How to tell if the NSA is spying on you

[gray_ghost]

Check this out

At a command prompt - type tracert followed by whatever website you want to examine. Here is what my output looks like when I did a traceroute to nsa.gov:

tracert nsa.gov
Tracing route to nsa.gov [12.110.110.204] over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms WRT54G [192.168.1.1]
2 12 ms 11 ms * wa-pullman-cuda1i-gate.losaca.adelphia.net [68.69.200.1]
3 14 ms 8 ms * ca-glendora4a-169.stmnca.adelphia.net [24.51.244.169]
4 14 ms 9 ms * 192.168.0.5
5 22 ms 18 ms * so02-00-00.a0.sea90.adelphiacom.net [66.109.12.9]
6 41 ms 38 ms * so03-01-00.c0.sjc75.adelphiacom.net [66.109.3.241]
7 38 ms 40 ms * g1-00-00-00.p0.sjc75.adelphiacom.net [66.109.3.194]
8 66 ms 66 ms 67 ms 65.57.86.17
9 66 ms 64 ms 66 ms ae-23-56.car3.SanJose1.Level3.net [4.68.123.173]
10 45 ms * 42 ms att-level3-oc48.SanJose1.Level3.net [209.0.227.30]
11 105 ms 102 ms 106 ms tbr2-p012301.sffca.ip.att.net [12.123.12.29]
12 106 ms 107 ms 100 ms tbr1-cl2.sl9mo.ip.att.net [12.122.10.41]
13 104 ms 100 ms 102 ms tbr1-cl4.wswdc.ip.att.net [12.122.10.29]
14 117 ms 104 ms 104 ms ar2-a3120s6.wswdc.ip.att.net [12.123.8.65]
15 106 ms 107 ms 109 ms 12.127.209.218
16 111 ms 114 ms 109 ms 12.110.110.131
17.....

Now apparently the line you want to look for in a traceroute report is sffca.ip.att.net. If it's present above or below any non-AT&T entry, then according to the allegations of Marc Klein (an expired hired by the EFF to support EFF claims that AT&T is cooperating with the NSA to spy on you), that means your packets are being copied and examined by the government, after passing through an OC-48 switch AT&T tapped in late February, 2003. BTW- that is a HUGE amount of Internet traffic. OC-48 lines are gigantic.

And assuming Klein is correct and AT&T has installed listening posts all over the country, seeing att.net anywhere in a trace route report should make you feel a little paranoid.

Comments

[snash-attack.livejournal.com]

Hmmm...is there a specific reason they use the SFFCA router (that obviously lives in San Fran)? Is that where the big room with all the processing equipment is?

If so, one must assume that any AT&T routing point is suspect because where I am placed in the country, my traffic doesn't get routed through SF. However, my tracert shows me going from Road Runner-->Level3-->AT&T-->NSA

The difference in our routes is that #11 step: you go through SFFCA and I go through DLSTX (obviously Dallas). After that, both of us get routed through St. Louis and then on to the NSA in Washington DC.

So, either I'm not being tracked...or AT&T is doing it at all major hubs (SF, Dallas, etc.)...it'll be interesting to watch this all unfold...

[gray-ghost.livejournal.com]

I wonder how they are sifting through all that data?
An OC-48 line carries about 2.5 Gbps, so caching all of that even for just a day would be pretty tough. It might be less if you are just looking at packets going outside the United States, or even for all packets going to certain IP addresses I suppose.