Modern Internet surveillance (or monitoring) is done by software looking for specific keywords or phrases. This is known as flagging. Whenever a particular keyword passes through the infrastructure, the IP address of the sender is recorded along with the message. Flagging could also react to requests for certain websites. In a targeted surveillance scenario, a particular IP could be singled out for monitoring and all of its activity recorded.
Note: When you are using a satellite Internet connection, your bypass the national infrastructure. The satellite relays your connection to a ground station usually located in another country (depending on your choice of providers). Communications between the satellite and your receiver antenna are encrypted by default. For this reason, many authoritarian states forbid satellite Internet connections and by using advanced equipment can locate the transmitter.
<img>
Here you can see login and password details being transmitted on the Internet. Every router located between the user's computer and the website being visited has access to this data.
Media: A very interesting (if slightly lengthy) DEFCON lecture explaining the implementation of Internet surveillance on commercial and government levels
<vid>