Russia Ramps Up Censorship Beef With Twitter Using Deep Packet Inspection Tech

from the not-helping dept

Over the last decade Russia has accelerated the government's quest to censor the internet. That was most conspicuous with the passage of a 2016 surveillance bill that not only mandated encryption backdoors, but effectively banned VPN providers from operating in the country unless they were willing to spy and censor at Putin's behest. Many VPN providers weren't keen on that, so they simply stopped doing business in the country.

More recently, Russia has been engaged in a bit of a hissy fit over Twitter's unwillingness to censor things the Russian government doesn't like. And while Twitter has been trying to filter more illegal behavior and pornography at the government's behest, the company hasn't been censoring broader content at the rate Putin and pals prefer. So as punishment, Russia has taken to throttling user access to Twitter to a rather 1997-esque 128 kbps, or about the speed of an old IDSN line. Granted the ham-fisted gamesmanship Russia has been engaged in has already resulted in some notable collateral damage:

New data suggests (you can find the technical specifics here) that Russia is engaging in the throttling via the use of "middleboxes" that Russian ISPs have installed as close to the customer as possible. Russian authorities then feed data on which domain should be throttled and punished to the devices, which utilize deep packet inspection to identify targeted traffic. Ars Technica notes that the deep packet inspection technology (which US ISPs also use, though most frequently for targeted advertising) opens the door to a much more sophisticated tracking and censoring regime less prone to collateral damage:

"The middleboxes inspect both requests sent by Russian end users as well as responses that Twitter returns. That means that the new technique may have capabilities not found in older Internet censorship regimens, such as filtering of connections using VPNs, Tor, and censorship-circumvention apps. Ars previously wrote about the servers here.

The middleboxes use deep packet inspection to extract information, including the SNI. Short for “server name identification,” the SNI is the domain name of the HTTPS website that is sent in plaintext during a normal Internet transaction. Russian censors use the plaintext for more granular blocking and throttling of websites. Blocking by IP address, by contrast, can have unintended consequences because it often blocks content the censor wants to keep in place.

New reports suggest there are around seven countermeasures Russian companies and citizens can use to thwart these efforts, including ECH, or Encrypted ClientHello, an update for the Transport Layer Security protocol that prevents domain blocking and throttling. That forces government censors to rely on the more collateral damage-prone IP-level blocklists, which (might) act as a deterrent for censorship obsessed governments that don't want a whole lot of attention focused on the fact they're massive cowards afraid of the free exchange of information that might challenge their hegemony.

Filed Under: censorship, deep packet inspection, russia, throttling
Companies: twitter

If You're Pissed About Facebook's Privacy Abuses, You Should Be Four Times As Angry At The Broadband Industry

from the selective-outrage dept

To be very clear, Facebook is well deserving of the mammoth backlash the company is experiencing in the wake of the Cambridge Analytica revelations. Especially since Facebook's most substantive reaction to date has been to threaten lawsuits against news outlets for telling the truth. And, like most of these stories, it's guaranteed that the core story is only destined to get worse as more and more is revealed about the way such casual handling of private consumer data is pretty much routine not only at Facebook, but everywhere.

Despite the fact that consumer privacy apathy is now bone-grafted to the DNA of global corporate culture (usually only bubbling up after a scandal breaks), the outrage over Facebook's lack of transparency has been monumental.

Verizon-owned Techcrunch, for example, this week went so far as to call Facebook a "cancer," demanding that readers worried about privacy abuses delete their Facebook accounts. The #Deletefacebook hashtag has been trending, and countless news outlets have subsequently provided wall to wall coverage on how to delete your Facebook account (or at least delete older Facebook posts and shore up app-sharing permissions) in order to protect your privacy.

And while this outrage is well-intentioned and certainly justified, a lot of it seems a touch naive. Many of the folks that are busy deleting their Facebook accounts are simultaneously still perfectly happy to use their stock smartphone on a major carrier network, seemingly oblivious to the ugly reality that the telecom sector has been engaged, routinely, in far worse privacy violations for the better part of the last two decades. Behavior that has just as routinely failed to see anywhere near the same level of outrage by consumers, analysts or the tech press.

You'll recall that a decade ago, ISPs were caught routinely hoovering up clickstream data (data on each and every website you visit), then selling it to whoever was willing to pony up the cash. When ISPs were asked to share more detail on this data collection by the few outlets that thought this might not be a good idea, ISP executives would routinely play dumb and mute (they still do). And collectively, the lion's share of the press and public generally seemed OK with that.

From there, we learned that AT&T and Verizon were effectively bone grafted to the nation's intelligence apparatus, and both companies were caught routinely helping Uncle Sam not only spy on Americans without warrants, but providing advice on how best to tap dance around wiretap and privacy laws. When they were caught spying on Americans in violation of the law, these companies' lobbyists simply convinced the government to change the law to make this behavior retroactively legal. Again, I can remember a lot of tech news outlets justifying this apathy for national security reasons.

Once these giant telecom operators were fused to the government's data gathering operations, holding trusted surveillance partners accountable for privacy abuses (or much of anything else) increasingly became an afterthought. Even as technologies like deep packet inspection made it possible to track and sell consumer online behavior down to the millisecond. As the government routinely signaled that privacy abuses wouldn't be seriously policed, large ISPs quickly became more emboldened when it came to even more "creative" privacy abuses.

Like the time Verizon Wireless was caught covertly modifying user data packets to track users around the internet without telling them or letting them opt out. It took two years for security researchers to even realize what Verizon was doing, and another six months for Verizon to integrate an opt out function. But despite a wrist slap by the FCC, the company continues to use a more powerful variant of the same technology across its "Oath" ad empire (the combination of AOL and Yahoo) without so much as a second glance from most news outlets.

Or the time that AT&T, with full regulatory approval, decided it would be cool to charge its broadband customers hundreds of additional dollars per year just to protect their own privacy, something the company had the stones to insist was somehow a "discount." Comcast has since explored doing the same thing in regulatory filings (pdf), indicating that giant telecom monopolies are really keen on making consumer privacy a luxury option. Other companies, like CableOne, have crowed about using credit data to justify providing low income customers even worse support than the awful customer service the industry is known for.

And again, this was considered perfectly ok by government regulators, and (with a few exceptions) most of these efforts barely made a dent in national tech coverage. Certainly nowhere near the backlash we've seen from this Facebook story.

A few years back, the Wheeler run FCC realized that giant broadband providers were most assuredly running off the rails in terms of consumer privacy, so they proposed some pretty basic privacy guidelines for ISPs. While ISPs whined incessantly about the "draconian" nature of the rules, the reality is they were relatively modest: requiring that ISPs simply be transparent about what consumer data was being collected or sold, and provide consumers with working opt out tools.

But the GOP and Trump administration quickly moved (at Comcast, Verizon and AT&T's lobbying behest) to gut those rules via the Congressional Review Act before they could take effect. And when states like California tried to pass some equally modest privacy guidelines for ISPs on the state level to fill the void, telecom duopolies worked hand in hand with Google and Facebook to kill the effort, falsely informing lawmakers that privacy safeguards would harm children, inundate the internet with popups (what?), and somehow aid extremism on the internet. You probably didn't see much tech press coverage of this, either.

So again, it makes perfect sense to be angry with Facebook. But if you're deleting Facebook to protect your privacy but still happily using your stock, bloatware-laden smartphone on one of these networks, you're just trying to towel off in a rainstorm. The reality is that apathy to consumer privacy issues is the norm across industries, not the exception, and however bad Facebook's behavior has been on the privacy front, the telecom industry has been decidedly worse for much, much longer. And whereas you can choose not to use Facebook, a lack of competition means you're stuck with your snoop-happy ISP.

We've collectively decided, repeatedly, that it's OK to sacrifice consumer privacy and control for fatter revenues, a concept perfected by the telecom sector, and the Congressional and regulatory lackeys paid to love and protect them from accountability and competition. So while it's wonderful that we're suddenly interested in having a widespread, intelligent conversation about privacy in the wake of the Facebook revelations, let's do so with the broader awareness that Facebook's casual treatment of consumer privacy is just the outer maw of a mammoth gullet of dysfunction.

Filed Under: broadband, deep packet inspection, privacy, surveillance
Companies: at&t, comcast, facebook, verizon

AT&T Stops Charging Broadband Users Extra For Privacy

from the privacy-is-a-luxury-option dept

A few years ago, AT&T came up with an "ingenious" idea: charge broadband consumers more money if they want to protect their privacy. Under this plan, users ordering AT&T's U-Verse broadband service could get broadband for, say, $70 a month. But if you want to opt out of AT&T's Internet Preferences program (which uses deep packet inspection to study your movement around the Internet down to the second) you'll pay $30 to $50 more, per month. AT&T also made opting out as cumbersome as possible, knowing full well that few people would dare take the option.

With its decision, AT&T effectively made user privacy a luxury option.

After years of this behavior, AT&T suprisingly proclaimed last week that it would be eliminating the privacy surcharge and its Internet Preferences behavioral advertising service completely this month:

"To simplify our offering for our customers, we plan to end the optional Internet Preferences advertising program related to our fastest Internet speed tiers," an AT&T spokesperson confirmed to Ars today. "As a result, all customers on these tiers will receive the best rate we have available for their speed tier in their area. We’ll begin communicating this update to customers early next week."

Why the sudden AT&T about-face? While AT&T claims it's just concerned about "simplicity," the real reason is because the FCC is considering some basic privacy protections for broadband users, who often can't vote against bad behavior with their wallet thanks to the lack of competition in the broadband space. AT&T's decision to issue a surcharge for privacy was one of the primary reasons the FCC began the privacy rulemaking proceeding. AT&T's lobbyists and lawyers clearly hope that if they eliminate this controversial program, they'll be more easily able to argue that broadband privacy rules aren't necessary.

Broadband ISPs have consistently tried to argue that consumer broadband privacy protections aren't necessary because carriers are fantastic at self-regulating on this front. Yet time and time again they've proven that's simply not the case. Verizon, for example, proclaimed in 2008 that broadband privacy protections weren't necessary because "public shame" would keep the company on its best behavior. Fast forward to 2014 and Verizon was caught covertly modifying user wireless data packets to track customer behavior around the internet -- without notifying consumers or offering working opt-out tools.

It took security researchers two years before they even discovered what Verizon was doing. It took another six months before Verizon was even willing to provide customers with working opt-out tools. That's fairly consistently what "self regulation" on the broadband privacy front looks like.

While they've been portrayed by ISPs as mammoth overreach, the FCC's proposed broadband privacy rules are relatively basic, simply requiring that ISPs are completely transparent about what they're collecting and selling, while requiring ISPs also provide working opt-out tools. ISPs, eagerly hoping to compete with Google and Facebook on the advertising front (see Verizon's acquisitions of AOL and Yahoo), don't want any regulations that put them at a competitive disadvantage, arguing the playing field should be level as they eye billions in new advertising revenues.

The problem with that argument is that while internet users can choose not to use Facebook and Google, they all-too-often have no such luxury when it comes to broadband. So while regulations aren't entirely ideal, there's an argument that (like net neutrality rules) they're necessary until we can get something vaguely resembling competition established in the broadband space. Until that happens, and without meaningful privacy protections, there's absolutely nothing preventing AT&T's next "great idea" from being aggressively worse.

Filed Under: broadband, charges, deep packet inspection, fcc, privacy, surcharge
Companies: at&t

Former DHS Boss Puts University Of California Employees Under Secret Surveillance

from the you-didn't-see-anything-so-you'd-better-not-say-anything dept

Former DHS boss Janet Napolitano -- who once stated she "doesn't use email" (for many reasons, but mainly to dodge accountability) -- is now showing her underlings at the University of California why they, too, might not want to "use email": someone might be reading them over their shoulders.

UC professor Christopher Newfield has the inside details of the recently-exposed monitoring system secretly deployed by the University of California (and approved by school president Napolitano) to keep tabs on the communications, web surfing and file routing of its employees. The SF Chronicle has an article on the secretly-installed spyware behind its paysieve [try this link], but Newfield has the internal communications.

The installation of the third-party monitoring software was so secretive that even the university's campus information technology committee was forbidden from discussing it with other staff. The committee has now decided to go public.

UCOP would like these facts to remain secret. However, the tenured faculty on the JCCIT are in agreement that continued silence on our part would make us complicit in what we view as a serious violation of shared governance and a serious threat to the academic freedoms that the Berkeley campus has long cherished.

Some salient facts:

- The UCOP had this hardware installed last summer.

- They did so over the objections of our campus IT and security experts.

- For many months UCOP required that our IT staff keep these facts secret from faculty and others on the Berkeley campus.

- The intrusive hardware is not under the control of local IT staff--it sends data on network activity to UCOP and to the vendor. Of what these data consists we do not know.

- The intrusive device is capable of capturing and analyzing all network traffic to and from the Berkeley campus, and has enough local storage to save over 30 days of *all* this data ("full packet capture"). This can be presumed to include your email, all the websites you visit, all the data you receive from off campus or data you send off campus.

The official excuse for the installation of intrusive spyware is "advanced persistent threats" possibly related to a cyberattack on the UCLA Medical Center last summer. How monitoring staff emails plays into the thwarting of "threats" hasn't been explained. Now that the secret's out, the university is claiming it's all good because policies prevent the university from using any intercepted information/communications for "nonsecurity purposes."

The university may have a policy forbidding this activity, but that's not really the same thing as guaranteeing abuse of this surveillance will never happen. Its belated not-an-apology offers no contrition for keeping this a secret from a majority of its staff. And the statement does not name the third party in charge of the collection and monitoring.

While it certainly isn't unusual for employers to monitor employees' use of company computers and devices, it's normally clearly stated in policy manuals, rather than installed surreptitiously and cloaked in deep secrecy.

As Newfield points out, no one was apprised of the monitoring until after it was underway. Some heard a few weeks after the monitoring was put in place (August of last year) when the university updated its security policies following the medical center breach. Many more heard nothing until the first week of December. Following the wider exposure, staffers were assured by the school's vice president that the monitoring would cease and the software would be removed.

The VP said one thing and the school did another.

On Jan. 12, 2016, The Berkeley Joint Committee on Campus Information Technology (JCCIT) met with Larry Conrad and others. The committee was informed that contrary to the Dec. 21, 2015 statements, UCOP had decided to continue the outside monitoring and not disclose any aspects of it to students or faculty.

At this point, the decision was made to go public. A letter was drafted and sent to school administration. It was also sent to the New York Times. This prompted the generation of bullshit from the Executive VP's office.

On Jan. 19, 2016, UCOP Exec. VP and COO Rachael Nava sent a letter to those who signed the Jan. 15, 2016 letter. The original version was marked "CONFIDENTIAL: DO NOT DISTRIBUTE" and invoked "Attorney-Client privilege". After several recipients responded to her via email questioning who is the client and why her letter must be kept secret, a revised version of the letter was sent the next day removing that language, stating: "All: Please accept my apologies with regard to the confusion on the attorney client privilege language on the letter. It was a clerical error and was not intentional. Please find a revised version of the letter with the language removed."

The full letter contains some truly incredible statements.

With respect to privacy, the letter and structure of the University’s Electronic Communications Policy (ECP) reflect the principle that privacy perishes in the absence of security. While the ECP establishes an expectation of privacy in an individual’s electronic communications transmitted using University systems, it tempers this expectation with the recognition that privacy requires a reasonable level of security to protect sensitive data from unauthorized access.

Privacy does not "perish" in the absence of security. This conflation of the two is ridiculous. If a malicious party accesses private communications, that's a security issue. If an employer accesses these communications, that a privacy issue. Claiming to value privacy while secretly installing monitoring software (and then lying about removing said software) only serves to show the university cares for neither. By adding a third party to the monitoring process, the university has diminished the privacy protections of its staff and added an attack vector for "advanced persistent threats." It has effectively harmed both privacy and security and, yet, still hopes to claim it was necessary to sacrifice one for the other.

The other statement, tucked away as a footnote, absurdly and obnoxiously claims the real threat to privacy isn't the school, but people making public records requests.

Public Records Act requesters may seek far more intrusive access to the content of faculty or staff records than what the ECP permits for network security monitoring. The limits on the University’s own access to electronic communications under the ECP do not apply to Public Records Act requests.

Meanwhile, the school's tech committee has pointed out its IT staff is more than capable of handling the privacy and security of the network and, quite obviously, would show more respect for their colleagues' privacy while handling both ends of the privacy/security equation.

It's perfectly acceptable for entities to monitor employees' use of communications equipment. But you can't do it this way. You can't install the software secretly, swear certain employees to secrecy, not tell anyone else until the secret is out in the open, promise to roll it back and then secretly decide to do the opposite, etc. And when challenged, you can't play fast and loose with "security" and "privacy" as if they were both the same word spelled two different ways.

[Update: a TD reader has given us a copy of Janet Napolitano's response to the outcry over the school's secret surveillance efforts. A new post on that letter is on the way. If you'd like a head start, it's embedded below.]

Filed Under: deep packet inspection, dhs, janet napolitano, surveillance
Companies: university of california

Dear ZDNet: Comcast Has Been Sketchily Injecting Messages Into User's Browsers For Years

from the old-news-bad-news dept

Comcast has been dutifully modeling its behavior in such a way so as to fill up Techdirt's story pages for years now. So, when we come across a story somewhere discussing how Comcast is doing some bad new thing, it's tempting to simply assume it's true and move on. Such might be the case for some readers of ZDNet's recent post about how Comcast was injecting notices into browsers warning of potential copyright infringement.

The cable and media giant has been accused of tapping into unencrypted browser sessions and displaying warnings that accuse the user of infringing copyrighted material -- such as sharing movies or downloading from a file-sharing site. Jarred Sumner, a San Francisco, Calif.-based developer who published the alert banner's code on his GitHub page, told ZDNet in an email that this could cause major privacy problems.

Well, sure, this is horrible, and it is a privacy issue -- but it isn't new. In fact, Comcast as been doing some flavor of this sort of browser injection for the better part of a decade. The company started this practice way back in 2009, using the tactic to warn users of potential malware infections, and there was even discussion about expanding the use for other security purposes in 2011. More specifically on browser injections being used as a copyright warning system, our own Karl Bode noted in 2013 that this was all specifically laid out in Comcast's six-strike plan. Per Karl's post, Comcast isn't even alone in using this tactic.

Comcast has now put information on their implementation of six strikes online. According to the nation's largest broadband company, their version of the program will involve a persistent nagging pop up that continues to alert the user after the fourth warning. Time Warner Cable, who outlined their version of the plan to me last November , stated they're using a similar pop up warning system that blocks browsing until users acknowledge receipt of "educational" copyright materials.

None of that is to say that the privacy and security concerns aren't very real, of course, and ZDNet does a nice job of discussing those concerns. But it's not new. Perhaps the better conversation to be had is why anyone in their right minds would think that Comcast deserves anyone's trust to the level where users' browsers should be injected with copyright violation notices in a system rife with abuse from pretty much every player involved.

Filed Under: alerts, copyright, deep packet inspection, injection
Companies: comcast

AT&T's $30 'Don't Be Snooped On' Fee Is Even Worse Than Everybody Thought

from the ill-communication dept

Last week we noted that while AT&T has been trying to match Google Fiber pricing in small portions of several markets, it has been busily doing it in a very AT&T fashion. While the company is offering a $70, 1 Gbps service in some locations, the fine print indicates that users can only get that price point if they agree to AT&T's Internet Preferences snoopvertising program. That program uses deep packet inspection to track your online behavior down to the second -- and if you want to opt out, that $70 1 Gbps broadband connection quickly becomes significantly more expensive.

While most people thought this was rather dumb, AT&T actually received kudos on some fronts for trying something new. Apparently, the logic goes, AT&T charging you a major monthly fee to not be snooped on will result in some kind of privacy arms race resulting in better services and lower prices for all. While sometimes that sort of concept works (Google and Apple scurrying to profess who loves encryption more, for example), anybody who believes this is a good precedent doesn't know the U.S. telecom market or AT&T very well.

As Stacey Higginbotham at GigaOM notes, it's not as simple as just paying AT&T a $30 to not be snooped on. AT&T actually makes it very difficult to even find the "please don't spy on me option," and saddles the process with a number of loopholes to prevent you from choosing it. In fact, you're not even able to compare prices unless you plug in an address that's in AT&T's footprint, but currently doesn't have AT&T service. Meanwhile, according to Higginbotham's math, even if you're successful in signing up, that $30 privacy fee is actually much more depending on your chosen options. If you just want broadband, opting out of AT&T snoopvertising will actually run you $44:

"Gigabit service costs $99 per month under the Standard Plan plus a $7 monthly fee modem rental fee and a $99 one-time activation fee, that nets out to a monthly cost of $114. The Internet Preference Plan waives the one-time activation and monthly modem fee which means you pay only $70 a month, giving you a true cost of $44 a month if you choose the privacy-preserving option."

It's worse if you want to sign up for television services:

"The Standard Plan has a higher cost of $149 per month plus the $7 monthly fee and a one-time $49 activation fee. Only you also add in a $10 monthly service fee for HD TV and a $16 monthly fee for HBO Go which are included in the Internet Preference Plan. So the comparable plan nets out to $186, which costs $66 more than the $120 you’d pay for letting AT&T sneak a peek at your home broadband web surfing habits."

So no, AT&T isn't opening up some brave new frontier here where consumers have greater control of privacy. It's charging you a huge premium just to opt out of deep packet inspection, and making it as expensive and as confusing as possible to do so.

Filed Under: broadband, competition, deep packet inspection, internet preferences, privacy
Companies: at&t

Comcast NBC Universal Already Moving Past Six Strikes; Trying New Malware Popups Urging Downloaders To Buy

from the that-seems-like-a-bad-idea dept

The "six strikes" Copyright Alert System (CAS) is barely under way and already Comcast/NBC Universal are looking to go beyond it with malware-like popups that show up as you download a piece of content, pushing you to buy it (well, "license" it) via an authorized source. Variety has the details at the link above, though late in the article it seems to suggest that this is all really coming from the NBC Universal side, not the Comcast side, which shouldn't come as a huge surprise:

While Comcast knows the solution is feasible, the company’s engineers haven’t formally begun work on it. The project is being worked on in tandem with engineers at NBC Universal, the content side of the conglomerate.

That certainly sounds like something cooked up on the NBC Universal side of things. The offering here sounds ridiculous and intrusive:

As sources described the new system, a consumer illegally downloading a film or movie from a peer-to-peer system like Bittorrent would be quickly pushed a pop-up message with links to purchase or rent the same content, whether the title in question exists on the VOD library of a participating distributor’s own broadband network or on a third-party seller like Amazon.

This highlights a few key points:

• For all the fuss about the six strikes system and how important it was, it sure sounds like yet another expensive disaster in a long line of expensive disasters by the legacy entertainment industry in its quixotic quest to stamp out infringement. They still don't get that this isn't an education problem, nor is it an enforcement problem. It's a service problem. And being creepy and spying on what people are surfing on isn't going to make people feel particularly warm and fuzzy about moving on to buy something.
• Popups are a bad idea. As in really, really bad. First off, it just pisses people off to get any sort of popup. Second, the only way to do this is by effectively spying on all trafffic -- i.e., some sort of deep packet inspection/malware-like setup monitoring everything you do. Anyone who doesn't think that doesn't open up opportunities for abuse and security vulnerabilities hasn't been paying much attention.
• As many people warned, you knew that the legacy entertainment industry would never believe that the six strikes program was "enough." They have huge staffs of "anti-piracy" people who need to stay employed, so you had to know they were cooking up more. But, no matter what plan is agreed to, there's always going to be mission creep as they try to get more and more and more.
• Any system that involves spying on the activities of users is going to be a non-starter. Creeping the hell out of people isn't a way of encouraging them to buy. It's a way of encouraging them to want nothing to do with you.
• My favorite part: the system would include affiliate links within the alerts in an attempt to drive extra revenue and to encourage other ISPs and sites to participate. I guess it's better than pressuring companies with a stick, but the affiliate link carrot just feels sleazy.

In the end, as we've been saying all along, the way to deal with infringement is by offering users a good reason to buy. That means providing them with more value -- whether it's direct value from purchasing authorized versions or something like a connection (e.g., so that people want to support the content creator directly). Anything that involves trying to pressure people just turns people off. It's the difference between setting up a store so that it's friendly and inviting, and filling a store with pushy salespeople who keep scolding you. One system attracts customers, the other attracts disdain. Why the legacy guys always go with the "disdain" path is beyond me.

Filed Under: copyright, copyright alert system, deep packet inspection, infringement, malware, popups, six strikes
Companies: comcast, nbc universal