Open source intelligence. From the ASN to IP ranges, and onwards to old messages on mailing lists, where the headers leaked the fact that the person sent email from WYLTK, and the person was publicly associated with the FBI by way of speaking gigs.