we know about the singapore VPN because they connected to IRC on libera chat with it.

Hmm.

I don't know if the VPN provider is willing to provide any information, but I wonder if it's possible to pierce the veil of VPN in at least approximate terms?

If you have a tcpdump of packets coming out of a VPN -- probably not something that anyone has from the Jia Tan group -- you have timings on packets.

The most immediate thing you can do there -- with a nod to Cliff Stoll's own estimate to locate the other end of a connection -- is put at least an upper bound and likely a rough distance that the packets are traveling, by looking at the minimum latency.

But...I bet that you can do more. If you're logging congestion on major Internet arteries, I'd imagine that it shouldn't take too many instances of latency spikes before you have a signature giving the very rough location of someone.

Some other people pointed out that if they used a browser, it may have exposed some information that might have been logged, like encodings.