How many NSA spy hubs are scooping up your Internet data? I counted 7

A couple of years ago, when I was investigating the UK's safest ISP, a high-ranking employee at Virgin Media told me there was no NSA or GCHQ Internet traffic interception equipment hiding within Virgin's network. He also said that, in his opinion, not much traffic interception actually occurs in the UK. I asked him why. "Because they don't need to. They'll get your data when it lands in the US."

While it's not true that all Internet traffic flows through the US, the addition of a few listening posts at key Internet exchanges in Europe (London, Paris) and some in Asia (Hong Kong, Tokyo) ensure that the NSA and its Five Eyes partners can analyse and ingest the majority of international Internet traffic.

To visualise the extent of the NSA's surveillance network, IXmaps is hosting a tool that shows you the location of suspected Internet traffic interception points. You can input your own traceroute data, or if you're in a rush you can just bring up traceroute data from people living in the same city or using the same ISP. Then click the "layers" button and turn on NSA, AT&T/Fairview, and Verizon/Stormbrew.

Most of the suspected surveillance sites come from Edward Snowden's leak of NSA documents in 2013, including the image you see below. The blue dots, which appear to all be at submarine cable landing sites, are the most important: Internet traffic can take many different routes across a country, but there are only a handful of submarine trunk links that most international traffic traverses.

The AT&T and Verizon interception sites, which are primarily located in the US but also throughout the rest of the world, have been rumoured to exist for years, but were allegedly confirmed as part of the NSA's sigint (signals intelligence) system by the Snowden trove.

IXmaps also shows how data often takes an unexpected path across the Internet. For example, for a Canadian Internet user, even if the server you're trying to reach is also in Canada, almost every packet of data "boomerangs" through the US. This is mostly because the shortest path isn't always the cheapest: if two ISPs in Canada don't have a peering deal, the data might flow out to the nearest US ISP where there is a peering deal in place.

And indeed, that is actually the main reason for this map's existence in the first place: it was created by Andrew Clement and other Canadian researchers, with support from OpenMedia, and funded by the Canadian Internet Registration Authority (CIRA) and the Office of the Privacy Commissioner of Canada, to highlight Canada's lack of digital sovereignty.

OpenMedia proposes a few ways of improving the situation, such as building up domestic infrastructure (i.e. more Internet exchanges inside the country) and more Canada-owned backhaul capacity. Neither of those options would be cheap, of course.

Here in Europe we're approaching things a little differently, with increasingly strict rules on the flow of personal data across the Internet. One of the reasons that so much European data ends up in the US is because the Googles and Amazons of the world have most of their data centres over there. That should change as more data centres are built in Europe.