From the slides, apparently a node in the system just connects at an ISP or peering site and grabs all the packets. Then they essentially 'parse' the packets t

From the slides, apparently a node in the system just connects at an ISP or peering site and grabs all the packets. Then they essentially 'parse' the packets to TCP/IP sessions, logical user sessions, e-mail messages, etc. Then back at HQ, can send the node what are essentially 'filters' to return 'alerts' and the associated content. So, point: As a system, it's quite obvious. As software, it's quite routine. And, from their description of working with anomalies, they are being just intuitive and elementary and not at all advanced or powerful. It would appear that a terrorist Internet user could do fairly well beating that system by using a proxy server also used by many other Internet users and also using a lot of strong encryption -- PGP used well might be strong enough.