Sorry, I don’t follow? Why did it need to hide its activities to run analytics? What statistical analytical purpose is served by wiping logs and removing logging?

Since we’re spitballing, Why not try giving them the opposite of benefit of doubt, as well? Something like, the administration is clearly compromised by Russia and hired a bunch of low status hackers, and we’re seeing massive bombs being dropped all over our cybersecurity defenses?