For some of the "how" explanation - you can configure mirror ports so all traffic going in and out a single port (for instance, the main uplink port) is essenti

For some of the "how" explanation - you can configure mirror ports so all traffic going in and out a single port (for instance, the main uplink port) is essentially copied and sent to another port. The secret service could plug their listener device into such a port, and it will gather all packets sent through that device. If you consider the ISP network as "local" it will need to leave the "local" network to access Internet resources. Basically, the secret service could be monitoring the device which represents the "edge" of the network, where traffic from any ISP customer leaves the network of the ISP and all traffic intended for ISP customers touches first. As others mentioned, this is only gathering data in transit and if the data is encrypted it will not be readable (in theory).