Slashdot Mirror
Tool To Allow ISPs To Scan Every File You Transmit
timdogg writes "Brilliant Digital Entertainment, an Australian software company, has grabbed the attention of the NY attorney general's office with a tool they have designed that can scan every file that passes between an ISP and its customers. The tool can 'check every file passing through an Internet provider's network — every image, every movie, every document attached to an e-mail or found in a Web search — to see if it matches a list of illegal images.' As with the removal of the alt.binary newgroups, this is being promoted under the guise of preventing child porn. The privacy implications of this tool are staggering."
This will cause huge latency issues and cost beaucoup bandwidth. ISPs would be shooting themselves in the foot if they did this with all traffic. OTOH, I could see laws requiring such tools for P2P traffic -- in fact that may well be inevitable, with the **AA's "ruling class" status these days.
Caveat Utilitor
ends with the MPAA and RIAA suing you for your mp3s and .mpgs.
Careful What You Wish For....
"The tool can 'check every file passing through an Internet provider's network -- every image, every movie, every document attached to an e-mail or found in a Web search -- to see if it matches a list of illegal images.' "
How exactly is this going to be accomplished? The equipment cost must be staggering and would consume allot of power. Way to conserve electricity, I thought we were trying to reduce the amount of power the Internet consumes. Does also this remove the common carrier status of ISP's?
I hope this never comes to fruition.
Wasn't that the Aussie spyware company attached to Sharman Networks/KaZaA?
Before it got raided, I mean?
I call shenanigans.
Can it decrypt SSL/SSH in real time?
extern warranty;
main()
{
(void)warranty;
}
So what happens when the malware guys decide to have their malware fire off images that are on this list of banned files/images?
Suppose that their 'smart' and have the image embeded in the malware (or otherwise obscured). the malware sits there for a while and infects as many systems as possible... then the SPAM event happens. With this crap... I mean "wonderful, keep-our-kids-safe" software kicks in and drags even more of the internet down, who's gonna pick up the tab?
I know... have the **AA morons... I mean overlord masters, sign an iron-clad agreement to pick up that tab and I'll gladly get infected. :|
Except... I don't really feel like being arrested for having been infected by perverted malware. :(
When those around you are loosing their heads while you are keeping yours, maybe you've misunderstood the situatiuation.
... what is going to prevent this proverbial snowball from building into a full-blown avalanche? I guess it has already become one to some extent... I can't recall a time in history when the WORLDS rights and privacy were as stripped and neglected as it is now, and then everyone suddenly got their right to privacy and freedom back. Despite its amazing capabilities, technology sure has put us into an interesting position when in the hands of people like "Brilliant Digital Entertainment" ... yeah, real brilliant. Crackheads.
Ok, on really simple protocols, like HTTP or FTP, maybe - but most, if not all, p2p traffic is safe, i think. This is of course because of the chunky nature of transmission - you can't really tell what part of the file went through your pipe just by looking at it, and since parts are sent at random, you cannot rebuild the file with your chunks without guiding information, be it a torrent file, a list of parts for emule, or whatever else there is. And you need the whole file to get your hash-check. That's one. Two: encryption totally kills the effort, as the ISP can in no way examine your file without interfering with your transfer, and SSL exists solely to protect you from this.
Even if my line of thinking is really misguided here, this would require lots and lots of processing power - i mean, on a routing line with a hundred users on one end, it's thousands of hash-checks to be made for every stupid rebuilt file - both processes of course painfully CPU-eating, unless you want false-positives, since you didn't bother to use a proper hashing algorithm.
All in all, this looks to me like a terrible waste of money.
"We are the music makers, and we are the dreamers of dreams [...]."
shhh.. don't tell the government..
Goatse? That might as well be a default Windows wallpaper once you've seen Mr. Hands.
On the Oregon Cost born and raised, On the beach is where I spent most of my days
Time to make a utility that puts a file into an encrypted 7Zip archive, with the password stored in some reversable encryption method (encrypt the password with all zeroes as a key 1 million to 2 million times), so it would take x CPU seconds on some hardware to decrypt it.
This would allow files to still go across the net without requiring passwords or keys, but prevent utilities like this from just passively obtaining traffic, just due to the CPU cycles involved.
Of course, just stuffing a password in the comments field works too, but with a decent text parser, it can be extracted.
Its just more of the same cat and mouse game. The real crooks will not be affected while Joe ISP User will lose his privacy even more.
According to the Wikipedia entry on Australian copyright law "[...]Brilliant Digital Entertainment in Australia were raided for copyright violations[...]" in 2004.
It looks like someone switched sides but taking a closer look they only seem to be in charge of the adware that came with Kazzaa, so I guess they were always evil.
Not only that, but it says that it works against movies.
The ISP downloads the entire 1-5GB file, hashes it, compares the hash, and then if it passes sends the file on to the user?
I think that would break almost every kind of application, and could easily be used to swamp the downstream of the ISP by making requests and then dropping the connection.
And then what about hash collisions, or programs that aren't web browsers?
If I have nothing to hide, don't search me
Comment removed based on user account deletion
They're claiming they'll man-in-the-middle p2p users to disable encryption. Major problems there.
They're using a hash for the images/movies. Alter the image tags, or change a pixel, you've beat it. The more they ignore diffs, the more false positives they'll get.
There's my five seconds of thought on the efficacy/ethics of this. If you manage to solve all those problems, come back and I'll give it another five seconds. See you in ten years.
But hey, once it's in place they can use it for the *AA! Which is really what this is about, more free handouts to obsolete business models.
This is fantastic, since the amount of money required by an ISP to implement this will sink them. This will filter all "idiot" ISPs, who think they are rulers of the internet.
is to have ISPs scan all downloading files to make sure they do not contain malware or viruses so we don't have so many botnet zombies around the web from idiots opening britneysex.exe
Well I'll be damned! THATS why every time I try to listen to shoutcast my ISP (centurytel)
kicks me off. Maybe if I listened to a station they liked?
Can it decrypt SSL/SSH in real time?
According to the article they use man-in-the-middle attacks. This is probably quite easy if the server is using self-signed certs.
The problem with all the hysteria around child pornography is that it's too easy to frame someone. A little research, five minutes alone with your computer, and an anonymous phone call are all someone needs to ruin your life and reputation.
Let me be perfectly clear: Even if you're completely innocent, this is a serious threat to you. If someone decides to frame you, you won't be able to prove your innocence, and it won't matter even if you can. That's unacceptable. Yes, child porn is bad, but a society where anyone can anonymously destroy anyone else is much, much worse.
You know what? In a dozen years of actively surfing porn, I've never encountered kiddie porn in the wild. This great big threat to all mankind so severe that we all need to put woolly pullovers over all our electronic gear and filter all telecommunications is simply and plainly crap. It's a ruse.
There are some people who want to control everyone else. They want to control what you see, what you hear, and as much as is humanly possible, what you think. They want to monitor us all (but not themselves, of course) and make us all cookie-cutter little clones who all think the same harmless little thoughts and are all scared of their authority.
F * U * C * K them.
Anyone telling you this sort of "protection" is necessary is deluded or a liar. Either way, such people should be ignored or in extreme cases, put somewhere they cannot bring harm to others.
"but the side effect is that in a few years millions of Asians, who might otherwise have become normal, productive, law-abiding citizens of their respective countries, will instead have become deranged pedophiles."
Japan is proof the two aren't mutually exclusive.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Seems to me that if a user attempts to download a file that happens to have the same hash as a "known bad" file, they could be in for a world of hurt unless the system does verification of some kind. And if the verification step is conducted manually rather than automatically -- in the interest of expediency, of course -- what do you bet the odds are that some law enforcement types aren't going to be bothered with niceties like actually checking that some file is indeed prohibited material?
Try mounting your own defense when you are systematically blocked from obtaining a copy of the file that you attempted to download in the first place. (Yes, surely our hypothetical user's attorney could find this file, even if they needed to use an ISP outside the country to do it. This assumes that Joe User has an attorney and can afford to mount a defense.)
A malicious actor could craft a file that will generate a hash collision with some known prohibited file, and if the sender/creator is suitably crafty and hides his tracks, such techniques could be easily used to grief our hypothetical user with virtually no chance of reprisal against the originator of the bogus file.
And good luck trying to teach a jury about hash collisions.
Comment removed based on user account deletion
Why not snoop every phone call, open and scan every piece of snail mail, record every conversation?
That's a good idea. If everybody was monitored then we'd likely catch somebody doing something wrong. Unfortunately your idea isn't very original as the British are ahead of you on this. It would be even better if we made it mandatory for computer manufacturers to have Webcams built into monitors and turned on by default so that we can actually see the individual and put his picture in a database in case they end up doing something bad. Also with IPv6 we can (have enough addresses) to assign static IPs to individual names and addresses that we can store in a government database. This isn't just convenient for law enforcement, it is for the good of the children.
Britain, China, North Korea, and the US seem to be leaders in protecting the children.
OK, why are they being allowed to treat electronic content differently from sealed letters and packages? Do they steam open your letters and parcels to see if anything contentious is being sent? No, and I'll bet that's because it is unconstitutional... so why are they treating electronic delivery differently? There should be massive protests against this... no way should they be able to use the protecting you from child-porn line either... With snail mail, they have to get a warrant to intercept and open your mail and packages... the same should apply for electronic content...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
"...Internet service providers could easily be seen by the public as "overreaching," making it harder to get public support for efforts of law enforcement. What's needed, said the group's executive director, Grier Weeks, is for cops to investigate the leads they already have..."
and
"The Department of Justice and all 50 attorneys general are sitting on a mountain of evidence leading straight to the doors of child pornography traffickers," Weeks said. "We could rescue hundreds of thousands of child sexual assault victims tomorrow in America, without raising any constitutional issues whatsoever. But government simply won't spend the money to protect these children. Instead of arrests by the Federal Bureau of Investigation, the child exploitation industry now faces Internet pop-ups from the Friendly Bus Investigators. That was always the fundamental difference between the Biden bill and the McCain bill. Biden wanted to fund cops to rescue children. McCain wanted to outsource the job."
This my friends is about the money! The U.S. Government and Brilliant Digital (ironic business name!) both know this won't work. Brilliant Digital see this as a market to exploit and make millions of dollars. The U.S. Government get a "cheap" way of "dealing" with child pornography and a perception from the general public as "something being done".
I'm sure the Government know about Brilliant Digital's dubious past but the percieved "benefits" are too good to miss.
It's a win-win for both parties!
I have children myself and I find developments like this horrifying.
Someone does not become a paedophile by looking at images on the internet, it's deeper and more complex then this - blocking content will not cure the problem or reduce related crimes in any way.
The last quoted paragraph sends chills down my spine and really makes me angry.
Children can be rescued if the funding is available but a company like Brilliant Digital will recieve the funding instead and the problem is never solved - people are made richer instead.
I really mean Think of the children
It's interesting to see you saying this, because it seems like every fifth post I see is someone saying the same type of thing... Wait, does that make complaints about "/. group-think" slashdot group-think?
*head explodes*
Resistance is futile. Your technological distinctiveness will be added to our own. You will become one with the morgue
Heh, you're right "common carrier" does not seem to be explicitly defined by treaty (ie: it's more of a tradition than a rule) - found this on the WIPO site...
"63 The concept of a "common carrier," dating from 16th century English common law, captures private entities that perform public functions. Since at least the middle ages, most significant carriers of communications and commerce have been regulated as common carriers. Common carrier rules have resolved the disputed issues of duty to serve, nondiscrimination, and interconnection. Facilities such as railroads, telegraphs and telephone companies were obliged either by common law or by legislation to implement an equal "duty to serve" regime. The history of common carrier duties illuminates three reasons supporting the imposition (and the occasional elimination) of those requirements. Common carrier duties have been imposed variously upon theories of de facto and de jure monopoly, on the theory that the enterprise had become "essential," and upon theories that the enterprise was publicly concerned in a particular manner (See James B. Speta, A Common Carrier Approach to Internet Interconnection, 54 Fed. Comm. L.J. 225 (2002) (surveying the history of common carriers and arguing that the same reason justify a general interconnection obligation for Internet carriers)."
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.