Where do they copy the file?  Does that not leave a trail? I haven't seen any analysis of the forensic data except what Bill Binney and his VIPS people have talked about.  I assume someone in the group would be familiar with your workaround and yet they are all in stating it proves it was not an external hack.