Dan Guido

@mattblaze If given the shellcode, I think you can make that argument? It does the search. I'm not sure what perspective the exploit adds.

@dguido The argument would be that the beacon was installed on more computers than authorized by the warrant.

@mattblaze How does a copy of the exploit source code indicate the # of times it was used (in potential violation of warrant terms)?

@dguido I don't know - since I've not seen the code, we have no idea what it does.

@mattblaze I wonder who would use this argument. If given nearly any piece of software, can you tell how many times it's been run?

@dguido If I were the defense, I'd demand to see the entire chain of code from selecting the target computer onward.

@mattblaze I'm sure they would, but I think the launcher + shellcode discharge all potential arguments about the validity of the search.

@dguido From the defense's perspective, they have no way to know whether the prosecution's description of the components is accurate.