I was pretty impressed that the blog post author thought of this. Pretty classic Eureka moment! I wonder if there's a way for regular people to do this with something like Packetbeat and tcpdump?
I think what the "worst nightmare" comment really meant was observation/monitoring that they (the NSA) could not disable. Hackers can turn off logging or even exploit monitoring agents as an attack vector (the Target breach a couple years used BMC agents as an attack vector). However, if a copy of all the network traffic is being passively analyzed by a monitoring appliance, then there's no way that they can hide from that or turn it off.
Yes. In addition, this type of monitoring cannot be turned off. Hackers can turn off logging on servers, but they cannot keep from sending communications over the wire.