The white hats are the forensic cyber security experts Lindell hired.
I think you answered your own question though. The entity which could capture this volume of data is the NSA.
Or ubwr.
Maybe, maybe not. If they had packet captures enabled at the router for the central reporting site, you could probably get what they are talking about. Normally though, you wouldn't be running pcap on a production router unless you were troubleshooting something. They take up a fair amount of space, if you have a lot of network traffic.
That's not saying that the NSA couldn't snoop this data at one of their pinch points, but a local source is more likely.