arpwatch running on an edge router of mine tells me that there's a host with a DoD-registered IP address connected to my (major US) ISP network segment, which I know for a fact contains both business and residential subscribers. I port scanned it when I first discovered it just to say 'hello', and I have little doubt that a dragnet surveillance apparatus lives on the other side of that firewall.
Governments have utilized clandestine wiretaps for as long as there have been wires. Bad guys and the children and all that. Not to mention, what an advantage that people think you're kooky when you talk openly about this stuff!
A long-forgotten machine on a DoD network sounds like the kind of host that could serve for idle scanning or any other technique using a forged source address and a predictable dummy host; I imagine that arpwatch takes a view of network security focused on classifying frames and less on connection behavior.
Governments have utilized clandestine wiretaps for as long as there have been wires. Bad guys and the children and all that. Not to mention, what an advantage that people think you're kooky when you talk openly about this stuff!