Comment by raggi

This is tin-foil-hat speculation, but for example, if you observe a locality measurement protocol picking where it should connect to, but you already know all of the local sites of interest that are relevant, you might want to find remote sites of interest. If you manipulate the more open sampling protocol to lean toward that remote site, you can then observe where secured connections to which you're otherwise blind, connect to. Now you have new remote targets of interest.