Multi-hop messages are probably more important than cover traffic. If the average message does two hops, then dive your estimates by two, etc. In a real privacy environment, almost nobody would send serious messages by just one remailer hop. On the other hand, for posting minor spam and non-professionally-secure messages to mailing lists, one hop will do. A first step at estimating this would be to check the fraction of mail addresses to known remailers (since most remailers are more likely to track destinations than sources.) Most of pamphlet's bouncemail is from other remailers, but that seems to be more of a configuration issue, or people sending test mail to mixmasters or something.
One could make some attempt to account for all known cover traffic. Given a known average quantity of cover traffic, the rest is either real or independent cover.
I would be very grateful for pointers to data concerning the number of messages that pass through remailers. (Not anon.penet.fi -- real remailers.) I am currently in a conversation with a journalist who should know better, but claims that secure anonymous remailers are never used by anyone -- just a curiosity. Good question. How do we determine this without ourselves being able to distinguish between cover traffic and "real" traffic? #-- # Thanks; Bill # Bill Stewart, stewarts@ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...