spinofflive
The image shows a laptop with a screen displaying a sign saying "Ministry of Business, Innovation & Employment." Surrounding the laptop are multiple surveillance cameras pointed towards it.
Image: The Spinoff

InternetJune 19, 2024

Unpacking MBIE’s bad romance with a US-Israeli surveillance-for-hire firm

The image shows a laptop with a screen displaying a sign saying "Ministry of Business, Innovation & Employment." Surrounding the laptop are multiple surveillance cameras pointed towards it.
Image: The Spinoff

The Ministry of Business, Innovation and Employment has called it quits with shady spyware peddlers Cobwebs Technologies, but is now in the market for another data-harvesting cyber mercenary match. Violet Blue explains.

Last week’s announcement that Aotearoa’s Ministry for Business, Innovation and Employment ended its contract with Israeli-US surveillance-for-hire “cyber mercenaries” Cobwebs Technologies likely came as a surprise to many. That’s probably because MBIE worked pretty hard to keep it quiet.

Before you pour one out for MBIE’s spyware besties, rest assured the ministry is planning to replace Cobwebs citizen-tracking data collection tools with another flavour of spyware peddlers. 

Just maybe not the same one in a different hat. “As the procurement process is ongoing, we are unable to provide further comment on possible decisions around future suppliers, including the option not to renew the contract with Cobwebs,” Jacqui Ellis, MBIE’s general manager of data, insights and intelligence, told The Spinoff via email. “As part of evaluating the options, MBIE will continue to ensure that the use of these types of tools is responsible, appropriate, and proportionate.”

That’s going to make for some tricky shopping in the surveillance-for-hire space. Even Hacking Team sold “lawful interception” tools to governments and law enforcement until their active role in global human rights abuses came to light. 

Let’s rewind for a minute. In 2020 MBIE contracted Cobwebs Technologies (now PenLink Cobwebs) to use its surveillance product suite. No one, including the Office of the Privacy Commissioner, knew until MBIE was forced to admit it. The Office of the Privacy Commissioner confirmed this to The Spinoff via email, saying it “became aware of MBIE’s use of Cobwebs Technologies in October 2022, following media coverage”.

Per RNZ, “The first searches using Cobwebs began in 2022. MBIE said they had been carefully targeted and closely controlled.” Phew, sounds less bad when you put it like that. But to speak infosec for a minute, it’s weird for someone to take two years from buying an off-the-shelf capability to actually running their first intelligence search.

According to product descriptions and demos, the Cobwebs family of products harvest personal and online data, geolocate targets using mobile ad tokens and other tools, scrape the dark web, image and face processing modules, profile creation including friend and family connections, and carry out AI-driven “predictive monitoring” and predictive policing. 

One of the company’s add-ons, Lynx, provides a network of proxies so clients, like government analysts or the LAPD, can hide their identities. That’s handy, because predictive policing tools are notoriously inaccurate, consistently racist, and astonishingly incompetent at monitoring threats.

Cobwebs maintains that it only creates and stores creepy detailed profiles about us by collecting publicly available information, like your old LiveJournal posts rating X-Files actors by hotness, or Mum’s embarrassing Facebook baby photo collection of you. 

Image: Tina Tiller

Yeah, about that.

One year into MBIE’s contract with Cobwebs, a funny thing happened to Cobwebs’ access to Facebook, Instagram and WhatsApp. Meta banned them in December 2022. That’s saying a lot coming from a company who spent years turning the word “Facebook” into an antonym for “privacy”, and the ban wasn’t even a matter of professional jealousy. 

“​​We removed about 200 accounts which were operated by Cobwebs and its customers worldwide,” Meta’s Threat Report on the Surveillance-for-Hire Industry explained. “This firm was founded in Israel with offices in the United States and sells access to its platform that enables reconnaissance across the internet, including Facebook, Instagram, WhatsApp, Twitter, Flickr, public websites and ‘dark web’ sites… the accounts used by Cobwebs customers also engaged in social engineering to join closed communities and forums and trick people into revealing personal information.”

One of the Cobwebs clients Meta named in these violations was New Zealand, along with Saudi Arabia, Hong Kong and other countries. “In addition to targeting related to law enforcement activities, we also observed frequent targeting of activists, opposition politicians and government officials in Hong Kong and Mexico.”

Well, that’s awkward. Especially considering that per RNZ, MBIE’s “business case had specified the tools must be able to search the encrypted WhatsApp platform, and span audio, video, images and text – collecting information without a person knowing – which could include family details, financial, health, political and religious information.” Further, documents RNZ obtained showed that MBIE’s intelligence spy unit MI “had sought and got the ability through Cobwebs to reach into people’s private Whatsapp channels, as well as search the likes of Facebook and Twitter”. 

Responding to Meta’s threat report, Cobwebs CEO Udi Levy, one of three ex-Israel Defence Force intelligence operatives who founded the company, told Israeli business daily Globes, “This report was false.” 

But that was then, and this is now-ish. An investigation by Vice found that Cobwebs’ core system, Tangles, was marketed as late as 2023 as being designed to circumvent changes social media sites make to their API rules. If you’re unfamiliar, APIs handle a wealth of sensitive user data and rule changes often come after breaches, or similar inappropriate access (like Cambridge Analytica). Currently, Cobwebs’ Web Intelligence Webinar explains that one of its main challenges and goals is to “get past privacy restrictions as much as possible”.

Conceptual image with a bunch of floating eyeballs in different sizes overlooking a red phone
Image: Getty Images

It’s good MBIE let that contract lapse this year, though I bet it was uncomfortable to be in the room during 2023’s US Summit for Democracy. That’s when New Zealand joined 11 nations, including Australia, the United Kingdom and the United States, in agreeing to responsible use of commercial spyware. “Israel, a key spyware exporter, is not part of the deal,” reported Cyberscoop. “At time of purchase, Cobwebs Technologies was an Israeli-based company,” MBIE said in its email comments to The Spinoff. “In July 2023, Cobwebs Technologies was acquired by Spire Capital, changing ownership to a wholly owned US company.”

Let’s just hope MBIE makes sure to get all its data back after the breakup. Cobwebs offers clients the options of self-storing the data, or keeping it on Cobwebs’ own servers. Among what information RNZ was able to obtain, “One of the documents, the business case, shows Cobwebs stores the data.” 

An OIA obtained by RNZ showed that MBIE’s “data collected using the Cobwebs tools is stored in Australia”. That’s also where the Office of the Privacy Commissioner stores their data, confirming via email: “It made this decision following a full privacy impact assessment (PIA)… It is our expectation that agencies also undertake this level of care.”

We still don’t know who might’ve been swept up in those Cobwebs-powered MBIE dragnet searches. One of the serious risks inherent in products like those sold by Cobwebs is that they scrape data indiscriminately and profile people inaccurately, with lots of racial bias and collateral collection of innocent people’s data, not just those under suspicion – even on a good day, when they’re not bragging about breaking API rules like Cobwebs has

MBIE (which Immigration New Zealand is part of) told The Spinoff via email: “The Cobwebs tools were not focused on any specific nationality or ethnic group. They were solely used for the purpose of managing the risk of, including preventing, maritime mass arrivals.” 

MBIE acknowledged, “A mass arrival has never arrived in New Zealand; however, they have in many other countries and present an ongoing risk.”

In light of that, the pretence that New Zealand needs to protect itself from mass maritime arrivals feels like the half-drawn horsie meme of excuses. Unless MBIE has a time travel machine, in which case concerns about invading boatloads of migrants are warranted. 

Anyway, we all hope the Office of the Privacy Commissioner gets to go on the next MBIE surveillance-as-a-service shopping trip. It does too, telling The Spinoff it “would expect to be informed of any significant surveillance procurement by a government agency particularly where this technology is new or untested in New Zealand. Our expectation is that the agency would have conducted a PIA and provided assurance to the Privacy Commissioner.”

So who is Aotearoa’s next top surveillance model? It sure seems like MBIE’s trust in Cobwebs may have been misplaced, and we wish them luck in their next cyber mercenary Tinder match.

‘He mea tautoko nā ngā mema atawhai. Supported by our generous members.’
Liam Rātana
— Ātea editor
Keep going!
FeatureImage_Dreame-Lover.png

InternetJune 7, 2024

A Dreame world: The grim story behind those horny werewolf ads

FeatureImage_Dreame-Lover.png

Asia Martusia King investigates an online publisher making authors write 50,000 words a month to receive 6-8% of profits – if their story gets any clicks at all. 

It was a sponsored ad on Facebook in 2019. Three buff, half-naked werewolves tore the clothes off a young pregnant woman, eyes blazing with feral passion. Their paws ripped at her bodice, exposing her pendulous bosom. Accompanying the photo was a lengthy chunk of erotica: 

The triplet alphas each took turns with Luna during the mating ceremony. Their faces darkened with lust. She was in heat and they could smell it. She couldn’t help but moan…

It was from a page called “Dreame”. I raised an eyebrow (figuratively, because I can’t actually) and kept scrolling, but it wasn’t long until the next sexy werewolf ad appeared. In fact, for the next five years, I received constant sponsored ads about sexy werewolves from different copycat pages: Dreame-Lover, DreameFans, Dreame Wonderland, etcetera. They would last a matter of days before being deleted and then replaced.

Like a lycanthrope’s bite, the stories began to spread. A huge majority of my friends in a similar demographic (female, relatively young, interested in literature) were having their feeds pounded by werewolf ass. Each was unique, but a trend was there: hunky, badly photoshopped wolfmen accompanied by horny, seemingly AI-generated text. The main girl was usually called Luna or Thea, and she was being lusted over by a trio of “alpha” werewolves. Somebody was paying good money to sponsor these advertisements. 

Dreame itself is a website which hosts stories. It is run by a company called “Stary Pte Ltd”, whose headquarters, according to their terms and conditions, are situated in a mall in Singapore. Stary operates at least 16 other apps for readers and writers, Dreame being the best known, with 2.1 million users. 

Who is the person behind Dreame? Is it a fetish thing? Dreame’s customer service wrote back immediately. “Dreame’s primary founder is a web novelist with a deep passion and extensive experience in online literature. He chooses to engage with the world through the platform of Dreame, embodying his belief in “Enriching lives through creativity,” rather than seeking personal publicity. Our founder prefers to maintain a low profile and is currently unavailable for interviews.”

Determined to uncover his agenda, I joined Dreame fan pages on Facebook, each with a couple million followers. I contacted authors advertising their work. I would ask them questions about Dreame and then their accounts would be mysteriously deleted without trace. Desperate, I signed up to Dreame as a writer (for no cost) and published my first story, “Where, Wolf, Where?”, about a steamy forbidden dalliance in the woods.

In doing so, I discovered that, before you can sign a contract with Dreame, you must publish at least three free chapters of your story, with a minimum of 3,000 words each. Writers on other websites with similar clientele, such as Wattpad, have claimed they have been approached by Dreame staff and propositioned to sign over their story rights. If you get a contract with Dreame, stories that perform well are put behind a paywall, where fans pay to read your story by the chapter. 

‘If you value The Spinoff and the perspectives we share, support our work by donating today.’
Anna Rawhiti-Connell
— Senior writer

According to the Dreame contract, which I obtained a copy of, authors are expected to write 50,000 words every month to receive 6-8% of the profits – presuming the story gets any clicks. You must publish a chapter every day, and may not be absent for more than two days a month. Failure to uphold this results in being “fired” from Dreame. 

Here are some popular novels that are around 50,000 words in total: The Great Gatsby, Fahrenheit 451, The Hitchhiker’s Guide to the Galaxy, Of Mice and Men

“I would gain a dollar a month, sometimes five,” said Amanda, a pseudonymous teen writer contracted to Dreame, in an exclusive interview with The Spinoff. “It takes loads of readership to get any amount of money.” She feels trapped – all of her intellectual property is now owned by Dreame. She begrudgingly continues to write for them, partly for something to do, but mostly to get her name out there. Terminating the contract would cost her $60 and all additional money Dreame spent on advertising her work. Failure to uphold the conditions means Dreame could pursue legal action. 

The contract also forbids signed writers to badmouth Dreame. Clause 3.8 states that the author “shall not disparage or denigrate the Licensee orally or in writing, and that neither the Licensor nor anyone acting on the Licensor’s behalf will publish, post, or otherwise release any material in written or electronic format, make speeches, gain interviews, or make public statements which could adversely affect any manner of the conduct of business.” This explains why it was so difficult to find interviewees.

The consumer side of things doesn’t seem to be much better. Readers report getting hooked on a story, only to reach a cliffhanger and have to pay for the next chapter. “I am disgusted that in a very short time I lost $50 for only a few chapters,” wrote Donna, a reviewer. “I could buy a whole book for that. I will be deleting and uninstalling this app forever and warn everyone that it is misleading the public.”

And yet readers are hooked, coming back year after year, spending upwards of $80 to read a werewolf story, many of which seem to be either AI-generated or, based on my perusal of the author profiles, written by teenage girls. Some reviews show users spending upwards of $100 to watch a short reel on Dreame’s video app. Dreame says they have 21 million regular readers. 

“Let me be clear, stay away from Stary,” Amanda said. “I can’t say much because it makes me cry. They lie about profit shares when you only gain 6 or 8%. They prey on inexperienced or poor or struggling young writers, at the cheapest cost to their company. They’re poaching desperate authors desperate for recognition, who’ll take anything on offer. They don’t care about the quality of work. They don’t care about you at all.”

Dreame refutes this, saying in a statement that they “deeply care about the quality of work” and carefully select the best submissions for their audience. It is a mutually beneficial relationship between company and author, Dreame says, adding the following:

Understanding the challenges authors face in publishing and promotion, we invest significantly to ensure outstanding works reach appreciative readers. The royalty distribution for authorised works is mainly based on total revenue, with all costs covered by us.

We know that readers ultimately decide the fate of a published work, and few authors achieve both fame and fortune. Nonetheless, we are dedicated to helping aspiring authors overcome obstacles and supporting grassroots authors towards professional development. With our successful experience, we will further enhance our products and services, benefiting more outstanding authors.

According to Dreame and various unvalidated articles floating around the internet, these outstanding authors are earning up to $80,000 a month. The Spinoff could not locate any of these authors. Between $80,000 a month versus Amanda’s $5, a stark disparity is at play, for the same contracted amount of work. 

Something which still eluded me was the collaborative werewolf universe. Dreame doesn’t force its writers to churn out stories about horny triplet alphas, but they write about horny triplet alphas anyway. Dreame’s customer service said that the werewolf genre is “among the most popular on Dreame, alongside other cherished genres. The popularity of works is determined by the readers. The broad appeal of the werewolf genre and the ongoing success of related works may be contributing factors.”

Amanda confirmed this. “The target audience is teenage girls, and teenage girls love werewolves. They’re hitting puberty and they’re horny. Teenage girls are some of the biggest drivers of fantasy erotica.”

As to why the characters and plots are often the same, it’s as simple as the formula works. With the amount of writing these authors need to generate every day, it’s easiest to go with what’s tried and true. Luna and her triplet alphas are likely to earn views.

One reader agreed, telling The Spinoff that there’s no agenda as far as the genre proclivities. “It’s young female-skewing readership with a boner for particular flavors of fiction, with the trendsetting and copying that follows. … A condensed social network encourages copycatting, because 15-year-old girls can read about werewolves in perpetuity forever.” 

Where there is life in the universe, there are hormonal teenage girls writing sexy werewolf novels. Online writing platforms allow them to be free from the pressures of normality, to express themselves, to simply be horny and weird; a God-given right. Some surely do make a sizable income doing what they love. The question is, is it worth it for those who don’t?

But wait there's more!