Even if he was, then what? Quick glance at the repo does not show any kind of End-User License and even if it had what's the NSA going to do? Revoke his license? Sue him?