Seems like overkill for a government entity to scan all packets entering or leaving the network as a whole. Definitely not minimally intrusive.

It seems likely that the computers with information they really need to protect are already on separate subnets/vlans, so why not protect just those instead of sweeping up everything?