-Caveat Lector- ---------- Forwarded message ---------- Date: Tue, 23 Jan 2001 20:29:56 -0800 From: Scott Jordan <[EMAIL PROTECTED]> Subject: OT?: UPDATE: Web monitoring... gone with Clinton?! Last summer, I posted some web traces (courtesy of the client software available from http://www.visualroute.com) that showed clear evidence that web browses to "crypto"-related sites were being monitored. Browses to these sites were being "detoured" to assorted spooksvilles in a way that was visible to VisualRoute's analysis. What I (with the help of some friends) posted included the following: -------------------- Crypto & hacker sites are reliably detoured for me and other users. I've been keeping a personal database of the "detours" so far for this type of site. Examples: URL Date Detoured to http://www.alphatrust.com 26-Jul-00 Beltsville or Middletown http://www.digsigtrust.com 26-Jul-00 Beltsville or Middletown http://www.lopht.com 26-Jul-00 (unknown) http://www.pgp.com 25-Jul-00 Beltsville MD http://www.verisign.com 26-Jul-00 Beltsville or Fairfax http://www.2600.com 26-Jul-00 Beltsville http://www.lippogroup.com 26-Jul-00 Beltsville -------------------- I personally was not visibly detoured when I visit political sites, "right" or "left", even militia-related or stridently radical... only the crypto and hacker sites. Others, however, were. A controversial friend, with a record as a whistle-blower, found he's detoured in ALL his web browsing, including to innocuous sites like msn.com. Our testing indicated that detouring was NOT be performed for those connected by ISPs who assign IP addresses randomly at log-on out a large pool of available addresses. Detouring was not seen when browsing is initiated via a fixed intermediary like http://www.anonymizer.com or via VisualRoute's web-based demo service. Detouring was also not seen for browsing initiated from within at least some large companies. My controversial friend, by the way, has a static IP address. -------------------- Thoughts: o The above behavior was consistent with a system aimed at (1) identifying users of "suspicious" tools, (2) paying closer attention to those with especially interesting profiles, while (3) operating in a manner which maximizes efficiency. Users assigned dynamic IP addresses from a large pool or shielded behind an intermediary are difficult to identify, so why bother. Similarly, users behind a corporate veil may be of little interest. o My research into traceroute routines suggests it would not be a huge challenge to set up a sniffer mechanism in a way that is fully cloaked. Which begs the question of why this sniffing--if that's what we're seeing (he said, tinfoil chapeau cocked jauntily)--is detectable. Easy answer: maybe it's supposed to be. "Let the Bad Guys know we're on to them..." Flip side: there might well be sniffing going on that can't be detected because it's NOT desired that we know. UPDATE: I checked out the PGP site a few weeks ago. It was still detoured to Beltsville. But it is NOT detoured today. NONE of the above sites is detoured now. POSSIBILITIES: 1) Monitoring of individual browsing to crypto sites is no longer performed. OR: 2) Monitoring is still performed, but is cloaked. Whether this change in monitoring behavior has anything to do with the change in administrations is open to conjecture. --Scott J. ================================================================= Kadosh, Kadosh, Kadosh, YHVH, TZEVAOT FROM THE DESK OF: *Michael Spitzer* <[EMAIL PROTECTED]> ~~~~~~~~~~~~~~~ The Best Way To Destroy Enemies Is To Change Them To Friends ================================================================= <A HREF="http://www.ctrl.org/">www.ctrl.org</A> DECLARATION & DISCLAIMER ========== CTRL is a discussion & informational exchange list. Proselytizing propagandic screeds are unwelcomed. Substance�not soap-boxing�please! These are sordid matters and 'conspiracy theory'�with its many half-truths, mis- directions and outright frauds�is used politically by different groups with major and minor effects spread throughout the spectrum of time and thought. That being said, CTRLgives no endorsement to the validity of posts, and always suggests to readers; be wary of what you read. CTRL gives no credence to Holocaust denial and nazi's need not apply. Let us please be civil and as always, Caveat Lector. ======================================================================== Archives Available at: http://peach.ease.lsoft.com/archives/ctrl.html <A HREF="http://peach.ease.lsoft.com/archives/ctrl.html">Archives of [EMAIL PROTECTED]</A> http:[EMAIL PROTECTED]/ <A HREF="http:[EMAIL PROTECTED]/">ctrl</A> ======================================================================== To subscribe to Conspiracy Theory Research List[CTRL] send email: SUBSCRIBE CTRL [to:] [EMAIL PROTECTED] To UNsubscribe to Conspiracy Theory Research List[CTRL] send email: SIGNOFF CTRL [to:] [EMAIL PROTECTED] Om
