The 25-year-old’s alleged actions in the days after the attack suggest he was not exactly a criminal mastermind. The U.S. Attorney’s Office said Council conducted a series of suspicious internet searches, for phrases like “SECGOV hack,” “telegram swap,” “how can I know for sure if I am being investigated by the FBI,” and “What are the signs you are under investigation by law enforcement or the FBI even if you have not been contacted by them.”
Yeah. It’s likely that the terms only came up with a wider investigation of the device/network data that the hack originated from.