Slashdot Mirror

← Back to Stories (view on slashdot.org)

ISPs May Be Selling Your Web Clicks

Posted by Zonk on from the hey-those-are-mine dept.

Mozzarella writes "Could our ISPs be selling our click data without us even knowing it? It seems like the practice is happening a lot more than we realize, and can be tracked for each user. Complete Incorporated's CTO David Cancel told Ars Technica that his company (an internet research firm) licenses click information from ISPs for 'millions of dollars' to figure out how we use the web. From the article: 'He did not give a specific figure about what this broke down to in terms of dollars per ISP user, although someone in the audience estimated that it was in the range of 40 per user per month — this estimate was erroneously attributed to Cancel himself in some reports on the event. Cancel said that this clickstream data is 'much more comprehensive' than data that is normally gleaned through analyzing search queries.'"

9 of 110 comments (clear)

  1. Your Internet soul was sold years ago by BristolCream · · Score: 5, Informative

    There is little new here. Companies such as http://www.hitwise.com/ have been purchasing raw traffic data for years. They place a box at switch level and monitor everything about everyone and the sell on the reports for profits. The last time I had a quote from them it was in the region of $28k to monitor footfall to a single site for a year. Access to the full data set can run into the hundreds of thousands.

    1. Re:Your Internet soul was sold years ago by cswiger · · Score: 3, Informative

      Well, you can get free tools like analog or webalyzer, or commercial things like Unison, which process a webserver logfile and generate all kinds of reports like search terms, OS & user-agent breakdowns, aggregated over various time-intervals, without installing an inline traffic sniffer.

      But there's a difference between a website analyzing the traffic sent to it, particularly if reasonable notice in the site's privacy policy is there, and reselling that data to third parties, or gathering data from all sites going by an MAE or ISP NAP without any permission or notification. The former is something which most people take for granted when they decide to browse to a site, but the latter is not something which most people assume is OK.

      Fortunately, using SSL is a pretty good defense against man-in-the-middle attacks, so long as the server keys have not been compromised-- trying to analyze HTTPS traffic only gives you source and dest IPs, but no info about the specific URLs being hit, cookies, search keywords, and so forth.

      --
      "The human race's favorite method for being in control of the facts is to ignore them." -Celia Green
    2. Re:Your Internet soul was sold years ago by BristolCream · · Score: 3, Informative

      I'm not talking about statistics collected at site level. Hitwise place a box at switch elvel with consumer ISP's, tracking everywhere they go and eveything the do. Seriously. Read all about here.

    3. Re:Your Internet soul was sold years ago by Anonymous Coward · · Score: 2, Informative

      What is needed is an anonymous network beyond the government watched Tor and simple proxifiers. A new network is needed. A few people have created an anonymous, deniable, virtual Internet using OpenVPN and Quagga. anoNet has all the luxuries of the Internet (http, ftp, IM, IRC, p2p, search, etc.). They also have full DNS and IP/AS registration to keep things sane. Unlike the Internet all registration is anonymous and private. This network is not a warez network at all, merely a group of people who want a different network, founded on privacy.

      http://www.anonet.org/

  2. Possible by HomelessInLaJolla · · Score: 3, Informative

    While a counterattack is possible there are two mitigating factors:

    First, philosophically, it is always the course of greater wisdom to explore extinguishing the problem using passive resistance (eg. avoiding offending services). Sadly, this is rarely effective against a determined aggressor but it does prevent unnecessary conflict by establishing a baseline of just how determined the aggressor is.

    Second, in terms of time, the information gathering industry is way ahead of us and the internet laws are written to be easily used against people who would interfere with their exploits.

    All in all, though, data pool pollution would be an effective approach if the aggressor has been determined to be resolute and the legal aspect weren't so grim.

    --
    the NPG electrode was replaced with carbon blac
  3. Re:Is this legal? by scribblej · · Score: 2, Informative

    I use ComCast.

    When you sign up, they have a disk you are supposed to use to get started.

    It's a damn internet connection. I don't need a disk for that. nor will I use one. Plus, I'm on Linux, which they don't support.

    The practical upshot of this is, I've never seen a contract. I called them up to activate service over the phone. No EULAs, no clicking, no "I agree," nothing.

  4. Re:Is this legal? by TuballoyThunder · · Score: 2, Informative
    You probably agreed to quite a few things.

    By using this service you are agreeing to
    • Operator Acceptable Use Policy
    • Cable Modem Service Subscription Agreement
    • Time Warner Cable and Affiliated ISPs Subscriber Privacy Notice
    and, from the Operator Acceptable Use Policy

    e) In addition to the foregoing, Operator and ISP each shall have the right at any time to add to, modify or delete any aspect, feature or requirement of the ISP Service, including but not limited to content, equipment and system requirements. Operator shall have the right to add to, modify or delete any provision of this Agreement and/or any Terms of Use established by Operator and/or the Subscriber Privacy Notice at any time. An online version of this Agreement, the Terms of Use, and the Subscriber Privacy Notice, as so changed from time to time, will be accessible at http://help.twcable.com/ or another online location as designated by Operator. Operator will notify Subscriber of any significant change in this Agreement, the Terms of Use or the Subscriber Privacy Notice. Upon any such change, Subscriber's continued use of the ISP Service will constitute Subscriber's consent to such change. If Subscriber does not agree to any such change, Subscriber immediately shall stop using the ISP Service and notify Operator and ISP that he/she is terminating the subscription to the ISP Service.
  5. Typo by merreborn · · Score: 2, Informative

    That's $0.40 dollars per user, not $40. The cents sign is missing from the summary.

  6. Re:Is this IANAL but...? by Sparr0 · · Score: 2, Informative

    One less than you have now told us. I have an implicit contract with all of my utility companies. They give me [something], I give them money in return. That's it, the bulk of our spoken and/or implicit agreement. If either of us want more out of the deal, it would need to be spelled out and signed.