Slashdot Mirror
ISPs Using "Deep Packet Inspection" On 100,000 Users
dstates writes "The Washington Post is reporting that some Internet Service Providers (ISP) have been using deep-packet inspection to spy on the communications of more than 100,000 US customers. Deep packet inspection allows the ISP to read the content of communications including every Web page visited, every e-mail sent and every search entered, in short every click and keystroke that comes down the line. The companies involved assert that customers' privacy is protected because no personally identifying details are released, but they make money from advertisers who use the information to target their online pitches. Deep packet inspection is a significant expansion over tools like cookies in the ability to track a user. Critics liken it to a phone company listening in on conversations."
..., ssh, pgp all the time!
DNSSec and opportunistic IPSec should put an end to the snooping and throttling once and for all.
Thats it, I say webservers move to SSL only transactions. All other plaintext transmissions should get encrypted at the endpoints transparently. Then when the government whines about not being able to find the terrorists they can blame datamining companies that paid for their election campaign. Then they can make a law that forces a back-door, which would create a need for some nifty-ass steganography which would lead to massively excessive processor and network overhead (encryption and steganography respectively) for the most basic of transactions which would lead to NSA funded algorythms to find these hidden messages which would. . .holy shit it's almost 10AM, I need to hit the sack.
If you are about to mod me down, keep in mind that this post was most likely sarcastic.
If ISPs are monitoring traffic so closely, doesn't that make them more responsible for what people are using their service for? Namely piracy.
Let's start turning over rocks in the private lives of telcom CEO's and see what scurries out. I'm sure they won't mind, it's in the interests of an open society and free debate, don'cha know.
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
Never mind that it's evil, or that it's a great step to losing their common-carrier status.
Never mind that it's a true violation of privacy.
Never mind that I block cookies pretty well and I run with NoScript most of the time and I don't see very many ads, and besides, half of the time I'm inside my employer's VPN.
But even more than that, I have seven other users in my household, half of them teenagers. If they want to sniff all of my NAT-ed packets coming out, they're going to discover that I'm a geek who has four Facebook sites, likes art and hates it, plays Runescape incessantly (the 10-year-old), likes the Wiggles, and works as a beauty consultant. So go ahead and hand me the ad for the latest XBox game (I hate games). Offer my kids server hardware, and see if you can get my wife to click on fun games to play with the Backyardigans. Oh, wait, you already do. It's called "not targeting advertising", and it's free.
So what we have is a thoroughly broken high-cost borderline-illegal absolutely-unethical service offered to advertisers in a difficult economic period. By people who we all hate a lot, and who will rapidly become targets for everything from blocking to legislative action to you name it.
I knew there would be some kind of career move for spam kings in the future. I just thought it would pay better.
I predict a less than stellar outcome for these idiots, and they deserve every painful moment.
Isn't this the real issue with clogging 'tubes'? How can the government and ISPs keep up with the computational resources needed to continue this as we demand greater and greater amounts of bandwidth? OK, so they could only inspect http traffic, rather than say, bittorrent traffic, but OMG what happens when 'terrorists' start communicating with other protocols?
If these are the ISPs (as opposed to the visited web sites) doing the spying, then how are the advertising companies involved supposed to deliver the content? Are they going to use the same "deep packet" method to inject the advertising? If the advertising delivery is away from that deep packet inspection, then how do they identify which user was interested in penis enlargement products vs. which user was interested in replica watches? Or are the ISPs going to lock-in the IP address, now?
now we need to go OSS in diesel cars
The difference is that in the first case, the data passes through a dumb machine that compresses, caches, etc. The result is cached like it is expected (RFC 2616 is pretty clear about that), even though it is done transparently. No need to keep logs about who downloaded what.
In this case, the data is explicitly mined, by a company interested in building a profile of each user. It doesn't say it is limited to web traffic only, only that "Nor does NebuAd record a user's visits to pornography or gaming sites or a user's interests in sensitive subjects -- such as bankruptcy or a medical condition such as AIDS.", which I doubt both on technical grounds and because it is a market and someone will want to take advantage and "The company said it processes but does not look into packets of information that include e-mail or pictures." which I think is in contradiction with other parts of the article and even if they didn't, it's a matter of time before they do.
Basically, it's the intent that counts. The ISP can intercept everything they want because they're in the middle. When they start doing so for reasons that are not part of maintaining the communications as specified (like forwarding, maybe firewalling and proxying depending on the conditions), alarms should go off.
GPG 0x1B479C78
Search for info on heartburn... get some post cards advertising the latest antacid. Search for info about Lasik eye surgery... gee handy flyers about your local providers appear.
You get the idea. If I were selling a service and an ISP offered to sell me names and addresses based on keyword searches, why wouldn't I buy that list?
This issue is a bit more complicated than you think.
Ever get the feeling the the Internet just isn't worth it anymore?
Government's idea of a balanced budget: take money from the right pocket to balance...oh who am I kidding?
standing up for our rights is the answer. unfortunately, corporations listen only to once voice, money, so hit them where it hurts.
Cancel your internet, refuse to pay your bills... boohoo, then you won't have internet? you won't have internet anyway, if they get their way.
We *do* need fewer laws. However, the ones that remain need to be effective and of value, and actually enforced.
The law to protect your right to privacy already exists, it just needs to be enforced. Creating more laws doesn't help with lack of enforcement of what is already there.
---- Booth was a patriot ----
And if I hear one libertarian say we need less laws, I'll puke.
Pesky semantics....
While it may be true that the actual raw number of laws presently on the books is huge and unwieldy, and while it may be true that the removal of many of those laws would actually bring a good deal of efficiency while also eliminating some loopholes that are routinely exploited to the detriment of the majority, and while it may be true that a common knee-jerk response to any kind of exploitive behavior is to cry "pass a law that says you can't" even which there is actually no feasible way to construct or enforce a law that will accomplish that.....while all these things may be true...
Sometimes, it is also true that in this specific circumstance, a new law is actually feasible, beneficial, and totally warranted.
While I don't have a problem with far-reaching statements like "we need fewer laws," I DO have a problem with the thoughtless application of such statements to all circumstances equally. Not all circumstances are equal, and they must each be intelligently judged, on a case-by-case basis.
I hope I didn't make you puke.
> I pay for a dedicated server (essentially colo but they provide
> the hardware) from a company with a decent AUP. I put linux on
> the server and run squid.....
And you are a fool with more money and tech knowledge than you have the brains to use wisely.
Exactly what are you hoping to accomplish by going to all of that bother? Your last mile ISP can't monitor you but the hosting company and THEIR ISP can so you have just shifted the point of attack.
And the government (which is what you are afraid of, right?) can't monitor either (the spooks can but anything they find can't be used against you in a court... they would just have to kill ya) without a warrant. And with a warrant they can monitor you wherever. Doing the kind of crap you are doing makes you a likely target for governmnet snooping. So don't come whining to me whne ya find a keylogger on your machine.... buried inside your keyboard controller chip.
Democrat delenda est
Brilliant post! The problem, though, is that the citizens will not stand up for their rights, because our current culture is taught to depend on the government to fix all of the problems. If citizens were to take a stand on the issue, government and corporations would see that it is not in their best interest to continue these practices. What needs to happen is (as has previously been posted) citizens encrypting their communications and taking other steps (Tor, Freenet, etc.) to prevent snooping, government, corporate, or otherwise.
Liberty and capitalism don't solve problems, they just give us an opportunity to. That's why less government is good.
Do away with our corrupt tax code. Support the Fair Tax
What ever happened to "A government of the people, by the people and for the people"? Get involved, and stay involved. As Adlai Stevenson (who??) said, "In a democracy, people get the government they deserve."
Statesman
Some of us do not use Google mail or Google desktop search for exactly the reasons you give.
Statesman
Fedex and UPS open your packages to look at what you are shipping so they can sell that data to advertisers?
rather they're searching through it looking for things that look suspiciousDid you even bother to RTFA? Wait, dumb question around here. This has nothing to do with looking for 'suspicious activity'. The ISPs in question are allowing third-party companies to build profiles of their users by spying on their traffic in order to do targeted advertising.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
I don't use gmail by choice because of this policy. Gmail isn't a free service, there is a cost to your privacy and if you make that choice, great. I have my own domain specifically for this reason that I'm not under the rules of another company. But for communications that I pay for, my isp thinks they can eavesdrop? Big difference between what google and the isp's are doing.
No one authorized ISPs to inspect packets for any purpose.
However if they provided their service at the same price google offers gmail in exchange for authorization to inspect packets, I'm sure there would be lots of people willing to take the deal. And I think whoever modded you insightful was on crack.
Spiderlike, sure, but IIRC Tor only obfuscates your identity from the site operator via a maze of proxies - It doesn't do anything like create an encrypted tunnel for the traffic, so eavesdroppers at the phone company can still snoop all they want.
Just sayin'.