If your data crosses a network you don’t own, assume someone has a copy.
Want proof? Here are real cases, each one backed by its sources.
You can do everything right and still get recorded.
Some of the cases below were attacks. Some were honest mistakes. Some were settings nobody checked. As you read, notice where each one happened: a carrier’s router, a routing table on the other side of the world, a satellite link run by someone else.
Almost none of it happened on the victims’ own networks.
They got inside the carriers. Then they recorded.
State‑sponsored hackers broke into the backbone routers of major telecommunications carriers. Twenty‑three security agencies from thirteen countries later documented that they “collected PCAPs” (packet captures) and used the routers’ own features “to capture or mirror traffic.”
In the United States, the FBI and CISA confirmed “the theft of customer call records data” and the compromise of private communications of “a limited number of individuals who are primarily involved in government or political activity.”
The carrier you trust with your link can be the place it’s recorded.
On the recordJoint advisory, 23 agencies in 13 countries (2025) · FBI and CISA joint statement (2024)
About $800 of equipment. Half the links in the clear.
University researchers pointed a rooftop dish at 39 satellites over seven months, using about $800 of off‑the‑shelf equipment. About half the satellite links they examined carried unencrypted traffic, including phone calls and texts, military data, and internal bank and corporate networks.
Listening is cheap. Encryption is all that stands between a recording and what’s inside it.
On the recordUC San Diego and University of Maryland, ACM CCS 2025 · UC San Diego news release
For about 18 minutes, routes to 15% of the internet pointed through China.
On April 8, 2010, China Telecom advertised routes that sent traffic for about 15 percent of the internet’s destinations through servers in China, including U.S. Senate, military and NASA sites, according to a report to Congress. The Commission couldn’t determine what, if anything, was done with it, and China Telecom denied wrongdoing.
It happened again in 2020, when a Russian carrier briefly announced routes for more than 4,000 blocks of Amazon and Akamai addresses.
You don’t choose the path your traffic takes. Every network on that path sees it pass.
On the recordU.S.‑China Commission, 2010 Report to Congress · MANRS routing analysis (2020)
Traffic was pulled through Belarus and Iceland, then sent on its way.
In 2013, network analysts at Renesys watched internet traffic get diverted through Belarus and Iceland, then sent on to its destination as if nothing had happened. Victims included financial institutions, governments, network providers and a large VoIP provider.
Renesys concluded the diversions were malicious man‑in‑the‑middle attacks, not accidents. Who was behind them was never established.
A detour you can’t see is the perfect place to keep a copy.
On the recordRenesys findings, reported by The Register (2013)
Google’s traffic took a detour through Russia and China.
On November 12, 2018, a configuration error at a small Nigerian ISP leaked routes that sent traffic for Google services through China Telecom and a Russian carrier, disrupting Google for over an hour.
The ISP said it was a mistake. The traffic still went where it shouldn’t, and much of it was dropped in China Telecom’s network.
Even an accident can put your traffic on someone else’s wire.
On the recordThousandEyes analysis (2018)
About $300 of hardware. Corporate traffic in the clear.
Five years before the larger 2025 study, an Oxford‑led team used about $300 of hardware and a satellite TV dish to pick up satellite broadband traffic. They found a lawyer’s emails to clients, business documents from Fortune 500 companies, and a shipping company’s employee passport information, all unencrypted.
This isn’t new. It’s been cheap for years.
On the recordDEF CON 2020 research, reported by The Register
The wire was never theirs to control.
Patching, training and process protect what you own. They can’t protect the wire in between, and somewhere along it, sooner or later, something goes wrong.
That’s why PacketLoq exists: to make that wire stop mattering. Whatever gets copied off it stays locked, today and on Q‑Day. That’s how you sleep at night.
A recording doesn’t expire. Your encryption might.
A recording can be copied, stored and kept for as long as someone wants it. Nothing about it fades.
Many links still agree on their session key with RSA or elliptic‑curve math, in the open. That’s the part a large quantum computer would be able to break, and breaking it opens every packet in the session.
How Shor’s algorithm does it →Account records, patient records, contracts, designs: much of it has to stay secret for decades. The encryption protecting it in transit today may not last that long.
See a typical bank’s exposure →The people responsible for national security treat this as current.
“…the risk of adversaries collecting United States information now, and decrypting it later once large‑scale quantum computers are operational.”
“…cyber actors could target our nation’s most sensitive information now and leverage future quantum computing technology to break traditional non‑quantum‑resistant cryptographic algorithms.”
“…the present and ongoing threat of HNDL to currently protected data.”
Six questions. If one is hard to answer, that’s your answer.
Each question has a short guide: why it matters, and what a good answer looks like.
- Which of our links still use RSA or elliptic‑curve key exchange?
Why ask. These are the key exchanges a large quantum computer could break, so anything recorded on those links today could be opened on Q‑Day.
What to expect. Expect some digging. Key‑exchange settings live in VPN, firewall, router and load‑balancer configurations, and many teams have never listed them in one place. A cryptographic inventory is the first step NSA, CISA and NIST recommend. A good answer is a list, not a guess.
- How long does the data on each of those links need to stay secret?
Why ask. This is the data’s shelf life. If it has to stay secret longer than it will take for Q‑Day to arrive, a recording made today is a real risk.
What to expect. Expect the answer to come from legal, compliance and the business, not just IT: retention rules, contracts and regulations for things like patient, financial and customer records. Expect different answers for different links.
- Which links cross networks we don’t own: carriers, the internet, cloud providers, satellite?
Why ask. Almost every case on this page happened on a network the victims didn’t control. That’s where recordings get made.
What to expect. Expect the list to be longer than people first think: carrier circuits, internet VPNs, cloud interconnects, backup and replication links, and satellite or cellular backup links. A network diagram is a good start; check it against what’s actually running.
- If someone recorded our busiest link today, what would the recording contain?
Why ask. It turns an abstract risk into a concrete one that the business can weigh.
What to expect. Expect answers like database replication, payment files, patient records, source code, credentials and internal email. If the honest answer is “a bit of everything,” that’s a good link to protect first.
- Would we know if a carrier or router on that path had been compromised?
Why ask. Recording is passive. It doesn’t slow the link or set off an alarm, and it can happen on equipment you don’t run.
What to expect. For networks outside your own walls, expect an honest “probably not.” That isn’t a failing of your team. It’s why the data itself has to stay protected wherever it travels.
- What’s our date for moving off RSA and elliptic‑curve key exchange, and does it beat Q‑Day?
Why ask. Moving off vulnerable key exchange takes years: inventory, testing, vendor upgrades and change windows. Every month of delay adds to what’s already been recorded.
What to expect. Expect a date, a plan and a list of what’s blocking it. For comparison, the U.S. federal deadline for high‑value and high‑impact systems is December 31, 2030. If there’s no date yet, that’s the answer.
Can’t answer them yet? We’ll help you find out.