  Internet users and service providers do not often know when traffic is being
watched but desire a way to determine when, where, and by whom. We present
NOISE, the Nonce Observatory for Inverse Surveillance of Eavesdroppers, a
method and system that detects monitoring by disseminating nonces - unique,
pseudorandom values - in traffic and seeing if they are acted upon
unexpectedly, indicating that the nonce-laden traffic is being monitored.
Specifically, we embed 64-bit nonces innocuously into IPv6 addresses and
disseminate these nonces Internet-wide using a modified traceroute-like tool
that makes each outbound probe's source address unique. We continually monitor
for subsequent nonce propagation, i.e., activity or interest involving these
nonces, e.g., via packet capture on our system's infrastructure. Across three
experiments and four months, NOISE detects monitoring more than 200k times,
ostensibly in 268 networks, for probes destined for 437 networks. Our results
reveal: (a) data collection for security incident handling, (b) traffic
information being shared with third parties, and (c) eavesdropping in or near a
large commercial peering exchange.
