Attacking a linux box that runs little more than the TOR daemon is much harder than attacking a browser on an avarage client machine. The difference in attack s

Attacking a linux box that runs little more than the TOR daemon is much harder than attacking a browser on an avarage client machine. The difference in attack surface is huge. Further, one needs to attack many (hundreds) of TOR nodes to effectively "own" the TOR network. The difficulty level between these two attack vectors is very different. I'd go as far as saying that such an attack is beyond what "low level" fed departments can do (due to HR shortages, budget limits, lack of cooperation with the more serious guys, etc). An attack of this level is something, that in my opinion, is reserved to the guys who hunt down bearded men in some warmer regions of the world. Now, a "common" browser exploit, and some basic attack skills, is something you can expect for these "low profile" investigations such as the one in question (again, purely in my opinion).