Appendix I: Source Commits, Manuals, and References

This appendix is the book’s consolidated provenance index. It identifies the immutable source revisions, manual files, research artifacts, and external works used across the chapters. It does not replace the local citation beside a claim: a commit identifies a tree, while a file and line range identify the evidence inside it.

Paths beginning with data/ refer to read-only leak material in the defensive research workspace. Paths beginning with docker-lab/ refer to the isolated reconstruction or its documentation. Paths under research/hackingteam-rcs/ are book research artifacts. No repository or manual hash establishes that the material was deployed by a particular customer.

Frozen repository revisions

The first six revisions are the primary snapshots frozen before drafting. The anonymizer revision was added to this reference index when Chapter 9’s cited supporting tree was consolidated. The local connector implementation cited in Chapters 9 and 10 is not a separate repository in this archive; it lives under rcs-db/lib/rcs-connector/ and is therefore covered by the rcs-db commit.

Git timestamps are repository metadata, not release dates. In particular, the database identifies itself as 9.2.3 while the common library and console-side trees identify 9.6.0. The source/version appendix records the direct version evidence and fidelity consequences.

Endpoint capability-audit revisions

The endpoint audit adds the following immutable repository states. Full tree hashes, classification rules, and file/line anchors are recorded in research/hackingteam-rcs/IMPLANT-CAPABILITY-AUDIT.md.

These sources were read only. None was built, run, repaired, or improved, and their different timestamps do not establish a coherent shipped release.

Historical common-library compatibility reference

The current-tree table is supplemented by one historical revision and its immediate transition:

This history proves that the expected interface existed in a contemporary 9.2.3 common-library state. It does not identify the database’s exact build input: rcs-db/Gemfile.lock records a path dependency and version, not a common-library commit. The lab shims therefore restore historically attested interfaces but remain adaptations onto the selected 9.6 implementation.

Canonical source roots

When a chapter cites a bare path such as lib/rcs-db/rest/auth.rb, its Sources and evidence section supplies the repository and commit. A citation to a lab copy must say LAB or name docker-lab; otherwise the cited implementation is the read-only original.

Operator manual corpus

The four core RCS 9 manuals are image-only PDFs. Page numbers in the book use the PDF page (pdf-p.N) unless the citation explicitly says “printed page.” The page footer and PDF page can differ because of covers and front matter.

These total 479 PDF pages. The OCR cache contains 479 per-page text files plus four combined text files. Identical copies of the four PDFs also exist under data/HackingTeam/; matching SHA-256 values confirm that either location contains the same bytes. The book treats data/HackingTeam - manuals/ as the canonical citation root.

The supporting manual directory also contains:

The locally preserved Intercept article PDF is contextual reporting, not an RCS product manual. It is not counted in the 479-page operator corpus.

Manual verification artifacts

The web-console manual audit connects 38 concrete manual claims to the running reimplementation:

• docker-lab/console-web/tests/specs/manual-claims.js stores claim text, manual file, PDF page and executable check;
• docker-lab/console-web/tests/specs/manual-audit.live.spec.js runs the claims against the isolated backend;
• docker-lab/console-web/tests/manual-ocr/ preserves the OCR text;
• docker-lab/manual-audit.md records the per-section findings; and
• docker-lab/console-web/MANUAL-AUDIT.md explains reproduction and state hygiene.

The result—38/38 claims matched—supports surface conformance of the web port. It does not turn the new JavaScript application into an original HackingTeam artifact or prove every untested AIR behavior.

Internal research artifacts

Chapter 10 also cites the immutable assessment snapshot identifier codex-security-snapshot/v1:sha256:63da7d1a5c75bc3be86076e68891284c4bbc6b8125b4369b327bed289911139e. The claim ledger carries the 27 validated findings and their limitations. The identifier describes the reviewed source snapshot, not a hash of a historical customer installation.

Human rights, history, and policy

The following sources support Chapter 1 and the framing used elsewhere. The book preserves each source’s level of certainty: product identification, targeting, suspected operator geography, commercial relationship, and successful compromise are not interchangeable conclusions.

• Citizen Lab, Backdoors are Forever: Hacking Team and the Targeting of Dissent (2012).
• Citizen Lab, Hacking Team and the Targeting of Ethiopian Journalists (2014).
• Citizen Lab, Mapping Hacking Team’s “Untraceable” Spyware (2014).
• Citizen Lab, Hacking Team Reloaded? US-Based Ethiopian Journalists Again Targeted with Spyware (2015).
• Kaspersky GReAT, HackingTeam 2.0: The Story Goes Mobile (2014).
• Committee to Protect Journalists, Ethiopia suspected of spying on independent TV network ESAT (2015).
• European Commission, Delegated Regulation (EU) No 1382/2014.
• Camera dei Deputati, response 5-08423 concerning HackingTeam export authorisations (20 April 2016).
• Privacy International, The Right to Privacy in Italy: submission to the UN Human Rights Committee (2017).
• UN Special Rapporteur, Surveillance and human rights, A/HRC/41/35 (2019).
• Formiche, interview with Memento Labs president Paolo Lezzi (2019).

Vulnerability and exploit-history references

These works validate public vulnerability identifiers and post-disclosure use. They do not establish who authored every repository package or whether any specific HackingTeam customer deployed it.

• Microsoft, Security Bulletin MS11-031 and MS11-081.
• NIST National Vulnerability Database, CVE-2015-5119, CVE-2011-0609, and CVE-2010-1095.
• Palo Alto Networks Unit 42, APT Group UPS Targets US Government with Hacking Team Flash Exploit.
• Mandiant, Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability.

Citation and review rules

• Cite original source with repository, commit, file and refreshed line range.
• Cite a manual with filename and PDF page; add printed page when useful.
• Mark lab observations with the test, trace, capture or reproduction step.
• Mark web-port behavior separately unless original source/manual evidence also supports it.
• Attribute vendor claims as vendor claims.
• Do not cite a Git timestamp as a product release date.
• Do not turn source capability into evidence of sale, deployment or use.
• Do not reproduce victim content, passwords, cookies, component signatures, agent keys or licence cryptographic material merely to make a claim reproducible.
• Preserve unresolved discrepancies and negative results rather than silently harmonizing versions.

The mechanical link and source-range check is recorded in research/hackingteam-rcs/CITATION-AUDIT.md. The final publication pass must repeat it after edits and complete semantic technical, manual, historical, human-rights, archival, and publication-safety review.