Thank you all very much. All responses have been very useful.
From what I see, although the network is decentralized, the initial list of nodes has to come from somewhere. From the code, I gather it has a list of initial seed nodes to download updated lists from. I assume that it is important for the integrity of the network that these hardcoded seed nodes are not compromised or can't easily become subject to persecution from hostile goverments / agents.
The link to the Satoshi Client Node Discovery also gives very good ideas. Thanks.
Using WebRTC?
Yes.