Are you saying that sending and scanning are the same? I think we need to define "scan" (or "sniff" or whatever other metaphors are used here) as more than just

Are you saying that sending and scanning are the same? I think we need to define "scan" (or "sniff" or whatever other metaphors are used here) as more than just receiving a copy that's still encrypted. What definition is there, which is distinct from "decrypt"? You can often determine the source, the destination, the amount of data over time, etc. but those are hardly sufficient to suspect wrongdoing unless there's also other overwhelming evidence already.