ITU Approves Deep Packet Inspection Standard Behind Closed Doors, Ignores Huge Privacy Implications

from the and-they-want-us-to-trust-them? dept

Techdirt has run a number of articles about the ITU's World Conference on International Telecommunications (WCIT) currently taking place in Dubai. One of the concerns is that decisions taken there may make the Internet less a medium that can be used to enhance personal freedom than a tool for state surveillance and oppression.

Against that background, a story published by the Center for Democracy & Technology about the ITU's work in the area of standards takes on an extra significance:

The telecommunications standards arm of the U.N. has quietly endorsed the standardization of technologies that could give governments and companies the ability to sift through all of an Internet user's traffic -- including emails, banking transactions, and voice calls -- without adequate privacy safeguards. The move suggests that some governments hope for a world where even encrypted communications may not be safe from prying eyes.

The new Y.2770 standard is entitled "Requirements for deep packet inspection in Next Generation Networks", and seeks to define an international standard for deep packet inspection (DPI). As the Center for Democracy & Technology points out, it is thoroughgoing in its desire to specify technologies that can be used to spy on people:

The ITU-T DPI standard holds very little in reserve when it comes to privacy invasion. For example, the document optionally requires DPI systems to support inspection of encrypted traffic "in case of a local availability of the used encryption key(s)." It's not entirely clear under what circumstances ISPs might have access to such keys, but in any event the very notion of decrypting the users' traffic (quite possibly against their will) is antithetical to most norms, policies, and laws concerning privacy of communications.

One of the big issues surrounding WCIT and the ITU has been the lack of transparency -- or even understanding what real transparency might be. So it will comes as no surprise that the new DPI standard was negotiated behind closed doors, with no drafts being made available.

But probably most worrying is the following aspect:

Several global standards bodies, including the IETF and W3C, have launched initiatives to incorporate privacy considerations into their work. In fact, the IETF has long had a policy of not considering technical requirements for wiretapping in its work, taking the seemingly opposite approach to the ITU-T DPI document, as Germany pointed out [doc] in voicing its opposition to the ITU-T standard earlier this year. The ITU-T standard barely acknowledges that DPI has privacy implications, let alone does it provide a thorough analysis of how the potential privacy threats associated with the technology might be mitigated.

This apparent indifference to the wider implications of its work is yet another reason why the ITU is unfit to determine any aspect of something with as much power to affect people's lives as the Internet.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: deep packet inspection, itu, privacy, wcit

The Battle For Net Neutrality Flares Up Again: But Which Countries Still Have It?

from the time-to-check dept

Net Neutrality has suddenly become a hot topic again. Partly, that's thanks to some awful ideas about regulating the Internet coming from the International Telecommunication Union, notably those proposed by the ETNO -- the European Telecommunications Network Operators Association -- discussed recently on Techdirt. New information from WCITLeaks Wikileaks (found via the Net neutrality in Europe site) provides us with the following details (pdf):

To ensure more efficient use of networks and to allow for new business models better reflecting future demand, Member States should support a new IP interconnection ecosystem that provides both, best effort delivery and end-to-end Quality of Service delivery. Delivery based on QoS allows for management of the IP traffic according to its characteristics (i.e. delivery requirements and acknowledged value) thus supporting innovation to provide a value-added service, making better use of the assets of telecommunications operators.

That may sound innocuous enough, but "supporting innovation to provide a value-added service" is a coded way of saying that the telcos should be allowed to abandon net neutrality, something confirmed in one of the accompanying proposals, which reads:

Art. 4
International Telecommunication Services
4.4 Operating Agencies shall cooperate in the development of international IP interconnections providing both, best effort delivery and end to end quality of service delivery. Best effort delivery should continue to form the basis of international IP traffic exchange. Nothing shall preclude commercial agreements with differentiated quality of service delivery to develop.

The key sentence is the last one: "differentiated quality of service delivery" means ignoring net neutrality.

That proposal to move away from net neutrality contrasts with the Netherlands' decision to enshrine it in law:

The net neutrality law prohibits internet providers from interfering with the traffic of their users. The law allows for traffic management in case of congestion and for network security, as long as these measures serve the interests of the internet user. A technical error in the law might still be corrected in a vote on 15 May. [It was.]

In addition, the law includes an anti-wiretapping provision, restricting internetproviders from using invasive wiretapping technologies, such as deep packet inspection (DPI). They may only do so under limited circumstances, or with explicit consent of the user, which the user may withdraw at any time. The use of DPI gained much attention when KPN admitted that it analysed the traffic of its users to gather information on the use of certain apps. The law allows for wiretapping with a warrant.

DPI is one of the most intrusive ways of undermining net neutrality, since it involves looking inside the data part of an IP packet, not just the header, which contains basic information such as source and destination IP addresses. A recent study from a team at the Syracuse University School of Information Studies has explored the use of DPI to throttle BitTorrent connections:

In order to better understand DPI use and the scope of its deployment, the project makes use of crowdsourced data from a network monitoring test known as Glasnost. An Internet user who runs the Glasnost test can see whether BitTorrent is completely blocked by their ISP, slowed down (throttled), or running normally.

The results for various countries are available as graphs of ISP throttling against time, and show the wide variation in BitTorrent throttling -- and hence the extent to which net neutrality is preserved around the world and by different Internet service providers.

The good news:

BitTorrent throttling by most US ISPs ceased after an FCC ruling in August 2008 that declared Comcast’s actions to be against its 2005 Internet Policy Statement. Only wireless ISPs Clearwire and Hughes showed high levels of BitTorrent manipulation after August 2008, but Clearwire substantially reduced it in 2009. But the Comcast Order was reversed by the courts in April 2010. This data shows that no US ISPs have increased their use of DPI-based throttling since April 2010, despite the absence of any network neutrality regulation in the US.

And the bad news:

The UK is one of the few countries where BitTorrent manipulation appears to be on the rise. DPI measurements for the BT Group in particular increased progressively throughout the 3-year period. Talk Talk’s use of it seems to have declined, but it is still consistently above the threshold indicating some form of manipulation. Test results for O2 UK move erratically slightly above and below the error threshold, making any conclusion difficult. Virgin Media, on the other hand, seems to have altered its policy and increased DPI-based intervention in the 4th quarter of 2010.

At a time when much of the debate about net neutrality is driven by dogma, it's particularly valuable to have some objective data on what's really happening. It's worrying that it turns out that net neutrality has been under assault in some countries for a while -- and disturbing that ETNO wants to intensify that attack still further.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: deep packet inspection, etno, europe, itu, net neutrality, united nations

Phorm Still Looking For A Large-Scale Deployment, Still Finding Investors

from the why-do-they-bother? dept

As a search through the Techdirt archives shows, Phorm's behavioral advertising service based on watching your Web activity was beset by problems in its early days. One of the last Techdirt posts on the company from a couple of years ago explained how Phorm was planning to expand overseas, and here's some news on how that's been going:

Despite Phorm softening the service in response to privacy concerns, three UK ISPs who trialled it decided not to go deploy it. Phorm moved operations to South Korea but the same happened. So it moved to Brazil.

Now operating on an opt-in basis, Phorm has finally gained actual commercial roll-out with Brazilian ISPs Oi and Telefonica and with Romania’s Romtelecom. With them, Phorm says opt-in rates have met or exceeded targets, advertiser prices have been “significantly higher than forecast” while publisher costs have met or undermet targets.

With this record, Phorm could certainly use with a few more big new markets; its financial results so far have been dismal:

The company had never recorded any revenue until the first half of this year, just $17,336. (£10902.53) In 2010, Phorm lost $28.6 (£17.99) million.

Despite that track record, it is predicting big things:

"The potential scale ... of the Brazilian business could be £7.03 ($11.13) million... The (value) of Romania could be £78 ($124.03) million," Phorm itself forecasts modestly to investors. These targets are based on Phorm scaling up from small, post-trial deployment to large-scale adoption.

It also has high hopes elsewhere:

Phorm says discussions with other global ISPs have also continued for the last three years. It plans to roll out in China and a southern Europe country early in 2012. It also says it is due to deploy in a southern Europe country it values at £483 ($768.01) million and a south-east Asian country it values at £82 ($130.39) million early next year.

Those are rather a jump from this year's six-month sales of $17,336. Undeterred by that fact, investors still seem to be piling in:

This time, it is raising £30 ($47.7) million, which will be used partly to repay a £16 ($25.44) million convertible-notes loan it took out this March and partly “to provide sufficient working capital to get to positive operational cash flow”. It is planning a cash burn of £1.1 ($1.75) million per month for the next year.

At this point, you could be forgiven for having lost track of how much money Phorm has raised and how much equity it has given out to finance its ongoing hefty losses. But paidContent has previously reported Phorm took a total £53 ($84.28) million between 2005 and 2010. The recent loan and latest funding bring that total to nearly £100 ($159.01) million.

That's pretty incredible: nearly $160 million for a service that has yet to prove itself in any large-scale deployment. There's something very strange about this persistent belief by investors that what the world is really waiting for is a service that watches your every move online to serve up targeted ads and content.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: deep packet inspection, investment, privacy
Companies: phorm

Mediacom Puts Its Own Ads On Other Websites, Including Google & Apple

from the lawsuit-waiting-to-happen dept

A few years ago, there were stories of ISPs who wanted to use deep packet inspection technology to inject their own content, especially advertising, onto websistes. AT&T even insisted that customers would like it if AT&T did this. Public outcry and Congressional scrutiny seemed to lead many ISPs to shelve such plans... but you knew it was only a matter of time.

Broadband Reports is noting that Mediacom, who recently started using DNS redirection to feed ads (rather than 404 pages) to people who ended up on non-existent web pages (and who made its "opt-out" option not really work), has jumped into the fray and is injecting its own ads for its own services on all sorts of websites including those of Google and Apple -- two companies known for caring an awful lot about what their website looks like in each and every pixel:

This seems like a lawsuit waiting to happen. If users choose to modify websites themselves, that's one thing, but having your ISP jump into the stream and adding its own advertisements to websites seems to go way over the line of what's appropriate. And, you have to wonder how effective it is. If I ever saw something like this, it would immediately make me look for alternative ISPs.

Filed Under: ad injection, deep packet inspection, isps
Companies: apple, google, mediacom

Virgin Media Using Deep Packet Inspection To Spy On Your Internet Usage For Hollywood

from the how-nice dept

Last year, there were early reports that ISP Virgin Media in the UK would become a copyright cop for the entertainment industry and start kicking file sharers offline if they were accused of infringement. While Virgin later denied this, the company did send letters threatening to kick users offline anyway. And, now, reports are coming out that Virgin Media is starting to use controversial deep packet inspection technology to spy on users to see if they're sharing any copyrighted works. As the article notes: "It's the equivalent of the Royal Mail opening every parcel to see if there's a CD inside, and making a note if there isn't a receipt in there too."

While this is just a test, and the information is being aggregated in a supposedly anonymous way just to judge the extent of the problem, there are a bunch of issues with such claims. First, there is no such thing as an anonomyzed dataset. Second, there are some pretty serious privacy questions raised by this. In the US, the use of Deep Packet Inspection for looking at what users do has been frowned upon, but in the UK it's been deemed not so bad by the legal system (however, the wider EU doesn't agree with the UK on this position). No matter how you look at it, it does seem quite extreme for your ISP to carefully look at everything you do online. In the end, of course, this will only serve to drive up the demand for encryption technology.

Filed Under: copyright, deep packet inspection, infringement, privacy, uk
Companies: virgin media

Why Is Andrew Cuomo Pushing ISPs To Use Spyware On Everyone's Internet Traffic?

from the political-ambitions-over-common-sense dept

We've already covered NY AG Andrew Cuomo's ridiculous crusade to get ISPs to censor content in a misguided attempt to stop child porn. Obviously, stopping child porn is a good goal, but Cuomo's approach actually makes the problem worse and sets a dangerous precedent. First, rather than actually tackling the root of the problem, Cuomo simply demanded that ISPs block any site that he and a group he supports consider to be child porn. Of course, they have no legal requirement to block them (section 230 of the CDA was written to make it clear that ISPs are not at all liable here), but Cuomo got around that by promising to shame publicly any ISP that didn't implement his plan. This is the lowest of the low of political tricks, and it would simply be lying. An ISP may be quite committed to stomping out child porn, and could recognize that Cuomo's tactics actually make the problem worse, by not targeting the actual pornographers -- and Cuomo would still publicly splash their names across the news as not wanting to stop child porn.

In fact, a recent look at the details of Cuomo's highly publicized campaign found that Cuomo clearly exaggerated the extent of the problem for political benefit, forcing ISPs to block all of Usenet, despite 99.9997% of the 3.7 billion available Usenet articles being perfectly legitimate content. But that's not stopping Cuomo. In fact, he's going even further.

He's been sending ISPs a presentation from a company called Brilliant Digital that's offering a "deep packet inspection" system that could scan every file sent across an ISP's network and try to determine if it was child porn. Yes, Cuomo is suggesting that ISPs spy on every single file sent over their network now, 4th Amendment be damned. Brilliant Digital even claims that its system can trick users into sending files unencrypted, so even those who send encrypted traffic could be spied upon. Cuomo claims that he's not endorsing the product, but just thought ISPs would be interested in looking into it. Yet, given his heavy handed tactics earlier in this effort, it's pretty clear what message he's sending.

But why Brilliant Digital? If the name sounds familiar, it's because the company has an extremely sketchy past that has been touched on before. It was, effectively, one of the first surreptitious "adware" installs, back in the day, when it tried to secretly distribute a "legit" P2P file sharing system that would sit on top of the popular Kazaa and give you the option of paying for songs rather than just straight file sharing them. The software was downloaded and secretly installed on one million computers, before it was revealed.

This is the company our politicians want spying on every packet sent across the internet?

Not only that, but Brilliant Digital is also (of course) rather aggressive on the patent front, suing Streamcast for daring to make use of a hash system for trying to identify music tracks being shared over a P2P network. So we have an Australian spyware company that wants to scan every bit of traffic and identify it (even if it's encrypted), and it's being pushed by a US politician who has a history of trying to publicly shame companies into doing his bidding, even if it involves lying about them. And, the whole damn thing almost certainly violates the 4th Amendment.

Last week, we wrote about Paul Ohm's suggestion that we should create a stronger privacy law that outlawed deep packet inspection, as that would pretty much stop any attempt to break net neutrality without requiring special net neutrality laws. It's worth noting that such a law would also have the added benefit of making it doubly clear to Cuomo that such a program is quite illegal.

Filed Under: andrew cuomo, deep packet inspection, isp blocking, objectionable content, porn
Companies: brilliant digital