If the NSA has the logs of ISPs that carry one third of the world's traffic, couldn't they execute the attack without running any Tor nodes? Or am I misundersta

If the NSA has the logs of ISPs that carry one third of the world's traffic, couldn't they execute the attack without running any Tor nodes? Or am I misunderstanding the onion protocol?