All they really need is DHCP history and name servers at this point. Connect the dots. The actual info in communications isn't needed yet, but the crumbs lead to the rats, and with how we outsource IT to other countries, they will need to be subpoenaed or involved too. The info WILL come to light, but I don't think thats the primary objective now. Its making sure there's nowhere left for them to run. SA was the head cut off the bad bird, per se.