[erikpukinskis]

There are ways of doing it invisibly. Change timestamps in very subtle ways, Embed data in lossy media formats, etc.

If the code says "phone home if anywhere on the screen you see one of the following email addresses" then it won't show up in a normal security audit, unless you email one of those people during the audit. All the NSA has to do is make the phoning home rare enough that it's probabilisticly unlikely to be observed.