Possible attack questions

[Bradford X]

I'm not certain this is the proper place to ask. If someone has a
better suggestion please let me know.

I have some friends who work in a fairly restrictive country.
Currently their web traffic is tunneled through a VPN and pops out in
the United States. My understanding of attacks on this type of network
is slim. However my understanding is that it would be possible for an
attacker to view traffic at their ISP in this country, and also the
traffic coming out in the US, and tell who was visiting what because
of the timing.

My question, assuming I am correct that this is possible, is: What
resources would the attacker have to possess to conduct such an
attack? I assume that major powers (USA, China, what have you) could
carry this out. What about African, Southeast Asian, or Middle Eastern
governments? I assume it is possible the government could contact the
US for help, but I don't know the likelihood of that help being given.
Or perhaps Google, Yahoo, or MS in the USA could help out this
government.

I know I'm limiting the amount of help that can be given because I'm
not naming the countries involved. I'm just wondering how likely this
attack is.

I appreciate any advice