If I was a US intelligence agency I would specifically establish colocation presences with ISPs in Russia, Belarus, Uzbekistan, china, etc, on commercial ISP terms, and admin the servers remotely to set them up as a commercial vpn service. There's plenty of datacenter operators in Russia that will take your money.
Presumably the feds wouldn't say who they were and would pose as common criminals, because they wouldn't have any reason to suppose that the datacenter operator would keep quiet if they were open about their identity.
First-order strategy (do something that works as long as the other side hasn't also thought of it) only works until the other side thinks of it. My guess is that the intelligence complex (CIA +) thought of this around 1995, and the domestic law enforcement complex (FBI +) around 2005.
