Senate Scrutinizes Privacy Issues of ISP User Tracking

Hugh Pickens writes "As companies collect, use, and disseminate data regarding online users, there is concern that tracking individuals' Internet activity and gathering information from online users violates their expectations of privacy. The Senate Commerce Committee will hold a hearing Wednesday to look at the policy issues, and the hottest topic will be proposed systems by which ISPs can watch users and sell information about their surfing habits to advertising companies. The Center for Democracy and Technology has issued a report suggesting that these systems may violate federal law (PDF). 'Advertising per se is not the evil here,' says Leslie Harris from CDT. 'It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that.' On the other side NebuAd, the most active ad-targeting company, says its profiles are interest-based, and not personally identifiable. 'We have designed our entire company to make sure that we stay on the opt-out side of those laws and policies,' says NebuAd CEO Robert Dykes. Charter Communications announced last month that it would suspend a trial of NebuAd due to customer concerns about privacy."

Comments

SETEC ASTRONOMY

[Anonymous Coward]

too many secrets

Wrong department

[Anonymous Coward]

Slashdot should have filed this one under the "Blind Leading the Blind" department.

Re:Wrong department

[Anonymous Coward]

More the "Pot calling the kettle black" department

Scrutiny should extend further.

[suck_burners_rice]

I'd say it's great that the Senate is scrutinizing what ISPs do to track people, but this shouldn't be limited solely to ISPs. There should be a lot of scrutiny about what the government does with your information, and I'm talking about all levels of government from the local level up to the federal level. Further, there are millions of businesses around the world, small and large, that gather all kinds of information. It is difficult to scrutinize so many companies, so I would say that the Senate should concentrate on the government first. Because the government collects the most.

Re:Scrutiny should extend further.

[pin0chet]

Agreed. When an ISP makes a bone-headed move, like using NebuAd, it gets a lot of bad press and has a strong competitive incentive to say sorry and fix its mistake.

I'm a lot more concerned about government invading my privacy than my ISP. You can always sue a company, but thanks to qualified immunity, government agents can break the law and get away scot-free.

Now there is a bill in the Senate, sponsored by Grassley, to force online retailers to inform the government of every online credit card transaction. You can't opt-out of govermment data collection, and you can't just "take your business someplace else."

The Senate's first priority should be taking a close look at the privacy implications of the REAL ID, the national fingerprint registry, the FBI's DNA database, and warrantless surveillance.

Re:Scrutiny should extend further.

[PopeRatzo]

You can always sue a company.

Not so. After tomorrow, for example, Americans will no longer be able to sue AT&T for violating the law by letting the Bush Administration tap their phones without any judicial oversight.

The current president has taken the 60-year old notion of "state secrets" to an extent that absolutely shreds the Bill of Rights, but there was always the possibility that the truth would come out and the lawbreakers would have to pay. After tomorrow, not any more.

Re:Scrutiny should extend further.

[corsec67]

Doesn't "state secrets" as currently used in court violate the first amendment?

Not the speech part, the ... to petition the Government for a redress of grievances. part.

Re:Scrutiny should extend further.

[PopeRatzo]

Doesn't "state secrets" as currently used in court violate the first amendment?

Absolutely. It was argued so in the 1948 case that started this whole "state secrets" baloney.

There's a recent book by Barry Siegal, Claim of Privilege which tells the story of how this remarkable encroachment on the Constitution first occurred, when a military plane crashed and some contractors died. Their wives sued and just wanted to see the accident report. The government, trying to prevent a scandal and the relatively tiny payout they would have made to the widows, pulled this "privilege" out of their asses. Two courts denied the existence of this "privilege", but the Supreme Court, always happy to oblige a powerful Executive, found for the State.

That was just the start, though. George Bush has raised the claiming of state secrets to an artform. A very ugly, thuggish and anti-American art form. May he and Dick Cheney rot in hell.

Re:Scrutiny should extend further.

[sarts]

George Bush has raised the claiming of state secrets to an artform. A very ugly, thuggish and anti-American art form. May he and Dick Cheney rot in hell.

Noted... you can expect some CIA operatives picking you up right.. about... NOW!

Good day Sir.

Re:Scrutiny should extend further.

[mi]

George Bush has raised the claiming of state secrets to an artform. A very ugly, thuggish and anti-American art form. May he and Dick Cheney rot in hell.

And you are not condemning Harry Truman and Alben Barkley to same for starting this non-sense — not to defend the country, mind you, but simply to cover-up their government's fuck-up — because?.. Oh, right, they were Democrats and thus could do no wrong...

Re:Scrutiny should extend further.

[PopeRatzo]

Harry Truman and Alben Barkley are the godfathers of the "state secrets" privilege. They scratched the surface of that canard at a time when the Cold War was just getting underway, anti-Communism was rampant and nuclear weapons had only recently been unleashed on the Earth.

But what they did absolutely pales beside what George Bush and Dick Cheney have done. I'm sorry if that pains you to hear, but it's the truth.

The two guys you voted for have done more in eight years to destroy our Constitution and the entire American way of life than all the presidents before them, combined. Just look at the number of signing statements George Bush has used compared to the previous few dozen presidents.

Oh, right, they were Democrats and thus could do no wrong...

mi (197448), That's a real peckerhead thing to say. You right-wing jackoffs sure get snotty when things don't go your way, huh?

Re:Scrutiny should extend further.

[mi]

You right-wing jackoffs

The term is "jerk-off", and it applies to you.

Re:Scrutiny should extend further.

[Anonymous Coward]

i pretty sure bot apply do a google search for each

Yeah, and?

[Red Flayer]

'It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that.'

Hey, guess what... if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice (i.e., don't give private info to someone you don't trust). If you choose not to make safe your correspondence from third parties via encryption, that's your problem.

I'm willing to risk some troll or flamebait mods here to make a point:

No correspondence should ever be considered absolutley private. The same tools that allow data aggregation by companies like Google and ISPs give us better access to information and (arguably) a better quality of life. You have to take the bad with the good.

Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in (ok, in theory. In practice, this needs further work). They allow people and businesses to target our needs better, so it's easier for me to find what I'm looking for.

As long as we have the ability to anonymize and encrypt our traffic (which isn't a given), I have no problem with profiling. Those who want to opt out can do so easily... and if there is enough demand for it, there will be off-the-shelf tools for joe sixpack to do so.

So my point is this: Allow us to anonymize our traffic. Allow us to encrypt our traffic. Then you can go ahead and profile all you want.

Re:Yeah, and?

[no-body]

Have you ever counted or even looked at the 1 pixel images embedded into web sites?
I encountered a recent ridiculous one from a Yahoo access - something like that:
us.bc.yahoo.com/b?P=FjLh6UWTUG8MnHdaSGkxXR + over 1000 characters more

To load 1 PIXEL!!!!!

There is tons of that stuff embedded in web sites. And that's got nothing to do with 2-way communication whatsoever.

Wo tracks it, who controls it, who sells and buys it?
Are the neurons in Sentat's heads interlinked enough to grok this?

Highly doubtful - and they (the trackers) will fight tooth and nail about it to keep it that way.

We all are paying for the free ride to information with our privacy.

Re:Yeah, and?

[Red Flayer]

Wo tracks it, who controls it, who sells and buys it?

And why should you care, if your traffic is anonymized and your personal information, when needed, encrypted?

Re:Yeah, and?

[Anonymous Coward]

"Creation of profiles allow vendors to serve us better. "

It also makes society totally transparent and the balance of power is in favor of private interests, I'm more worried about fascism personally then government. I wish someone who could shake the corporations down would get elected, the free market has killed democracy quite badly.

If historians will remember anything they will remember that commerce is the only political force worth talking about outside of violence.

Re:Yeah, and?

[Anonymous Coward]

Hey, guess what... if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice (i.e., don't give private info to someone you don't trust).

Your ISP is a carrier of information, not a partner in a two-way correspondence, they are a third party who facilitates your communication. Like the postal service in a snailmail correspondence. In the contexts of internet access they are proposing to eavesdrop on private communication for profit. I doubt you would be happy if the postal service routinely read your mail, then slotted in 'targeted' adverts, before re-sealing and delivering to your home but promising to forget what they had read.

Re:Yeah, and?

[Red Flayer]

the free market has killed democracy quite badly.

Reminds me of a quote (or sig) I saw once, wish I could remember the source:
"In the 80s, capitalism triumphed over communism. In the 90s, it triumphed over democracy."

Re:Yeah, and?

[lordofwhee]

Not only are there people who don't know anything about encryption, but why should I have to do something extra to ensure I have what is already supposed to be mine?

Re:Yeah, and?

[Red Flayer]

Hence anonymization and encryption. Did you even read my post? Or did you rush to respond to the first line you read to which you could raise an objection?

If all your traffic is encrypted, and goes to an anonymization server, how exactly is the ISP supposed to sniff the traffic? Seriously.

The two-way correspondence refers to the end recipient of your packets, not to the ISP.

Re:Yeah, and?

[Opportunist]

There is no harm in a business wanting my data to serve me better.

Provide I, and only I, decide when they get what data.

Re:Yeah, and?

[Red Flayer]

Not only are there people who don't know anything about encryption

If they care about their privacy, that is their problem. If they don't care, no harm, no foul.

but why should I have to do something extra to ensure I have what is already supposed to be mine?

I have tons of problems with this question. Why do you assume that "it" is supposed to be yours? You're transmitting postcards, not sealed envelopes... assuming that by "it" you are referring to privacy, what makes you think that you have any expectation of privacy in a de facto public space if you don't make any efforts to safeguard it?

If I send a postcard to a friend, I assume anyone who handles it could read it. But that's not fair! Why should I have to take the extra step of sealing an envelope in order to maintain the privacy of my letter? And if it's really important info, you can bet your ass I'd encrypt it with a one-time pad. So even if they open my mail, they won't find anything useful without dedicating ridiculous resources to it.

Re:Yeah, and?

[no-body]

"if"

-yeah, encrypted web surfing/email for the masses is happening and Tor has lightning access speed.

It's just not reality at this point and will it ever be? So, your premise to arrive on your conclusion to "no need to care" is not a given, it's a cloud castle.

Re:Yeah, and?

[noidentity]

Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in (ok, in theory. In practice, this needs further work).

Then why do they show me ads at all? I DO NOT WANT THEM. Oh right, the profile isn't to serve me, it's to serve them (usually by manipulating me). So the profiles allow them to better manipulate me. Why do I want this, again?

Re:Yeah, and?

[flaming error]

if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice

Maybe. But that doesn't mean it's legal, and, more to the point, that there isn't "an expectation of privacy."

If you choose not to make safe your correspondence from third parties via encryption, that's your problem

So we should google over SSL? I can't find their https search service.

The same tools that allow data aggregation ... give us better access to information... You have to take the bad with the good.

Why do we have to "take the bad with the good"? Is there some law of quantum physics that says website visitor tracking must be entangled with advertising services?

Re:Yeah, and?

[inhahe]

Collecting information about people's habits without their knowledge or explicit consent for the purpose of making money is reptilian. I say reptilian because I'm not sure that I can say it's unethical, because I don't believe that taking pictures of people in public is unethical. But then, what they do is more akin to paying someone you're likely to speak to to secretly record your conversation for them.

If we all believed that companies just wanted to serve our best interests, then there would be no backlash against this kind of profiling. But since we know on a deep level that corporations are fundamentally cold, evil and without conscience, it bothers us. You could say that by the devil's grace it just happens to work out so that serving their best interests serves ours, but that does not make it not reptilian.

And saying that, basically, if you don't want companies to profile you then surf anonymously is dangerously close to saying that if you don't want to be shot (and injured) by a criminal then wear a bullet-proof vest. Or if you don't want someone creating a voodoo doll in your likeness and dipping you in vaults of various acids in effigy, or perhaps collecting a DNA swipe off of a counter you touched to analyze it on their computer and determine the best pick-up line to give you the next day, then wear a hair net, a veil, gloves, a long-sleeved shirt and pants whenever you go out. Or maybe just a burqa to make it easier. We shouldn't _have_ to hide.. Oh, yeah, and the DNA analyst at his computer is just trying to figure out how to best serve you, right?

TBH though, there is no law against making a voodoo doll of someone and burning it (and I don't want the Inquisition all over again), so it's iffy whether companies should legally be allowed to do that. But I'm certainly not going to be apologetic for them..

Re:Yeah, and?

[Red Flayer]

If there is a demand for anonymization and encryption services, someone will provide it. As more people are aware of (and concerned about) privacy issues, they will make use of such services, even if they have to pay for it.

Just because you don't see it happening a ton today doesn't mean it won't be used a lot tomorrow.

What is important is that our *right* to use anonymization services and encryption is not abrogated.

Re:Yeah, and?

[Red Flayer]

Fully agreed. Hence the right to use anonymization and encryption must be held sacred. A built-in opt-out clause solved through technology, not through legislation (which is bound to have transgressions).

Re:Yeah, and?

[flaming error]

> the free market has killed democracy
Maybe it's not so much the "free market" that's to blame, but that we allowed our government to sell itself.

> [killed] quite badly.
It just so happens that it's only mostly dead.

Re:Yeah, and?

[Red Flayer]

Why do I want this, again?

Because it pays for the content you're accessing? Because it helps offset the cost of providing service to you?

Re:Yeah, and?

[Anonymous Coward]

Hence anonymization and encryption. Did you even read my post? Or did you rush to respond to the first line you read to which you could raise an objection?

If all your traffic is encrypted, and goes to an anonymization server, how exactly is the ISP supposed to sniff the traffic? Seriously.

The two-way correspondence refers to the end recipient of your packets, not to the ISP.

I did indeed read your post, all the way through, the point you made related to someone party to the correspondence revealing information, not the carrier (postal, phone or internet). Your ISP is a third party to your internet browsing, you pay them to carry your traffic, not to parse then serve 'targeted' adverts for profit, which is the subject of the article.

Google and ISP profiling are not comparable, I don't pay Google for a service and can opt out of their profiling. As I said, I pay my ISP for access to the internet, their profiling gives no added value and will reduce my security.

As to encryption, it's a sad day when you cannot trust your service provider to provide a service, without eavesdropping for profit. What next, encryption for snailmail? We could always use invisible ink, but that might prove difficult for the mail service to deliver.

Re:Yeah, and?

[compro01]

Hey, guess what... if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice

Actually, that's not always the case. With phones for example, in some states[1], it is illegal to record a phone call without the other person's knowledge and consent. This is the reason for that "this call may be monitored or recorded" thing. Staying on the line implies consent.

[1]California, Connecticut, Delaware, Florida, Massachusetts, Maryland, Michigan, Montana, New Hampshire, Pennsylvania, and Washington.

Re:Yeah, and?

[Red Flayer]

But that doesn't mean it's legal, and, more to the point, that there isn't "an expectation of privacy."

Why should it be illegal? Other than things like credit card numbers, social security numbers, etc, why should it be illegal? Is it illegal for me to tell my wife the details of a conversation I had with you?

As for the expectation of privacy, are you kidding me? Were you never taught that emails (or for that matters, any packets) should be considered postcards, not sealed envelopes? The internet is a de facto public space. The quicker you internalize this, the happier you will be.

Why do we have to "take the bad with the good"? Is there some law of quantum physics that says website visitor tracking must be entangled with advertising services?

Is there some law of quantum physics that says that wensite visitor tracking cannot be entangled with advertising services?

I am loathe to ask for a legislative solution to a problem that has a technical solution. Far better to use the technical solution that makes the question moot, than use a legislative solution that *trust* that the law is being followed.

Re:Yeah, and?

[bersl2]

Are the neurons in Sentat's heads interlinked enough to grok this?

I found that typo somewhat amusing, because it rhymes with "mentat", and that produced a very bizarre image in my mind.

Re:Yeah, and?

[Darkness404]

And why should you care, if your traffic is anonymized and your personal information, when needed, encrypted?

But honestly, in order to get anonymous internet, you either have to A) take a huge speed-hit or B) trust a proxy. Neither of those are usually good options.

Re:Yeah, and?

[Anonymous Coward]

As others have said, the ISP is a carrier and not a party to a communication. These ad companies need the explicit consent of both parties before they eavesdrop. Web sites with cookie based user login have an expectation of privacy and while you can snoop if you own a router, doing so is illegal*

* except for national security, which still excludes adware scumbags

Re:Yeah, and?

[Red Flayer]

As to encryption, it's a sad day when you cannot trust your service provider to provide a service, without eavesdropping for profit. What next, encryption for snailmail? We could always use invisible ink, but that might prove difficult for the mail service to deliver

If you're going to continue the snailmail metaphor, again I have to stress that without encryption, you are sending postcards, not sealed envelopes. And plenty of people have used, and still use, encryption with snailmail, as they deem it necessary to maintain their privacy. The question is, how much do they value their privacy, and how much effort do they have to put in for encryption? When encryption is so easy electronically, why not take advantage of it?

I think it's absolutely absurd to think that when you give a private for-profit organization your correspondence, you don't expect them to try to make money off their own information (after all, they have as much right of ownership to the information of what crosses their network, and from where, as you do).

Privacy cannot be protected by legal recourse. It can only truly be protected by technological recourse. Making something illegal does not prevent it from happening. Making something impossible does.

Re:Yeah, and?

[Red Flayer]

Why? I use a proxy for sensitive stuff, and I trust it. I pay for that privilege, but at some point, you have to trust someone unless you personally own all the network the packet transverses. I'd rather trust a proxy I pay to safeguard my information (who stands to lose a lot of business if it gets around that they aren't doing their job) than trust someone with a monetary incentive to sniff my information.

Re:Yeah, and?

[flaming error]

> why should it be illegal?
Because it isn't opt-in.

> Is it illegal for me to tell my wife the details of a conversation I had with you?
The more relevant question would be: Is it ethical for the phone company to record and correlate all conversations going through their lines and sell (summaries of) the recordings to third parties? Without their customers' consent? Without their knowledge?

> Were you never taught that emails ... should be considered postcards
What I've been taught is irrelevant. What the average user expects is what congress is asking. And just because a mailman has the ability to peruse a postcard doesn't mean he should photocopy it and sell it on eBay.

> I am loathe to ask for a legislative solution to a problem that has a technical solution
Me too - I absolutely agree. So, how do I conceal my slashdot posts, google searches, and online shopping from my ISP?

Re:Yeah, and?

[Red Flayer]

Because it isn't opt-in

I fail to see the point of that argument. You are voluntarily sending data on their network, why should you have to opt in?

The more relevant question would be: Is it ethical for the phone company to record and correlate all conversations going through their lines and sell (summaries of) the recordings to third parties? Without their customers' consent? Without their knowledge?

Were you around when all calls went through a switchboard? And you had to assume that the operator was listening in? Believing your phone calls are private is only two generations old, and I think it's a mistake. One should NEVER assume that information crossing someone else's network, be it via telephone or via the internet, is private. Note that we have a technical solution to eavesdropped phone calls, as well -- VOIP can be encrypted (sure, there's some latency, but that's a small price to pay for privacy).

As far as I'm concerned, there should be no expectation of privacy on any public means of data transmission. We have the technical capability of securing our correspondence, and legislating privacy is a big mistake since it makes us dependent on government to safeguard our privacy, and that is not always in the government's interest.

What I've been taught is irrelevant. What the average user expects is what congress is asking. And just because a mailman has the ability to peruse a postcard doesn't mean he should photocopy it and sell it on eBay.

Then the problem is with the average user. The internet is still a relatively new technology, and it will take time for people to become aware of the implications of their internet use. Until we stop comparing it to older means of communication, people will be confused. It just needs to be made clear to people that internet traffic is not private unless they make it private. We have the means to do so.

So, how do I conceal my slashdot posts, google searches, and online shopping from my ISP?

Use an anonymizer or a proxy. If my paid proxy reveals my info, he's got a breach of contract suit on his docket. I only use it for sensitive info, but it meets my needs.

Re:Yeah, and?

[Anonymous Coward]

AI think it's absolutely absurd to think that when you give a private for-profit organization your correspondence, you don't expect them to try to make money off their own information (after all, they have as much right of ownership to the information of what crosses their network, and from where, as you do).

Privacy cannot be protected by legal recourse. It can only truly be protected by technological recourse. Making something illegal does not prevent it from happening. Making something impossible does.

The point is, it's NOT their information, it's OURS, we generate the information, not our ISP, without surfers and website owners, the ISPs infrastructure is just so much wet string.

Some of the proposed systems, will parse every scrap of port 80 HTTP traffic coming from and returning to the user, what you've said is the ISP owns that, what about the webmasters who either generated or paid for the content on their sites, the system is using their content, to create the profile used to 'target' the adverts. If the user then surfs to one of the ISPy partner websites, they are presented with an advert from a rival- copyright infringement anyone?

Re:Yeah, and?

[Red Flayer]

But then, what they do is more akin to paying someone you're likely to speak to to secretly record your conversation for them

Sure. And why should I expect that this would never happen? Because it's unprofitable for them. But when the value of my conversations is more than the cost of paying people to eavesdrop, I have no expectation that people won't do so. This is why if you have information worth a lot to you, you don't share it, except with people you trust.

And saying that, basically, if you don't want companies to profile you then surf anonymously is dangerously close to saying that if you don't want to be shot (and injured) by a criminal then wear a bullet-proof vest. Or if you don't want someone creating a voodoo doll in your likeness and dipping you in vaults of various acids in effigy, or perhaps collecting a DNA swipe off of a counter you touched to analyze it on their computer and determine the best pick-up line to give you the next day, then wear a hair net, a veil, gloves, a long-sleeved shirt and pants whenever you go out. Or maybe just a burqa to make it easier. We shouldn't _have_ to hide.. Oh, yeah, and the DNA analyst at his computer is just trying to figure out how to best serve you, right?

I nuderstand what you're saying, but the problem is that legal recourse will not protect your data. Someone with the resources and the desire will be able to get your data if they want it. Your right to privacy means nothing if it can be transgressed at will.

The only solution is a technical one. When you have to depend on your government to protect your privacy, you're fucked. The government has invasion of your privacy in its interests, so you better protect it yourself... in this case, via encryption and anonymization.

Re:Yeah, and?

[Domo-Sun]

Well, not everyone agrees with you. Some states make it a crime to record police, or phone calls without informing all parties.

We don't have to take the bad with the good. We can change it. Why are you so gangbusters? You sound like and ad fanatic.

Creation of profiles allow vendors to... annoy us. My needs are not being targeted well at all. My need is for them to stop profiling and showing me irrelevant things I don't want to buy.

As for your If there's anonymity demand, it'll be filled comment later. I like privacy tools like that but they always seem to be short lived. There's no guarantee that because people want those things they'll just be there. Often people want things but they're forced to take garbage. It's a wishful thinking false dilemma.

Re:Yeah, and?

[markjhood2003]

Profiling is only justified on an opt-in basis. Users need to know exactly what they are exchanging for access to searches or web content, and this can only be accomplished by an explicit agreement between the service or content provider and the user. Otherwise there is no informed consent, and we are lost in legal murkiness.

No correspondence should ever be considered absolutley private.

Aside from technical screw-ups, accidental or illegal behavior, or possibly national security concerns, the default expectation absolutely should be privacy in one's correspondence. If privacy is not going to be honored, then an opt-in mechanism that explicitly details the information to be collected is the only ethical approach.

The same tools that allow data aggregation by companies like Google and ISPs give us better access to information and (arguably) a better quality of life.

Data aggregated from public web sites for searching purposes is not the same as aggregating data from individuals operating under the default expectation of privacy.

Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in ...

No, surreptitious profiling allows Google and other advertising companies to serve their corporate clients better, not individuals. I am better served by not having to view ads at all, as I am capable of directing my own searches. I'd much prefer to pay for each search I request using some sort of micro-payment scheme; other individuals should be given the opt-in to free advertising-supported searches if they personally feel comfortable with that.

Re:Yeah, and?

[Domo-Sun]

Because we're supposed to be in a society that's built around rules that our papers and effects and privacy should not be infringed. People do care. Just because people are unaware or don't know how to encrypt their e-mail doesn't mean a company has a right to copy, read, sell and distribute it.

Re:Yeah, and?

[Anonymous Coward]

Nobody expects that their data will be completely private, but they do expect a reasonable limit to the collection and use of that data.

Most people aren't that worried about the employee reading your mail, they're more worried about random passersby and thieves. Also, the sharing of data adds an extra layer of obscurity to the matter of privacy. If data held solely by the Post Office is abused or misused, I know exactly who to blame. Imagine if the Post Office decided to read all mail not in dark envelopes, but they would not record the sender/receiver on the envelope. That may not seem so bad, until someone sends me a letter saying, "Dear John Smith: How's the weather in Dallas?" They have my data, and if I complain, responsibility is deferred because they didn't abuse that data; they simply mixed personal data into data they sold and someone else abused it.

"Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in"

So if I have no interest in anything outside what I'm currently looking at, I would ideally get no ads? Ads are designed to be as obtrusive as possible without leaving too negative of an impression. "Serving us better" is an occasional byproduct, not the intention.

"As long as we have the ability to anonymize and encrypt our traffic (which isn't a given), I have no problem with profiling. Those who want to opt out can do so easily... and if there is enough demand for it, there will be off-the-shelf tools for joe sixpack to do so."

Except you have to know about it first. No matter how smart or dumb you are, you can't fix a problem you don't know about. If it were opt-in, or made publicly aware by the company themselves (i.e. mentioned by mass media, and/or made completely visible with no attempt to obscure it), I would have no problem. However, they're banking on the fact that this information won't spread beyond the tech-savvy few. The "free" market would likely cost the offending company business, but there is little room for competition, and those competitors won't attack the offender because they'll be considering it themselves.

Lastly, there is a limitation as to what data can be collected based on the service. If I buy from an online store, they know my name, my shipping address, my purchase history, etc. Only what I've expressly given them. In this case, they know when and how I use the service they've given me (which is not the same; the former records the transaction itself, the latter records how I use what I've already paid for).

Yes, I can encrypt every bit of data, but why should I have to? How far should I have to go to defend my rights against an encroaching ally who is increasingly against me?

Re:Yeah, and?

[Domo-Sun]

Why do I want this, again?

Because it pays for the content you're accessing? Because it helps offset the cost of providing service to you?

No, that's why the ISP wants it. I don't want it. Try not with the double speak why don't you.

Re:Yeah, and?

[Domo-Sun]

you are sending postcards, not sealed envelopes... I think it's absolutely absurd to think that when you give a private for-profit organization your correspondence, you don't expect them to try to make money off their own information (after all, they have as much right of ownership to the information of what crosses their network, and from where, as you do).

What? If I send a postcard, I'm not too excited about people reading it, but then I don't assume that a corporation is going to copy everything I send and claim ownership to it just because they handle it.

Why does a corporation have a right to the information in my postcards? That's like saying that amazon has rights and ownership of all books that they handle. Copyright infringement is a crime, and it's don't stop people completely from violating it, but I expect amazon and any other company to respect copyright. Those e-mails I write are mine just the same.

Re:Yeah, and?

[Darkness404]

If you are paying for a proxy then I suppose that it would have incentive to keep your info safe. The downside is, it is more likely to be bullied into giving logs, etc. to various government and possibly other businesses.

Re:Yeah, and?

[pin0chet]

There are plenty of highly anonymous VPN/SSL tunneling services available for 10 or 15 bucks a month. No need to take a speed hit or trust an unknown foreign proxy server. -Steganos https://www.steganos.com/us/products/home-office/internet-anonym-vpn/overview/ -VPNGates http://www.vpngates.com/ -SecureIX http://www.secureix.com/ -Relakks https://www.relakks.com/?cid=gb -Anonymizer http://www.anonymizer.com/

Re:Yeah, and?

[ben(zen)]

Because it pays for the content you're accessing? Because it helps offset the cost of providing service to you?

I thought the bill you pay monthly covers the cost of maintaining the networks over which the information is travelling. As you wrote them, the two rhetorical-sounding questions there are contradictory, in some ways. In the first case, the content is being paid for by targeted advertising, while in the second, you're receiving a discounted price from the full cost and receiving targeted advertising. One does not equal the other. I would much rather they run the system without the advertising and charge an accurate cost for access.

Re:Yeah, and?

[Zontar The Mindless]

Reminds me of a quote (or sig) I saw once, wish I could remember the source:
"In the 80s, capitalism triumphed over communism. In the 90s, it triumphed over democracy."

Source of the quote: David Korten.

(Props to Jeremiah Cornelius, where I first saw it.)

Re:Yeah, and?

[Opportunist]

I don't see why I should have to take steps to avoid being spied on by corporations. Such a notion pretty much means that privacy becomes the prerogative of people technically savvy enough to protect it.

Re:Yeah, and?

[Anonymous Coward]

"Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in (ok, in theory. In practice, this needs further work). They allow people and businesses to target our needs better, so it's easier for me to find what I'm looking for."

Vendors don't want customers to find what the customers want. Vendors want customers to find what the vendors are selling. Profiles help corporations spam you with more of what you've been buying, to the point where you start having problems even knowing there's something else out there that you'd like more. Just look at what Microsoft is doing.

Re:Yeah, and?

[Anonymous Coward]

Because it's a silly assumption that 'my' privacy isn't in fact mine. That sort of follows from the 'my' bit. And if it's in fact on a postcard then why do most mail programs use a closed envelope, why does a closed envelope appear in the taskbar that denotes I have 'unopened' mail?

Re:Yeah, and?

[Anonymous Coward]

Have you ever taken a look at the icon of thunderbird?

Re:Yeah, and?

[CowTipperGore]

You're transmitting postcards, not sealed envelopes... assuming that by "it" you are referring to privacy, what makes you think that you have any expectation of privacy...

To complete your analogy, I guess it would be okay for the US government to read all postcards sent via the US mail, log the data, and use it for whatever purpose they want? After all, not sending it in a triple-sealed container means that we clearly wanted this information gathered and used. UPS can open and examine packages sent in paper envelopes or cardboard boxes, since if we cared about privacy we would have used a welded box.

You're confusing what could happen with what should happen. Just because someone can read your postcard doesn't mean we should be okay with the USPS doing so as policy. Just because UPS could open packages and reseal them, we shouldn't be okay with them modeling my underwear before they arrive.

Re:Yeah, and?

[Anonymous Coward]

When the Nazis came for the communists, I remained silent; I was not a communist. When they locked up the social democrats, I remained silent; I was not a social democrat. When they came for the trade unionists, I did not speak out; I was not a trade unionist. When they came for the Jews, I remained silent; I wasn't a Jew. When they came for me, there was no one left to speak out.

Re:Yeah, and?

[Anonymous Coward]

The secure vs non secure is a trival issue compared to the overal issue.
From the executive report on NebuAd:
"Unique Identification: The NebuAd device ties a customers's individual record maintained by the ISP to an Alphanumeric code (calls a 'hash code"). This method allows NebuAd to uniquely and persistently to identify individuals withou ISPs needing to release data from billing records."

Whether or not they actually inspect the packets, they tie patterns of behavior to a unique identification of a user, and profile that user for means other than what the user has contracted for with the ISP. I contract with an ISP to provide service defined by the IP protocal RFC. If they use the NebuAd (or any other of DPI) software and insert data, in my opinon, they have violated the terms of my contract with them.

In addition the NebuAd system modifies the content of the response. Since I aslo have a server which serves content I'm a bit chapped about the idea of an intermediary changing my message. Not only changing my message but in essence putting words in my mouth. Adding data from an untrusted/unknown/un-asked for source to the message of know/trusted source.

Isn't this similar to the classic 'man-in-the-middle' scenario?

Since When Do They Care About Our Privacy?

[Anonymous Coward]

They're going to grant the telecoms immunity and the Bush Administration a free pass on breaking federal wiretap laws and violating the 4th Amendment, but *this* concerns them? Spare me.

Re:Since When Do They Care About Our Privacy?

[Tackhead]

They're going to grant the telecoms immunity and the Bush Administration a free pass on breaking federal wiretap laws and violating the 4th Amendment, but *this* concerns them? Spare me.

1970s: Don't steal. The government hates competition.
2010s: Don't spy on your users. The government still hates competition.

Re:Since When Do They Care About Our Privacy?

[Anonymous Coward]

1970s: Don't steal. The government hates competition.
2010s: Don't spy on your users. The government still hates competition.
Today: The governement and the private sector are one and the same - They both hate competition

Re:Since When Do They Care About Our Privacy?

[Naturalis Philosopho]

The Bush administration will make their life difficult if they investigate telecomm immunity.

If they look into ISP privacy issues then the telecomm industry will buy them expensive vacations and contribute to their "re-election campaign fund" (not to influence them though).

If you were a political hack, which would you look into?

Re:Since When Do They Care About Our Privacy?

[Guppy06]

"The Bush administration will make their life difficult if they investigate telecomm immunity."

For six months? Does the phrase "lame duck" mean anything to you? All anybody that didn't support the immunity and wasn't complicit in it would have to do is run out the clock, and yet...

Re:Since When Do They Care About Our Privacy?

[Naturalis Philosopho]

You're right, but your reasoned response requires a thinking adult who is not interested in telco money to implement such a plan... have you seen anyone who meets that description (outside of the visitor's gallery) hanging around the Capitol Building recently? That said, my point was more that they could profit financially acting as they are- they probably aren't even considering the hassle they'd get from the administration.

I share your frustration.

Well

[Anonymous Crowhead]

It's not that I don't not disagree against this, but I can't say that I agree with the counter argument against this. That said, I pick the blue marble and place it in the yellow jar.

Re:Well

[maxume]

You have awakened a mummy.

It's alright though if the government is tracking.

[Anonymous Coward]

Hypocrites. Every single one of them.

Boiling a frog

[Mike Rice]

How ironic that Congress is, in all likelihood, about to pass a telecoms immunity bill which allows them to spy on us... but are giving lip service to the issue of telecoms spying on us.

CongressCritters and Snoozators will soon be making a lot of noise about how they are protecting the public from being spied upon, while at the same time making it legal for us to be spied on.

Nothings changed, just another election year.

Re:Boiling a frog

[Anonymous Coward]

CongressCritters and Snoozators will soon be making a lot of noise

9% approval rating - seriously. 9%.
On another note, I don't think this is about privacy at all. I think this is to make the rules clear to businesses. It is OK to spy on your customers and sell the data as long as they don't find out. And if they do find out, you might get a slap on the wrist to save some face.

Re:Boiling a frog

[easyTree]

CongressCritters and Snoozators will soon be making a lot of noise about how they are protecting the public from being spied upon, while at the same time making it legal for us to be spied on.

Democracy in action :) - or rather that's what happens when the free market and democracy collide.

We had a similar situation in the UK recently with a company called Phorm. ISP's were entering into secret deals with them to collect our data so that they could modify the html streams returned from sites to inject targeted advertising. i.e. pure evil was afoot :)

http://en.wikipedia.org/wiki/Phorm

Re:Boiling a frog

[Opportunist]

What free market? I hope you don't mean the mockery thereof that the current market of corporate cartels is.

Re:Boiling a frog

[easyTree]

Perhaps I'm using the wrong term - I'm ignorant of world affairs..

I'm talking about the situation that exists when profit is used as a means to determine what is moral.

Re:Boiling a frog

[Guppy06]

"9% approval rating - seriously. 9%."

It could be 0% and nothing would change. Ask any voter and they'll tell you that the House of Representatives is composed of 434 voting asshats and one person who walks on water, who just happens to represent their district. Besides, the incumbents have seniority due to tenure, which further disinclines voters to vote against them.

Re:Boiling a frog

[Anonymous Coward]

When Barak Obama votes tomorrow to legalize the warrantless wiretapping he will have shown me how little concern he has for my human rights. He loses my vote. I now believe that if he had been in the senate at the time, he would have approved of the so-called Patriot Act, twice, Just like Hillary.

Re:Boiling a frog

[Opportunist]

It's not even profit anymore. Profit as a measurement of morality could be considered free market. What we have today is more control instead of profit. Everything is moral and fine as long as I get more control. More control of the market (in case I'm a corporation) or more control of the people (in case I'm a government).

Re:Boiling a frog

[Anonymous Coward]

9% approval rating - seriously. 9%

I don't believe you. Seriously, I don't believe you, and citing some poll (unless it's taken on November 4) won't change my mind. I bet over 99% of the candidates who win the elections in November (and I bet most of them will be incumbents), will be members of the same old parties who have set the very policies that everyone is complaining about.

I think you left off a digit. Congress and the President have closer to a 99% approval rating. A lot of people say they don't approve, but when it comes down to the real poll, they show their true feelings.

Dear Obama Fans:

[Anonymous Coward]

The Committee will do as its bribed.

Cheers,
Kilgore Trout

I'd have less problem with this...

[fahrbot-bot]

We have designed our entire company to make sure that we stay on the opt-out side of those laws and policies,' says NebuAd CEO Robert Dykes.

... If they'd stay on the "opt-in" side, but I'm sure user participation and company profits would be lower. Too bad, so sad...

Re:I'd have less problem with this...

[QuantumRiff]

Charter Communications announced last month that it would suspend a trial of NebuAd due to customer concerns about privacy. The sad thing was, their page specifically stated that their Cookie would opt you out of seeing the ads. They did not say that the cookie would keep you from being tracked. Even most non-tech people know to clean their cookies, and many programs will do it for you, like ccleaner on windows. Their privacy policy explicity states they will turn over all logs and information for a warrant or supeana. There is nothing "opt-in" about what they were trying.

Re:I'd have less problem with this...

[Gat0r30y]

Not necessarily - what if you could opt in for a little discount. You get 5 bucks off your monthly internet bill, and in exchange they have permission to keep a cookie on your machine to track what your doing. On the other hand, as a government backed monopoly I suspect that the ISP's are going to come out of this whistling the tune of the free market.

Re:I'd have less problem with this...

[leenks]

Why would they need a cookie to track what you are doing? They can just monitor your connection directly as it flows through their network.

Re:I'd have less problem with this...

[Taibhsear]

I get $20-30 an hour for doing random surveys, taste testing, and the like for a local ad research agency so they'd have to do far better than $5 per month. If they are collecting my info they damn well better ask me first and they sure as hell better be paying ME for it. Not the other way around. If they paid for my internet connection I'd consider taking a 1 hour survey a month about my surfing habits. But they sure as hell better not actually track me and you don't get to do it unless I say so. Opt-out my ass.

Re:I'd have less problem with this...

[Domo-Sun]

Yeah, I always clear my cookies when I close windows. Especially in a torrent, as nothing spoils an evening more than wet cookies.

Re:I'd have less problem with this...

[Domo-Sun]

I hate opt-in discounts. It's like those grocery cards that you have to choose between them spying on you for a discount, or inflated prices. And then everyone lectures you about it if you don't. It's wrong.

Re:I'd have less problem with this...

[inwo42]

Notice to all advertisers wishing to target me: I opt out. Please do not advertise to me. If I want your crap, I'll find you.

Watch just one little word

[Ollabelle]

To me, the money here is targeting the user to feed him/her ("them") ads based on what that user has already seen, queried, etc.

Yet, NebuAd says the data they collect is not "personally" identifiable. I'll bet a six-pack that the data is damn-sure "individually" identifiable by cookies, etc.

"Personally" just means they're not selling my name along with my surfing habits. But they are very much tracking my individual habits/interest and selling that; user by individual user. I say send them back to tele-marketing, the scum-bags.

Re:Watch just one little word

[MrDERP]

all of these comments and ideas were covered pretty thoroughly in a recent Security Now Podcast, definitely worth a listen... JEff

Putting it simply

[CopaceticOpus]

What is needed is a clear separation between those companies that sling bits (ISPs) and those who provide content and advertising. Each ISP should be required to transfer data as fairly as possible with a minimum of interference and monitoring.

Most broadband providers have a monopoly or duopoly, and therefore need to be regulated strongly. Otherwise, customers who object to these invasions of privacy will have nowhere to turn.

Phooey on that.

[Anonymous Coward]

Senate Scrutinizes Privacy Issues of ISP User Tracking

How about scrutinizing the privacy issues of government tracking citizens?

---HOW--- are they showing ads?

[BUL2294]

One question that the article doesn't explain is HOW they are showing targeted ads on sites... Sure, I understand if I were a Charter Communications ISP customer going to a Charter site, then there would be some ad-targeting... But I seriously doubt most customers are frequenting sites that are affiliated with their ISP. Of course, this knocks out Google, Yahoo, YouTube, Slashdot, ESPN, most newspapers, Hotmail, TinyURL, etc. as they really aren't affiliated with a specific ISP that could provide data for ad-shaping. (Yes, I know Ameritech/SBC/AT&T has an affiliation with Yahoo, and Hotmail is "related" to MSN, but those relationship are not all-encompassing...)

So, this leads me to one conclusion--they're replacing ads on popular sites with their own. This is the only logical conclusion, and one that (will hopefully) land them as defendants in numerous lawsuits...

Re:---HOW--- are they showing ads?

[QuantumRiff]

Neubud purchases ad space on tons of websites.. when the web page is requested, they check the requesting IP. If its on a network they "service" then they call up the cookie and the profile from the monitoring hardware at the ISP, and instead of displaying a static ad, display one targeted to your surfing habits. Then they give the ISP a chunk of change (or a percentage of ad revenue, not sure), for allowing them to have their monitoring/profiling tools installed at their access points.. The ads don't go "over" other ads, IE, you won't see them on your personal blog.. only on sites where they have already purchased advertising. (at least thats what they claim for now)

Re:---HOW--- are they showing ads?

[Anonymous Coward]

Actually, other articles have stated this is not the case.

NebuAd gets a bunch of various advertising spaces from a bunch of different web sites. Advertisers sign on with them. They act as middlemen, and an advertiser's ad may appear on any of the sites they have a deal with. It's the same as google ads in that sense. The difference is that google reads the page, and shows ads related to the content on that page; nothing personal is collected. NebuAd, on the other hand, partners with ISPs and collects user data. The ads that are displayed are related to your previous activity on other sites, but they only show up in NebuAd spaces; they don't hijack the ad spaces on any old site.

So don't worry, they're not screwing over other businesses, just you.

How I Learned to Stop Worrying & Love Data Min

[retchdog]

"...a foreign substance is introduced into our precious bodily fluids without the knowledge of the individual. Certainly without any choice. That's the way your hard core Commie works." - Jack T. Ripper

"It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that." - Center for Democracy and Technology

They are using injection and interception...

[NetPoser]

How do they do it?
Pretty nasty stuff
http://www.dslreports.com/forum/remark,20757285

I didn't RTFA, but...

[WDot]

Is Hugh Pickens the more generously filled brother of Slim Pickens?

Swell

[wellingj]

Great and grand until the the bastards grant them immunity for breaking the law again.
Do you really think that the government is going to give this a pass so that ads can be sold? Fuck no. It's going to be used as another spying opportunity when they deem fit stating, "all that information is just sitting there, why don't you give us some so we can hunt bad guys."
This will just be abused when they deem it necessary to incarcerate you for a longer period of time on some trumped up charge. 1984 is just that much closer.

Want broadband? Agree to give up privacy.

[Jackie_Chan_Fan]

All that will come out of this is when signing up for any broadband service, you will simply sign away your rights entirely.

The gov doesnt give a shit if you're privacy is protected.

To have service you will have to sign away all rights. Its that simple.

Twit

[Krapulator]

Leo Laporte and Steve Gibson went through a technical analysis of these kinds of products last week: http://www.twit.tv/sn151

Anonymous Coward

[Anonymous Coward]

... and then agrees to do nothing about it and use the information for fighting the war on terror

NebuAd is not my partner

[Anonymous Coward]

"Hey, guess what... if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice..."

NebuAd is not my partner and I am not corresponding with them.

My online behavior, the contents of the packets I transmit, are MY intellectual property, they are intended for the site to which I am transmitting, not some intercepting third party and I do not give permission to some advertiser wanting to hawk products to use my information for their profit.

take the power

[Anonymous Coward]

Perhaps it is time that everybody starts running browser testscripts that simulate browser behaviour with a lot of random sites and let it run overnight to disturb the data that is being collected.

Forget ISP's

[Wowsers]

Forget ISP's for a moment, why not investigate media companies trawling other companies (Youtube) for data on what viewer viewed what video, and how often (trade secrets)... http://tech.slashdot.org/article.pl?sid=08/07/03/121221 .

Generally, this is a bunch of FUD

[Addict-09]

I don't know the Charter deal specifically but I do know ISP's aren't planning on selling info that is identifiable back to a specific person. IE, they are not going to correlate your IP back to the account holder and sell something like John Doe at IP x.x.x.x went to sex.com 10 times between 1pm and 3pm. It would be more like, a user in this geo region went to sex.com 10 times between 1pm and 3pm.

This is already happening every time you surf the web, someone should explain what a cookie is to those idiots in Washington.

Now let's talk about Google/Hotmail/Yahoo, they read your email to target you with ad's and you can be sure *something* is being provided back to the advertisers. I'm sure it's not my username but it's certainly something like I described above. I don't see anyone complaining about that (any more at least).

Simple Solution to Tracking

[Anonymous Coward]

Setup a script to do random web crawling. That'll defeat their spying efforts. Generate a lot of 'noise' -- they'll never be able to figure out your real web behavior