Appendix J: Glossary

This glossary defines terms as they are used in this book. Some are HackingTeam product terms, some come from the underlying technologies, and some are research distinctions introduced to prevent the evidence from saying more than it can support.

The product uses target as a database-object name. When discussing people, the book prefers “person targeted,” “affected person,” “victim,” or the more precise description supported by the evidence. A record labelled evidence by RCS is called RCS evidence or an evidence record; the label does not make its contents independently authentic.

Product and architecture terms

Term	Meaning in this book
Adobe AIR Console	HackingTeam’s original desktop operator application, implemented in MXML and ActionScript. It was not executed in this Linux reconstruction.
Agent	A deployed RCS instance represented in the backend. It inherits factory identity/configuration fields and adds an instance value, runtime state, requests, statistics and a parent target. The book does not use “agent” to mean an autonomous AI system.
Analyst	An operator role focused on investigations, evidence, entities, dashboards and alerts. In the privilege model this broadly corresponds to `VIEW` and its sub-privileges.
Anonymizer	A forwarding node between a collector and the backend, represented by a remote collector document. The examined source is a next-hop HTTP proxy; no forwarding chain was run.
Archive node	An RCS database node that exchanges signed items, evidence and synchronization events through `/sync` actions. It is distinct from a backup archive file.
Backend / RCS Database	The central Ruby EventMachine service that exposes REST and WebSocket interfaces, manages MongoDB state, licensing, tasks and component coordination.
Collector / Frontend	The deployment-edge service that receives synchronization traffic, serves selected public files, and forwards evidence or state toward the backend. “Frontend” in original backend code often refers to this infrastructure, not the web UI.
Connector	A policy-controlled evidence export mechanism. A connector can export locally in JSON/XML or remotely in RCS format, and its `keep` policy can affect local retention. It is not the same thing as a collector.
Console web port / web reconstruction	The new vanilla HTML/CSS/JavaScript implementation of the AIR console. It uses original backend contracts but is labelled `WEB PORT`, never an original executable.
Core	An RCS implant package or level referenced by factories and builds. Core code and packages are never built, run, fixed or improved in this project.
Da Vinci / Galileo	Product names associated with HackingTeam’s Remote Control System in reporting and marketing. The names do not identify one exact source revision.
Factory	A reusable undeployed agent template. First synchronization can clone an open factory into a concrete agent instance. A factory’s configuration behavior differs from that of a deployed agent.
Network Controller	The backend-adjacent controller that receives topology/configuration operations for deployment-edge components. It is not run in the lab.
Network Injector	RCS infrastructure for rule-based content injection into selected network traffic. The book covers source/manual concepts and a render-only UI; no traffic modification is performed.
Operation	The top-level investigation/case object in `items`. Operations contain targets, factories and agents through hierarchy paths and receive user access through groups.
RCS	Remote Control System, HackingTeam’s commercial surveillance platform. In this book it usually means the examined RCS 9-era platform, not every product version sold under related names.
Scout / Soldier / Elite	Product deployment or capability levels found in agent/factory configuration and licensing. They are product taxonomy, not analytical severity ratings. No implant at any level is run.
Tactical Control Center (TCC)	Manual terminology associated with the Network Injector control workflow. It is discussed as documented product architecture, not reconstructed operational capability.
Target	A backend object beneath an operation that groups factories, agents, evidence and entities for a monitored subject. In human-rights prose, the book avoids using this database label as a substitute for the person.
Technician	An operator role responsible for factories, configurations, uploads, commands and build-related workflows, broadly corresponding to `TECH` privileges.

Investigation and evidence terms

Term	Meaning in this book
Acquisition time (`da`)	Time reported for collection in an evidence header. It can differ from receipt, upload, processing and analyst-action times.
Aggregate	A target-scoped derived record summarizing communications, positions, URLs or other selected evidence by agent, type and day. It is stored separately from raw evidence metadata.
Alert	A per-user rule matching events such as evidence, synchronization, instance or entity activity. Trigger records are embedded logs and are subject to their own retention behavior.
Audit record	A database document describing an action, actor, time and named objects. RCS audit is useful but incomplete and not cryptographically chained.
Blotter / report flag (`blo`)	Boolean evidence field marking inclusion in the analyst’s report/blotter workflow. It is not proof that an external report was issued.
Dashboard	A user-specific set of pinned operation/target/agent views and recent evidence counters. Dashboard IDs are stored on the user; update propagation has version-specific quirks.
Evidence	RCS’s term for collected or imported records such as calls, messages, files, screenshots, locations or keylogs. The term describes platform classification, not courtroom admissibility or independent authenticity.
Evidence body	The potentially large or sensitive type-specific content omitted from many list responses. Binary bodies are commonly stored in GridFS and referenced from metadata.
Evidence type	The lower-case category assigned to an evidence record. Ordinary types include call, chat, file, keylog, message, position and screenshot; pseudo-view types have different API/statistical treatment.
Entity	A profile-layer record representing a target, person, group, position or virtual object, with handles, links, photos, trust level and operation path.
Handle	A normalized account or contact identifier—such as a phone, email or service identity—embedded in an entity and used for correlation. It may identify victims or associates.
Intelligence	The entity, handle, relationship, graph and map layer derived from or associated with evidence. It does not imply independently verified intelligence reporting.
Keyword index (`kw`)	Array of terms extracted or stored for evidence search. Its contents and completeness depend on evidence type and processing.
Link	A relationship embedded between entities, potentially backed by communications or analyst action. A graph edge is not automatically proof of a real-world relationship.
Note	Analyst-supplied annotation on an evidence record. It must be distinguished from device-collected or worker-derived fields.
Pseudo-view evidence	`filesystem`, `info`, `command`, and `ip` records accessed through specialized console/API views and excluded from ordinary evidence statistics.
Receipt time (`dr`)	Backend-assigned time when decoded evidence is received/stored. It should not be collapsed into acquisition time.
Relevance (`rel`)	Analyst tag/priority value attached to evidence. An alert can change it. It is a workflow judgment, not an authenticity score.
Synchronization	The lifecycle in which an agent or archive exchanges status, configuration, requests and evidence with RCS infrastructure. In this project, selected backend sync paths use synthetic data.

Identity, authorization, and protocol terms

Term	Meaning in this book
Base role	One of the broad privilege categories `ADMIN`, `SYS`, `TECH`, or `VIEW`. Many actions also require a narrower sub-privilege.
Component signature	A shared secret stored by scope and used to authenticate server-side components or synchronization paths. Values are never reproduced in the book.
Cookie / session cookie	UUID-shaped bearer value linking REST and WebSocket activity to a `sessions` document. It is sensitive credential material.
`good` flag / crisis state	Boolean item/component state used to separate ordinary and crisis behavior/configuration. It is product state, not a security confidence label.
Group-derived access	RCS’s model in which users and operations meet through groups and access is copied into descendant `user_ids`. Asynchronous rebuilding can leave stale or orphaned states.
`ident`	Factory/agent identifier used with `instance` to locate a deployed agent and name worker staging records. It is not necessarily globally unique by itself.
`instance`	Per-deployment value paired with `ident` to distinguish a concrete agent instance.
Object membership	The row-level question of whether a user ID appears on an item/entity or can reach it through the investigation hierarchy. It is separate from holding a functional privilege.
Path	Array of BSON object IDs encoding hierarchy, commonly operation → target → agent. Paths also scope alerts and connectors. A path is data, not a cryptographic boundary.
Server principal	A component-authenticated session whose level includes `server`, used for collector/backend coordination. It has broad action-dependent authority.
Session snapshot	The role/user information captured when a user logs in. Later account changes do not necessarily revise the active session immediately.
Sub-privilege	Narrow permission such as `VIEW_DELETE`, `VIEW_EXPORT`, `TECH_CONFIG`, `SYS_BACKUP`, or `ADMIN_USERS`, checked in addition to or instead of a base role.
WebSocket / WSS	Persistent TLS channel on the port adjacent to REST, used for authentication, heartbeat and push messages. It is not the evidence-ingest channel.

Storage and processing terms

Term	Meaning in this book
BSON	MongoDB’s typed binary document format. Preserving BSON matters because a string ID and ObjectId with the same printed characters are not equivalent.
Capped collection	Fixed-size MongoDB collection that rotates older records. RCS uses capped collections for notification queues and per-component logs. Absence after rotation is not proof of historical absence.
GridFS	MongoDB convention splitting large binary files into `.files` metadata and `.chunks` content collections. RCS uses default, target-specific and worker-staging buckets.
Moped	Low-level MongoDB driver used by the leak-era Mongoid stack. The live fixtures use it to preserve old BSON and sharding behavior.
Mongoid	Ruby object-document mapper used for RCS models, fields, relationships, callbacks, indexes and collection selection.
Notification queue	Capped work collection whose `flag` changes from queued (`0`) to processed (`1`) when claimed. Processed documents may remain until capped rotation.
Shard key	Fields MongoDB uses to distribute a collection. RCS evidence uses `{type, da, aid}`; aggregate uses `{type, day, aid}`; GridFS chunks use `files_id`.
Target-scoped collection	A collection whose name contains the target ID, such as `evidence.<id>` or `aggregate.<id>`. It is an organizational/sharding mechanism, not an access-control guarantee.
Worker	Internal service that stages encrypted blobs, resolves an agent, decrypts and decodes records, stores evidence, and invokes queues/alerts. The lab validates this with a named synthetic DEVICE replay, not an implant-to-collector session.
Worker staging	Separate `rcs-worker` MongoDB namespace containing `grid.evidence.files/chunks` before decoding. Raw entries are normally deleted after processing.

Reconstruction and evidence labels

Term	Meaning in this book
Compatibility patch	Minimal change to a copied lab source needed for old components to load or interoperate. It is inventoried and never silently attributed to the original.
Defensive lab	Isolated Docker Compose environment running the original backend/worker through patched copies, MongoDB 2.6, and the web console with synthetic data. Host listeners bind to loopback.
Fidelity seam	Known boundary where versions, runtime adaptation, missing components, mock behavior or the web port prevent a simple original-behavior claim.
Fixture	Synthetic test/demo document or file created to exercise a backend/UI contract. A direct database fixture proves storage/rendering, not collection provenance.
LAB	Provenance label for a reproducible observation against the isolated reconstruction. The associated component version and patch dependence still matter.
MANUAL	Provenance label for a claim stated in an original product manual. It establishes documentation, not necessarily implementation or use.
Original source	Read-only leaked repository material under `data/`, pinned to a commit when Git history exists. It is never modified.
REPORTING	Provenance label for a cited public, official or research source, worded no more strongly than that source.
SOURCE	Provenance label for a conclusion directly supported by static original source. It does not prove runtime exercise or historical deployment.
Synthetic worker evidence	Deliberately generated backend-format input sent directly to the internal worker. It validates decoding/storage paths without running an implant or collector.
WEB PORT	Provenance label for behavior of the research console reimplementation. Independent source/manual support is required before attributing it to AIR.
INFERENCE	Provenance label for a reasoned conclusion connecting observations but not directly demonstrated by one source or test.

Security and incident-response terms

Term	Meaning in this book
Companion signal	Independent indicator from another layer used to raise or lower confidence—for example, a certificate combination corroborated by exact service names and MongoDB structure.
IOC	Indicator of compromise or investigative lead. In this book, many RCS indicators identify platform presence rather than proving that the platform itself was compromised.
Negative validation	Testing a detector against material expected not to match. A tiny sanity corpus does not substitute for representative false-positive evaluation.
Platform compromise	Unauthorized control of the RCS operator/backend environment or its data. It is distinct from identifying RCS and from compromise of a monitored endpoint.
Platform identification	Conclusion that artifacts belong to or reproduce RCS. It does not identify the operator, customer, victim or legality of use.
Positive validation	Demonstrating that a rule or query finds the expected known artifact under a stated sensor position and version. One positive does not establish coverage.
Preservation-first	Incident approach that captures volatile state, topology, BSON, logs, binaries and hashes before login, restart, repair, restore or other state-changing action.
Sensor position	Where a detector observes data: TLS wire, decrypted HTTP, Windows events, acquired files, MongoDB, or application logs. A rule’s meaning depends on this location.
Target compromise	Successful unauthorized access to or surveillance of a person’s endpoint. A targeting attempt, backend record or platform sale does not by itself prove it.
Threat model	Explicit account of assets, trust boundaries, attacker capabilities, entry points and security properties. It is not merely a list of vulnerabilities.

Historical and attribution distinctions

Term	Meaning in this book
Commercial relationship	Evidence of sale, support, contract or official admission involving a customer. It does not establish use against a named person.
Deployment	An installed or operating product instance supported by technical or documentary evidence. Repository presence and negotiation are not deployment evidence.
Infrastructure attribution	Technical inference connecting servers or proxy chains to an operator geography or organization. It does not necessarily identify the individual directing an operation.
Negotiation or trial	Meeting, demonstration, proposal, tender or evaluation. It must not be rewritten as purchase or deployment without additional evidence.
Product identification	Technical linkage of a sample, server or artifact to RCS. It is narrower than operator or customer attribution.
Source capability	Function present in code or documentation. Capability does not prove packaging, licensing, delivery, successful use or exclusivity.
Targeting	An attempt directed at a person or account, such as delivery of a linked malicious document. It does not automatically establish successful infection or collection.

When two terms appear close but are not interchangeable—collector/frontend, archive/backup, evidence/proof, targeting/compromise, product/customer, or AIR console/web port—the narrower term governs the claim.

↑ HackingTeam's RCS: Bringing a Commercial Spyware Platform Back to Life