I'm not sure it is explicit in the show, but here is my long-winded explanation based on extrapolating from present-day technologies and trends:
Today, "certificates" are used to verify the identity of (trust) computers you communicate with; a website that looks like your bank's, isn't your bank's. By installing/using your OS, you've already consented to trusting whoever they've added to the default list. VeriSign is an example; the company has a process for new websites to establish trust with them, and they have trust with your OS manufacturer, and you have already consented to trust them.
Today, this is all done with >128-bit keys, however, in the time of GITS, it's reasonable to assume they are able to use massively long keys, possibly >128-Mbit. It would take a PC from our time, working non-stop, until the time of GITS to crack one.
You could Google extensively about encryption, but for simplicity's sake:
Someone can create a certificate to "verify" anything they want. Ultimately, you will have to either explicitly trust them, or defer to a third-party to evaluate their claims on your behalf. We don't background check and explicitly trust every single merchant with a credit card reader; instead, we trust a select few companies, Visa, Mastercard, etc. to not associate with disreputable merchants and unconditionally handle any problems that arise, if they do.
In the time of GITS, cyber-brains are evidently secured by, at a minimum, a very-strong private key, approximately unique to each. Additional security features can be added/upgraded such as "attack barriers", "dummy barriers", etc. As governments usually go, it is extremely likely that the government has interfered heavily in cyberization matters, enacting legislation to ensure minimum-this', maximum-thats, etc. Another typical feature of governments both in today's time, and in GITS time, is reliance on a self-preserving model of "buying "security"" with liberty. In other words, we cannot be 100% safe and 100% free at the same time. In order to do their job, we must trust the government. The result of that implied trust are (many) laws allowing them to legally spy on and/or indefinitely detain you. If you are deemed a "threat to national security", your liberty is administratively revoked, your communications are monitored, you are no longer innocent until proven guilty, etc. Consider that, today, your cell phone's microphone, camera, GPS, etc. are all controlled by software and can all be enabled and activated remotely.
Notice that in GITS, although technically a "police force", we are never given any indication that any member of Section 9 has EVER applied for a search warrant. Many times, while in their own country, Section 9 shows no regard (and sometimes contempt) for security/local police or their instructions, preferring to knock them down or disable them to gain (technically-illegal) entry to private properties, usually by kicking in a few doors/walls/faces. Section 9 goes and does, almost unilaterally, wherever and whatever they want.
Regarding the GIK:
- I suspect that it is not a single entity. It is more likely to be a set of private keys from a very-high-level certification authority (CA). These keys have long, but not indefinite, lifetimes and today's computers already check for both revoked and expired certificates.
- When folks get "back-hacked", minor systems are affected and the intrusion is not necessarily obvious. A few examples are: Batou being "encouraged" to punch himself out by The Major, Batou's eyes being hacked by Aoi, Batou hacking an arm suit operator's eyes to appear dead, etc. These were all basically "subliminal suggestions" to lower-level systems. After convincing Batou's eyes that he was no longer there, Aoi casually walks off. Batou is very sharp, but even he took a few seconds to realize/remember that lists of vaccine recipients do not usually materialize out of thin air and hand themselves to people. In contrast, the recruits initially failed the entrance exam because they never figured out they had been implanted with false memories.
- [I think] "Ghost" refers to hacking an individual with the intent to directly harm, disable, and/or control the human (override their ghost/spirit/soul), rather than to just subvert their free will by obfuscating reality (eye hacking) or misdirecting them (implanting false memories).
- Using "the GIK" is not so much, more-invasive, as it is final. The implied super-extra-high-level nature of these keys makes overriding their use impossible; the prosthetic body, cyber-brain, any barriers, and all other related systems and functions will deliberately ignore input from the human brain-cells they are intended to support in favor of the trust implied by a GIK.
