3 ms·

I've been assuming that they saw him connect to a torrent tracker and download files with known hashes, or something.