"It’s sort of a puzzle; it’s a detective game, trying to say, 'Well, this matches that,' or, 'This thing has some Cyrillic letters in it. Where did it come from? Which IP address?' But there's some assumptions in this kind of work, like all detective work."