The only thing they have to watch out for is code that is explicitly licensed such that the military can't use it, or the "don't be evil" licenses... and I wouldn't be surprised they've got some sort of immunity against that buried in the law somewhere. Even if they don't, this doesn't seem to be that much code.
I wouldn't expect to see a line of code from them come back to the community... not because they're unwilling individually, but because I would imagine the process of getting it legally safe to release publicly just won't be worth it.
http://www.h-online.com/security/news/item/NSA-releases-secu...
What people don't often realize is that GPL (both v2 and v3) has a "trigger" condition, where the GPL reciprocity applies only with physical distribution of the code.
As an end-user, it's perfectly fine to modify GPL code and keep the changes private.