If TLS was used in the packet transmission, then either the sender was capturing all traffic prior to sending it, and hence prior to encryption, and provided him the unencrypted packets, or a receiver captured all received packets after decrypting them and provided the received packets to him.
Or, the operation was being done as a man in the middle attack and somebody involved in the attack is the source of the unencrypted PCAPs.
Or, an older, insecure version of TLS/SSL was used and the encryption was broken using known vulnerabilities in the older protocols.
I was just assuming TLS encryption was used, but then again these voting machine companies claim that their machines are not even connected to the Internet. So who knows. Maybe they didn’t even use data encryption. Then Mike would have the metadata and the election voting data.
Just have to figure out how someone was able to capture all the intrusions into the election machines in all the States.