[_nullandnull_]

> Isn't this just a subset of what anti-virus software does?

Yes. The signatures are written more generically to detect the samples though. AV software can (or at least shouldn't) write signatures so generically because the potential for false positives. Since the scanner is scanning a non-enterprise environment the signatures can be a little more generic.

[unclesaamm]

That makes no sense to me. Isn't it important for this to be useful in an enterprise environment too? Gov't may be spying on any number of entities, including businesses.