# Quantifying Information Exposure in Internet Routing

## TL;DR

This paper evaluates how much information about Internet communications is exposed across countries by analyzing routing data, revealing high exposure levels and a tradeoff between robustness and privacy.

## Contribution

It introduces a comprehensive measurement approach using public data to quantify international information exposure in Internet routing.

## Key findings

- High levels of information exposure across countries.
- Physically adjacent countries often use routes involving many other nations.
- Well-connected countries tend to have higher exposure.

## Abstract

Data sent over the Internet can be monitored and manipulated by intermediate entities in the data path from the source to the destination. For unencrypted communications (and some encrypted communications with known weaknesses), eavesdropping and man-in-the-middle attacks are possible. For encrypted communication, the identification of the communicating endpoints is still revealed. In addition, encrypted communications may be stored until such time as newly discovered weaknesses in the encryption algorithm or advances in computer hardware render them readable by attackers. In this work, we use public data to evaluate both advertised and observed routes through the Internet and measure the extent to which communications between pairs of countries are exposed to other countries. We use both physical router geolocation as well as the country of registration of the companies owning each router. We find a high level of information exposure; even physically adjacent countries use routes that involve many other countries. We also found that countries that are well `connected' tend to be more exposed. Our analysis indicates that there exists a tradeoff between robustness and information exposure in the current Internet.