That way we can gather intel! If we push them off of the internet and back onto the sneakernet then we will have a much harder time getting information. We'll need to find and infiltrate the cells, gain trust, let some incidents happen as a calculated risk in order to get deeper into the organization, etc.
At least this way if they post we can determine the time, possible location, IP addresses, we can set up taps to capture PCAPs and further enumerate, the list goes on and on.