how was it determined that it is phoning home the content of the slides? One thing is to exchange network packets with a remote server, and another thing is to

how was it determined that it is phoning home the content of the slides? One thing is to exchange network packets with a remote server, and another thing is to claim that it's leaking slide content.