Uh, in case you hadn't heard, Hacking Team has been accused of doing heaps of terrible stuff already. How would this be "beyond the pale" for them?

"pippo" and "pluto" are used in Italian as "foo" and "bar" are used in English, see http://www.outpost9.com/reference/jargon/jargon_28.html#TAG1... .

I think it is a bit ironic that some seem to have no qualms accusing a company of creating fake child porn accusations. It follows the exact same reasoning for planting evidence: How would child porn be beyond the pale for a dissident?

Even if they have a terrible track record, this code implies nothing that they are currently accused of. It is not like the code is heavily obfuscated or missing other parts. Let's not forget these leaks were "planted" too and we have no idea about its integrity.

Yeah, I think it's the responsibility of the user to bring his own child porn to plant on his victim's computer.

Any tool you can use to upload files on a remote system can be used for that. Hacking Team's tools certainly allow that but I very much doubt they have a tool specialized for planting child porn/evidence on a computer.

But then... we're so used of seeing child porn used as a straw man to increase surveillance that's it's pretty fun to see it used against one of the companies making tools to help with said surveillance. Even if it's wrong.

Most anyone interested in this story immediately jumped on the code thinking it was inserting files. Then a few software engineers took a look at the code and realize the file names were pretty much jokes. Now, everyone thinks it a joke that the tool inserts such material, when in reality it allows any user to insert any file they have, so the government (who has a collection of illegal files) can still use this to frame someone but any outrage over it has been dissipated.

I'm not saying it was intended to happen like this but it is sad it did.

Looking at the code, it's clear the strings are merely tests, and not used when a proper string is defined. However, the fact that their tests and examples use these strings, makes it clear what they thought a good application of their product was.

Assuming this was created with malicious intent (however unlikely), the motive would not be to plant false evidence but rather to create an excuse for probable cause (search and seizure). It would give law enforcement a legitimate reason to hold you and search your devices.

So something like a parallel construction[1] then? It's obviously not exactly the same, but it's the same type of scummy if not worse.

[1] https://en.wikipedia.org/wiki/Parallel_construction

At which point planting evidence becomes very easy as long as the one doing it is smart enough to not leave traces that it was planted.