Upvote for the thinking, but I don't think constant monitoring is implied. The information more likely came from his phone network's and ISP's logs of his activity (which they'll have demanded and the companies won't have made any serious efforts to oppose), and anywhere that may have led.
Biting the hand that feeds IT
