See http://freejeremy.net/wp-content/uploads/2013/10/jeremy-hammond-federal-complaint.pdf The search function doesn't work but look at the detail on Pages 30-33. The point is that Hammond's IP was accessing Tor at the same time as he was in his residence and / or in contact with CW-1 (Monsegur I assume).