The big takeaway from this article for me is that I should probably look for or write a browser extension that tracks changes to analytics tools and IDs on sites. If a site is silently taken over, the state actor would either need to separately gain access to the analytics tool accounts, or would need to modify the IDs to connect to a new account. I'd love to see how often tracking IDs change on high-profile sites.