A large amount of Canadian internet traffic is being routed through the United States, leaving it vulnerable to collection and probing by the National Security Agency.

And most Canadians have no idea of how exposed they are to American data sweeps, say the researchers behind a new tool that aims to show Canadians what path their internet traffic takes to connect to the websites they want to visit.

In a new online project launched Thursday, researchers from the University of Toronto and York University have partnered with Open Media to create a tool to show the paths Canadians’ internet data take when they access websites or send online communications.

While past estimates have suggested roughly 90 per cent of Canadian internet traffic is routed through the United States — particularly in cases where a Canadian visits an American or foreign website — the new data gathered so far by the researchers build on that and suggest that even when both the origin and destination of the traffic are in Canada, there’s still a one-in-four chance it goes through the U.S.

“I think most Canadians would be really surprised to learn that quite so much of our internet traffic, even our domestic Canada-to-Canada traffic, actually ends up being routed through the U.S.,” said David Christopher, spokesperson for Open Media.

“Canada’s lack in sufficient internet exchange points within our borders is really a big reason why so much of our traffic does travel through the U.S. I think nowadays a lot of people think of the internet as almost like a cloud and I think a lot of people don’t put a lot of thought into what happens when we visit a website on the other side of the country.”

To get a user to a website, internet service providers (ISPs) must connect to internet exchange points — physical hubs that connect all of the most important cables that connect internet access points — like your computer — with the end destination, such as the iPolitics homepage.

There are nine internet exchange points located in Canada: one each in Vancouver, Edmonton, Calgary, Winnipeg, Toronto, Ottawa, Montreal, Halifax and Waterloo, Ont.

(Picture an extension cord connecting your laptop to the power bar across the room: You need some intermediary to help you access the power bar, but you could use one, two or even three extension cords to help you get there.)

“You get to there and then you can connect to other networks that have also reached that,” said Andrew Clement, professor emeritus at the University of Toronto and coordinator of the school’s Information Policy Research Program. “It’s like a big power bar in the sense that everybody just plugs in there rather than making all of these arrangements with individual carriers.”

But Canadian internet traffic can also be routed through intermediary exchange points in the U.S., rather than directly through the hubs in major Canadian cities.

Sometimes this is because the U.S. exchange points are cheaper and more developed: Think of routing through the U.S. as being like taking the Trans Canada Highway instead of a winding, two-lane road to drive across country.

Sometimes it can also be because larger internet service providers don’t want to directly transport traffic from smaller services piggy-packing on their expensive network infrastructure.

“That’s about the pricing policies and the lack of government regulatory intervention,” Clement said.

The problem lies in the fact that the use of such “boomerang” routes means Canadian internet traffic loses its protections under Canadian privacy law — and instead becomes subject to the Patriot Act while it passes through U.S. exchange points. That exposes the Canadian traffic to the National Security Agency’s broader powers to intercept and probe both the metadata and content of the traffic.

An example: In the course of setting a time for an interview, iPolitics and Christopher exchanged a number of emails between the iPolitics office in Ottawa and his office in Vancouver. While even internet traffic within cities can be routed through the U.S., the likelihood of traffic crossing south of the border increases between websites or servers that are distant from one another.

“That chance increases when it comes to long-haul traffic, so with you being in Ottawa and me being in Vancouver I think there’s a bigger chance than 25 per cent that the emails we’ve been exchanging have been routing through the U.S. because Canada just lacks sufficient long-haul background capacity in our networks,” Christopher said.

And when Canadians access websites based outside North America, the traffic almost always will be routed through the U.S. because the primary seafloor cables — connecting Asia and North America, for example — make landfall in the U.S.

While the Canadian Internet Registration Authority, the service that registers domain names for websites hosted in Canada, actively encourages the use of Canadian internet exchange points, there is no regulation requiring internet service providers to do so.

Clement said that if every internet service provider with access to the Canadian exchange points used them, it would help to keep more traffic within Canada.

He pointed to one example where he and his students traced the route their internet data took when they accessed the Ontario Student Assistance Program website from his office just down the street at the University of Toronto.

“The route that that data takes is from Toronto to New York and Chicago, where [provincial government carrier] Telus then connects it back to the provincial government,” Clement said. “We’ve observed this for years and this pattern is fairly reliable.”

But that doesn’t mean it should stay that way, he said, pointing to the coming inauguration of President-elect Donald Trump as a reason Canadians should be concerned about their internet traffic, including the content of online communications, being routed through the United States.

“Going to the United States exposes it to NSA surveillance and now I think with Trump and his government, it’s going to be even worse,” Clement said. “It’s an unnecessary loss of legal and constitutional protection.”

The project itself doesn’t advocate for any particular course of action but rather is set up as a platform to allow people to trace the routes their own internet traffic takes so they can better understand the issue.

But that doesn’t mean those behind it don’t have clear ideas on how to solve the problem.

“Fundamentally it’s about education, so people understand how this can happen, and further about the risks to privacy,” said Clement, pointing to the need for a baseline level of understanding before Canadians and policy makers can move to find solutions.

“There are a number of things that can be fixed but the easiest thing is to reduce that exposure to US surveillance. Make it easier and require that connection within Canada.”