What they choose to investigate is itself revealing. CDNs and large hosting providers for example would be in a position to make inferences by observing and correlating traffic from that origin. I would be trying to obfuscate it using a VPN distributed over a range of countries and IP addresses. That could appear strange to a host, depending on how they implement it.
Except that most open source material is now encrypted. They could see lots of traffic towards Twitter/Facebook/YouTube/google and lots of overseas news sources but would have little insight into actual content.
The NSA doesn't want any of the hundreds of thousands of Twitter/Facebook/YouTube/Google workers to have that insight either. And when the sites they're visiting aren't encrypted they can't browse to it because of OPSEC? That would all be at risk of side channel analysis. They aren't going to leave it chance. Count on them covering their tracks.
