Yes, we are all just guessing.
And I think you misunderstand. I am not arguing that it "could not be" the NSA. And I haven't see anyone say that. I am simply arguing that it is extremely unlikely.
It's a guess, yes, but it's an informed guess. It's a matter of looking at probabilities and seeing what's more likely. Shippers screw up all the time. Packages make crazy detours because somebody tossed a box in the wrong truck. A label falls off and a mixup occurs. Somebody typos a tracking number.
On the other hand, for this to be the NSA, several unlikely things would have to be true:
1. The NSA would need to be intercepting computer equipment destined for certain people and modifying it to spy on them.
2. The NSA would need to be targeting the person in question for this program.
3. The NSA would need to have set up this program in such a boneheaded way that it shows up on a package tracker. (If I were in charge of this program, I'd just set it up in FedEx's sorting facility in Memphis and then ensure all the relevant equipment uses FedEx. Simple, fast, and no chance of the target finding out.)
4. The NSA would need to have set up this program in Alexandria, even though it has little to recommend it for such a thing.
Now, we know that #1 is actually true. So that's one requirement fulfilled, out of several. But what about the rest?
I'm somewhat skeptical on #2. It's possible, but it seems unlikely. Why would the NSA target Tor developers? The security of Tor falls apart in the presence of an adversary that is able to monitor the entire internet, because you can just correlate traffic that enters with traffic that exits. The NSA can presumably monitor enough of the internet to defeat Tor right now. So why bother spying on Tor developers? It's possible as a belt-and-suspenders maneuver, but this person just doesn't strike me as a likely target.
I'm really skeptical on #3. It's about as believable as having the FBI spy on me by parking a van outside my house that says "Flowers By Irene". It's possible, but really unlikely.
And #4 doesn't make a whole lot of sense to me. Again, possible, but unlikely.
So we have one thing that's true, and then several other things that are individually unlikely, and combine to be really unlikely. It looks to me that people are committing the basic fallacy of thinking that the truth of #1, since it's unlikely, somehow makes the rest more likely too.
It comes down to this: is it a screwup by USPS or Amazon or a third-party reseller, or is it the NSA screwing up royally while trying to plant a bug? In the absence of evidence, we are stuck guessing, but we can guess intelligently by realizing that one is vastly more likely than the others.
"When you hear hoofbeats, think of horses not zebras."
That doesn't mean zebras are impossible. But it means you should prefer the more obvious explanation unless there's evidence to the contrary.
