Has Hacking Team's government trojan been used against journalists?

Hacking Team is a supplier of “lawful intercept” technology based in Milan. A regular attendee of surveillance industry conferences around the world, last year one of the company’s founding partners told the Guardian that Hacking Team had sold surveillance software to 30 countries across five continents. 

Hacking Team’s marketing material promises that it can “defeat encryption” and “attack and control target PCs from a remote location” in a way that “cannot be detected”. The company has been very clear in the way it describes its ‘Da Vinci’ Remote Control System: 

It is spyware. It is a Trojan horse. It is a bug. It is a monitoring tool.” 

According to Hacking Team, the Da Vinci software logs Skype calls, emails, instant messaging, web browsing records, deleted files and shots taken from the computer’s own webcam. In effect, the company claims that their product not only relays what's happening on a target’s computer, but also enables surveillance of anything that occurs within the range of the computer’s internal camera or microphone. 

Hacking Team’s Remote Control System was detected 'in the wild' last week - shortly after Gamma International's FinSpy (a similar tool) was identified in email attachments sent to Bahraini activists. A Trojan targeting Snow Leopard and Lion versions of OSX was identified as part of Hacking Team’s range of products, exhibiting similar behaviour to that promoted in marketing brochures. Hacking Team claim to be able to compromise computers running Mac OS and Windows, in addition to a range of smartphones. There are rumours that this software was used to target a group of Moroccan journalists. We would appreciate any further information on this. 

This is not the first time an Italian manufacturer of surveillance technology has been brought under the spotlight. In November, it was revealed that employees of Area SpA, based just outside Milan, were installing a system for the Syrian government “with the power to intercept, scan and catalog virtually every e-mail that flows through the country” – and this at a time of major unrest, when political demonstrations were being brutally crushed by the Assad regime. Partly as a result of these revelations, the EU banned the export and maintenance of surveillance technology to Syria a month later. Under export regulations dating from 2009, Italy is also obliged to ensure that surveillance and intercept technologies exported by Italian companies are not used in violation of “public security or human rights considerations”. 

EU regulations and other export laws classify products like those manufactured by Hacking Team and Gamma International as “dual use”, in recognition of the fact that law enforcement agencies may have a legitimate need to intercept the communications of those suspected of breaking the law. However, persuasive evidence is increasingly coming to light that suggests these systems are being used to target not serious criminals, but of those who are merely guilty of expressing their opinions.