He could have picked up a black market encryption package, installed it through some vulnerability that he would be aware of through a sufficiently remote proxy and no one would have been the wiser.

But instead he reenacted scary movie it’s coming from inside the house.

The problem is no matter how much it looks like it’s a remote service he’s going to be right then and there in the center of the investigation. He is suspect number one and two.