While I agree that the FBI's explanation as they gave it is impossible, I see 2 possible explanations for how their explanation would make sense. I don't know w

While I agree that the FBI's explanation as they gave it is impossible, I see 2 possible explanations for how their explanation would make sense. I don't know why they would glaze over these details, but: 1. They could have meant simply viewing all the HTTP response headers with something like Chrome's dev tools, Firebug, or possibly a proxy like Burp Suite. 2. They may have set up Tor to essentially use no hops and use only their own host as an exit node. That way they would be able to directly observe traffic from a clearweb IP address in a PCAP. Or they could set just a single hop and specified another host they control as an exit node. This seems way overboard just to find an exposure like this, but it's possible that the FBI or NSA have such test environments to probe for other Tor-related vulnerabilities and misconfigurations.