The provider doesn’t have to do anything. Their upstream transit provider probably has a span port plugged directly into the NSA. Which is what was happening wi

The provider doesn’t have to do anything. Their upstream transit provider probably has a span port plugged directly into the NSA. Which is what was happening with Room 641A over a decade ago. On one hand, they won’t be able intercept encrypted VPN traffic, but on the other, they are definitely collecting IP addresses, timestamps and traffic heuristics. With enough resources to pick out patterns and bulk collection on both sides, encryption and logging might not even matter.