whose watchin the watchers -- I GOT THE EXPLANATIONS OKAY

[Jim Warren]

At 04:19 PM 11/05/95, Stephen Whitaker wrote:
>The following is an exerpt is from Jim Warren's listserv, GovAccess 183.
>
>Are there folks on this list who have insights or definitive information on
>this topic?
>
>Are there ways for someone with access to modify router tables to constantly
>create alternate paths at other routers which would serve to end-around any
>such snoops?
>
>***********begin_included_text*************************
>
>&&&&&&&&&&&&&&&&&&&&
>
>
>Is Someone Already Watching All International Net Traffic?
>
>The following is the transcript of an actual communications trace that a
>friend ran, while I was sitting next to him, watching -- reprinted here
>with his permission.
>
>He did a "traceroute" of two messages that he sent from his machine in
>Switzerland ...




Folks,

I've received ample explanations/corrections to my naive paranoia.

The following will be posted in GovAccess.184, within an hour or two.

Many thanks.

--blushing-jim
Jim Warren, GovAccess list-owner/editor (jwarren at well.com)
Advocate & columnist, MicroTimes, Government Technology, BoardWatch, etc.
345 Swett Rd., Woodside CA 94062; voice/415-851-7075; fax/<# upon request>

[puffery:  John Dvorak Lifetime Achievement Award (1995); James Madison
Freedom-of-Information Award, Soc. of Professional Journalists - Nor.Cal.
(1994); Hugh Hefner First-Amendment Award, Playboy Foundation (1994);
Pioneer Award, Electronic Frontier Foundation (its first year, 1992);
founded the Computers, Freedom & Privacy confs, InfoWorld; blah blah blah :-).]

=== EXPLANATION OF WHAT GOVACCESS IS & WHERE TO FIND ITS ARCHIVES ===

GovAccess is a list distributing irregular info & advocacy regarding
technology and civil liberties, citizen access to government - and
government access to citizens, covert and overt.

To add or drop GovAccess, email to  Majordomo at well.com  ('Subject' ignored)
with message:  [un]subscribe GovAccess YourEmailAddress (insert your eaddr)
For brief description of GovAccess, send the message:  info GovAccess





===this will be posted in GovAccess.184===

Enlightenment Regarding European Net Traffic Flowing Through Numbered Sites

If I'm gonna let my net-surveillance paranoias burn brightly, I better
learn more about the technology.  Which is to say, I goofed:

In #183, yesterday eve, I flamed forth about how a friend traced his
messages from Switzerland to San Jose CA and to Israel -- and discovered
that they "went through an unnamed site -- 134.222.9.1 and then a
strangely-named site, "lp (134.222.35.2)" -- then through the same Vienna,
Virginia (USA) site ... and thereafter, on to their destination."

With beady eye and suspicious mind, I then entoned, "Now let me see ...
which spy agencies are located in or near Virginia?"


Well, half a dozen net-*literate* technoids quickly corrected the errors of
my ways:

>Date: Sun, 5 Nov 1995 08:25:17 +0100
>Subject: GA183 booboo
>To: jwarren at well.com
>From: nobody at REPLAY.COM (Anonymous)   [apparently an anonymous remailer --jim]
>Organization: RePLaY aND CoMPaNY UnLimited
>XComm: Replay may or may not approve of the content of this posting
>XComm: Report misuse of this automated service to <postmaster at REPLAY.COM>
>
>Jim--
>      Great work, but you've got to be more careful. ...
>
>I ran it by Cypherpunks and, within a half-hour, got ... [among others] ...
>
>From: Richard Huddleston <reh at wam.umd.edu>
>Date: Sun, 5 Nov 1995 01:55:09 -0500
>To: cypherpunks at toad.com, nobody at REPLAY.COM
>Subject: Re: lp (134.222.35.2)?
>Sender: owner-cypherpunks at toad.com
>
>134.222.0.0 is a Class B network, so if you do 'whois' on 134.222.0.0
>(instead of the individual IP addresses) you find:
>
>European Unix Users Group (NET-EUNET-X25)
>   Kruislaan 413
>   NL-1098 SJ Amsterdam
>   NETHERLANDS
>...

and

>X-Pgp-Fingerprint: 01107BAB1C85F1B49358D98FEAD4339E
>Date: Sat, 4 Nov 1995 23:01:42 -0800
>To: cypherpunks at toad.com
>From: Stephan Somogyi <somogyi at digmedia.com>
>...
>>>  Now let me see ... which spy agencies are located in or near Virginia?
>
>Oh please.
>
>The probable reason that the InterNIC doesn't know about the
>132.222.0.0 networks is because they're in Europe. If you search for
>either of the network numbers of the IP addresses mentioned above in
>the RIPE database <http://www.ripe.net/>, you will find that they
>belong to the EUnet backbone.
>
>After pinging 134.222.9.1 successfully, I telnetted to it and it
>claimed, quite plausibly, that it's a device (presumably a router) in
>Amsterdam. I am currently unable to ping 134.222.35.2; this, however,
>fills me with no dread whatsoever.
>
>Stephan Somogyi               Senior Editor               Digital Media

and

>Date: Sun, 05 Nov 1995 13:42:55 -0800
>From: John Fricker <jfricker at vertexgrp.com>
>Subject: Return of Paranoia and Vienna
>
>Using nslookup to reverse resolve 134.222.15.2 reveals it to be
>"Oslo1.NO.EU.net" and 134.222.9.1 to be "Amsterdam4.NL.EU.net".
>
>Now this doesn't mean they are not nefarious, packet sniffing spy-boxes
>since I doubt the spooks would name their routers
>"cloak-and-dagger1.cia.gov".
>
>It still is strange that it is cheaper for UUnet/EUnet to route traffic
>across the Atlantic to get to Isreal instead of developping a continental
>backbone. In many ways the architecture of the Internet is still rather
>primitive.
>
>john fricker
>dir research and development
>The Vertex Group, Inc.

followed by

>Date: Sun, 05 Nov 1995 13:23:06 -0800
>From: John Fricker <jfricker at vertexgrp.com>
>Subject: Paranoia and Vienna
>
>Now, Jim I think you're a touch paranoid here. And after reading the
>latest about the FBI wire tap bill I don't blame you ;)
>
>134.222.0.0 is in the EU domain so most likely both of those routers are
>European. The packets then went into UU Net Technologies Vienna hub. I did
>a traceroute from me to 193.8.230.64 and went through two EU.net routers
>in Vienna, VA. Vienna must be one fiberous town! Sure would make for a
>nice little listening post for nosy ears. I don't know off hand the
>relationship between EUnet and UUnet but I would guess that they are more
>than just friendly. Microsoft bought a minority interest in UUnet which
>inspired UUnet to grow rapidly. (Now there's another tidbit for paranoia!)

===

Oh ... sez I <blusing>.


So the remaining question was -- why would a msg from Switzerland go
through Alternet in Virginia on its way to Israel?  I asked several of the
[many] folks who enlightened me re the numbered sites, and within minutes,
got back:

>From: Tim Pozar <pozar at kumr.lns.com>
>Date: Sun, 5 Nov 1995 11:28:44 -0800 (PST)
>
>...
>> So the only remaining question is ... why should a Swizz msg go thru
>> Alternet in Virginia in order to get to Israel?
>
>A number of links go through there.  Most of this is tied up with
>politics and policies with the links that go over to Europe and
>little to do with the NSA. ...

Which leaves me without any inflamatory paranoia at all ... except to
wonder about those "politics and policies" that cause traffic from and to
European sites to flow through a site near the NSA and CIA.

===

To which, I just received this additional response -- email traffic's hot
'n' heavy (sender prefers to be anon :-):

Almost certainly just a matter of available capacity or administrative
issues.  There may be higher bandwidth routes available from both of those
points to the U.S., rather than directly to each other, so the traffic is
routed that way.  There are often administrative issues too--that is,
sometimes the direct routes are controlled by some company or group to which
a different net doesn't subscribe, and they have to route differently,
through entities that they both subscribe to or have agreements with (e.g.
Alternet).  This happens a bunch in Europe (and here for that matter--it's
part of the reason that some traffic from L.A. to S.F. used to route through
Atlanta or NY or similar places--and still can (depending on the service
providers).  The topology of the net is "logically" sensible, but not
necessarily geographically so...


--spooky jim, who can't tell a carburator from a crankshaft, net-wise


&&&&&&&&&&&&&&&&&&&&


Net Police, Take Note:  Net is the Fastest Self-Correcting Human System I Know

On the upside of the above notes is that they [again] illustrate how
quickly the net corrects erroneous postings -- which is my answer to all
those who howl for censorship or content-control of the net, "because it
distributes incorrect information."

It does -- but it also distributes, uh, "vigorous" corrections to any iota
of intended or naive imperfection in a posting, at least to the extent that
such postings receive significant circulation on the net.  (And if they
don't, then they are little different than the erroneous information that
people exchange by voice and phone, every day.)

And woe be unto the reputation of anyone who appears to have posted
*intentionally* incorrect or biased-incomplete information -- who get
vigorously torched in the process of getting corrected.  :-)

I think it was John Perry Barlow who observed that, the best way to get a
question answered on the net, was to post it in the form of an erroneous
statement.

--jim