Seems like overkill for a government entity to scan all packets entering or leaving the network as a whole.  Definitely not minimally intrusive.<p>It seems likely that the computers with information they really need to protect are already on separate subnets&#x2F;vlans, so why not protect just those instead of sweeping up everything?