I don't think that they needed to trace it back through the VPN. They started asking questions at his workplace (for whatever reason), and a co-worker turned ov

I don't think that they needed to trace it back through the VPN. They started asking questions at his workplace (for whatever reason), and a co-worker turned over a chat log in which he was describing what he was doing. They could have just been questioning The Canton Group through 'good old fashioned police work.' It's not like The Canton Group was unconnected to the University.