Information flows like electricity, often unseen, but never truly lost. Every packet of data you send travels through a complex network of routers, servers, and exchanges — some secure, some not. For anyone conscious about privacy, the journey your information takes is just as important as the destination.
Most people picture the internet as a line: you at one end, the site at the other. It is not a line. It is a relay, and the runners change hands more often than you would guess.
The actual journey
Open a site and a packet leaves your device on a route that looks roughly like this:
- Your router. Rewrites the source address and hands it to the line.
- Your ISP's access network. The first party that knows both who you are — you have a contract — and where the packet is going.
- Your ISP's core, then an exchange or a transit provider. A building full of other people's networks, where traffic is handed between companies that have agreed to carry each other's.
- One to several transit networks. Chosen by routing policy, which is to say by commercial agreements and the honour system. Nobody asked you.
- The destination's network, its load balancer, and finally the server.
A dozen hops is ordinary. Every one of them is a machine owned by an organisation you have no relationship with, in a jurisdiction you did not choose, and each one necessarily reads the outside of your packet in order to forward it. That is not a flaw. Forwarding requires reading the address, and the whole system works because everyone does exactly that and nothing more.
Nothing more, at least, is the convention. Conventions are not guarantees.
What each hop can see
With ordinary HTTPS and no tunnel:
- Everyone on the path sees your address, the destination address, the size and timing of every packet.
- Nobody on the path sees the page content, your credentials, or what you typed. TLS does that job well.
- Your DNS resolver — usually your ISP — sees a plain-text list of every domain you look up, in order, with timestamps. This happens before the encryption exists, which is why DNS gets its own article.
- The first hops have historically seen the site name inside the TLS handshake itself, in the field that tells a shared server which certificate to present. Encrypted Client Hello is fixing this, unevenly and slowly.
So the content is private and the itinerary is not. For most purposes the itinerary is the interesting part: which sites, how often, at what hours, in what order. You can characterise a person quite well from that without reading a single word they wrote.
The parts of the path nobody controls
Routing between networks runs on BGP, a protocol built when the internet was small enough that everyone involved knew each other. Networks announce which addresses they can reach; their neighbours believe them.
Occasionally a network announces addresses it has no business announcing. Usually it is a misconfiguration and traffic for a large service disappears for twenty minutes. Occasionally it is not a misconfiguration, and traffic for a region takes an unexpected detour through somewhere it has no reason to be, and then continues to its destination as if nothing happened.
You cannot detect this from your laptop and you cannot prevent it. What you can control is whether a detour yields anything worth having.
What the tunnel actually does
A VPN does not shorten the path or make it safer. The same routers, the same exchanges, the same unaccountable middle. What changes is where the readable part begins.
Your packet is wrapped in another packet addressed to the VPN server. Every hop between you and that server now sees a single encrypted flow to a single address — no site names, no destinations, no traffic shape beyond volume and timing. The original packet is unwrapped at the server and continues from there.
Which means the first leg of the journey stops being informative to your ISP, and a new first leg is created beginning at the VPN provider. They see everything your ISP used to see. That is not a criticism of any provider; it is the mechanism. The observer moved. Choosing a VPN is choosing which company occupies that position, and choosing badly is worse than not choosing at all — a point worth sitting with before reading the anonymity piece.
Where this matters most
The clearest case is a network you do not control.
Café, hotel, airport, conference, a landlord's shared connection. The operator can see your DNS queries, redirect them, inject into any unencrypted traffic, and log addresses against a device that will return next week. Captive portals routinely do several of these as a feature. The equipment is cheap and often configured by nobody in particular.
On that kind of network a tunnel is not a privacy nicety, it is the difference between one observable flow and a complete transcript of your afternoon. This remains the single most defensible use of a VPN, and the one nobody needed to oversell.
The underground, in summary
Your traffic crosses a dozen organisations that never agreed to protect it, on routes chosen by commercial arrangements, through buildings you will never see. Encryption means they carry it without reading it. A tunnel means the early hops cannot even tell where it is going.
Nothing in that chain is removed. The packets still go the long way round, still pass through everyone's hands, and still arrive because thousands of unrelated parties keep an old convention. Understanding the route is what makes the tool legible — and what stops anyone selling you a tunnel as though it were a private internet. It is a private first leg, which turns out to be worth quite a lot.