I read the whole paper, and it doesn't at all look like the "real deal". No actual evidence in the form of malware samples (after exploitation of the netwrok),

I read the whole paper, and it doesn't at all look like the "real deal". No actual evidence in the form of malware samples (after exploitation of the netwrok), detected "duplicate" certificates or whatever is provided. Not even network captures of any MITM traffic going to the hidden VLAN. The only "evidence" provided was the presence of the hidden VLAN, which got assigned some 30.x.x.x IPv4 addr via DHCP. This could simply be some internal management VLAN of the ISP. As the author had stated, the ISP installs updates remotely. So that's their way of connecting to the router. Regardless of updates, ISPs always have a way of managing their equipment remotely. A WHOIS was performed by the author, and the address turns out to belong to the DoD. Howerver, it's more likely that since this is a "private" VLAN, this address has nothing to do with internet WHOIS records. It was just made up by the ISP. The authors getting a ping of 8ms to the NSA/GCHQ, is really just them talking to some local server at their ISP. Also the described attack on TOR seems completely wrong. No details were provided, but the basic premise looks to be just wrong. To conclude, this whole paper smells to me of sensationalism and confirmation bias.