# Schengen Routing: A Compliance Analysis

Daniel Dönni, Guilherme Sperb Machado, Christos Tsiaras, Burkhard Stiller

► To cite this version:

Daniel Dönni, Guilherme Sperb Machado, Christos Tsiaras, Burkhard Stiller. Schengen Routing: A Compliance Analysis. 9th Autonomous Infrastructure, Management, and Security (AIMS), Jun 2015, Ghent, Belgium. pp.100-112, 10.1007/978-3-319-20034-7_11. hal-01410156

HAL Id: hal-01410156

https://hal.science/hal-01410156

Submitted on 6 Dec 2016

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Schengen Routing: A Compliance Analysis

Daniel Dönni, Guilherme Sperb Machado,
Christos Tsiaras, Burkhard Stiller

University of Zurich, Department of Informatics,
Binzmühlestrasse 14, CH-8050 Zurich, Switzerland
doenni|machado|tsiaras|stiller@ifi.uzh.ch

**Abstract.** Schengen Routing was proposed as a countermeasure to traffic monitoring activities practiced by intelligence agencies. This work here presents the results of a larger-scale measurement performed to quantify Schengen Routing compliance in today's Internet. Based on 3388 TCP, UDP, and ICMP traceroute measurements executed from RIPE Atlas probes located in over 1100 different Autonomous Systems (AS) in the Schengen Area, it was found that 34.5% to 39.7% of these routes are Schengen-compliant, while compliance levels vary from 0% to 80% among countries. Finally, an approach was developed that allows end-users to determine whether a specific route to a host is Schengen-compliant or not.

**Keywords:** Schengen Routing, Geo-location, Compliance checks

## 1 Introduction

The affair involving Edward Snowden and the National Security Agency (NSA) in 2013 demonstrated that wiretapping large amounts of Internet traffic data was not only possible, but also applied on a regular basis by various intelligence agencies in violation of privacy laws [13]. However, the controversy only came into broader political debate by the time it was alleged that several European state heads had become victims of the wiretapping activities themselves [2].

In the context of the political and technical debate that followed, the idea of *Schengen Routing* demonstrated to be a possible amendment to protect communications across Europe. The term *Schengen* refers to the treaty targeted at reducing border controls and implementing a harmonized legal framework [9]. Those countries, who signed the Schengen Treaty, form the Schengen Area. Table 1 shows the current Schengen members. It is important to highlight that the Schengen Area is not equivalent to the European Union (EU), since some countries belonging to the EU are not part of Schengen (e.g., United Kingdom), while Schengen also comprises non-EU countries (e.g., Switzerland).

Schengen Routing refers to the practice of routing Internet traffic between hosts located in the Schengen Area, not leaving the borders of countries part of the Schengen Treaty. Such Internet traffic not leaving the Schengen Area is more difficult to be wiretapped by non-Schengen intelligence agencies, since
<table><caption>**Table 1.** Schengen members as of January 2015</caption><thead><tr><td>Country Code</td><td>Country Name</td><td>Country Code</td><td>Country Name</td></tr></thead><tbody><tr><td>AT</td><td>Austria</td><td>IT</td><td>Italy</td></tr><tr><td>BE</td><td>Belgium</td><td>LI</td><td>Liechtenstein</td></tr><tr><td>CH</td><td>Switzerland</td><td>LT</td><td>Lithuania</td></tr><tr><td>CZ</td><td>Czech Republic</td><td>LU</td><td>Luxemburg</td></tr><tr><td>DE</td><td>Germany</td><td>LV</td><td>Latvia</td></tr><tr><td>DK</td><td>Denmark</td><td>MT</td><td>Malta</td></tr><tr><td>EE</td><td>Estonia</td><td>NL</td><td>Netherlands</td></tr><tr><td>ES</td><td>Spain</td><td>NO</td><td>Norway</td></tr><tr><td>FI</td><td>Finland</td><td>PL</td><td>Poland</td></tr><tr><td>FR</td><td>France</td><td>PT</td><td>Portugal</td></tr><tr><td>GR</td><td>Greece</td><td>SE</td><td>Sweden</td></tr><tr><td>HU</td><td>Hungary</td><td>SI</td><td>Slovenia</td></tr><tr><td>IS</td><td>Island</td><td>SK</td><td>Slovakia</td></tr></tbody></table>

the Internet traffic remains still unencrypted. However, this traffic remains still vulnerable to wiretapping activities that may occur within Schengen [16].

An implementation of Schengen routing requires the reconfiguration of routing tables and the renegotiation of transit and peering agreements. The effort required depends significantly on the degree to which current routing already complies with Schengen routing or not. However, there is no previous work available, which measured a Schengen routing compliance through active measurements by analyzing TCP, ICMP, and UDP traffic. Thus, this paper answers the following question: What is the Schengen routing compliance or non-compliance percentage of current traffic among Schengen countries based on the observation of active measurements?

For that a large number of traceroute measurements was executed by applying RIPE Atlas [17] probes located in Autonomous Systems (AS) within Schengen to a well-known host in Switzerland, being part of the Schengen Area. ASes were chosen as the unit of analysis, because ASes are collections of network devices managed by a single administrative authority that can decide to cooperate with government agencies or not. IP addresses of nodes along a network path can be determined by using the traceroute tool. By means of a database, such as GeoLite [10], IP addresses obtained can be related to ASes and countries and, thus, placed in- or outside Schengen. Next to these measurements, a tool termed chkroute has been developed, allowing end-users to find out whether specific routes are Schengen-compliant.

This paper is structured as follows. Section 2 presents related work. The approach applied and evaluations performed are described in Sections 3 and 4, respectively. Section 5 presents the chkroute tool developed. Finally, Section 6 summarizes the work, draws conclusions, and outlines future steps.
## 2 Related Work

The most detailed work analyzing routes leaving the Schengen Area was performed by [16]. Publicly accessible BGP routing tables were obtained and, based on BGP routing entries, a graph of ASes was generated. Based on these graphs, traffic routes were established and analyzed to assess whether traffic between two peers within the Schengen Area would leave the area, thus, pointing on non-compliant Schengen Area routes. It was assumed that an AS belongs to a particular country, if the majority of its allocated Internet Protocol (IP) address space is bound to that country. Therefore, if an AS hosts IP addresses used in countries X, Y, and Z, but more than 50% is allocated to country X, the AS is considered to be located in country X. Such an assumption simplifies the full process of binding ASes to particular countries. However, it may present non-realistic results, since some ASes can present logical connections to several countries that not necessarily reflect the true country of origin of such an AS [19]. Those results show that, e.g., in Belgium, Switzerland, and Spain, more than one third of available routes are operating via ASes located outside the respective country. It is further found that the number of routes leaving the Schengen Area substantially varies among countries, e.g., 0% in Iceland and 35.38% in Belgium.

Another approach analyzed the content of BGP routing tables [12]. The respective outcomes are beneficial due to 3 reasons:

1. BGP looking glasses are servers running specific software designed to retrieve routing information. These servers are found in a considerable number of strategic ASes around the globe.

2. Evaluating BGP routing tables is a passive and, thus, less intrusive approach to form an AS graph.

3. BGP routing tables present a wider view of routing possibilities within each AS.

The major disadvantage of this approach is the lack of certainty that a packet will follow the inferred AS graph to a specific destination as the information may be incomplete or out of date.

Therefore, active measurements involving tools such as, e.g., traceroute, are employed to discover Internet routes that are being used in practice for particular protocols and traffic [3]. Moreover, traceroute measurements are able to (1) reveal multiple routers within an AS and not only an AS-level graph representation, and (2) provide a real time result of the current network hops from source to destination. Thus, Paris traceroute [1] provides a more realistic routing map compared to the classic traceroute tool, solving problems caused by the current vast deployment of load balancers in the Internet. Paris traceroute addresses per-flow load balancers, varying header fields, such as the TCP/ICMP sequence number, the UDP checksum, and the ICMP identifier. The chkroute tool uses Paris traceroute to collect routing information (i.e., IP addresses of network hops) from the source to the destination, and uses the GeoLite database [10] to map IP address ranges to ASes. Table 2 summarizes major characteristics of chkroute and [16] to analyze Schengen Routing compliance.
<table><caption>**Table 2.** Characteristics comparison of approaches analyzing Schengen Routing compliance</caption><thead><tr><th rowspan="2">Approaches</th><th colspan="4">Characteristics</th></tr><tr><th>Based on Active Measurements</th><th>Based on Passive Measurements</th><th>Uses GeoLite Database</th><th>Provide Compliance in Real Time</th></tr></thead><tbody><tr><td>[16]</td><td>no</td><td>yes</td><td>yes</td><td>no</td></tr><tr><td>chkroute</td><td>no</td><td>yes</td><td>yes</td><td>yes</td></tr></tbody></table>

A major disadvantage of Schengen routing is that Internet traffic remains unencrypted. As a consequence, it is still vulnerable to wiretapping activities from within Schengen. A wide-spread use of end-to-end encryption would resolve this issue [16].

# 3 Approach

To measure Schengen routing compliance, a larger-scale measurement has been performed. RIPE Atlas [17] was chosen as a measurement platform due to its high AS coverage. ASes were selected for analysis, because they appear as units controlled by a single administrative entity defining routing policies that has the capability to cooptare with intelligence agencies or not.

## 3.1 Test-bed Selection

To perform real-life measurements at a larger scale, a suitable test-bed is needed. Test-beds had to meet two requirements to be taken into consideration:

1. The test-bed had to be able to run traceroute measurements to retrieve IP addresses of nodes along a routing path.

2. The test-bed had to provide a high AS coverage in the Schengen Area.

Several test-beds could have been used to perform larger-scale measurements: Planet-Lab [15], EMANICSLab [8], Bismark [18], and RIPE Atlas [17].

On one hand, Planet-Lab [15] and EMANICSLab [8] provide administrative access to the machines and, therefore, allow for full control over all aspects of the experiment. On the other hand, the number of ASes currently covered by these test-beds in Europe is lower when compared to RIPE Atlas: EMANICSLab provide nodes in 11 different ASes, while Planet-Lab provides nodes in 69 ASes. In contrast, RIPE Atlas provides 1306 ASes in the Schengen Area alone. Since Planet-Lab and EMANICSLab nodes are predominantly located in academic and
research networks, such a distribution may not necessarily be representative for assessing Schengen routing compliance in the Schengen Internet as a whole [7].

The project Bismark [18] allows researchers to perform measurements from home routers equipped with a modified openWRT firmware [14]. The project cannot be used to study Schengen compliance, since there are only 178 routers globally available, and even less within Schengen as of 2014 [18].

RIPE Atlas is a measurement infrastructure initiated and coordinated by RIPE NCC [17]. According to RIPE's website, "RIPE NCC is building the largest measurement infrastructure ever made" [17]. The RIPE Atlas measurement infrastructure is based on a large number of low-cost measurement nodes given away for free to volunteers willing to host those probes in their private, institutional, or public networks. In exchange for hosting a probe, volunteers get access to measurement statistics and obtain credits that can be traded for running user-defined measurements on the infrastructure. The RIPE Atlas measurement infrastructure provides the best AS coverage by a substantial margin (1306 different ASes in Schengen alone) and was, therefore, chosen for the Schengen routing compliance analysis.

## 3.2 AS Selection

To determine to what extent traffic complies with Schengen Routing, a list of ASes in the Schengen Area had to be selected. Maxmind provides a free geo-location database named GeoLite [10], which maps IP address ranges to ASes and countries. The respective information is provided in two separate files. The first file contains IP address ranges in a long representation along with an AS number (e.g., 5 10 AS1). The second file contains IP address ranges in a long representation along with a country code (e.g., 5 10 CH). Based on this information, the number of IP addresses per AS and country was calculated (e.g., AS1 has 10 - 5 + 1 = 6 IP addresses in CH (Switzerland)). These AS and country ranges did not always match and had to be divided into matching subranges in these cases. The logic for calculating the number of IP addresses per country remained the same. ASes were included in the measurement effort, if they had at least one IP address in a Schengen country. The resulting number of ASes in the Schengen Area was 9967 (cf. Table 3).

<table><caption>**Table 3.** Number of ASes after results processing (T: TCP, U: UDP, I: ICMP)</caption><thead><tr><th rowspan="2">Original</th><th rowspan="2">Not<br>Covered</th><th colspan="3">No Probes</th><th colspan="3">Failed/Error</th><th colspan="3">Outside Schengen</th><th colspan="3">Remaining</th></tr><tr><th>T</th><th>U</th><th>I</th><th>T</th><th>U</th><th>I</th><th>T</th><th>U</th><th>I</th><th>T</th><th>U</th><th>I</th></tr></thead><tbody><tr><td>9967</td><td>8661</td><td>44</td><td>47</td><td>50</td><td>25</td><td>24</td><td>25</td><td>105</td><td>104</td><td>106</td><td>1132</td><td>1131</td><td>1125</td></tr></tbody></table>
## 3.3 Measurement Execution

All traceroute measurements were executed using the RIPE Atlas measurement infrastructure. RIPE Atlas allows to specify an AS number as a measurement source and selects a suitable probe with an IP address within the AS automatically. The target IP address of all traceroute measurements was a machine located within Schengen at the premises of University of Zurich, Switzerland (within AS 559). Measurement requests were submitted for all 9967 ASes determined in Section 3.2 for the ICMP, TCP, and UDP protocol in turn. For each protocol, RIPE Atlas performed three traceroute measurements automatically.

These measurements were limited to one target host and three traceroute measurements per protocol because the number of measurements that can be performed on RIPE Atlas is limited by the credit earned by the respective volunteer.

## 3.4 Results Processing

All results obtained from these measurements were processed in several steps (see Table 3).

1. Measurement requests were submitted for 9967 ASes, out of which 8661 ASes were not covered by RIPE Atlas. They could, therefore, not be taken into consideration.

2. RIPE Atlas could not find suitable probing devices in all ASes covered. These ASes could not be taken into consideration.

3. Some measurements failed or produced invalid results (e.g., error messages rather than measurement data) and were excluded.

4. ASes may have IP address ranges advertised in several countries, especially in ASes with large number of IP address subnets. Because RIPE Atlas chooses IP addresses within the AS at its discretion, an IP address outside the Schengen Area may be selected. Measurements executed from probes having IP addresses located outside the Schengen Area were excluded.

After this results processing, 1132 TCP, 1131 UDP, and 1125 ICMP valid measurements remained for an evaluation. The unprocessed traceroute files obtained from RIPE Atlas measurements have been made publically available [5].

# 4 Evaluation

These results obtained were classified with respect to Schengen routing compliance as follows:

1. Measurements containing at least one IP address located outside the Schengen Area were classified as "Non-compliant" (NC).

2. Measurements containing only IP addresses inside the Schengen Area were classified as "Compliant" (C).
3. Measurements containing IP addresses for which no country information was available or for which traceroute did not produce an IP address were classified as "Unknown" (U), if all other IP addresses were located within Schengen and "Non-Compliant" otherwise

To determine the geographic location of an IP address, Maxmind's GeoLite database [10] was used, the same database as was used for the AS selection process described in Section 3.2. Figure 1 provides an overview of those results found. Light gray shades represent higher Schengen routing compliance levels while dark gray shades stand for lower compliance levels.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Schengen routing compliance levels</figcaption></figure>

All detailed results are shown in Table 4. The “R” column ranks the Schen-
gen countries – represented by their ISO code – according to the relative amount
of compliant TCP routes. TCP was chosen for ranking, since it is the most fre-
quently used transport protocol in the Internet as of today. The “ASes” column
represents the number of ASes for which traceroute measurements have been per-
formed. “T” represents the total number of measurements that were performed
for the respective country and protocol. “C”, “NC”, and “U” show the amount
of routes that were compliant, non-compliant, and unknown, respectively. For
each of these categories the absolute and relative values are provided.

**4.1 Results Analysis**

This section discusses the results presented in Table 4, providing insight into
compliant, non-compliant, and unknown routes.
<table><caption>Table 4. Schengen Routing compliance analysis</caption><thead><tr><th rowspan="2">R</th><th rowspan="2">ISO</th><th colspan="3">TCP</th><th colspan="3">UDP</th><th colspan="3">ICMP</th></tr><tr><th>ASes</th><th>T</th><th>CC (%)</th><th>NC NC (%)</th><th>UU (%)</th><th>ASes</th><th>T</th><th>CC (%)</th><th>NC NC (%)</th><th>UU (%)</th></tr></thead><tbody><tr><td>1</td><td>LI</td><td>5</td><td>15</td><td>12</td><td>80.0%</td><td>0</td><td>0.0%</td><td>3</td><td>20.0%</td><td>4</td><td>12</td><td>9</td><td>75.0%</td><td>3</td><td>25.0%</td><td>0</td><td>0.0%</td></tr><tr><td>2</td><td>NL</td><td>88</td><td>264</td><td>148</td><td>56.1%</td><td>51</td><td>19.3%</td><td>65</td><td>24.6%</td><td>88</td><td>264</td><td>165</td><td>62.5%</td><td>65</td><td>24.6%</td><td>34</td><td>12.9%</td></tr><tr><td>3</td><td>CH</td><td>66</td><td>198</td><td>102</td><td>51.5%</td><td>30</td><td>15.2%</td><td>66</td><td>33.3%</td><td>67</td><td>201</td><td>126</td><td>62.7%</td><td>39</td><td>19.4%</td><td>36</td><td>17.9%</td></tr><tr><td>4</td><td>AT</td><td>56</td><td>168</td><td>79</td><td>47.0%</td><td>42</td><td>25.0%</td><td>47</td><td>28.0%</td><td>56</td><td>168</td><td>77</td><td>45.8%</td><td>59</td><td>35.1%</td><td>32</td><td>19.0%</td></tr><tr><td>5</td><td>DE</td><td>192</td><td>576</td><td>253</td><td>43.9%</td><td>187</td><td>32.5%</td><td>136</td><td>23.6%</td><td>189</td><td>567</td><td>266</td><td>46.9%</td><td>198</td><td>34.9%</td><td>103</td><td>18.2%</td></tr><tr><td>6</td><td>FR</td><td>115</td><td>345</td><td>143</td><td>41.4%</td><td>91</td><td>26.4%</td><td>111</td><td>32.2%</td><td>117</td><td>351</td><td>155</td><td>44.2%</td><td>94</td><td>26.8%</td><td>102</td><td>29.1%</td></tr><tr><td>7</td><td>HU</td><td>20</td><td>60</td><td>24</td><td>40.0%</td><td>23</td><td>38.3%</td><td>13</td><td>21.7%</td><td>21</td><td>63</td><td>28</td><td>44.4%</td><td>26</td><td>41.3%</td><td>9</td><td>14.3%</td></tr><tr><td>8</td><td>CZ</td><td>81</td><td>243</td><td>90</td><td>37.0%</td><td>76</td><td>31.3%</td><td>77</td><td>31.7%</td><td>80</td><td>240</td><td>91</td><td>37.9%</td><td>83</td><td>34.6%</td><td>66</td><td>27.5%</td></tr><tr><td>9</td><td>DK</td><td>38</td><td>114</td><td>42</td><td>36.8%</td><td>30</td><td>26.3%</td><td>42</td><td>36.8%</td><td>38</td><td>114</td><td>53</td><td>46.5%</td><td>33</td><td>28.9%</td><td>28</td><td>24.6%</td></tr><tr><td>10</td><td>LT</td><td>11</td><td>33</td><td>12</td><td>36.4%</td><td>12</td><td>36.4%</td><td>9</td><td>27.3%</td><td>11</td><td>33</td><td>13</td><td>39.4%</td><td>11</td><td>33.3%</td><td>9</td><td>27.3%</td></tr><tr><td>11</td><td>PL</td><td>78</td><td>234</td><td>81</td><td>34.6%</td><td>96</td><td>41.0%</td><td>57</td><td>24.4%</td><td>78</td><td>234</td><td>73</td><td>31.2%</td><td>108</td><td>46.2%</td><td>53</td><td>22.6%</td></tr><tr><td>12</td><td>LU</td><td>19</td><td>57</td><td>18</td><td>31.6%</td><td>27</td><td>47.4%</td><td>12</td><td>21.1%</td><td>19</td><td>57</td><td>15</td><td>26.3%</td><td>30</td><td>52.6%</td><td>12</td><td>21.1%</td></tr><tr><td>13</td><td>SK</td><td>13</td><td>39</td><td>12</td><td>30.8%</td><td>13</td><td>33.3%</td><td>14</td><td>35.9%</td><td>13</td><td>39</td><td>12</td><td>30.8%</td><td>16</td><td>41.0%</td><td>11</td><td>28.2%</td></tr><tr><td>14</td><td>SE</td><td>58</td><td>174</td><td>41</td><td>23.6%</td><td>53</td><td>30.5%</td><td>80</td><td>46.0%</td><td>58</td><td>174</td><td>72</td><td>41.4%</td><td>63</td><td>36.2%</td><td>39</td><td>22.4%</td></tr><tr><td>15</td><td>IT</td><td>70</td><td>210</td><td>39</td><td>18.6%</td><td>66</td><td>31.4%</td><td>105</td><td>50.0%</td><td>70</td><td>210</td><td>43</td><td>20.5%</td><td>78</td><td>37.1%</td><td>89</td><td>42.4%</td></tr><tr><td>16</td><td>NO</td><td>41</td><td>123</td><td>21</td><td>17.1%</td><td>51</td><td>41.5%</td><td>51</td><td>41.5%</td><td>41</td><td>123</td><td>17</td><td>13.8%</td><td>65</td><td>52.8%</td><td>41</td><td>33.3%</td></tr><tr><td>17</td><td>GR</td><td>24</td><td>72</td><td>12</td><td>16.7%</td><td>44</td><td>61.1%</td><td>16</td><td>22.2%</td><td>24</td><td>72</td><td>12</td><td>16.7%</td><td>40</td><td>55.6%</td><td>20</td><td>27.8%</td></tr><tr><td>IS</td><td></td><td>6</td><td>18</td><td>3</td><td>16.7%</td><td>7</td><td>38.9%</td><td>8</td><td>44.4%</td><td>6</td><td>18</td><td>3</td><td>16.7%</td><td>9</td><td>50.0%</td><td>6</td><td>33.3%</td></tr><tr><td>19</td><td>LV</td><td>13</td><td>39</td><td>6</td><td>15.4%</td><td>24</td><td>61.5%</td><td>9</td><td>23.1%</td><td>13</td><td>39</td><td>3</td><td>7.7%</td><td>29</td><td>74.4%</td><td>7</td><td>17.9%</td></tr><tr><td>20</td><td>BE</td><td>27</td><td>81</td><td>12</td><td>14.8%</td><td>40</td><td>49.4%</td><td>29</td><td>35.8%</td><td>27</td><td>81</td><td>9</td><td>11.1%</td><td>52</td><td>64.2%</td><td>20</td><td>24.7%</td></tr><tr><td>21</td><td>ES</td><td>43</td><td>129</td><td>12</td><td>9.3%</td><td>56</td><td>43.4%</td><td>61</td><td>47.3%</td><td>43</td><td>129</td><td>14</td><td>10.9%</td><td>73</td><td>56.6%</td><td>42</td><td>32.6%</td></tr><tr><td>22</td><td>SI</td><td>16</td><td>48</td><td>4</td><td>8.3%</td><td>28</td><td>58.3%</td><td>16</td><td>33.3%</td><td>15</td><td>45</td><td>6</td><td>13.3%</td><td>35</td><td>77.8%</td><td>4</td><td>8.9%</td></tr><tr><td>23</td><td>PT</td><td>13</td><td>39</td><td>2</td><td>5.1%</td><td>26</td><td>66.7%</td><td>11</td><td>28.2%</td><td>13</td><td>39</td><td>3</td><td>7.7%</td><td>28</td><td>71.8%</td><td>8</td><td>20.5%</td></tr><tr><td>24</td><td>F1</td><td>25</td><td>75</td><td>3</td><td>4.0%</td><td>42</td><td>56.0%</td><td>30</td><td>40.0%</td><td>26</td><td>78</td><td>3</td><td>3.8%</td><td>45</td><td>57.7%</td><td>30</td><td>38.5%</td></tr><tr><td>25</td><td>EE</td><td>11</td><td>33</td><td>0</td><td>0.0%</td><td>27</td><td>81.8%</td><td>6</td><td>18.2%</td><td>11</td><td>33</td><td>0</td><td>0.0%</td><td>27</td><td>81.8%</td><td>6</td><td>18.2%</td></tr><tr><td>MT</td><td></td><td>3</td><td>9</td><td>0</td><td>0.0%</td><td>6</td><td>66.7%</td><td>3</td><td>33.3%</td><td>3</td><td>9</td><td>0</td><td>0.0%</td><td>5</td><td>55.6%</td><td>4</td><td>44.4%</td></tr></tbody><tfoot><tr><td>Total</td><td>1132</td><td>3396</td><td>1171</td><td>34.5%</td><td>1148</td><td>33.8%</td><td>1077</td><td>31.7%</td><td>1131</td><td>3393</td><td>1268</td><td>37.4%</td><td>1314</td><td>38.7%</td><td>811</td><td>23.9%</td><td>1125</td><td>3375</td><td>1341</td><td>39.7%</td><td>1429</td><td>42.3%</td><td>605</td><td>17.9%</td></tr></tfoot></table>
Overall compliance levels range from 34.5% in the TCP case, to 37.4% in the UDP, and 39.7% in the ICMP case. The variation among countries is substantial, though, it ranges from 0% (TCP), 0% (UDP) and 0% (ICMP) in the case of Malta (MT) to 80% (TCP), 75% (UDP), and 80% (ICMP) in the case of Liechtenstein (LI). These results show that no country is fully compliant with Schengen routing for those active measurement results.

Overall non-compliance levels range from 33.8% in the TCP case to 38.7% in the UDP and 42.3% in the ICMP case. As it happens for the compliance level, the variation among countries is considerable, it ranges from 0% (TCP) and 20% (ICMP) in the case of Liechtenstein (LI) and 19.4% (UDP) in the case of Switzerland (CH) to 81.8% (TCP), 81.8% (UDP), and 84.8% (ICMP) in the case of Estonia (EE).

The relative amount of unknown routes ranges from 31.7% in the TCP case to 23.9% in the UDP and 17.9% in the ICMP case. The variation among countries is less pronounced for unknown routes compared to compliant and non-compliant routes, in the TCP case results range from 18.2% in Estonia (EE) to 50% in Italy (IT), in the UDP case they range from 0% in Liechtenstein (LI) to 42.4% in Italy (IT), and in the ICMP case results range from 0% in Liechtenstein (LI) to 41.1% in Italy (IT).

The core finding is that compliance levels vary significantly among individual countries and range from a very low to a very high compliance. As a consequence, overall values are of limited use. The second finding is that there is no significant variation among transport protocols with respect to the relative amount of compliant, non-compliant, and unknown routes.

## 4.2 Comparative Analysis

While the work [16] used a passive approach based on publicly available BGP routing table information, countries were ranked according to a Schengen routing compliance score, which represents the relative amount of routes that do not comply with Schengen routing [16]. Although the geo-location information is taken from Maxmind's GeoLite database [10] in both cases, the comparison of both sets of results obtained are compared and shown in Table 5. The relative amount of non-compliant routes obtained using active measurements in the chkroute approach exceeds in almost all cases the amount obtained using the model based on BGP routing table data. An analysis discussing the reasons resulting in those differences found between [16] and the chkroute approach is omitted at this point, because the routing data used to produce results in [16] is not available.

# 5 Design and Implementation of the chkroute Tool

While those results presented are useful to obtain a general understanding of compliance levels in each of the individual Schengen countries, end-users are more interested to learn whether specific routes are compliant with Schengen
<table><caption>**Table 5.** Non-compliant routes according to Pohlmann et al. [16] vs. chkroute</caption><thead><tr><th>Country Code</th><th>Country</th><th>Pohlmann et al. [16]</th><th>chkroute</th></tr></thead><tbody><tr><td>BE</td><td>Belgium</td><td>35.38%</td><td>49.4%</td></tr><tr><td>LI</td><td>Liechtenstein</td><td>29.41%</td><td>0.0%</td></tr><tr><td>CH</td><td>Switzerland</td><td>23.48%</td><td>15.2%</td></tr><tr><td>ES</td><td>Spain</td><td>21.27%</td><td>43.4%</td></tr><tr><td>LU</td><td>Luxembourg</td><td>21.15%</td><td>47.4%</td></tr><tr><td>FR</td><td>France</td><td>19.13%</td><td>26.4%</td></tr><tr><td>MT</td><td>Malta</td><td>17.86%</td><td>66.7%</td></tr><tr><td>FI</td><td>Finland</td><td>16.58%</td><td>56.0%</td></tr><tr><td>CZ</td><td>Czech Republic</td><td>16.31%</td><td>31.3%</td></tr><tr><td>SE</td><td>Sweden</td><td>14.92%</td><td>30.5%</td></tr><tr><td>NL</td><td>Netherlands</td><td>13.07%</td><td>19.3%</td></tr><tr><td>DE</td><td>Germany</td><td>12.26%</td><td>32.5%</td></tr><tr><td>NO</td><td>Norway</td><td>10.31%</td><td>41.5%</td></tr><tr><td>GR</td><td>Greece</td><td>8.67%</td><td>61.1%</td></tr><tr><td>EE</td><td>Estonia</td><td>6.78%</td><td>81.8%</td></tr><tr><td>SK</td><td>Slovakia</td><td>6.25%</td><td>33.3%</td></tr><tr><td>LT</td><td>Lithuania</td><td>5.50%</td><td>36.4%</td></tr><tr><td>IT</td><td>Italy</td><td>3.70%</td><td>31.4%</td></tr><tr><td>AT</td><td>Austria</td><td>3.23%</td><td>25.0%</td></tr><tr><td>DK</td><td>Denmark</td><td>1.75%</td><td>26.3%</td></tr><tr><td>PL</td><td>Poland</td><td>1.43%</td><td>41.0%</td></tr><tr><td>PT</td><td>Portugal</td><td>1.39%</td><td>66.7%</td></tr><tr><td>LV</td><td>Latvia</td><td>1.34%</td><td>61.5%</td></tr><tr><td>SI</td><td>Slovenia</td><td>1.15%</td><td>58.3%</td></tr><tr><td>HU</td><td>Hungary</td><td>0.49%</td><td>38.3%</td></tr><tr><td>IS</td><td>Iceland</td><td>0.00%</td><td>38.9%</td></tr></tbody></table>

Routing or not. Therefore, *chkroute* was designed and prototyped. The tool *chkroute* assesses whether a specific route complies to Schengen Routing or not and is available at [6].

The tool's architecture consists out of the 3 components depicted in Figure 2. The client desires to verify a route. The target host or IP address represents the endpoint of the route. The geo-location server stores location and compliance information about IP addresses. The compliance checks for routes are performed in four steps.

1. The client runs traceroute to the target host.

2. The client collects responses from hops along the path.

3. The client submits hops to the geo-location server.

4. The geo-location server analyzes these hops and sends country and compliance information back to the client, which prints the result.

A sample run of *chkroute* is shown in Figure 3. The *chkroute* command is executed from a client at University of Zurich towards a server of the University of Federal Armed Forces in Munich. Both hosts are located in Schengen. The output produces a hop count, an IP address, the country code, Schengen routing compliance information (Yes ("Y"), No ("N"), and Unknown ("Unknown")), and the AS number.
<figure><img src="image_3.png" /><figcaption>Fig. 2. The chkroute architecture</figcaption></figure>

The sample output shows that this network traffic remains inside the Schen-
gen Area until hop 7, leaves the Schengen Area for hops 8 to 11, and it returns
at hop 12. Hop 13 is unknown. To ease the readability of this result, all hops
are color-coded: green is for compliant, red for non-compliant, and yellow for
unknown.

# 6 Summary, Conclusion, and Future Work

This paper presented key results of a larger-scale measurement conducted to determine the extent to which current routing is Schengen-compliant in Schengen countries. Based on 3388 TCP, UDP, and ICMP traceroute measurements run from RIPE Atlas probes located in over 1100 ASes in the Schengen Area it was found that compliance levels vary substantially among countries and range from 0% (TCP), 0% (UDP) and 0% (ICMP) in the case of Malta to 80% (TCP), 75% (UDP), and 80% (ICMP) in the case of Liechtenstein. The overall compliance levels range from 34.5% (TCP) to 37.4% (UDP) and 39.7% (ICMP).

Based on these measurements performed, this paper concludes that Schengen Routing compliance is not achieved in any of the Schengen countries, contradicting the claim that Schengen routing already was a factual reality today, as it has been stated by the Association of the German Internet Industry [4]. Therefore, intelligence agencies still can perform potential wiretapping activities outside the Schengen jurisdiction on traffic originating within and destined to the Schengen Area.

This work and chkroute especially with the data set collected only analyze
traffic in the forward direction. The reverse path may not necessarily be the
same [11]. Hence, future work will address the reverse path, too. Furthermore,
as only routes originating in Schengen countries targeted at a single node in
Switzerland have been analyzed, results may differ, if a target node in another
<figure><img src="image_4.png" /><figcaption>Fig. 3. chkroute output</figcaption></figure>

country was chosen. In particular, routes originating in a Schengen country A may be more or less likely than those originating in another Schengen country B to traverse a non-Schengen country depending on the location of the target node. Finally, an additional extension to this work is to analyze traffic for individual countries in more detail as well as to provide details with respect to countries that cause routes to be non-compliant with Schengen routing. It is also essential to identify those Schengen countries that are exit and entry points for traffic out of the Schengen Area and to examine the reason why this is the case.

## 7 Acknowledgments

This work was partially supported by the SmartenIT and the FLAMINGO projects, funded by the EU FP7 Program under Contract No. FP7-2012-ICT-317846 and No. FP7-2012-ICT-318488, respectively.

## References

1. B. Augustin, X. Cuvellier, B. Orgogozo, F. Viger, T. Friedman, M. Latapy, C. Magnien, and R. Teixeira: Avoiding Traceroute Anomalies with Paris Traceroute, 6th ACM SIGCOMM Conference on Internet Measurement (IMC 2006), Rio de Janeiro, Brazil, 2006, pp. 153–158

2. J. Blau: NSA Surveillance Sparks Talk of National Internets, IEEE Spectrum 51, February 2014, pp. 14–16

3. T. Bourgeau: Monitoring Network Topology Dynamism of Large-scale Traceroute-based Measurements, 7th IEEE International Conference on Network and Service Management, Paris, France, October 2011, pp. 489–493
4. Computerwoche: Internet-Verband ECO Beklagt Scheindiskussion um "Schengen-Routing", http://www.computerwoche.de/a/internet-verband-eco-beklagt-scheindiskussion-um-schengen-routing, 2556658, Last Accessed: February 2015

5. Daniel Dönni, Guilherme Sperb Machado: Traceroute Measurements in Schengen Area, http://www.csg.uzh.ch/publications/data/traceroute-schengen/, Last Accessed: February 2015

6. Daniel Dönni: chkroute utility, https://cms.uzh.ch/lenya/csg/authoring/publications/software/chkroute.html, Last Accessed: March 2015

7. Suman Banerjee, Timothy G. Griffin, Marcelo Pias: The Interdomain Connectivity of PlanetLab Nodes, 5th Passive and Active Network Measurement Conference (PAM 2004), Lecture Notes in Computer Science, Volume 3015, Antibes Juan-les-Pins, France, April 2004, pp. 73 – 82

8. EMANICSLab, http://www.emanicslab.org, Last Accessed: December 2014

9. European Commission: The Schengen Area, http://biblio.ucv.ro/bib_web/bib_pdf/EU-books/0056.pdf, Last Accessed: February 2015

10. Maxmind: GeoLite Legacy Downloadable Databases, http://dev.maxmind.com/geoip/legacy/geolite, Last Accessed: December 2014

11. Y. He, M. Faloutsos, S. Krishnamurthy, and B. Huffaker: On Routing Asymmetry in the Internet, Global Telecommunications Conference (GLOBECOM 2005), Volume 2, St. Louis, USA, 2005, pp. 6–17

12. Y. Hyun, A. Broido, and K.C. Claffy: Traceroute and BGP AS Path Incongruities, Cooperative Association for Internet Data Analysis (CAIDA), Technical Report, March 2003. Available at: http://www.caida.org/publications/papers/2003/ASP/asp-incon.pdf. Last Accessed: February 2015

13. S. Landau: Making Sense from Snowden: What's Significant in the NSA Surveillance Revelations, Journal of Security Privacy, Vol. 11, No. 4, July 2013, pp. 54–63

14. OpenWRT, https://openwrt.org, Last Accessed: January 2015

15. Planet-Lab, https://www.planet-lab.org, Last Accessed: December 2014

16. N. Pohlmann, M. Sparenberg, I. Siromaschenko, and K. Kilden: Secure Communications and Digital Sovereignty in Europe, ISSE 2014 Securing Electronic Business Processes, Brussels, Belgium, 2014, pp. 155–169

17. RIPE NCC: RIPE ATLAS, atlas.ripe.net, Last Accessed: December 2014

18. S. Sundaresan, S. Burnett, N. Feamster, and W. De Donato: BISmark: A Testbed for Deploying Measurements and Applications in Broadband Access Networks, 2014 USENIX Conference, San Diego, USA, August 2014, pp. 383 – 394

19. Y. Zhang, R. Oliveira, H. Zhang, L. Zhang: Quantifying the Pitfalls of Traceroute in AS Connectivity Inference, 11th Passive and Active Measurement Conference (PAM 2010), Lecture Notes in Computer Science, Vol. 6032, Zurich, Switzerland, April 2010, pp. 91–100