1. it's very bad practice, even if only internal, to use an already registered public domain. It crossed my mind that this might just be an internal domain (devlan -> developer LAN), though it seemed unbelievable an agency would have people in IT with that much disrespect for proper network config.

It must be an interesting life for the French admin of the "real" devlan.net since the leaks.

2. I don't get the Kaspersky reference. Can you explain?

ISP and University: I suppose you mean those would be running public Solaris hosts, right? And that therefore the CIA has been hiding on those servers. I sure would hate the CIA to spy on scientists, though it's not unheard of that one of the agencies knocks on a door of a scientist who just happened to be on the verge of publishing something they deem a risk. Happened in the past and sure still does. The imbalance and abuse of power is the problem and here it's legalized/constitutionalised. An agency can spy on my private life and professional work without being questioned, but we aren't allowed to demand a transparent administration or any of the many ranches of government.