[BBKing]

The cardinal rule is that bandit country starts at the edge of your network, i.e. where you stop controlling traffic, treat it as visible to all. This doesn't apply only to ntl, but generally, in fact I apply it to the internal network my team uses.

Downstream traffic is more vulnerable than upstream though, but both can be snooped with the right equipment, so use SSL, SSH, VPN, PGP if you have anything you wouldn't be happy to have seen.