'My Week as an Internet Spy'

On a bright April morning in Menlo Park, California, I became an Internet spy.

This was easier than it sounds because I had a willing target. I had partnered with National Public Radio (NPR) tech correspondent Steve Henn for an experiment in Internet surveillance. For one week, while Henn researched a story, he allowed himself to be watched—acting as a stand-in, in effect, for everyone who uses Internet-connected devices. How much of our lives do we really reveal simply by going online?

Henn let me into his Silicon Valley home and ushered me into his office with a cup of coffee. Waiting for me there was the key tool of my new trade: a metal-and-plastic box that resembled nothing more threatening than an unlabeled Wi-Fi router. This was the PwnPlug R2, a piece of professional penetration testing gear designed by Pwnie Express CTO Dave Porcello and his team and on loan to us for this project.

The box would soon sink its teeth into the Internet traffic from Henn's home computer and smartphone, silently gobbling up every morsel of data and spitting it surreptitiously out of Henn's home network for our later analysis. With its help, we would create a pint-sized version of the Internet surveillance infrastructure used by the National Security Agency. Henn would serve as a proxy for Internet users, Porcello would become our one-man equivalent of the NSA’s Special Source Operations department, and I would become Henn's personal NSA analyst.

As Henn cleared a spot on his desk for the PwnPlug, he joked that it might not provide anything useful for us to analyze. In the year since Edward Snowden pulled back the curtain of secrecy around the NSA’s dragnet surveillance programs, many of the major Internet service providers targeted by the spy agency have publicly announced plans to better protect customers, often through the expanded use of encryption.

Our experiment would answer the question: could a passive observer of Internet traffic still learn much about a target in this post-Snowden world?

Sassy wrote:Is the result of the experiment known yet?

Watching Henn’s traffic let us track much of his activity on the open Internet, but it didn’t give us everything. Like many people who work from home, Henn's corporate e-mails, Voice over IP phone (VoIP) calls, and other official communications were concealed by encryption—either by application-specific encryption or by NPR’s virtual private network. Encryption, when applied consistently, at least helps to thwart casual passive surveillance.

However, we quickly discovered that the encryption used by most popular Internet services doesn’t completely protect users from eavesdropping. Inconsistent implementations of encryption, plus data leaked by connections to unprotected sites, still provided us with enough data to paint a fairly complete picture of what Henn was doing.

On one of the days we watched him, Henn was reporting on environmentally friendly data centers, though I didn't know this at the time.

I got my first hint of what Henn was researching by reconstructing his Google searches. Google encrypts searches by default now, but data leaks from Google’s search engine can easily give up a person’s searches once they’ve been de-anonymized—in part by using Google’s own “cookies” against a target.