How to detect eavesdropping by your ISP

Question

I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss.

I know how to get around this online, use a VPN, use disposable virtual machines, Tor, etc. But I kind of want to know IF they are spying on my data and what they are doing with it? Intercepting, monitoring, manipulating, etc. More specifically, how does one detect eavesdropping which got me thinking, is there a way to tell if my ISP spying on me or monitoring my data other than asking a network admin at my ISP?

Answer 1

connections dropping frequently, rate limiting occuring, and packet loss

Without knowing whether your connection resets are injected TCP reset packets or a result of dropped packets, it's hard to say whether you're actually having your data acted on or just having connection issues. It is entirely conceivable that your line or equipment aren't working quite right.

That said, every sane network provider, ISP, hosting facility, or transit provider monitors interface and by proxy customer bandwidth. Bandwidth caps are very common for residential ISPs in some countries.

None of this addresses whether they're inspecting the contents of your traffic, and unless they're acting on what they see in a way that's visible to you by changing how they handle their traffic (or using your credentials, making stock trades on information you email, etc.), it's impossible to tell. Anybody who routes your traffic is entirely capable of sending a copy to second interface.

When it comes to a 3rd party monitoring you on your own network, looking for diverted traffic is possible. When it comes to asking if somebody who is expected to be in the line of transit is doing something more with the data, there is no trace of it until you see them act on it.

Answer 2

That's totally impossible to tell whether your packages are being intercepted by the third party. Just check your connection, it may be simply unstable, or if it is wireless someone may utilize a Wi-Fi jammer nearby.

Answer 3

This is the only thing I've ever seen that does any sort of tests like what you want. Would be nice to know if there's others.

http://broadband.mpi-sws.org/transparency/

Answer 4

If your ISP has the right equipment in place and configured correctly you have absolutely no way of knowing the level of monitoring that is going on. The technology has existed for years to allow any ISP to store and process network traffic at data rates in ways that are completely undetectable to users.

It's not just your ISP that you have to consider here. The Internet is a patchwork quilt of large and small ISPs all connected through peering connections. When you're connecting to your favorite off-shore porno-tube site you will likely be going through five or more providers on your way to your destination, and any of them may be storing every packet of your connection. Many governments (many of them democracies) have instituted laws requiring ISPs to log traffic for the government's use, so if you're in the US and connecting to a site in the UK for example your traffic is likely available to both the US and UK governments. So it's not about "my ISP", it's about the internet in general.

As for your particular issue it sounds more like connectivity problems over your line to your ISP, or capacity issues between your ISP and their upstream providers. I'd call them and raise a trouble ticker, otherwise they won't know you're having a problem.