ITU Approves Deep Packet Inspection

dsinc sends this quote from Techdirt about the International Telecommunications Union's ongoing conference in Dubai that will have an effect on the internet everywhere: "One of the concerns is that decisions taken there may make the Internet less a medium that can be used to enhance personal freedom than a tool for state surveillance and oppression. The new Y.2770 standard is entitled 'Requirements for deep packet inspection in Next Generation Networks', and seeks to define an international standard for deep packet inspection (DPI). As the Center for Democracy & Technology points out, it is thoroughgoing in its desire to specify technologies that can be used to spy on people. One of the big issues surrounding WCIT and the ITU has been the lack of transparency — or even understanding what real transparency might be. So it will comes as no surprise that the new DPI standard was negotiated behind closed doors, with no drafts being made available."

Comments

can you say hell no

[lister king of smeg]

lets assume that the governments don't say no, they would still have to overturn wiretapping laws in the US at least. but maybe we could use this to get our security complacent friends to use strong encryption.

Re:can you say hell no

[TheRealMindChild]

No they won't. It is a matter of "national security"

Re:can you say hell no

[BlueStrat]

...they would still have to overturn wiretapping laws in the US...

Except that treaties that the US agrees to trump all domestic laws, regulations, and statutes...everything but the US Constitution, and as much as that meant to halting anything the government/politicians really wanted over the last few decades, I wouldn't put a lot of faith in that "goddamn piece of paper!"

Treaties entered into by the Executive Branch need to be ratified by Congress, but even if Congress fails to ratify it, that would not necessarily kill it. In many instances over the last decade, Congress has been bypassed by Executive Orders and similar Executive Branch power tactics to achieve their goals and simulaneously grab more Executive Branch power despite Congressional inaction and/or opposition, Congressional and/or popular.

There has to be a BIG push-back on this to stop it. Whether or not that push-back materializes to the strength and magnitude required to stop it is anyone's guess at this point, although I admit being pessimistic.

Strat

Re:can you say hell no

[Mashiki]

This is Canada's response on DPI from the privacy commissioner. For what it's worth, this won't fly here.

End-to-end encryption

[characterZer0]

End-to-end encryption. Problem solved.

Re:End-to-end encryption

[MichaelSmith]

You terrorist you.

Re:End-to-end encryption

[BitterOak]

End-to-end encryption. Problem solved.

That's not quite the ultimate solution that many believe it to be. There are firewalls and routers on the market now that have man in the middle programming right in the hardware, and decryption is a basic part of the DPI system. How many people actually check that the certificates match who their supposed to, and how do we know which root authorities can be trusted? I imagine the vast majority of people don't even look at the certificate information. And how many ssh users actually check the key fingerprints and verify they match those stored on the remote host? Is that even possible in most circumstances? And if you do discover something's up, what then? If a router is doing man in the middle DPI, your choices are pretty much accept it, or don't communicate with the remote host at all. Most people just sigh and go on doing what they're doing.

And that doesn't even take into account hacks on your computer, like browser attacks which quietly install new trusted certificate authorities, or more aggressive malware like keyloggers and such. Encryption is much harder to use properly than most people realize, and it is highly unlikely that people on BOTH ends of the connection are using it properly.

Re:End-to-end encryption

[Roman Mamedov]

And how many ssh users actually check the key fingerprints and verify they match those stored on the remote host? Is that even possible in most circumstances?

Hello, have you ever used ssh? As in, at all? It raises a holy hell if the keys have been tampered with.

$ ssh hostname.tld
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
The RSA host key for hostname.tld has changed,
and the key for the corresponding IP address xxxxxxxxxxxxxxxxxx
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.
Please contact your system administrator.
Add correct host key in /home/username/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/username/.ssh/known_hosts:76
RSA host key for hostname.tld has changed and you have requested strict checking.
Host key verification failed.

fucking politicians...

[wierd_w]

Sorry for the flamebait here, but goddamn!

They *clearly* know that these measures are against the public interest, and are only desirable for reasons that are directly counter to a free and legitimate government; that the voting publics that they represent would never willingly agree to this kind of "microscope colonoscopy" type surveylence if they knew what it really meant.

That's why the fuckers do closed room and secret fucking "negotiations" to plan, orchestrate, and implemet bullshit like this.

About the only way to combat this is to make closed room negotiations so undesirable from a political career standpoint that the slimeballs treat like radioactive waste.

Something like immediate no-confidence being enacted for mere participation or something, and blacklisting from ever running for public office ever again.

Of course, such strong measures would never make it passed the slimeballs to begin with.

Fox fucking owns the henhouse.

Re:fucking politicians...

[Anonymous Coward]

You should do some research on what the ITU is. It is mostly old fogy bureaucrats from state owned telcos, and not elected politicians. Or even unelected ones. And the old fogy bureaucrats that sit on ITU committees are the worst of the bunch, as they specialize in creating standards and rules. So they do nothing but create rules and standards.

The ITU is why it costs more to call one country than another, even though sending an email to Egypt or Portugal is the same price. Why do phone calls have different rates? It is 2012.

The ITU voted in 2011, to confirm that FAX was the only authorized way to distribute committee documents! Email was determined to be not widespread enough (?), and less reliable. That should just you some idea of the mindset you are dealing with.

And even with their so called "stewardship" of the public switched telephone network, it is still riddled with fraud and scams. In fact, there has been accusations that some of the ITU members benefit from these scams, and are creating a regulatory framework to allow them to continue.

Re:fucking politicians...

[wierd_w]

Then their little good-ol-boys club should be shuttered in place of an organization with some fucking public oversight, that CAN be policed against this bullshit!

A room of wrinkled old penises whacking off to violating the public trust should never be accepted. Ever!

Re:fucking politicians...

[ghostdoc]

Except this is not politicians making these deals. It's unelected bureaucrats, effectively outside the control of the politicians because a senior bureaucrat can do a lot more damage to a politician's career than the other way around.

You don't vote for these people, so they don't care about your opinion.

The treaty they come up with will need to be ratified by each country's politicians, but it'll either go through unannounced and unremarked, or there'll be a convincing 'If you've done nothing wrong you've got nothing to fear' campaign to lull the moron majority into complacence.

I hate to sound defeatist on this, but we are going to have to start building darknets if we want truly free communication in the future.

The answer to 1984 is RFC 1984

[WaffleMonster]

Props to Bellovin et al for arranging the numbering coincidence.

DPI != spying

[sgt scrub]

You do not have to do deep packet inspection to spy on traffic. In fact, you have to spy on traffic to do deep packet inspection. The vast majority of information gleaned about people has absolutely nothing to do with traffic filtering. Things like redirecting DNS queries, logging x-forwared-for headers, persistent HTTP connections, are vastly more popular for garnishing user information. It is easier, and much less expensive, to drop information gathering warez on a large number of machines than implementing DPI. DPI is best used to protect networks from stupid people. Yes it is used to filter access. Only a really stupid network engineer would use it for spying.

Fragmentation

[XeLiTuS]

This type of all of your data are belong to us mentality is simply going to drive fragmentation of the Internet as well as a rush to spawn unrouted networks and darknets. These governments and agencies pushing for this would be better served leaving things as is since everything is on one network at this point. They're just going to make it more difficult for themselves since people will simply encrypt data and adapt.

What lack of transparency?

[Attila Dimedici]

One of the big issues surrounding WCIT and the ITU has been the lack of transparency — or even understanding what real transparency might be.

I am confused. Why would you say that the WCIT and the ITU have lacked transparency? Something that is transparent can be seen through. I don't know about you, but I saw right through them when they said they were doing this to "enhance freedom".

Handing the Internet's control to the UN eh?

[fufufang]

I think ITU's action shows the true colour of the United Nation. I think it is simply too dangerous to pass on the control of the Internet to the United Nation.

Re:Handing the Internet's control to the UN eh?

[fyi101]

This might surprise you, but the United Nations is a big organization, and different parts of it act and think in different ways, sometimes with great disagreements. In fact, that's the whole purpose of the UN: to gather all this people together in one place and make them lob disagreements at each other instead of grenades. Just because one organization associated to the UN misbehaves doesn't mean the World Government is out to get you. Your comment about the UN's "true colours" betrays somewhat of a misconception of the way things work there. It's messy like all human things, but if you don't like the UN, just wait until the world drops any pretense of working together for a unified civilization, and the dictators participating in the Human Rights Commission leave it and drop any pretense of caring for them, then things will get really fun (at least now they admit Human Rights exist and pay lip service to them, that alone is already an ideological victory, which is more important that you might think).

Re:DPI isn't a problem.

[smellotron]

But if someone sets up BT on 80, how do you verify the protocol without looking at the payload? Even then, there are "tricks" where P2P protocols can use HTTP GET and PUT in the payload to be able to manipulate inspection.

Ugh. I had to do some research on SOAP as a part of an internship at an "Enterprisey" software shop. Many SOAP software stacks advertised themselves as firewall-friendly because they would "punch through the firewall on port 80". That is, the SOAP service was encapsulated in HTTP, with the implication that this was superior to getting permission from your network admins. Of course, these same service providers also provided "SOAP firewalls" so they could profit off of your company's internal dysfunction. What a pile of garbage, all of it.

Anyhow, I can see why BT would want to encapsulate itself in HTTP, but it stinks of an arms race.