the Bureau can't see the traffic but they have keyloggers on all of his systems. He tried bypassing them with Spice but failed and otherwise got logged getting onto Tor and searching for dubious things