They wouldn't need to. They'd ask his residential ISP to monitor him instead.

If you're using Tor, take it as a base assumption that the exit node is logging your traffic, or even modifying your http traffic.

Tor's value is in concealing the association between your visible access of an entry node, with visible activity on an exit node.