I think that quote was made because the writer was confused about what happens during live operation, and what happens during the time when communication was cut.

The host could potentially sniff the traffic during live operation by sniffing the memory of the vm.

But when the vm's communication is cut, the whole disk is encrypted. I expect this encryption to be done using some sort of public/private key encryption scheme, such that without the private key, you can't actually unencrypt the disk. THis is what is meant by gathering data on the user i suspect.

With whole disk encryption, the disk is always encrypted. While running, the decryption key is stored in memory and used to decrypt/encrypt blocks. When communication is cut, they are presumably purging the key from memory. The password would need to be entered to produce the key.

This means that while the system is running, the key can be read by the host. It doesn't matter is the key is later purged. Changing the key requires re-encrypting the entire disk which is a slow operation.

I guess there isn't enough detail to raelly work out what would happen - its not clear that they meant whole disk encryption in the way you described. I thought they encrypt the disk _only_ after loss of communications. The private key is not on the VM anywhere. Thus, the vm once encrypted, is useless (without the passphrase, which presumably only exist in the head of the operator of tpb).