In a rare press release issued Wednesday morning, Hacking Team, the embattled Italian surveillance software vendor, reiterated that it did not and does not have a "backdoor" into its clients’ installations of the Remote Control System, or RCS. But new analysis of its leaked source code seems to directly contradict this claim.

Hacking team said:

There have been reports that our software contained some sort of "backdoor" that permitted Hacking Team insight into the operations of our clients or the ability to disable their software. This is not true. No such backdoors were ever present, and clients have been permitted to examine the source code to reassure themselves of this fact.

According to new research by Joseph Greenwood, a UK-based researcher with 4Armed who has been examining the leaked RCS source code in detail, this is a distinction without a difference.

While Hacking Team may not have a backdoor in the covert sense, its source code clearly indicates that the company did and likely still does have an ability to remotely disable server clients (known as "collectors") belonging to governments.

Specifically, that code ("rcs-kill.rb"), as Greenwood provided to Ars, is part of Hacking Team's internal development toolkit and not distributed to customers. The code also contains a list of all the watermarks of its clients’ installs. As another leaked document suggests, this watermark is used as a way to locate particular collectors in the case of a leak and disable them—effectively an emergency scuttle code.

Those watermarks are sometimes matched with their internal code names, such as "PHOEBE," now known to be the FBI, and "PHANTOM," revealed to be a Chilean government contractor called Mipoltec, or sometimes actual names, like KVANT, a Russian buyer known to be a reseller to the FSB, the Russian successor intelligence agency to the KGB. (Incidentally, in February 2015, the Chilean Center for Investigative Journalism reported that Mipoltec resold this capability to the Carabineros de Chile, the national police force, but it didn't work.)

Eric Rabe, Hacking Team’s spokesman, did not immediately respond to Ars’ request for comment.

Sad trombone

That same Hacking Team statement, which was posted to the company's website and sent to Ars and other media, also laments the fact that the firm has been berated in the court of public opinion since it was hacked over two weeks ago.

The single fact not generally covered by news media is this: there is only one violation of law in this entire episode, and that one is the criminal attack on Hacking Team. The truth is that the company itself has operated within the law and all regulation at all times. However, commentators dislike the fact that strong tools are needed to fight crime and terrorism, and Hacking Team provides them. So the company is being treated as the offender, and the criminals who attacked the company are not. Had a media company been attacked as Hacking Team has been, the press would be outraged.

However, Ars is unaware of any secretive media companies that sell surveillance software to nefarious governments around the globe.

Since it was breached, Hacking Team has tried to maintain a brave public image, saying that it is poised to release a new version of its Remote Control System to governments. However, since its e-mails have been published to WikiLeaks and its source code and other data published elsewhere, it seems quite difficult for the company to recover, particularly given that all of its customers have been told to shut down the software.

Still, Hacking Team’s press release continues to maintain that "important elements" of its source code "were not compromised." The company further re-iterated that all deals it made were "strictly within the law and regulation as it applied at the time any sale was made," including "reported sales to Ethiopia, Sudan, Russia, South Korea, and all other countries."

As Ars reported recently, the company’s sales to the FSB are likely in violation of European regulations.

Still, Greenwood told Ars that he has been impressed with the software’s design.

"The Galileo Remote Control System has a very solid back-end which provides redundancy and scalability along with a good evidence management and viewing system," he told Ars. "The system of anonymizers works well, although requiring a large amount of effort to maintain. The implants themselves are unusual in that they are purely evidence collection platforms, with no lateral movement or spreading features. They have moderately sophisticated hiding mechanisms, including both rootkits and UEFI persistence, but this is let down by a very obvious and noisy network signature. Obviously Hacking Team assume that their targets will not be looking at the network traffic emanating from their computers, but would be disconcerted to see 'agent.exe' appear in their Task Managers."