Slashdot Mirror
Charter Is Latest ISP To Plan Wiretapping Via DPI
Charter Communications has begun sending letters to its customers informing them that, in the name of an "enhanced user experience," it will begin spying on their traffic and inserting targeted ads. This sounds almost indistinguishable from what Phorm proposed doing in the UK. Lauren Weinstein issues a call to arms.
So if I blog something, and title it a 'call to arms', am I suddenly relevant too?
I want to delete my account but Slashdot doesn't allow it.
Someone needs to tell Charter that you don't "enhance" suck.
The enemies of Democracy are
Now that a precedent has been set, I plan to examine and modify the direct deposit traffic found on the network. Just a few simple modifications, change the account number, add a few zeros to the amount, simple things like that.
Wonder when someone will figure out that their ad is being replaced by something else and sues?
Here is a project idea then, somebody start up a project to write a Firefox plugin that detects the inserted ads from Charter and either filter them out or replace them with something else.
As a Charter customer I can tell you that this comes as no surprise at all. They are shady as hell and their local offices are havens for the inept.
The "enhanced user experience" is nothing more than a smoke screen to spy on you, and get more ad revenue for their own personal gain. It's utter bullshit. Recently COX communications implimented nation wide DNS poisoning similiar to what versign does on domains it can't resolve.
http://support.cox.com/sdccommon/asp/contentredirect.asp?sprt_cid=e047dc81-18c4-485f-bcf3-1263d0b7b904
How to opt out of the "enhanced user experience"
How does injecting ad's into my browser "enhance" my experience? Give me more fucking bandwith you money grubbing cheap fucks, and that MIGHT enhance my experience.. I hate them.
Can someone tell me whether Charter is inserting any ads? If they are, I want to complain to the Attorney General and to my CongressCritters about felony copyright infringement.
"My opinions are my own, and I've got *lots* of them!"
This might actually fly. If some content owner starts a case, they could very well make a case for an "unauthorized derivative" under the copyright rules. Then ISPs or transits must take a license for all material they modify. I for one would not allow third parties to modify my HTML.
Some things call for the proverbial nuclear response: boycotts, lawsuits, all-out opposition. This is one of them. Once one of these corporations gets away with this, it's game over for those of us who want a corner of our lives that doesn't have some lying prick forcing his way into it to sell us something, spin the information we get and otherwise screw with our reality in a way that works to somebody else's advantage at our expense.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
This new system seems very simplar to Phorm, so here are details. The Phorm "Webwise" System - Richard Clayton. Seems you can avoid being monitored by blocking Phorm's cookie.
Reduce, reuse, cycle
I should hope at some point, that very theory will get tested in court.
Agree completely that for an ISP to change to contents of a page I request from a 3rd party is just plain wrong. What next, redirecting you from URLs critical of them onto URLs which sing their praises? Preventing you from reading about the services of competitors?
Modifying the requested data is way too invasive, but it seems to be consistent with the whole strategy of "monetizing what your customers do". What you want is irrelevant, you're just a revenue stream.
As has been said so often, I hope things like this cause the networks to lose anything resembling common carrier status -- right now, they're just a network, so whatever you send it up to you.
Cheers
Lost at C:>. Found at C.
The only way this will be any good is if any, or all, of the following are true:
1: You can opt out.
2: You ISP has gone to an ad-supported model that results in a drastic reduction of your monthly fees.
3: They are providing you with extra bandwidth free in order to carry the extra traffic they're generating to you (and not counting it against your usage caps).
Otherwise give them hell until they back off!
One is left to wonder how long before they start actually replacing ads on other sites with their own ads. After all, gangsters like this hate competition. Making you pay to get their ads, however, really sux!
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Margaret Thatcher and Stephen King on the same day? What are the odds?
If anyone is using charter (or just suspicious of things), please visit our tripwire server:
http://vancouver.cs.washington.edu/, to (hopefully) detect in-flight page changes.
Test your net with Netalyzr
MP3s in the incoming folder? "Charter put them there."
Child porn in the cache? "Charter put it there."
Nuclear weapon plans in email? "Charter sent it."
Seriously, WTF are they thinking? Do they really want to be named as co-defendants in every criminal or civil case brought against their customers? Because if they modified my incoming data and I was later called in to account for anything, you can bet my first line of defense would be to blame it on them.
Dewey, what part of this looks like authorities should be involved?
You may want to check out this site, which has tests on in-flight ad injection and tools that you can use to detect (aka tripwire) it.
http://vancouver.cs.washington.edu/
Reviewing just the first hour of video games.
I went to Charter's contact page and selected the option to chat live with a Customer Care Representative:
You have been connected to TTD JomarMe: I just read an article stating that Charter has begun sending letters to its customers informing them that, in the name of an "enhanced user experience," it will begin spying on their traffic and inserting targeted ads. Is there any truth to this?
TTD Jomar : Thank you for contacting Charter High Speed Internet Technical Support. My name is Jomar. How may I assist you today?
TTD Jomar : I'm so sorry, but this is already beyond our scope of support. Please call 1-888-438-2427 for further assistance.
Me: Thank you.
TTD Jomar : Again I apologize for the inconvenience you've experienced, but if there is anything further I can help you with please, let me know.
That kind of response doesn't sound like "Customer Care" to me.
Anyway, I called the number and spoke to someone who didn't have a clue what I was talking about. He transferred me to someone else.
The second phone rep said she hadn't heard about the new "enhanced user experience" feature, so she put me on hold to ask someone else. After she came back on the line, she said that she wasn't able to find out anything about it, so said to go to charter.net to stay informed about new features and services.
Naturally, there doesn't appear to be anything on Charter's site about the new "enhanced user experience."
the JoshMeister on Security
When ISPs can actually MODIFY data that does not belong to them, a SERIOUS boundary has been broken.
It's like the telephone company talking in place of someone on the phone.
"Hey mom" "Hi Mike, how are you?"
becomes:
"Hey mom" "HI MIKE, GET VIAGRA NOW FOR $3.99/20mg!"
I'm astonished. How is this any different from the postal service ripping out all the magazine ads and replacing them with their own ads before they get delivered to your house?
With the "deep packet inspection" technologies, conceivably ISPs can just replace, in real-time, our Google AdSense pubisher IDs with their own. Or, they could simply replace the Google AdSense Javascript snippet with something else.
I would hope that Google and other large advertising networks lead the charge against this, and that they are not partnered with any ISPs involved in this activity. A large class action lawsuit on behalf of publishers might slap sense into any ISPs using this "enhancement" to steal revenues from legitimate publishers.
The following web site contains some scripts which do self-analysis/ checksum calculations to determinwe whether they have been interfered unlawfully with:
Corruption detection scripts
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
A representative will be with you shortly. You have been connected to TTM Mike .
TTM Mike : Hi this is Mike from Charter. How may I help you today?
Robert Hafner: I read an article online, and the followed it to the Charter webpage, which states that Charter is going to be monitoring my surfing habits and placing ads into pages I'm viewing. I am wondering how soon this will happen to me personally.
Robert Hafner: http://connect.charter.com/landing/op1.html
TTM Mike : I do apologize but let me transfer you over toour internet support line.
TTM Mike has left the session.
Please wait while we find an agent from the CHAT - DUMA - HSD Support department to assist you.
You have been connected to TTD Grah .
TTD Grah : Hi, this is Grah. Thank you for contacting Charter's High Speed Internet support. How may I be of assistance to you today?
Robert Hafner: I read an article online, and the followed it to the Charter webpage, which states that Charter is going to be monitoring my surfing habits and placing ads into pages I'm viewing. I am wondering how soon this will happen to me personally.
TTD Grah : One moment please.
Robert Hafner: http://connect.charter.com/landing/op1.html Contains the information
Robert Hafner: that I am basing this question off of.
Robert Hafner: As well as http://consumerist.com/5008801/charter-to-begin-tracking-users-searches-and-inserting-targeted-ads
TTD Grah : Yes, that is our new update.
TTD Grah : One moment please as I download the document.
TTD Grah : Charter has formed a partnership with an industry-leader in online advertising, NebuAd (www.nebuad.com). NebuAd, through their advertising network, will display targeted advertisements to Charter High-Speed® Internet customers while they are surfing the Web. NebuAd does not collect and use personally identifiable information to deliver advertising. Customers will not see more ads - just ads that are more relevant to their interests that have been expressed through their web-surfing activity.
TTD Grah : The feature will be activated automatically for Charter HSI customers beginning in June 2008 in the following four Charter markets:
Newtown, Connecticut
Fort Worth, Texas
San Luis Obispo, California
Oxford, Massachusetts
Robert Hafner: So the ads are placed directly into websites I would normally view?
Robert Hafner: How do I opt-out for an entire household, with multiple computers and browsers?
Robert Hafner: Currently the only way to opt-out is by placing a cookie under each browser of each account of each computer, which is absolutely insane.
TTD Grah : The technology can actually often distinguish between different users on a shared computer and, therefore, can serve different ads to different users. Only a portion of the ads you see will be a function of the enhanced service - you will still see some ads that are served based on other criteria.
Robert Hafner: The question was were are those ads being placed- are they replacing other ads on websites, for instance?
Robert Hafner: And if so, how is the owner of the actual website going to be compensated?
TTD Grah : This site may appear depending on what are you trying to view online.
TTD Grah : This site will give you options on what to have according to what you need.
Robert Hafner: What site are you referring to?
TTD Grah : Say for example, you are surfing because you wish to purchase shoes online, this site will pop up and give you options to chose from.
TTD Grah : That is how it works.
TTD Grah : That is how it works.
TTD Grah : The site will not pop up everytime you go online.
Robert Hafner: So this only affects my traffic to
Well, they don't have your HTML. They have a copy of your HTML.
Your original HTML is still residing on the server where you put it. They are not interfering with your data.
What they are doing is interfering with their subscribers requested copy of that data. Their subscriber has the right to render the requested HTML in any way they see fit. They can use a different CSS file that resides on their box or some other network location. They can choose not to render graphics, flash, or allow JavaScript to run.
The provider, being in contract with the subscriber, is allowed to act as their agent while the packets are being transmitted over their part of the network. During this time, the ISP exercises that contracted ability, and injects code into the packets.
The ISP will tell the subscribers that this right is part of the contract, and if they don't agree to it - they don't get service. The ISP will also tell you to shove it up your ass - you can refuse requests made from their subscribers if you don't like what they do on their network.
According to your stance, the end user doesn't have the right to modify your HTML from what was intended. This, ironically, is the same exact stance that internet marketing companies take when confronted with browser plug-ins that effectively remove their code. Unfortunately for us, we can't have it both ways. Either we are allowed to alter how the packets are rendered, allowing us them to inject into packets due to powers granted them by their user terms and conditions, or they cannot - setting a precedent that would open the floodgates to client side packet altering and rendering changes.
Another point of argument they are going to make is that they aren't messing with your copyrighted web pages because they aren't distributing it without permission. When a user makes a request for your page, and your server fulfills that request, you have distributed the materials yourself. They are merely making a "derivative work" from that material.
I'm not saying I'm down with this at all. Frankly its a scummy tact and I hope their business dies. But this is what they are going to argue, we should get ready for it.
Actually, no it doesn't. Not without permission. From what I recall reading about this a couple of weeks ago in a very similar discussion (subtle way of saying "I think this story is a dupe"), if I understand what is being done correctly, there are two parts to this:
There's a specific ad provider that is involved with this, and that ad provider agrees to allow the local ISP to replace its ads with more targeted ads in exchange for a portion of the resulting ad revenue. The ad replacement, therefore, is authorized by the ad provider, who in turn is authorized by prior agreement with the website publisher.
The dirty part is the deep packet inspection, not the modification of the data stream. Attacking the latter to try to stop the former is likely to get you nowhere.
Check out my sci-fi/humor trilogy at PatriotsBooks.
One wonders how easy it would be to make an FF plugin to just replicate the cookie content.
I currently work for a cable company that is setting up this same kind of system. The only people that know what ads are being replaced are the people controlling the ad server, which is not the ISP. We (the ISP) are being paid to set up a black box that we will route ALL port 80 traffic through. Unless you opt out, which I'm not even sure will work properly. So the ad people can be doing all kinds of things with that data. Granted, they can't link the IP Address to a customer since they have no access to our provisioning server (and I'm pretty certain every last one of us Systems Engineers would quit before allowing that to happen). But they can be doing whatever they want with that traffic and we are none the wiser. Its such a black box, the ad company does all the monitoring on the black box. We are apparently the only company that even requested that we be allowed to monitor up/down and traffic status. The real problem is that we are setting up this extra router (it is another layer 3 hop) that also acts as a server and will delay any port 80 traffic. And we're pretty much allowing them full access to do as they will with the hostage packets. We're not checking. And if someone isn't happy with what their site looks like, we'll probably just route that one around the server, still pushing everything else through. I hope Google employees are checking their AdSense images to make sure that ads are actually from Google and that they are paying Google. As shady as this whole thing is, I expect that we will have legit ads removed, but leave the 'src' of the 'img' tag.