A First Look into Transnational Routing Detours

Many countries now engage in interference, degradation, blocking, or surveillance of Internet traffic. In response, individuals, organizations, and even entire countries are taking steps to control the geographic regions that their traffic traverses. For example, some countries are building local Internet Exchange Points (IXPs) to prevent domestic traffic from detouring through other countries. Unfortunately, our measurements reveal that many such ongoing efforts are futile, for two reasons: local content is often hosted in foreign countries, and networks within a country often fail to peer with one another. Yet, our work offers hope: we also find that routing traffic through strategically placed relay nodes can reduce transnational routing detours, in the best case, from 85% of studied paths to 38% of studied paths. Based on these findings, we design and implement RAN, a lightweight system that routes a client’s web traffic around specified countries with no modifications to client software (and in many cases with little performance overhead). 1 Problem and Motivation When Internet traffic enters a country, it becomes subject to those countries’ laws. As a result, users have more need than ever to determine—and control—which countries their traffic is traversing. As an increasing number of countries pass laws that facilitate mass surveillance of their citizens [15], governments and citizens are increasingly motivated to divert their Internet traffic from countries that perform surveillance (notably, the United States [4]). Many countries—notably, Brazil—are taking impressive measures to reduce the likelihood that Internet traffic transits the United States [4] including building a 3,500 mile long fiber-optic cable from Fortaleza to Portugal (with no use of American vendors); pressing companies such as Google, Facebook, and Twitter (among others) to store data locally; and switching its dominant email system (Microsoft Outlook) to a state-developed system called Expresso [4]. Brazil is also building Internet Exchange Points (IXPs), now has the largest national ecosystem of public IXPs in the world, and the number of internationally connected ASes continues to grow. Brazil is not alone: IXPs are proliferating in eastern Europe, Africa, and other regions, in part out of a desire to “keep local traffic local”. Building IXPs alone, of course, cannot guarantee that Internet traffic for some service does not enter or transit a particular country: Internet protocols have no notion of national borders, and interdomain paths depend in large part on existing interconnection business relationships (or lack thereof). Defending against these activities requires not only encryption, but also mechanisms for controlling where traffic goes in the first place: end-to-end encryption conceals some information content, but it does not protect all sensitive information. First, many websites do not fully support encrypted browsing by default; a recent study showed that more than 85% of the most popular health, news, and shopping sites do not encrypt by default [21]; migrating a website to HTTPS can be challenging, and doing so requires all third-party domains on the site (including advertisers) to use HTTPS. Second, even encrypted traffic may still reveal a lot about user behavior: the presence of any communication at all may be revealing, and website fingerprinting can reveal information about content merely based on the size, content, and location of third-party resources that a client loads [11]. DNS traffic is also revealing and is almost never encrypted [21]. Third, ISPs often terminate TLS connections, conducting man-in-the-middle attacks on encrypted traffic for network management purposes [8]. And, of course, encryption offers no solution to interference, degradation, or blocking of traffic that a country might perform on traffic that crosses its borders. Finally, a nation-state may collect and store encrypted traffic; if the encryption is broken in the future, a nation-state may be able to discover the contents of previous communications. Our work tackles two questions: (1) Which countries do default Internet routing paths traverse? ; (2) What types of methods can we use to take advantage of hosting and path diversity to help governments and citizens better control transnational Internet paths? Previous work has analyzed Border Gateway Protocol (BGP) routes [12, 20], but these provide an indirect estimate of country-level paths at best. Although BGP routing can offer some information about paths, it does not necessarily reflect the path that traffic actually takes, and it only provides Autonomous System (AS) -level granularity, which is often too coarse to make strong statements about which countries that traffic is traversing. We take a different approach and actively measure direct paths to popular websites to characterize the current state of transnational routing detours.1 Next, we explore the extent to which a network of overlay relays could help clients avoid certain countries to popular destinations. Due to promising measurement results, we design, 1This work was partially published in [6]. implement, and deploy RAN, a system that allows a client to access web content while avoiding the traversal of a specified country.2 We evaluate RAN to assess its ability to avoid certain countries, as well as the effect on end-to-end performance. 2 Background and Related Work Nation-state routing analysis. Shah and Papadopoulos recently measured international routing detours—paths that originate in one country, cross international borders, and then return to the original country—using public Border Gateway Protocol (BGP) routing tables [20]. The study discovered 2 million detours each month out of 7 billion paths. Our work differs by actively measuring traceroutes, yielding a more precise measurement of the paths, as opposed to analyzing BGP routes. Obar and Clement analyzed traceroutes that started and ended in Canada, but tromboned through the United States, and argued that this is a violation of Canadian network sovereignty [17]. Karlin et al. developed a framework for country-level routing analysis to study how much influence each country has over interdomain routing [12]. This work measures country centrality using BGP routes and AS-path inference; in contrast, our work uses active measurements and measures avoidability of a given country. Several studies have also characterized network paths within a country [3, 7, 9]; these studies focus on intra-country paths, as opposed to focusing on transnational paths. Routing overlays and Internet architectures. Alibi Routing uses round-trip times to prove that that a client’s packets did not traverse a forbidden country or region [13]; our work differs by measuring which countries a client’s packets would (and do) traverse. Our work then uses active measurements to determine the best path for a client wishing to connect to a server. RON, Resilient Overlay Network, is an overlay network that routes around failures [2], whereas our overlay network routes around countries. ARROW introduces a model that allows users to route around ISPs [18], but requires ISP participation, making it considerably more difficult to deploy than RAN. ARROW also aims to improve fault-tolerance, robustness, and security, rather than explicitly attempting to avoid certain countries; ARROW provides mechanisms to avoid individual ISPs, but such a mechanism is at a different level of granularity, because an ISP may span multiple countries. Zhang et al. presented SCION, a “clean-slate” Internet architecture that provides route control, failure isolation, and explicit trust information for communication [22]; SCION, however, requires fundamental changes to the Internet architecture, whereas RAN is deployable today. Circumvention systems. Certain tools, such as anonymous communications systems or virtual private networks, may use a combination of encryption and overlay routing to allow clients to avoid surveillance. Tor is an anonymity system that uses three relays and layered encryption to allow users to communicate anonymously [5]. In contrast, RAN does not aim to achieve anonymity; instead, its aim is to ensure that traffic 2This work is under submission. does not traverse a specific country, a goal that Tor cannot achieve. Even tools like Tor do not inherently thwart surveillance: Tor is vulnerable to traffic correlation attacks and some attacks are possible even on encrypted user traffic. VPNGate is a public VPN relay system aimed at circumventing national firewalls [16]. Unfortunately, VPNGate does not allow a client to choose any available VPN, which makes it more difficult for a user to ensure that traffic avoids a particular part of the Internet. Neither of these systems explicitly avoid countries; thus, they may not be able to avoid surveillance or the laws or jurisdiction of a particular country. 3 Approach and Uniqueness Here we discuss our measurement approach to characterize transnational routing detours (Section 3.1), as well as our approach to measuring how avoidable different countries are relative to where a client is located (Section 3.2). Lastly, we introduce RAN, which employs an overlay network to provide end-users some control over which countries their Internet paths traverse (Section 3.3). All results for these measurements are presented in Section 4. Our analysis focuses on five countries of interest—Brazil, Netherlands, Kenya, India, and the United States—for a variety of reasons. For example, Brazil has made a concerted effort to avoid traversing certain countries such as the United States through extensive buildout of Internet Exchange Points (IXPs). The Netherlands has one of the world’s largest IXPs and relatively inexpensive hosting. Kenya is one of the most well-connected African countries, but it is still thought to rely on connectivity through Europe and North America for many des