Ok, so:

The RCS software from Hacking Team is basically a Remote Access Trojan, right? As it says in the description:

"It is a tool for taking control of the endpoints, that is, the PCs" [0]

So they already have control over the system and are probably able to down- and upload whatever they want.

Isn't that a feature in all the "Lawful Intercept" tools? The only assurance that they don't upload incriminating stuff is their word. Or is the CP code snippet such a strong trigger?

[0]: https://wikileaks.org/spyfiles/files/0/31_200810-ISS-PRG-HAC...