Macroeconomic Analysis of Routing Anomalies

Any change in routing on the Internet is implemented via a BGP announcement indicating better or new paths for traffic. Announcements that cause information to go through extended paths rather than the intended or most efficient path are called BGP hijacks. Why are some countries more likely to originate routing anomalies than others, all other things being equal? What is the nature of most BGP hijacks? We analyzed reported routing anomalies and macroeconomic indicators over a four-year period to answer these questions. There are well-documented hijacks resulting from errors, for profit, or for national security and national intelligence purposes. Any individual hijack could be an accident, a crime, or an attack. Here we report on an empirical investigation into the macroeconomics of routing anomalies that addresses these three explanations. If BGP anomalies are a result of limited technical competence, then countries with low levels of education and expertise may be over-represented. If BGP anomalies are a crime, used by criminals for profit, then economic theories and analytical approaches from criminology should be able to provide at least partial answers to this question. Alternatively, if BGP hijacks are primarily used by national intelligence agencies to attack either internal dissidents or other countries, then the presence of conflict would be an indicator.Our analysis built on previous macroeconomic work in online crime using the factors that have been found to be significant in predicting malware, spam, and crowdsourced criminal labor (e.g. CAPTCHA solving). For crime, our data analysis evaluated if variables associated with (i) routine activity theory (fixed broadband subscribers, secure Internet servers), (ii) economic deprivation theory (GDP per capita by PPP), or (iii) structural theory (governance and education) were significant over multiple years. We found that two of the three theories were significant. Specifically, secure Internet servers, and density of fixed broadband subscribers were significant, supporting routine activity theory. Governance indicators were significant, supporting a structural theory of crime. Education alone was not found to be significant. Our findings suggest that strength of guardianship and weakness of governance do correspond to initiation of routing anomalies, supporting the possibility that these are driven by crime. In addition to these findings from regression analysis, clustering indicates that there are two groups of countries, one of highly developed and one of less developed nations. Cluster analysis showed some indication that civil war and surveillance may be correlated with hijacks. So while we cannot reject the possibility that these hijacks are a function of lower technical expertise, we also found no evidence for that argument. We found empirical evidence that some hijacks may be for profit.We cannot reject any of the three possible explanations for hijacks: accidents, crime, or attack. Any solution to the challenge of hijacks should consider all three possibilities. A solution that mitigates one should not exacerbate the others. Otherwise hijacks may not remain, in fact, anomalous.