Can ISPs presumably use packet sniffing applications such as wireshark and monitor my unencrypted data? Are they "allowed" to do so?
Generally speaking, unless there's something specific that prevents them from doing so, then they can.
Legally speaking, a contract might make this disallowed, but it's very unlikely that this would be in your contract. Similarly, local privacy laws might protect you. Either way, it's lawyer time - but how will you ever know?
Technically speaking, unless your data is properly encrypted, yes they can read and modify anything they want. Use SSH or SSL to connect directly to the resource you want to access. Or use TOR (or an SSL tunnel through a third party server - like an anonymizer service) if you are worried specifically about your ISP, but aren't concerned about "another" ISP.
Value-wise, a smaller organization probably isn't that interested in you personally, and probably won't target you. The NSA should be assumed to be collecting your data. Organizations like Google do automated data mining to give you directed ads - these organization s target you generically, not directly.
Do you have a raeson someone at your ISP might specifically target you, or why someone might get a job at your ISP or hack your ISP to target you?
Can they do this? Yes they can. Are they allowed to do this? Depends on the country and the purpose. If the purpose is to comply to certain laws and rules or to troubleshoot a problem, then they can indeed use a packet sniffer.
For instance Wireshark is often used to debug router problems, if traffic is flowing across these routers then it will be captured by the packet sniffers.
Yes they can, but some countries such as Germany have very strict laws of what they can do with the sniffed information. As far as I know, on Germany the URL is protected by law.
Yes they can, and do.
Many ISP's use Deep Packet Inspection to identify the type of traffic you are sending and receiving. There are many uses for this, and not all of them are out to get your passwords. Some of the ways they use this data:
- Quality of Service
- Lawful Intercept
- Targeted Advertising
- Usage Analysis
- Policy Enforcement
As of writing this, I believe it is very much legal for ISP's to conduct this action as they see fit. They are even mandated by the FCC to support this technology for law enforcement.
Please don't take this as legal advice though, I have no idea what I'm talking about. Always assume the worst, and hope for the best. They may be watching.