Researchers determine where Canadian data transfers increase exposure to US state surveillance

Researchers at the University of Toronto announced today that IXmaps, a visual, interactive database of Internet traffic routes, is now live. The tool, funded by the .CA Community Investment Program, helps Canadians understand how their Internet traffic moves, and how certain traffic routes (known as 'boomerang routes') move data through the United States and into the jurisdiction of the U.S. National Security Agency before returning to Canada.

Key facts

• Canada's Internet infrastructure is intimately linked to U.S. networks. Many of the major Internet providers in Canada have networks that favour north – south connections, pushing Canadian data flows toward key American routing hubs in New York, Chicago, Seattle or California.
• The most popular sites Canadians visit online, such as Google, Facebook, Youtube or Amazon, are based in the United States. When using these services, Canadians likely recognize the fact that their data leaves exclusive Canadian jurisdiction and is exposed to American mass surveillance under such laws as the Patriot Act.
• Canadians may be surprised to learn however that when accessing Canadian sites, even those in the same city, their data often still flows through the United States. IXmaps research has found thousands of Internet traffic routes in which both ends of a data transfer are located in Canada, but the information travels via the U.S. These are known as boomerang routes.
• Exposing private or sensitive data, such as health information, student records, political affiliation, religious beliefs, financial information, controversial viewpoints or intimate communications, to foreign surveillance is highly problematic. Even when sharing relatively innocuous information on social media, Canadians have a right to expect their privacy rights will be respected.
• There are several ways that companies and organizations can work to limit the risk of their customer or client data needlessly moving through the United States. Thanks to investment from the Canadian Internet Registration Authority, there is now a national network of Internet exchange points across Canada that allow Canadian IXPs to peer and exchange Internet data within Canada. Consumers should be aware of and comfortable with their ISP's level of commitment to maintaining data privacy.

Executive quotes

"There is nothing inherently wrong with data moving unencumbered across an interconnected global Internet infrastructure. It is, however, critical that Canadians understand the implications of their data being stored on U.S servers and moving through U.S. jurisdiction. ISPs need to be transparent, privacy protective and accountable custodians of user information in this regard. Internet users should be fully informed consumers and citizens when making choices about their sensitive personal data." —Andrew Clement, University of Toronto

"Internet advocates across Canada have long recognised that truly Canadian Internet infrastructure is the only way to keep Canadians' data under the purview of Canadian laws. At the Canadian Internet Registration Authority we have invested heavily in the east to west backbone of Internet exchanges points required to maintain Canadian Internet traffic routes." —Jacques Latour, chief technology officer at the Canadian Internet Registration Authority

"Few Canadians realize just how much of our everyday Internet traffic travels through the U.S. You could be in a restaurant in downtown Montréal emailing your friend across the street, and that data could easily be traveling through the U.S., where it's subject to invasive NSA surveillance. That's why it's so important that Canadians pitch in, and help us learn more about the paths our data actually takes online." —Laura Tribe, Digital Rights Specialist, OpenMedia

Canadians can learn from and contribute to IXmaps

• IXmaps has a crowdsourced database of over 40,000 internet routes, which you can map selectively via the Explore page of the IXmaps.ca website. It is working to expand its database to better represent all regions of Canada and all ISPs. Canadians can contribute to this research to help better understand how different regions, ISPs, and websites, influence the routes that our data takes online and the hence the privacy risks they are exposed to.
• Contributing data involves installing the IXmaps Client traceroute generating software built by the IXmaps development team. The software initiates anonymized traceroute requests from your location and shares the results via the Explore page of the IXmaps.ca website.