We’re going to wait for twittr to standardize how they do locations before we get into anything. Right now twittr’s geo location is a mess since it isn’t really anything standard.

As for network traffic. I have no idea how f-secure is doing it. The wireshark thing is great, except that we’re really looking for external data, like from off-site servers. That gives access to the most amount of global data. Opening a local packet capture would be interesting and might be something we could do later. It would neat to have it run back to you animated (you can see source and destinations appear and light up) as the capture is “played” back. You could of course pause rewind and fast forward.

http://en.wikipedia.org/wiki/Template:Coord

Or, even though I’m not a fan of it, Twitter?

http://apiwiki.twitter.com/Twitter-REST-API-Method:-account%C2%A0update_profile

(That one would be a little tougher as it doesn’t necessarily have any kind of standard for submitting geolocation data)

There’s also Google Search Queries, as I imagine those are geotagged to some extent. I’m basing that off the data available in Google Analytics, but maybe that’s based entirely on the geolocation of the IP address, which isn’t reliable at all (proxy servers, TOR clients, etc).

My favorite packet capture analyzer/utility Wireshark just implemented support for the geolocation of IP addresses in saved captures in version 1.2 . I’d love to see some sort of way to maybe visualize the correlation of heavy network traffic to a large number of tweets or Google searches or something along those lines.

One More Edit:
http://www.f-secure.com/en_EMEA/security/worldmap/

Not entirely sure how they’re obtaining the information for this, but mapping the density of infected hosts with different worms/viruses/etc would make for another interesting data source to correlate to/from.

PS. I’m loving how this is coming along beej.