They weren’t on a VPN, but my guess is that they got IP addresses from their DNS requests that were on our side of the partition. In any case, it looks like it

They weren’t on a VPN, but my guess is that they got IP addresses from their DNS requests that were on our side of the partition. In any case, it looks like it’s ended for us. The window for gathering evidence slides closed... It’ll be interesting to read the post mortem on this one.