Good point; This is something I wanted to see discussed but the paper didn't touch on it at all. It just focused on tools and vulnerabilities in the tool and didn't dip into the process surrounding the tool.