content: The NSA's method was different and required a compromised entry AND exit node, thus only being useful for clearnet snooping. It also required access to the logs of the server being connected to. Basically it would use time to connect the Tor entry, Tor exit, and server connection events together to prove a specific IP is making the connection. That method, while more demanding, is possible because the delay is roughly the same until you change nodes. At least that's how I remember it when I read it, I'm no networking expert.