[unwind]

Why would a TLA look for a file with a known (hashable) content? Is that common? Is that to be seen as looking for "contraband", i.e. if you have a certain file, for instance some known part of a rookit, you might be an evil attacking hacker? I don't quite follow.

Also, the typo "Drobpox" was fun, that's a good alias when feeling suspicious. :)

[patcon]

Tracking spread of leaked documents?

[sarciszewski]

Or things like child pornography. It isn't all about state secrets, y'know.