RE Pegasus, this is what a TechCrunch article pointed to:
https://github.com/mvt-project/mvt (although the TechCrunch
article isn’t loading atm - above links to other articles, it just displays the following error message:
“An error occurred with this part of the page, sorry for the inconvenience.”
and the same even gets overlaid on what looks like the article forming on Wayback Machine captures)
EDIT: Peer review here:
https://citizenlab.ca/2021/07/amnesty-peer-review/
But what really interested me was the information about licensing at the bottom of the MVT README on github:
“The purpose of MVT is to facilitate the
consensual forensic analysis of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals. Therefore, the goal of this license is to prohibit the use of MVT (and any other software licensed the same) for the purpose of
adversarial forensics.
In order to achieve this, MVT is released under an adaptation of
Mozilla Public License v2.0. This modified license includes a new clause 3.0, "Consensual Use Restriction" which permits the use of the licensed software (and any
"Larger Work" derived from it) exclusively with the explicit consent of the person/s whose data is being extracted and/or analysed (
"Data Owner").”
And that last part got me* thinking: if, legally, the explicit consent is required to come from the “Data Owner”, then could Apple, Facebook etc. not be considered the “Data Owner” since they are the entities
subpoenaed for the End Users’ data and they treat it as if they own it (viz Facebook’s relationship with Cambridge Analytica etc.). Are they able to represent themselves as “legal persons”? EDIT: Turns out the answer is “yes” (US Supreme Court ruling in Citizens United 2010).
*N.B. Just wondering aloud since I have no expertise in the area.