Any data received from the command and control server is sent unencrypted and unchecked. Additionally, the trojan contains a "backdoor within a backdoor", which allows any code to be attached to the trojan and executed unchecked!
Moral issues of computer surveillance aside, this trojan is a shocking example of the German government's (if indeed this is a government effort) incompetence regarding the internet.
The person surveiled has not been has not convicted of a crime yet the state has taken onto itself to install software that would leave the person open to further hacking by random individuals.
This is akin to the police not simply breaking into the house of a man they suspected of a crime but also them leaving his door a-jar after they left. See the Sony Rootkit.
It's no different from getting a warrant for a phone tap, or a copy or your US mail.
(Incidentally they don't need a warrant for a copy of the address on the front, called http://en.wikipedia.org/wiki/Mail_cover - so presumably they don't need a warrant to ask your ISP for a list of IP address, but I'd want a court to confirm that first.)
Not really. My understanding is that German law permits trojans for surveillance.
Also, they don't need to admit it, it's not like nobody knows that this software exists.
In my experience, suburban dwellers don't like learning that they're parasites.
