have missed this statement in the article:

German authorities were of course also customers of the company

Though I don't think that's what the title was implying, I think it means German "nationality" rather than German "state-owned".

spupe2• 4 years ago

You are right about this claim, but the only thing I could find to substantiate it is a 2013 article in which leaked documents suggests German federal police wanted to use it [1]. It is still incorrect to suggest this is a German state spyware, although of course you are right about the ambiguity here.

[1] https://netzpolitik.org/2013/secret-government-document-reve...

nbadg• 4 years ago

I will be interested to see how this interacts with the Ampel Koalition's desire to add more restrictions on state-sponsored hacking (search term, "Staatstrojaner" [1]). The current government coalition contract includes "increasing controls" and "higher thresholds" for their use (my translation), which would signal a shift in German federal policy _at least slightly_ away from state-sponsored hacking, which was very favored by the previous government.

It's probably also worth mentioning that these Staatstrojaner haven't really demonstrated effectiveness. It's an extremely common refrain on the Netzpolitik scene here that we would all be much, much better served if the government were compelled to responsibly disclose the bugs used in these tools to the companies producing the software, instead of trying to keep them quiet in order to weaponize them. But I suspect this argument is basically preaching to the choir at HN. For German speakers, I would highly recommend following both Netzpolitik and Lage der Nation; the former is self-explanatory but the latter also frequently talks about digital policy in Germany.

Edit: a clarifying point here, as far as I understand, FinFisher is *not* a state-owned company (that would be big news!), but rather a normal GmbH (like an LLC) that develops and sells Staatstrojaner. As such I think the line in the title ("German State Malware Company") strikes me as inaccurate in both English and a hypothetical German->English translation.

[1] https://netzpolitik.org/2021/koalitionsvertrag-das-plant-die...

----

Side note, I know metacommentary isn't typically considered entirely kosher on HN, but some threads I'm seeing pretty high up in the discussion here are really not meeting the quality standards I would expect from HN. Calling the current German chancellor Scholz a "criminal" with "buddies", and a follow-up thread that can be summed up as "I think the EU is so corrupt that it only looks after its own politicians" -- all of this with absolutely no evidence -- is so frustratingly hyperbolic and reductionist that it has me (in all seriousness) wondering what level of exposure HN has to state-level disinformation actors.

ThePhysicist• 4 years ago

Probably a simple "flip". Companies in Germany do that often when they want to move overseas. The reason is that the Finanzamt (IRS) will tax any assets you move abroad. That can be a large problem for companies that e.g. get US funding. I know of a case where a financially successful German startup got funded by YC and needed to reincorporate in the US. If they had done it via the official route the Finanzamt would have used the YC valuation as a basis for calculating the taxes and the company would've needed to pay a seven-figure amount. They circumvented this by bankrupting the company and buying out the assets instead, which was then tax-free. I strongly suspect this is a similar move by FinFisher.

bombcar• 4 years ago

Exactly. People assume bankruptcy of a company is like a human dying but it’s not at all - the exact company and people involved can continue to exist through a bankruptcy just with new owners.

mhh__• 4 years ago

But corporations are people?

Stage win: FinFisher is bankrupt

Related Stories