At a large US cloud provider I formerly worked at our fiber between colos in HKG were all tapped, with unexplained db losses. Seemed to be not a secret this goes on there.

a really good tap won't even have a perceptible loss if they're doing it right, it'll be indistinguishable when the link is first brought up (assuming you're renting dedicated dark strands) from just some older fiber with a very slightly higher dB per km loss figure. Modern singlemode for inter-city use can be 0.03 to 0.07 dB/km better than old stuff from 15, 20, 23 years ago.

if you're paying for lit L2 transport service between two sites then all bets are off, you don't get to see the underlying optical characteristics except for the customer hand off port on each side, and the carrier can of course just mirror an entire port to some capture entity.

>a really good tap won't even have a perceptible loss if they're doing it right

I'm curious, how does one "do it right"? Is there a technical explainer somewhere on how this works (in theory)?

singlemode fiber splitters come in various ratios of light passed to light split off to your own thing. You fusion splice it in place. It's basically just a prism in a box. If you want to tap a circuit such as between two datacenters at the most fundamental (OSI layer 1) level, before the dark fiber is ever handed off to the customer, you would put in place a tap that passes 90% of the light and keeps 10% of it, splits it off, then feed that into your own local amplifier if needed before passing the tap to your interception/storage equipment, if the received signal level from the 10% is too low.

the general principle is actually not much different from some things you do in ordinary DWDM system engineering (where you want to give an analysis port to a spectrum analyzer) or the various types of splitters that exist for GPON network builds.

there are also lots of ways to hand-wave away the loss from a tap to a carrier customer, like "oh yeah there's some dirty patch panels over there" or "that segment of fiber was fusion spliced in an emergency repair at 3am eight years ago after it got taken out by a truck, there may be some slightly higher loss on some strands". And even more so for an inter-city fiber link that's way under 80 km (more like 30-40km, tops), where the optical link budget POP-to-POP isn't in question, and well within the reach of ordinary optics even when considering old or dirty fiber in between. The ISP customers might not look too hard at it.

google "fiber plc splitter" for some manufacturer info and datasheets.

> google "fiber plc splitter" for some manufacturer info and datasheets.

See also "optical tap".

Most insightful, same excuse for beigeboxing back in the day but with fiber/glass. Wow.

I'd be surprised if there are any large players who don't encrypt everything e2e these days. (By e2e, I mean while data is in transit between datacenters.)

That's at least been the case at Google for something like a decade since the China hacks, the Snowden revelations, etc.

That said, I imagine there would be a big capacity crunch if all fibers transiting HKG were completely disrupted. As I understand it, HKG is primarily a stepping stone between SIN and TPE / NRT. There are comparably direct alternatives (e.g. MNL), but the capacity just isn't there yet.

(Networking often uses airport codes to describe metros, e.g. TPE for Taipei or NRT for Tokyo (Narita).)

By E2E you mean SSL and not actually end-to-end right? AFAIK no provider transports HTTP packets over the wire E2E in the same way that Signal or Telegram transports text messages E2E. It's not actually possible since there is no way to transmit a shared secret without first establishing a secure channel (which itself cannot be E2E).

Anyways point being, China/HK could just subpoena the private keys for individual SSL certificates and decrypt traffic on their end while it passes through the pipeline. Having sovereignty over the cable is still an advantage for them.

I mean e2e as far as the connection is concerned, whether it's a server talking to end-users via HTTPS, or a server in a datacenter in Singapore talking to a server in a datacenter in Atlanta using GPG or TLS or whichever proprietary encryption algorithm you want to use.

If China / HKG has that subpoena power for arbitrary SSL certificates, then we've already lost. As I mentioned, significant traffic already transits through HKG. But even so, what enforcement mechanism does China have? Facebook as well as many other services are already blocked...

And honestly, if China starts using subpoena power to take control of SSL certs, that's a _very_ strong incentive to leave that market entirely, as not only can they decrypt your traffic; they can also impersonate you.

"True e2e" as offered by Signal / Telecom still relies on Diffie-Hellman key exchange, and therefore some notion of public / private keys with custom PKI servers. It's no different from an attacker's perspective -- instead of the global PKI infra underpinning the web, you're just dealing with a single entity. Compromise the PKI, and you can MitM to your heart's content.

Fair point. I was under the assumption that subpoenaing certs at least for domestic entities was common place. I guess that barrier hasn't been crossed yet, or at least we assume so?

After some amount of poking around, I've found exactly one case where that happened (https://en.wikipedia.org/wiki/Lavabit in connection with Snowden).

Law enforcement might subpoena, say, search result records in connection with a specific crime (certain keywords + location + timeframe), but larger companies with the resources would absolutely have the ability and incentive to fight something as overly broad as requesting SSL keys.

couldn't they just wrap up the lines at the U.S. embassy, and give U.S. full control over any "snooping" and "transit"?

Right of way between the ocean and embassy and gives the consulate way to much power, you don't do that.