Yes, they saw a bunch of new relays, starting in February 2014. And they weren&#x27;t doing anything obviously alarming. But once Tor devs had seen the Black Hat abstract, they figured out what to look for. Once they were monitoring relevant parameters, the attack was obvious.<p>In retrospect, more monitoring seems an obvious approach. But that would probably hurt performance. And threaten security and anonymity. Maybe there&#x27;s a middle ground.