You're creating all sorts of situations and "what-ifs" and "buts" that don't fit the facts. We don't really have any idea what kind of investigation was conduct

You're creating all sorts of situations and "what-ifs" and "buts" that don't fit the facts. We don't really have any idea what kind of investigation was conducted, or what other steps they have taken before this point. I don't imagine police in most democratic societies -- especially ones with robust free presses -- conduct raids lightly. Furthermore, it's not really the police's job to interject possibilities into this situation. Phrases like "digital forensics are crap -- way to easy to forge" and "If the ISP employees are the criminals then getting a wiretap for the customer's IP address that they've been spoofing is going to tip them off" and "if you know enough about Tor to set up an exit node" don't really enter into their though process. The investigation reached a dead end, they got more evidence. I would like to point out that I don't know the specifics of this case either. I will say, however, that in the US, raids and seizures like this are subject to judicial review. Probable cause is shown and permission is granted or denied. It's not as if the police can just walk in there and take what they want. I also don't feel that police work needs to be held up in the face of new technologies. As the public's access to technology increases, so must law enforcements access to tools to investigate crimes. This is not to say there should not be checks and balances, but that getting a warrant already is a check.