The device intercepts a copy of the whole datastream and then sorts thru it. This is sufficient to monitor all the users if the connection is unencrypted, or i

The device intercepts a copy of the whole datastream and then sorts thru it. This is sufficient to monitor all the users if the connection is unencrypted, or if the Feds can MITM it with help from a CA. If PFS or a private cert setup is in use, then such an interception device cannot get any plaintext unless the spies also obtain the secret keys from the server owner. That is what the FBI demanded from Leveson.