Senate Scrutinizes Privacy Issues of ISP User Tracking

Hugh Pickens writes "As companies collect, use, and disseminate data regarding online users, there is concern that tracking individuals' Internet activity and gathering information from online users violates their expectations of privacy. The Senate Commerce Committee will hold a hearing Wednesday to look at the policy issues, and the hottest topic will be proposed systems by which ISPs can watch users and sell information about their surfing habits to advertising companies. The Center for Democracy and Technology has issued a report suggesting that these systems may violate federal law (PDF). 'Advertising per se is not the evil here,' says Leslie Harris from CDT. 'It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that.' On the other side NebuAd, the most active ad-targeting company, says its profiles are interest-based, and not personally identifiable. 'We have designed our entire company to make sure that we stay on the opt-out side of those laws and policies,' says NebuAd CEO Robert Dykes. Charter Communications announced last month that it would suspend a trial of NebuAd due to customer concerns about privacy."

Comments

Scrutiny should extend further.

[suck_burners_rice]

I'd say it's great that the Senate is scrutinizing what ISPs do to track people, but this shouldn't be limited solely to ISPs. There should be a lot of scrutiny about what the government does with your information, and I'm talking about all levels of government from the local level up to the federal level. Further, there are millions of businesses around the world, small and large, that gather all kinds of information. It is difficult to scrutinize so many companies, so I would say that the Senate should concentrate on the government first. Because the government collects the most.

Re:Scrutiny should extend further.

[pin0chet]

Agreed. When an ISP makes a bone-headed move, like using NebuAd, it gets a lot of bad press and has a strong competitive incentive to say sorry and fix its mistake.

I'm a lot more concerned about government invading my privacy than my ISP. You can always sue a company, but thanks to qualified immunity, government agents can break the law and get away scot-free.

Now there is a bill in the Senate, sponsored by Grassley, to force online retailers to inform the government of every online credit card transaction. You can't opt-out of govermment data collection, and you can't just "take your business someplace else."

The Senate's first priority should be taking a close look at the privacy implications of the REAL ID, the national fingerprint registry, the FBI's DNA database, and warrantless surveillance.

Re:Scrutiny should extend further.

[PopeRatzo]

You can always sue a company.

Not so. After tomorrow, for example, Americans will no longer be able to sue AT&T for violating the law by letting the Bush Administration tap their phones without any judicial oversight.

The current president has taken the 60-year old notion of "state secrets" to an extent that absolutely shreds the Bill of Rights, but there was always the possibility that the truth would come out and the lawbreakers would have to pay. After tomorrow, not any more.

Re:Scrutiny should extend further.

[corsec67]

Doesn't "state secrets" as currently used in court violate the first amendment?

Not the speech part, the ... to petition the Government for a redress of grievances. part.

Re:Scrutiny should extend further.

[PopeRatzo]

Doesn't "state secrets" as currently used in court violate the first amendment?

Absolutely. It was argued so in the 1948 case that started this whole "state secrets" baloney.

There's a recent book by Barry Siegal, Claim of Privilege which tells the story of how this remarkable encroachment on the Constitution first occurred, when a military plane crashed and some contractors died. Their wives sued and just wanted to see the accident report. The government, trying to prevent a scandal and the relatively tiny payout they would have made to the widows, pulled this "privilege" out of their asses. Two courts denied the existence of this "privilege", but the Supreme Court, always happy to oblige a powerful Executive, found for the State.

That was just the start, though. George Bush has raised the claiming of state secrets to an artform. A very ugly, thuggish and anti-American art form. May he and Dick Cheney rot in hell.

Re:Scrutiny should extend further.

[sarts]

George Bush has raised the claiming of state secrets to an artform. A very ugly, thuggish and anti-American art form. May he and Dick Cheney rot in hell.

Noted... you can expect some CIA operatives picking you up right.. about... NOW!

Good day Sir.

Re:Scrutiny should extend further.

[mi]

George Bush has raised the claiming of state secrets to an artform. A very ugly, thuggish and anti-American art form. May he and Dick Cheney rot in hell.

And you are not condemning Harry Truman and Alben Barkley to same for starting this non-sense — not to defend the country, mind you, but simply to cover-up their government's fuck-up — because?.. Oh, right, they were Democrats and thus could do no wrong...

Re:Scrutiny should extend further.

[PopeRatzo]

Harry Truman and Alben Barkley are the godfathers of the "state secrets" privilege. They scratched the surface of that canard at a time when the Cold War was just getting underway, anti-Communism was rampant and nuclear weapons had only recently been unleashed on the Earth.

But what they did absolutely pales beside what George Bush and Dick Cheney have done. I'm sorry if that pains you to hear, but it's the truth.

The two guys you voted for have done more in eight years to destroy our Constitution and the entire American way of life than all the presidents before them, combined. Just look at the number of signing statements George Bush has used compared to the previous few dozen presidents.

Oh, right, they were Democrats and thus could do no wrong...

mi (197448), That's a real peckerhead thing to say. You right-wing jackoffs sure get snotty when things don't go your way, huh?

Re:Scrutiny should extend further.

[mi]

You right-wing jackoffs

The term is "jerk-off", and it applies to you.

Yeah, and?

[Red Flayer]

'It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that.'

Hey, guess what... if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice (i.e., don't give private info to someone you don't trust). If you choose not to make safe your correspondence from third parties via encryption, that's your problem.

I'm willing to risk some troll or flamebait mods here to make a point:

No correspondence should ever be considered absolutley private. The same tools that allow data aggregation by companies like Google and ISPs give us better access to information and (arguably) a better quality of life. You have to take the bad with the good.

Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in (ok, in theory. In practice, this needs further work). They allow people and businesses to target our needs better, so it's easier for me to find what I'm looking for.

As long as we have the ability to anonymize and encrypt our traffic (which isn't a given), I have no problem with profiling. Those who want to opt out can do so easily... and if there is enough demand for it, there will be off-the-shelf tools for joe sixpack to do so.

So my point is this: Allow us to anonymize our traffic. Allow us to encrypt our traffic. Then you can go ahead and profile all you want.

Re:Yeah, and?

[no-body]

Have you ever counted or even looked at the 1 pixel images embedded into web sites?
I encountered a recent ridiculous one from a Yahoo access - something like that:
us.bc.yahoo.com/b?P=FjLh6UWTUG8MnHdaSGkxXR + over 1000 characters more

To load 1 PIXEL!!!!!

There is tons of that stuff embedded in web sites. And that's got nothing to do with 2-way communication whatsoever.

Wo tracks it, who controls it, who sells and buys it?
Are the neurons in Sentat's heads interlinked enough to grok this?

Highly doubtful - and they (the trackers) will fight tooth and nail about it to keep it that way.

We all are paying for the free ride to information with our privacy.

Re:Yeah, and?

[Red Flayer]

Wo tracks it, who controls it, who sells and buys it?

And why should you care, if your traffic is anonymized and your personal information, when needed, encrypted?

Re:Yeah, and?

[Anonymous Coward]

Hey, guess what... if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice (i.e., don't give private info to someone you don't trust).

Your ISP is a carrier of information, not a partner in a two-way correspondence, they are a third party who facilitates your communication. Like the postal service in a snailmail correspondence. In the contexts of internet access they are proposing to eavesdrop on private communication for profit. I doubt you would be happy if the postal service routinely read your mail, then slotted in 'targeted' adverts, before re-sealing and delivering to your home but promising to forget what they had read.

Re:Yeah, and?

[Red Flayer]

the free market has killed democracy quite badly.

Reminds me of a quote (or sig) I saw once, wish I could remember the source:
"In the 80s, capitalism triumphed over communism. In the 90s, it triumphed over democracy."

Re:Yeah, and?

[lordofwhee]

Not only are there people who don't know anything about encryption, but why should I have to do something extra to ensure I have what is already supposed to be mine?

Re:Yeah, and?

[Opportunist]

There is no harm in a business wanting my data to serve me better.

Provide I, and only I, decide when they get what data.

Re:Yeah, and?

[Red Flayer]

Not only are there people who don't know anything about encryption

If they care about their privacy, that is their problem. If they don't care, no harm, no foul.

but why should I have to do something extra to ensure I have what is already supposed to be mine?

I have tons of problems with this question. Why do you assume that "it" is supposed to be yours? You're transmitting postcards, not sealed envelopes... assuming that by "it" you are referring to privacy, what makes you think that you have any expectation of privacy in a de facto public space if you don't make any efforts to safeguard it?

If I send a postcard to a friend, I assume anyone who handles it could read it. But that's not fair! Why should I have to take the extra step of sealing an envelope in order to maintain the privacy of my letter? And if it's really important info, you can bet your ass I'd encrypt it with a one-time pad. So even if they open my mail, they won't find anything useful without dedicating ridiculous resources to it.

Re:Yeah, and?

[no-body]

"if"

-yeah, encrypted web surfing/email for the masses is happening and Tor has lightning access speed.

It's just not reality at this point and will it ever be? So, your premise to arrive on your conclusion to "no need to care" is not a given, it's a cloud castle.

Re:Yeah, and?

[noidentity]

Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in (ok, in theory. In practice, this needs further work).

Then why do they show me ads at all? I DO NOT WANT THEM. Oh right, the profile isn't to serve me, it's to serve them (usually by manipulating me). So the profiles allow them to better manipulate me. Why do I want this, again?

Re:Yeah, and?

[flaming error]

if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice

Maybe. But that doesn't mean it's legal, and, more to the point, that there isn't "an expectation of privacy."

If you choose not to make safe your correspondence from third parties via encryption, that's your problem

So we should google over SSL? I can't find their https search service.

The same tools that allow data aggregation ... give us better access to information... You have to take the bad with the good.

Why do we have to "take the bad with the good"? Is there some law of quantum physics that says website visitor tracking must be entangled with advertising services?

Re:Yeah, and?

[inhahe]

Collecting information about people's habits without their knowledge or explicit consent for the purpose of making money is reptilian. I say reptilian because I'm not sure that I can say it's unethical, because I don't believe that taking pictures of people in public is unethical. But then, what they do is more akin to paying someone you're likely to speak to to secretly record your conversation for them.

If we all believed that companies just wanted to serve our best interests, then there would be no backlash against this kind of profiling. But since we know on a deep level that corporations are fundamentally cold, evil and without conscience, it bothers us. You could say that by the devil's grace it just happens to work out so that serving their best interests serves ours, but that does not make it not reptilian.

And saying that, basically, if you don't want companies to profile you then surf anonymously is dangerously close to saying that if you don't want to be shot (and injured) by a criminal then wear a bullet-proof vest. Or if you don't want someone creating a voodoo doll in your likeness and dipping you in vaults of various acids in effigy, or perhaps collecting a DNA swipe off of a counter you touched to analyze it on their computer and determine the best pick-up line to give you the next day, then wear a hair net, a veil, gloves, a long-sleeved shirt and pants whenever you go out. Or maybe just a burqa to make it easier. We shouldn't _have_ to hide.. Oh, yeah, and the DNA analyst at his computer is just trying to figure out how to best serve you, right?

TBH though, there is no law against making a voodoo doll of someone and burning it (and I don't want the Inquisition all over again), so it's iffy whether companies should legally be allowed to do that. But I'm certainly not going to be apologetic for them..

Re:Yeah, and?

[Red Flayer]

If there is a demand for anonymization and encryption services, someone will provide it. As more people are aware of (and concerned about) privacy issues, they will make use of such services, even if they have to pay for it.

Just because you don't see it happening a ton today doesn't mean it won't be used a lot tomorrow.

What is important is that our *right* to use anonymization services and encryption is not abrogated.

Re:Yeah, and?

[Red Flayer]

Fully agreed. Hence the right to use anonymization and encryption must be held sacred. A built-in opt-out clause solved through technology, not through legislation (which is bound to have transgressions).

Re:Yeah, and?

[flaming error]

> the free market has killed democracy
Maybe it's not so much the "free market" that's to blame, but that we allowed our government to sell itself.

> [killed] quite badly.
It just so happens that it's only mostly dead.

Re:Yeah, and?

[Red Flayer]

Why do I want this, again?

Because it pays for the content you're accessing? Because it helps offset the cost of providing service to you?

Re:Yeah, and?

[Anonymous Coward]

Hence anonymization and encryption. Did you even read my post? Or did you rush to respond to the first line you read to which you could raise an objection?

If all your traffic is encrypted, and goes to an anonymization server, how exactly is the ISP supposed to sniff the traffic? Seriously.

The two-way correspondence refers to the end recipient of your packets, not to the ISP.

I did indeed read your post, all the way through, the point you made related to someone party to the correspondence revealing information, not the carrier (postal, phone or internet). Your ISP is a third party to your internet browsing, you pay them to carry your traffic, not to parse then serve 'targeted' adverts for profit, which is the subject of the article.

Google and ISP profiling are not comparable, I don't pay Google for a service and can opt out of their profiling. As I said, I pay my ISP for access to the internet, their profiling gives no added value and will reduce my security.

As to encryption, it's a sad day when you cannot trust your service provider to provide a service, without eavesdropping for profit. What next, encryption for snailmail? We could always use invisible ink, but that might prove difficult for the mail service to deliver.

Re:Yeah, and?

[compro01]

Hey, guess what... if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice

Actually, that's not always the case. With phones for example, in some states[1], it is illegal to record a phone call without the other person's knowledge and consent. This is the reason for that "this call may be monitored or recorded" thing. Staying on the line implies consent.

[1]California, Connecticut, Delaware, Florida, Massachusetts, Maryland, Michigan, Montana, New Hampshire, Pennsylvania, and Washington.

Re:Yeah, and?

[Red Flayer]

But that doesn't mean it's legal, and, more to the point, that there isn't "an expectation of privacy."

Why should it be illegal? Other than things like credit card numbers, social security numbers, etc, why should it be illegal? Is it illegal for me to tell my wife the details of a conversation I had with you?

As for the expectation of privacy, are you kidding me? Were you never taught that emails (or for that matters, any packets) should be considered postcards, not sealed envelopes? The internet is a de facto public space. The quicker you internalize this, the happier you will be.

Why do we have to "take the bad with the good"? Is there some law of quantum physics that says website visitor tracking must be entangled with advertising services?

Is there some law of quantum physics that says that wensite visitor tracking cannot be entangled with advertising services?

I am loathe to ask for a legislative solution to a problem that has a technical solution. Far better to use the technical solution that makes the question moot, than use a legislative solution that *trust* that the law is being followed.

Re:Yeah, and?

[bersl2]

Are the neurons in Sentat's heads interlinked enough to grok this?

I found that typo somewhat amusing, because it rhymes with "mentat", and that produced a very bizarre image in my mind.

Re:Yeah, and?

[Darkness404]

And why should you care, if your traffic is anonymized and your personal information, when needed, encrypted?

But honestly, in order to get anonymous internet, you either have to A) take a huge speed-hit or B) trust a proxy. Neither of those are usually good options.

Re:Yeah, and?

[Red Flayer]

As to encryption, it's a sad day when you cannot trust your service provider to provide a service, without eavesdropping for profit. What next, encryption for snailmail? We could always use invisible ink, but that might prove difficult for the mail service to deliver

If you're going to continue the snailmail metaphor, again I have to stress that without encryption, you are sending postcards, not sealed envelopes. And plenty of people have used, and still use, encryption with snailmail, as they deem it necessary to maintain their privacy. The question is, how much do they value their privacy, and how much effort do they have to put in for encryption? When encryption is so easy electronically, why not take advantage of it?

I think it's absolutely absurd to think that when you give a private for-profit organization your correspondence, you don't expect them to try to make money off their own information (after all, they have as much right of ownership to the information of what crosses their network, and from where, as you do).

Privacy cannot be protected by legal recourse. It can only truly be protected by technological recourse. Making something illegal does not prevent it from happening. Making something impossible does.

Re:Yeah, and?

[Red Flayer]

Why? I use a proxy for sensitive stuff, and I trust it. I pay for that privilege, but at some point, you have to trust someone unless you personally own all the network the packet transverses. I'd rather trust a proxy I pay to safeguard my information (who stands to lose a lot of business if it gets around that they aren't doing their job) than trust someone with a monetary incentive to sniff my information.

Re:Yeah, and?

[flaming error]

> why should it be illegal?
Because it isn't opt-in.

> Is it illegal for me to tell my wife the details of a conversation I had with you?
The more relevant question would be: Is it ethical for the phone company to record and correlate all conversations going through their lines and sell (summaries of) the recordings to third parties? Without their customers' consent? Without their knowledge?

> Were you never taught that emails ... should be considered postcards
What I've been taught is irrelevant. What the average user expects is what congress is asking. And just because a mailman has the ability to peruse a postcard doesn't mean he should photocopy it and sell it on eBay.

> I am loathe to ask for a legislative solution to a problem that has a technical solution
Me too - I absolutely agree. So, how do I conceal my slashdot posts, google searches, and online shopping from my ISP?

Re:Yeah, and?

[Red Flayer]

But then, what they do is more akin to paying someone you're likely to speak to to secretly record your conversation for them

Sure. And why should I expect that this would never happen? Because it's unprofitable for them. But when the value of my conversations is more than the cost of paying people to eavesdrop, I have no expectation that people won't do so. This is why if you have information worth a lot to you, you don't share it, except with people you trust.

And saying that, basically, if you don't want companies to profile you then surf anonymously is dangerously close to saying that if you don't want to be shot (and injured) by a criminal then wear a bullet-proof vest. Or if you don't want someone creating a voodoo doll in your likeness and dipping you in vaults of various acids in effigy, or perhaps collecting a DNA swipe off of a counter you touched to analyze it on their computer and determine the best pick-up line to give you the next day, then wear a hair net, a veil, gloves, a long-sleeved shirt and pants whenever you go out. Or maybe just a burqa to make it easier. We shouldn't _have_ to hide.. Oh, yeah, and the DNA analyst at his computer is just trying to figure out how to best serve you, right?

I nuderstand what you're saying, but the problem is that legal recourse will not protect your data. Someone with the resources and the desire will be able to get your data if they want it. Your right to privacy means nothing if it can be transgressed at will.

The only solution is a technical one. When you have to depend on your government to protect your privacy, you're fucked. The government has invasion of your privacy in its interests, so you better protect it yourself... in this case, via encryption and anonymization.

Re:Yeah, and?

[Domo-Sun]

Well, not everyone agrees with you. Some states make it a crime to record police, or phone calls without informing all parties.

We don't have to take the bad with the good. We can change it. Why are you so gangbusters? You sound like and ad fanatic.

Creation of profiles allow vendors to... annoy us. My needs are not being targeted well at all. My need is for them to stop profiling and showing me irrelevant things I don't want to buy.

As for your If there's anonymity demand, it'll be filled comment later. I like privacy tools like that but they always seem to be short lived. There's no guarantee that because people want those things they'll just be there. Often people want things but they're forced to take garbage. It's a wishful thinking false dilemma.

Re:Yeah, and?

[markjhood2003]

Profiling is only justified on an opt-in basis. Users need to know exactly what they are exchanging for access to searches or web content, and this can only be accomplished by an explicit agreement between the service or content provider and the user. Otherwise there is no informed consent, and we are lost in legal murkiness.

No correspondence should ever be considered absolutley private.

Aside from technical screw-ups, accidental or illegal behavior, or possibly national security concerns, the default expectation absolutely should be privacy in one's correspondence. If privacy is not going to be honored, then an opt-in mechanism that explicitly details the information to be collected is the only ethical approach.

The same tools that allow data aggregation by companies like Google and ISPs give us better access to information and (arguably) a better quality of life.

Data aggregated from public web sites for searching purposes is not the same as aggregating data from individuals operating under the default expectation of privacy.

Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in ...

No, surreptitious profiling allows Google and other advertising companies to serve their corporate clients better, not individuals. I am better served by not having to view ads at all, as I am capable of directing my own searches. I'd much prefer to pay for each search I request using some sort of micro-payment scheme; other individuals should be given the opt-in to free advertising-supported searches if they personally feel comfortable with that.

Re:Yeah, and?

[Domo-Sun]

Because we're supposed to be in a society that's built around rules that our papers and effects and privacy should not be infringed. People do care. Just because people are unaware or don't know how to encrypt their e-mail doesn't mean a company has a right to copy, read, sell and distribute it.

Re:Yeah, and?

[Domo-Sun]

you are sending postcards, not sealed envelopes... I think it's absolutely absurd to think that when you give a private for-profit organization your correspondence, you don't expect them to try to make money off their own information (after all, they have as much right of ownership to the information of what crosses their network, and from where, as you do).

What? If I send a postcard, I'm not too excited about people reading it, but then I don't assume that a corporation is going to copy everything I send and claim ownership to it just because they handle it.

Why does a corporation have a right to the information in my postcards? That's like saying that amazon has rights and ownership of all books that they handle. Copyright infringement is a crime, and it's don't stop people completely from violating it, but I expect amazon and any other company to respect copyright. Those e-mails I write are mine just the same.

Re:Yeah, and?

[Darkness404]

If you are paying for a proxy then I suppose that it would have incentive to keep your info safe. The downside is, it is more likely to be bullied into giving logs, etc. to various government and possibly other businesses.

Re:Yeah, and?

[pin0chet]

There are plenty of highly anonymous VPN/SSL tunneling services available for 10 or 15 bucks a month. No need to take a speed hit or trust an unknown foreign proxy server. -Steganos https://www.steganos.com/us/products/home-office/internet-anonym-vpn/overview/ -VPNGates http://www.vpngates.com/ -SecureIX http://www.secureix.com/ -Relakks https://www.relakks.com/?cid=gb -Anonymizer http://www.anonymizer.com/

Re:Yeah, and?

[ben(zen)]

Because it pays for the content you're accessing? Because it helps offset the cost of providing service to you?

I thought the bill you pay monthly covers the cost of maintaining the networks over which the information is travelling. As you wrote them, the two rhetorical-sounding questions there are contradictory, in some ways. In the first case, the content is being paid for by targeted advertising, while in the second, you're receiving a discounted price from the full cost and receiving targeted advertising. One does not equal the other. I would much rather they run the system without the advertising and charge an accurate cost for access.

Re:Yeah, and?

[Zontar The Mindless]

Reminds me of a quote (or sig) I saw once, wish I could remember the source:
"In the 80s, capitalism triumphed over communism. In the 90s, it triumphed over democracy."

Source of the quote: David Korten.

(Props to Jeremiah Cornelius, where I first saw it.)

Re:Yeah, and?

[Opportunist]

I don't see why I should have to take steps to avoid being spied on by corporations. Such a notion pretty much means that privacy becomes the prerogative of people technically savvy enough to protect it.

Re:Yeah, and?

[CowTipperGore]

You're transmitting postcards, not sealed envelopes... assuming that by "it" you are referring to privacy, what makes you think that you have any expectation of privacy...

To complete your analogy, I guess it would be okay for the US government to read all postcards sent via the US mail, log the data, and use it for whatever purpose they want? After all, not sending it in a triple-sealed container means that we clearly wanted this information gathered and used. UPS can open and examine packages sent in paper envelopes or cardboard boxes, since if we cared about privacy we would have used a welded box.

You're confusing what could happen with what should happen. Just because someone can read your postcard doesn't mean we should be okay with the USPS doing so as policy. Just because UPS could open packages and reseal them, we shouldn't be okay with them modeling my underwear before they arrive.

Well

[Anonymous Crowhead]

It's not that I don't not disagree against this, but I can't say that I agree with the counter argument against this. That said, I pick the blue marble and place it in the yellow jar.

Re:Well

[maxume]

You have awakened a mummy.

Boiling a frog

[Mike Rice]

How ironic that Congress is, in all likelihood, about to pass a telecoms immunity bill which allows them to spy on us... but are giving lip service to the issue of telecoms spying on us.

CongressCritters and Snoozators will soon be making a lot of noise about how they are protecting the public from being spied upon, while at the same time making it legal for us to be spied on.

Nothings changed, just another election year.

Re:Boiling a frog

[easyTree]

CongressCritters and Snoozators will soon be making a lot of noise about how they are protecting the public from being spied upon, while at the same time making it legal for us to be spied on.

Democracy in action :) - or rather that's what happens when the free market and democracy collide.

We had a similar situation in the UK recently with a company called Phorm. ISP's were entering into secret deals with them to collect our data so that they could modify the html streams returned from sites to inject targeted advertising. i.e. pure evil was afoot :)

http://en.wikipedia.org/wiki/Phorm

Re:Boiling a frog

[Opportunist]

What free market? I hope you don't mean the mockery thereof that the current market of corporate cartels is.

Re:Boiling a frog

[easyTree]

Perhaps I'm using the wrong term - I'm ignorant of world affairs..

I'm talking about the situation that exists when profit is used as a means to determine what is moral.

Re:Boiling a frog

[Guppy06]

"9% approval rating - seriously. 9%."

It could be 0% and nothing would change. Ask any voter and they'll tell you that the House of Representatives is composed of 434 voting asshats and one person who walks on water, who just happens to represent their district. Besides, the incumbents have seniority due to tenure, which further disinclines voters to vote against them.

Re:Boiling a frog

[Opportunist]

It's not even profit anymore. Profit as a measurement of morality could be considered free market. What we have today is more control instead of profit. Everything is moral and fine as long as I get more control. More control of the market (in case I'm a corporation) or more control of the people (in case I'm a government).

I'd have less problem with this...

[fahrbot-bot]

We have designed our entire company to make sure that we stay on the opt-out side of those laws and policies,' says NebuAd CEO Robert Dykes.

... If they'd stay on the "opt-in" side, but I'm sure user participation and company profits would be lower. Too bad, so sad...

Re:I'd have less problem with this...

[QuantumRiff]

Charter Communications announced last month that it would suspend a trial of NebuAd due to customer concerns about privacy. The sad thing was, their page specifically stated that their Cookie would opt you out of seeing the ads. They did not say that the cookie would keep you from being tracked. Even most non-tech people know to clean their cookies, and many programs will do it for you, like ccleaner on windows. Their privacy policy explicity states they will turn over all logs and information for a warrant or supeana. There is nothing "opt-in" about what they were trying.

Re:I'd have less problem with this...

[Gat0r30y]

Not necessarily - what if you could opt in for a little discount. You get 5 bucks off your monthly internet bill, and in exchange they have permission to keep a cookie on your machine to track what your doing. On the other hand, as a government backed monopoly I suspect that the ISP's are going to come out of this whistling the tune of the free market.

Re:I'd have less problem with this...

[leenks]

Why would they need a cookie to track what you are doing? They can just monitor your connection directly as it flows through their network.

Re:I'd have less problem with this...

[Taibhsear]

I get $20-30 an hour for doing random surveys, taste testing, and the like for a local ad research agency so they'd have to do far better than $5 per month. If they are collecting my info they damn well better ask me first and they sure as hell better be paying ME for it. Not the other way around. If they paid for my internet connection I'd consider taking a 1 hour survey a month about my surfing habits. But they sure as hell better not actually track me and you don't get to do it unless I say so. Opt-out my ass.

Re:I'd have less problem with this...

[Domo-Sun]

Yeah, I always clear my cookies when I close windows. Especially in a torrent, as nothing spoils an evening more than wet cookies.

Re:I'd have less problem with this...

[Domo-Sun]

I hate opt-in discounts. It's like those grocery cards that you have to choose between them spying on you for a discount, or inflated prices. And then everyone lectures you about it if you don't. It's wrong.

Re:I'd have less problem with this...

[inwo42]

Notice to all advertisers wishing to target me: I opt out. Please do not advertise to me. If I want your crap, I'll find you.

Re:Since When Do They Care About Our Privacy?

[Tackhead]

They're going to grant the telecoms immunity and the Bush Administration a free pass on breaking federal wiretap laws and violating the 4th Amendment, but *this* concerns them? Spare me.

1970s: Don't steal. The government hates competition.
2010s: Don't spy on your users. The government still hates competition.

Watch just one little word

[Ollabelle]

To me, the money here is targeting the user to feed him/her ("them") ads based on what that user has already seen, queried, etc.

Yet, NebuAd says the data they collect is not "personally" identifiable. I'll bet a six-pack that the data is damn-sure "individually" identifiable by cookies, etc.

"Personally" just means they're not selling my name along with my surfing habits. But they are very much tracking my individual habits/interest and selling that; user by individual user. I say send them back to tele-marketing, the scum-bags.

Re:Watch just one little word

[MrDERP]

all of these comments and ideas were covered pretty thoroughly in a recent Security Now Podcast, definitely worth a listen... JEff

Putting it simply

[CopaceticOpus]

What is needed is a clear separation between those companies that sling bits (ISPs) and those who provide content and advertising. Each ISP should be required to transfer data as fairly as possible with a minimum of interference and monitoring.

Most broadband providers have a monopoly or duopoly, and therefore need to be regulated strongly. Otherwise, customers who object to these invasions of privacy will have nowhere to turn.

---HOW--- are they showing ads?

[BUL2294]

One question that the article doesn't explain is HOW they are showing targeted ads on sites... Sure, I understand if I were a Charter Communications ISP customer going to a Charter site, then there would be some ad-targeting... But I seriously doubt most customers are frequenting sites that are affiliated with their ISP. Of course, this knocks out Google, Yahoo, YouTube, Slashdot, ESPN, most newspapers, Hotmail, TinyURL, etc. as they really aren't affiliated with a specific ISP that could provide data for ad-shaping. (Yes, I know Ameritech/SBC/AT&T has an affiliation with Yahoo, and Hotmail is "related" to MSN, but those relationship are not all-encompassing...)

So, this leads me to one conclusion--they're replacing ads on popular sites with their own. This is the only logical conclusion, and one that (will hopefully) land them as defendants in numerous lawsuits...

Re:---HOW--- are they showing ads?

[QuantumRiff]

Neubud purchases ad space on tons of websites.. when the web page is requested, they check the requesting IP. If its on a network they "service" then they call up the cookie and the profile from the monitoring hardware at the ISP, and instead of displaying a static ad, display one targeted to your surfing habits. Then they give the ISP a chunk of change (or a percentage of ad revenue, not sure), for allowing them to have their monitoring/profiling tools installed at their access points.. The ads don't go "over" other ads, IE, you won't see them on your personal blog.. only on sites where they have already purchased advertising. (at least thats what they claim for now)

Re:---HOW--- are they showing ads?

[Anonymous Coward]

Actually, other articles have stated this is not the case.

NebuAd gets a bunch of various advertising spaces from a bunch of different web sites. Advertisers sign on with them. They act as middlemen, and an advertiser's ad may appear on any of the sites they have a deal with. It's the same as google ads in that sense. The difference is that google reads the page, and shows ads related to the content on that page; nothing personal is collected. NebuAd, on the other hand, partners with ISPs and collects user data. The ads that are displayed are related to your previous activity on other sites, but they only show up in NebuAd spaces; they don't hijack the ad spaces on any old site.

So don't worry, they're not screwing over other businesses, just you.

Re:Since When Do They Care About Our Privacy?

[Naturalis Philosopho]

The Bush administration will make their life difficult if they investigate telecomm immunity.

If they look into ISP privacy issues then the telecomm industry will buy them expensive vacations and contribute to their "re-election campaign fund" (not to influence them though).

If you were a political hack, which would you look into?

How I Learned to Stop Worrying & Love Data Min

[retchdog]

"...a foreign substance is introduced into our precious bodily fluids without the knowledge of the individual. Certainly without any choice. That's the way your hard core Commie works." - Jack T. Ripper

"It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that." - Center for Democracy and Technology

I didn't RTFA, but...

[WDot]

Is Hugh Pickens the more generously filled brother of Slim Pickens?

Swell

[wellingj]

Great and grand until the the bastards grant them immunity for breaking the law again.
Do you really think that the government is going to give this a pass so that ads can be sold? Fuck no. It's going to be used as another spying opportunity when they deem fit stating, "all that information is just sitting there, why don't you give us some so we can hunt bad guys."
This will just be abused when they deem it necessary to incarcerate you for a longer period of time on some trumped up charge. 1984 is just that much closer.

Re:Since When Do They Care About Our Privacy?

[Guppy06]

"The Bush administration will make their life difficult if they investigate telecomm immunity."

For six months? Does the phrase "lame duck" mean anything to you? All anybody that didn't support the immunity and wasn't complicit in it would have to do is run out the clock, and yet...

Re:Since When Do They Care About Our Privacy?

[Naturalis Philosopho]

You're right, but your reasoned response requires a thinking adult who is not interested in telco money to implement such a plan... have you seen anyone who meets that description (outside of the visitor's gallery) hanging around the Capitol Building recently? That said, my point was more that they could profit financially acting as they are- they probably aren't even considering the hassle they'd get from the administration.

I share your frustration.

Want broadband? Agree to give up privacy.

[Jackie_Chan_Fan]

All that will come out of this is when signing up for any broadband service, you will simply sign away your rights entirely.

The gov doesnt give a shit if you're privacy is protected.

To have service you will have to sign away all rights. Its that simple.

Twit

[Krapulator]

Leo Laporte and Steve Gibson went through a technical analysis of these kinds of products last week: http://www.twit.tv/sn151

Forget ISP's

[Wowsers]

Forget ISP's for a moment, why not investigate media companies trawling other companies (Youtube) for data on what viewer viewed what video, and how often (trade secrets)... http://tech.slashdot.org/article.pl?sid=08/07/03/121221 .

Generally, this is a bunch of FUD

[Addict-09]

I don't know the Charter deal specifically but I do know ISP's aren't planning on selling info that is identifiable back to a specific person. IE, they are not going to correlate your IP back to the account holder and sell something like John Doe at IP x.x.x.x went to sex.com 10 times between 1pm and 3pm. It would be more like, a user in this geo region went to sex.com 10 times between 1pm and 3pm.

This is already happening every time you surf the web, someone should explain what a cookie is to those idiots in Washington.

Now let's talk about Google/Hotmail/Yahoo, they read your email to target you with ad's and you can be sure *something* is being provided back to the advertisers. I'm sure it's not my username but it's certainly something like I described above. I don't see anyone complaining about that (any more at least).