Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update isp-netflow-surveillance-and-vpn.md #805

Merged
merged 1 commit into from
Jul 24, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ If your VPN service provider is located in a different part of the puzzle than y

## Worldwide NetFlow database

Unfortunately, a 2022 [article from Vice][Augury] has reveled that a US-based private company has been collecting NetFlow exports from many ISPs worldwide in exchange for Threat Intelligence analysis. The number of involved ISPs suggests that, from the article, it may represent roughly ninety percent of the global Internet traffic. Information about [Team Cymru][cymru], the company that sells access to the consolidated NetFlows database, remains limited. It was found that their website contains a list of [facts and myths][cymru_facts] about their services, though their claims cannot be verified. Nevertheless, it is evident that they are working on NetFlow aggregation.
Unfortunately, a 2022 [article from Vice][Augury] has revealed that a US-based private company has been collecting NetFlow exports from many ISPs worldwide in exchange for Threat Intelligence analysis. The number of involved ISPs suggests that, from the article, it may represent roughly ninety percent of the global Internet traffic. Information about [Team Cymru][cymru], the company that sells access to the consolidated NetFlows database, remains limited. It was found that their website contains a list of [facts and myths][cymru_facts] about their services, though their claims cannot be verified. Nevertheless, it is evident that they are working on NetFlow aggregation.

Using the puzzle analogy again, Team Cymru has access to most of the puzzle pieces. While a single piece doesn't hold enough information in the context of using a VPN, having many of them could potentially expose your Internet usage **if they receive NetFlow exports from both your ISP and your VPN provider ISP**. For example, traffic correlation using the packets timing becomes a lot easier when you know the delay between the user and their VPN provider acting as a proxy.

Expand All @@ -68,7 +68,7 @@ In 2024, the NSA [stated to a senator][senate] that they were buying NetFlow exp

It is not possible to say which ISP shares their NetFlow data.

For European based ISPs, the [GDPR][gdpr] compliance dictates that personal data should not be shared. It is not our place to discuss if NetFlow datasets qualify as are personal data, but GDPR compliance implies that ISPs must not permit any third party to associate a NetFlow export with personal information such as names, addresses or, phone numbers.
For European based ISPs, the [GDPR][gdpr] compliance dictates that personal data should not be shared. It is not our place to discuss if NetFlow datasets qualify as our personal data, but GDPR compliance implies that ISPs must not permit any third party to associate a NetFlow export with personal information such as names, addresses, or phone numbers.

Two possibilities exist regarding NetFlow exports:

Expand All @@ -81,11 +81,11 @@ In the second case, the network activity would be much more specific: [identifie

## Possible mitigation

With someone able to view most of the global Internet traffic, as previously mentioned, a VPN alone would be insufficient to protect your privacy. Does it render VPNs useless? VPNs are effective at protecting against data snooping while using public networks, bypassing firewalls or preventing your ISP to know what you use Internet for, but its efficacy can be limited against a state-level actor.
With someone able to view most of the global Internet traffic, as previously mentioned, a VPN alone would be insufficient to protect your privacy. Does it render VPNs useless? VPNs are effective at protecting against data snooping while using public networks, bypassing firewalls or preventing your ISP from knowing what you use the Internet for, but its efficacy can be limited against a state-level actor.

In the worst case scenario of a NetFlow analysis, the data passing through the VPN remains encrypted and unusable, but it may be possible to reveal to which servers you connected, the protocol you used (HTTPS, emails etc.) and maybe infer visited websites.

However, using a VPN service offering multiple hops passing through different countries/ISPs can still protect your privacy, but only if the ISPs do not all share their NetFlow data. In order to increase the NetFlow analysis resistance, at the cost of both higher latency and reduced bandwidth, it's possible to chain multiple VPNs from different VPN providers, but at the condition that the VPN providers are trustworthy and that their servers aren't all part of the NetFlow exports.
However, using a VPN service offering multiple hops passing through different countries/ISPs can still protect your privacy, but only if the ISPs do not all share their NetFlow data. In order to increase the NetFlow analysis resistance, at the cost of both higher latency and reduced bandwidth, it's possible to chain multiple VPNs from different VPN providers, but on the condition that the VPN providers are trustworthy and that their servers aren't all part of the NetFlow exports.

To protect your privacy efficiently, it's important that you [define your threat model][threat_model] and check if it suits your needs.

Expand Down
Loading