Slashdot Log In
ISP Embarq Monitors User Traffic
Posted by
Soulskill
on Fri Jul 25, 2008 06:57 PM
from the you-can-trust-us dept.
from the you-can-trust-us dept.
Deli Korkmaz writes "The Washington Post reports that Sprint-Nextel spin-off Embarq, currently the US's fourth largest DSL provider, monitored Internet activity on some 26,000 customers in Kansas using deep-packet inspection technology NebuAd in order to deliver targeted advertising to users' desktops. CNet provides coverage as well. The House of Representatives Committee on Energy and Commerce is investigating whether any privacy laws were broken. Users were informed of this test and invited to opt out only via Embarq's online Privacy Policy; a mere 15 subscribers did so."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
wow (Score:5, Funny)
Re:wow (Score:4, Funny)
Parent
Re: (Score:3, Informative)
Opt-out should be replaced by opt-in, always!
was it limited to inspection? (Score:5, Insightful)
was this deep packet "inspection", or did they actually alter traffic? Like modifying web pages to insert ads, or change IP addresses of banners?
Or something more hands-off like monitoring customer browsing and using it to deliver better targeted ads when the customer browsed their own web pages?
Re:was it limited to inspection? (Score:4, Informative)
Parent
Re:was it limited to inspection? (Score:5, Interesting)
How is this legal?
I thought warrantless wiretapping only covered law enforcement.
Parent
Re:was it limited to inspection? (Score:5, Informative)
It was used to better target the advertisements on MyEmbarq.com and on the DNS redirection pages for server not found. If there was any more past that, then the general work force was not aware of it. No modifying of pages or redirecting others' advertisements.
This system would only work if you used Embarq's DNS servers.
Parent
Re:was it limited to inspection? (Score:5, Interesting)
If they are using the NebuAd services, it IS both deep packet inspection and inserting javascript in all pages.
The fact that it uses the information it gathers to give better targeted ads on your DNS redirection (a separate kind of internet breaking evil you should be ashamed of, BTW) is just gravy.
You as an employee have only received half the story, and it makes it sound a whole lot better that way.
Wikipedia's article on NebuAd will give you some of the real scoop, but it gets worse the more you find out about it..
http://en.wikipedia.org/wiki/NebuAd [wikipedia.org]
Parent
Re: (Score:2, Insightful)
From wikipedia, a quote allegedly from NebuAd's privacy policy:
The information we collect is stored and processed on NebuAd's servers in the United States. As a result, that information may be subject to access requests by governments, courts or law enforcement
So, the gov't doesn't need to do wiretapping without permission... NebuAd does it for them, with my ISP's permission. All that's needed is a subpoena.
NICE!
Re: (Score:2)
Re: (Score:2)
Out with those servers for my machines then....
Re:was it limited to inspection? (Score:4, Interesting)
Parent
Why aren't we encrypting everything already? (Score:5, Interesting)
If we can get web servers to support TLS (for multi-domain encryption on a single IP vs. SSL), and create a non-identity framework for encryption, we should just start encrypting everything end to end. ISPs are asking for it with these behaviors.
Re: (Score:3, Insightful)
Not sure if that'll work. Some internet companies apparently block all encrypted traffic. I'm thinking of Rogers Cable as my example (feel free to correct me though). I mean really it's their own business if they want to shaft their customers. Unfortunately most people either don't care that this sort of stuff is going on, or don't know of any other ISPs they can go to as alternatives.
Re: (Score:2)
Any ISP who blocks SSL wont get very far.
Everything from Internet banking to eBay uses SSL.
Stuff that normal people notice.
Re:Why aren't we encrypting everything already? (Score:4, Informative)
You seem to be in favour of ISPs respecting their customer's privacy but then went on to mock an anonymous coward for opting to remain anonymous.
That doesn't make much sense to me.
Yes, you are wrong. Rogers Cable throttles encrypted traffic, but doesn't block it.
Parent
Re: (Score:3, Insightful)
You just lost 99.9% of the intarweb using population.
Re:Why aren't we encrypting everything already? (Score:4, Insightful)
Just add a privacy light to browsers. "When that thing is on, your communications are between you and whoever you are communicating with, when it isn't on, anybody can see them". Then compare it to a postcard and a letter in an envelope.
Parent
Re: (Score:2)
OK, you made me look up http://en.wikipedia.org/wiki/Server_Name_Indication [wikipedia.org]
Now, it says Firefox and Apache have it implemented... what's the problem?
Re: (Score:3, Interesting)
I believe this de
Only 15 people opted out... (Score:5, Insightful)
Re:Only 15 people opted out... (Score:5, Insightful)
Opt-out?
How is this not wiretapping? You're intercepting and monitoring the exchange of information between two entities, possibly even "bugging" at least one of them if you're also introducing cookies or similar devices.
Can the phone company introduce something into their privacy policy that all communications may be tapped without the request of law enforcement and have that be legally sound because I didn't "opt-out"?
Furthermore, even if the subscriber had the opportunity to opt-out, did the second entity? No they didn't. Therefore the privacy of at least one party has been unquestionably violated.
Opt-out... WTF?
Parent
Re:Only 15 people opted out... (Score:5, Funny)
It was apparently on display next to Arthur Dent's home demolition notice.
Parent
Sell your own private data? Sure, why not! (Score:5, Insightful)
Whenever you have to search long and hard to find new 'features', this can only mean one of several things:
Even more on-topic are these quotes from the Wiki article [wikipedia.org] (provided by spinkham above):
According to Nebuad's sales pitch less than 1% of users opt-out. One ISP expects to earn at least $2.50 per month for each user (..) Generally, NebuAd provides an additional income stream to network operators, which may maintain or lower consumers' internet access bills.
As we've all known for a long time, ordinary people's surfing habits are worth money. What when you'd ask people up front: "Do you want your surfing habits to remain private, or give up this privacy in exchange for a discount?"
I'm afraid the vast majority of people would go for the discount. The anything-connected-to-everything world of today has gotten us so used to data breaches and 'unknown parties' snooping through our private info, that we just don't seem to care anymore. Which seems strange: the less (privacy) you have left, wouldn't you value those last remains more than you used to?
Parent
Re: (Score:2)
Not only that, but the privacy policy was posted on the ISP's home page, and said change to the privacy policy wasn't announced. I don't know many people who visit their ISP's priva
Re: (Score:2)
about:blank is the best page ever to start with.
Re: (Score:2)
One reason that you can't consumers responsible is that you can hardly consider a "privacy policy" verifiable. They are all a sad joke foisted on the public so they feel secure. Nothing could be farther from the truth. Congress must prohibit all monitoring by the ISPs. But that's not going to happen, because we must think of the children, and protect the copyright monopolies from the taarrarists.
Re: (Score:2)
Congress must prohibit all monitoring by the ISPs.
But that would require them to act in the intrests of the people!!!!
Re:Only 15 people opted out... (Score:5, Insightful)
Or a really, really, really long scroll in a narrow, non resizeable window.
Parent
Re: (Score:2)
They are not disclosing it to all users, that is not possible. They have only notified the customer not the user.
I don't pay for the Internet in this house so I won't be getting any notification that my privacy is being violated, and what if the bill payer is away? since it's opt out users on the home network would be violated until the bill payer returns and even then they may not get the letter or understand the ramifications involved.
What the United States need are some privacy laws (you apparently have
Re: (Score:2)
Douglas Adams put it this way
"But Mr Dent, the plans have been available in the local planning office for the last nine month."
"Oh yes, well as soon as I heard I went straight round to see them, yesterday afternoon. You hadn't exactly gone out of your way to call attention to them, had you? I mean, like actually telling anybody or anything."
"But the plans were on display ..."
"On display? I eventually had to go down to the cellar to find them."
"That's the display department."
"With a flashlight."
"Ah, well the
Sigh - I hate to suggest this... (Score:5, Insightful)
I think that very simply worded new legislation is required...
"Opt Out" is the new default for any new program, feature, change of any kind for any kind of product or service provider.
Any new programs or offerings will default the individuals to opt-out status, and require the user to notify the provider (without being hampered by phone calls, e-mails, etc) to opt-in.
Any company failing to comply with this policy shall have all of their assets liquidated and deposited into the bank account of the person(s) they elected to opt-in by default.
When did the world change? (Score:2)
Now, they secretly 'invite' you to not do something, like selling off your privacy, unless you sign up... or sign out, down, whatever... what does 'opt out' even mean anyway. Get off my lawn!
Re: (Score:2)
The world changed when Reagan gutted the education system and this country began a long, slow slide into ignorance.
Re: (Score:3, Informative)
Re: (Score:3, Funny)
That started when the education system was introduced.
Re: (Score:3, Interesting)
Re: (Score:2)
I was thinking along the lines of a radio button or toggle... two settings "Out" or "In" - with the label "Opt".
Default being "Out"...
Thanks for pointing out the definition of an "Opt-In" vs an "Opt-Out" - however, that wasn't quite what I was shooting for...
Semantics... /sigh
Re:EXACTLY (Score:5, Informative)
Please be careful with the terminology.
Opt-out means that you're in and you have to opt-out to stop your membership/subscription/whatever.
Opt-in is what you want: it's your choice to subscribe/join/whatever, and if you don't, there is no membership/subscription/whatever.
For example: The do-not-call list is an opt-out scheme. Unless you take action and put your name on the list, they're allowed to call you. Most newsletters are opt-in: You only receive the newsletter if you subscribe. Spam is neither opt-in nor opt-out: You get spam without doing anything. If you try to opt-out, you get more spam.
Parent
Deep packet inspection (Score:4, Funny)
I find the phrase 'deep packet inspection' interesting because it simultaneously describes the technique used and a large subset of the results acquired.
Tom Gerke (Score:5, Informative)
tom.gerke@embarq.com was the contact for the CEO back in March. I assume it is still legitimate...
Disclosure laws... (Score:5, Insightful)
We had this problem with the credit card industry before. People were signing up and had no clue what they were agreeing to because the most important terms weren't properly exposed. Then we got a law that made the current interest rate and the formula by which it is computer and how it may be changed in regulated-size type.
Time for a format for privacy policies to match that...
Actually a fairly high number of opt-outs (Score:5, Interesting)
Obviously there is no good way to do this experiment; but I'd be quite interested to see an estimate of the "expected baseline opt-out rate" for various sorts of disclosure, calculated by disclosing a ludicrously and absolutely unacceptable term or condition and seeing how many people opt-out. From that, you could then more accurately gauge the real level of unhappiness that a given opt-out percentage implies(For example, what percentage of people would opt-out if a term authorizing the CEO and the board to seize subscriber's assets at any time, for any reason, in any quantity appeared deep in the privacy policy? That value would, in effect, constitute the 100% opposition value.)
Or, we could just do the easier thing and make opt-in absolutely mandatory, perhaps with brutal mob justice for violators.(a man can dream, can't he?)
It's clear they are abusing their customers.. (Score:3, Informative)
To me, it looks like unilaterally changing the terms of a lease, after the fact, to allow me to go into your apartment an install cameras on every room.
I'd be switching providers right about... now.
long past time for encryption by default (Score:3, Insightful)
Re:long past time for encryption by default (Score:5, Informative)
HTTPS presents a significant load on servers. It can easily demand 3 times the hardware and support to transfer a large, busy set of servers to HTTPS for all traffic. If it *didn't* present a noticeable load, it would be fairly useful as a normal encryption channel.
It's also awkward to proxy and manage the encryption securely, because HTTPS is very careful about checking hostnames and IP addresses to avoid people forging your site. This makes it more awkard for usrs, as their browsers complain about untrusted keys or the server owners have to invest in registering keys.
Parent
Embar...? (Score:2)
Re: (Score:2)
Woosh?
Re: (Score:2, Insightful)
thats the brutal and unfortunate truth. Its not to say that everyone is unaware in areas where there is less exposure to different types of people, which you gain in major cities. For the most part, in large numbers, people will remain ingnorant and complacent until there is some form or ability to organize and invoke change.
I'm going to start randomly pasting this into comments on new stories, it's generic enough to work with almost every story and will probably soak up the insightful mod points.
Re:The majority of middle America is unaware (Score:5, Insightful)
I might go along with the Insightful were it not for the gratuitous (and most likely inaccurate) use of "middle America." There are a number of things wrong with this:
1) I can think of a lot of places in world (having lived there) where people are at least as technologically clueless as the average American. There is nothing special about Americans - either positive or negative - in that regard;
2) If you meant "middle" as in "middle class" you missed. The most technologically clueful income strata in America is most likely the middle class. One of the things that keeps the poor in poverty is lack of clue combined with means to acquire it; rich people, on the other hand, have middle class people who are paid to do all that stuff for them, and thus don't acquire clue about computers unless they are very interested in them or were once middle class;
3) If you meant "middle" as in "geographic center" it is still likely that you missed. Even in the Silicon Valley area, where I live, computer cluefulness remains largely the province or those who are in the industry or who are computer enthusiasts on their own. Everyone else is as clueless as they are everywhere else. Those who aren't clueless are, again, mostly in the middle class.
If you'd written that the majority of people (everywhere) are unaware, I might have spent one of my remaining mod points to mod you up. As it is, I was tempted to use to mod you troll, but decided to take the time to explain why I consider your post a troll instead.
Parent