Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Privacy The Internet Your Rights Online

Tool To Allow ISPs To Scan Every File You Transmit 370

Posted by timothy
from the in-case-they-run-out-of-human-tools dept.
timdogg writes "Brilliant Digital Entertainment, an Australian software company, has grabbed the attention of the NY attorney general's office with a tool they have designed that can scan every file that passes between an ISP and its customers. The tool can 'check every file passing through an Internet provider's network — every image, every movie, every document attached to an e-mail or found in a Web search — to see if it matches a list of illegal images.' As with the removal of the alt.binary newgroups, this is being promoted under the guise of preventing child porn. The privacy implications of this tool are staggering."
This discussion has been archived. No new comments can be posted.

Tool To Allow ISPs To Scan Every File You Transmit

Comments Filter:
  • by clang_jangle (975789) * on Thursday October 16, 2008 @05:04PM (#25406045) Journal
    FTFA:

    Here's how CopyRouter would work, according to the company's slide show: A law enforcement agency would make available a list of files known to contain child pornography. Such files are commonly discovered in law enforcement raids, in undercover operations and in Internet searches that start with certain keywords (such as "pre-teens hard core"). Police officers have looked at those files, making a judgment that the children are clearly under age and that the files are illegal in their jurisdiction, before adding them to the list. Each digital file has a unique digital signature, called a hash value, that can be recognized no matter what the file is named, and without having to open the file again. The company calls this list of hash values its Global File Registry.
    Whenever an Internet user searched the Web, attached a file to an e-mail or examined a menu of files using file-sharing software on a peer-to-peer network, the software would compare the hash values of those files against the file registry. It wouldn't be "reading" the content of the files -- it couldn't tell a love note from a recipe -- but it would determine whether a file is digitally identical to one on the child-porn list. If there were no match, the file would be provided to the user who requested it. But if there were a match, transmission of the file would be blocked. The users would instead receive another image or movie or document, containing only a warning screen.
    The makers of CopyRouter claim that it can even be used to defeat encryption and compression of files in the Internet's Wild West: the peer-to-peer file-sharing tools such as Gnutella and BitTorrent.

    This will cause huge latency issues and cost beaucoup bandwidth. ISPs would be shooting themselves in the foot if they did this with all traffic. OTOH, I could see laws requiring such tools for P2P traffic -- in fact that may well be inevitable, with the **AA's "ruling class" status these days.

    • Re: (Score:2, Insightful)

      by zoward (188110)

      On the flip side, having this would in place could potentially make you liable for the material your customers are transmitting. So much for common carrier status. If I were an ISP I'd be fighting this thing tooth and nail.

      • by Anonymous Coward on Thursday October 16, 2008 @05:26PM (#25406289)

        The parent is an example of typical slashdot idiocy. ISPs aren't common carriers. Though my karama will end up a smoking crater for breaking with the established GroupThink, so I'm making this post anonymously.

        The immunity ISPs currently enjoy in the US come from various other safe harbor laws (i.e. Â230; DMCA). The constant slashdot drone of "ohhh.. ISPs can't suppress my free speech: common carrier common carrier!" is both entirely incorrect and dangerous, since it causes the geek squad to under-estimate the risks and the importance of things like net neutrality.

        • by DerekLyons (302214) <(fairwater) (at) (gmail.com)> on Thursday October 16, 2008 @06:54PM (#25407091) Homepage

          The parent is an example of typical slashdot idiocy. ISPs aren't common carriers. Though my karama will end up a smoking crater for breaking with the established GroupThink, so I'm making this post anonymously.

          Yet, for all your noise and handwaving - you fail to establish that an ISP isn't a common carrier.

          • Re: (Score:3, Interesting)

            by paganizer (566360)

            From what I understand from dabbling in ISP-ism back in the mid-90's, the only common carrier protection a ISP enjoys is for a USENET server; a court ruling established that USENET had common carrier protection, therefore a ISP could not be prosecuted for what was on a NNTP server, unless they attempted to censor it; if they attempted to censor it, that would imply that anything illegal that got transmitted was purposefully allowed to remain on the server. The only protection is to just ignore it unless it

        • Re: (Score:3, Insightful)

          by logicnazi (169418)

          Yes, but his basic point is still valid. The DMCA only provides a shield against claims of copyright infringement. This isn't the issue here at all.

          Once the justice system recognizes some kind of legal obligation for the ISPs to scan the files passing through their pipes for child porn it is only a matter of time until some mother of an abused child sues the ISP for failing to properly monitor it's customers on the theory this would have prevented the abuse of her child.

          Now you might respond that any law

      • by Fluffeh (1273756) on Thursday October 16, 2008 @07:37PM (#25407389)
        If I was a person who wanted to get this thrown out the window, I wouldn't look at trying to convince people that it is bad. I wouldn't look at how it could be abused. I would much rather be looking at how to misuse it myself. I mean what better way to show potentially how bad a system is than to get into the "black list of hashes" and add some. Add lots. Like a real lot. Every email suddenly gets a warning message with details of why. Yes it was hacked. Yes the public outrage will be huge. It would be so huge that it would end up getting shit-canned pretty damned quickly.

        Best way to get anyone to get rid of something is to make them hate it. All my email blocked today? You bastards! Turn that thing off.
    • by negRo_slim (636783) <mils_oRgen@hotmail.com> on Thursday October 16, 2008 @05:12PM (#25406123)

      This will cause huge latency issues and cost beaucoup bandwidth.

      A soft touch with this would yield far better results depending on your intent. I would imagine an ISP that is sick and tired of certain traffics could utilize a system like this to start taking a closer look. Catch a few token users and then you have a excuse to throttle/monitor/block at will. I mean think of the children! What worries me is that with so many computers doing the bidding of people other than their owners, who knows what kind of traffic is being exchanged. Seems like an easy way for law enforcement to take a closer look at an individual... I've come across very questionable images via Google from rather inane, yet obscure, search queries. You could be one Russian rickroll away from the authorities and those around you having some nasty suspicions in their head.

      • Re: (Score:3, Insightful)

        by electrictroy (912290)
        I can see one way this might be abused - to eliminate political enemies. "Well Mr. Smith's ISP reports he downloads copies of "Playboy's College Girls". Is this really the man you want to be your next state represenative???"
      • by Hyppy (74366) on Thursday October 16, 2008 @05:49PM (#25406483)
        Even better... What happens if you send traffic to a user with one of the "bad files" in it? They don't need to have a connection open in order for you to send a jpeg to them. Even if the user's computer simply drops the unknown data, the ISP will pick it up in their scan. If all the software does is scan the hash values of images transferred over common protocols, I seriously doubt that it goes and checks to see if the user actually REQUESTED it before crying foul.

        One step further: make a file that has the same hash value of a "bad" file. This is trivial, especially if the file doesn't need to be valid for any application. If all that is checked is a hash of the traffic, then the actual contents of the file are meaningless.

        So, this software will allow law enforcement to ruin your life (any implication crime involving sex and/or kids will do that, guilty or not), by simply seeing an unknown party send you a block of unintelligible data that happens to have the same hash as "pr0n." Great.

        Anyone up for making an automated hash-spoofing packet forger? I'm sure something similar has already been done. With the speed of current connections, one could probably get the entire human race indicted for child pornography in under a week.
        • Re: (Score:3, Interesting)

          by meringuoid (568297)
          One step further: make a file that has the same hash value of a "bad" file. This is trivial

          I'm not sure whether there's any major prestigious prize given out in the field of crypto, but if there is, you just won it. Please publish!

          • by Baton Rogue (1353707) on Thursday October 16, 2008 @06:55PM (#25407101)
            I think he's referring to MD5 Collisions [slashdot.org] where you can make a completely different file that matches the same MD5 hash of another file.
            But if all they are doing is comparing hash files, couldn't you just as easily change the resolution of the file, or insert a couple different bits around to change the file slightly, which ends up with a completely different hash?
            • by svank (1301529) on Thursday October 16, 2008 @07:02PM (#25407157)

              But if all they are doing is comparing hash files, couldn't you just as easily change the resolution of the file, or insert a couple different bits around to change the file slightly, which ends up with a completely different hash?

              Yup. That, along with good encryption, means the bad guys get around this easily, while innocent bystanders are caught up by hash collisions.

              • by Baton Rogue (1353707) on Thursday October 16, 2008 @07:09PM (#25407199)
                After I RTFA, I got my answer.

                Encrypted files on the peer-to-peer network could not be decrypted by CopyRouter, but the company claims it can fool the sender's computer into believing that the recipient was requesting an unencrypted and uncompressed file.

                So basically what they do, is if your bittorrent client requests the files in encrypted format, they intercept that and instead request them unencrypted. They aren't decrypting the file, they are just asking for an unencrypted transmission of the file. If the file is in an encrypted zip file, then there is no way that they could see the actual files being transmitted.

                • by PopeRatzo (965947) * on Thursday October 16, 2008 @07:47PM (#25407471) Homepage Journal

                  but the company claims it can fool the sender's computer into believing that the recipient was requesting an unencrypted and uncompressed file.

                  That's not hostile, much. As is common in our corporatocracy, here's a company that starts from the assumption that their customers are their enemy. So now we're going to pay our ISPs to "fool" our computers. Some "customer service" huh?

                  No thank you.

                  How about this: We pay you, and you give us bandwidth and stay the fuck out of our business. If we're using too much bandwidth, then spell it out in our contract and charge us more, so we can choose to give our business to someone else.

      • Re: (Score:3, Insightful)

        by PopeRatzo (965947) *

        I would imagine an ISP that is sick and tired of certain traffics could utilize a system like this to start taking a closer look.

        So now it's our responsibility to make sure our ISP doesn't get "sick and tired" of our traffic? And we're supposed to give up the privacy of our transmitted data to insure that our ISPs are happy?

        I've come across very questionable images via Google from rather inane, yet obscure, search queries.

        Interesting, I was just thinking about how seldom I see anything remotely offensive i

    • Re: (Score:3, Insightful)

      by liquidpele (663430)
      Actually you're wrong. It depends on how it does this. For instance, the file scanning capabilities of Fidelis appliances have no bandwidth slowdown because they simply copy the traffic to analyze but never hold packets. As for analyzing the files, most of the better products use signatures made from parts of files, so you don't need the whole file to analyze, you can do it part by part as it streams past.

      There are a ton of possibilities in doing this type of thing, and I don't know how this company's
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      "Each digital file has a unique digital signature, called a hash value, that can be recognized no matter what the file is named, and without having to open the file again. The company calls this list of hash values its Global File Registry."

      Wait a second. Hash value? I sure hope the law enforcement people have been told about hash collisions [wikipedia.org]! I know it's unlikely in a large binary file like images or videos, but, taking one example, md5 hash collisions and ways to find them do exist, and it's inevitable

      • by Klaus_1250 (987230) on Thursday October 16, 2008 @05:57PM (#25406585)

        Hash Values are useless anyway; change 1 pixel in an image and voila, new hash. They could use loose hashes as used for Spam-filtering, but the chances for collisions are higher.

        The other issue is of course, it won't work on encrypted connections. It might not even work for obfuscated connections. AFAIK, Authorities are seriously shooting themselves in the foot using these techniques. They will only drive CP and others further underground, to a point that finding and prosecuting the bastards becomes too difficult and expensive.

      • hash collisions! I know it's unlikely in a large binary file

        I thought with the premise that MD5 and friends are based off, that hash collision possibility is not related to size of source.

    • by Firehed (942385)

      Looks like this does nothing to address encrypted traffic, it's just matching files transmitted in plaintext to a database of MD5/SHA1 hashes. Actually knowing the level of incompetence demonstrated by most enforcement agencies, probably something that generates a 40-bit hash or so, just to ensure as many collisions as possible.

      So bring on net-wide encryption.

    • but it would determine whether a file is digitally identical to one on the child-porn list

      So if this thing does perform a hash on a file, then changing one small part of it would completely alter the result. Presumably there's more to it than that - otherwise anyone wanting to post an image (that was on a list - there's nothing that limits this to kiddie porn) would make a near-identical copy and the whole detection system becomes worthless.

    • by CodeBuster (516420) on Thursday October 16, 2008 @06:31PM (#25406927)

      The makers of CopyRouter claim that it can even be used to defeat encryption and compression of files in the Internet's Wild West: the peer-to-peer file-sharing tools such as Gnutella and BitTorrent.

      What are they going to do? Detect and Man in the Middle [wikipedia.org] every single connection attempt that goes through their router? The file sharing tools will simply upgrade to stronger encryption, such as AES [wikipedia.org], and harden the connection handshaking against MITM attacks (perhaps by introducing public key infrastructure with well known key server(s)). It was my understanding that the present crop of file sharing tools provide obfuscation (ROT13 and the like) and not real encryption to set the bar just high enough to prevent packet inspection. However, it would not be difficult to implement stronger encryption methods (if they haven't done so already), should that prove necessary. In fact, the CopyRouter folks are at a distinct disadvantage in any encryption arms race since MITM and other cryptanalysis techniques are much more computationally expensive than the encryption itself AND the users outnumber the routers by thousands or even tens of thousands to one. The NSA might more credibly claim to be able to do this, but they have acres of underground super computers consuming as much electrical power as a small country, so I am very skeptical when anyone claims to be able to "defeat encryption" and doubly so when a private company mentions it as a bullet point in their power point presentation. It is more likely that this is a private company trying to sell a pig in a poke to ISPs and governments who don't inspect the merchandise to carefully or don't know any better.

    • Re: (Score:3, Informative)

      by conlaw (983784)
      Please, folks, remember when you go to vote that both Obama and Biden have taught constitutional law so they at least know that programs such as this one violate the First and Fourth amendments. They may end up with an uphill battle trying to protect the Bill of Rights, but I believe that they'll try.

      We must not continue to allow our fundamental rights to be taken away under the rhetoric of "protect the children" and "watch out for the terrorists."

      Here endeth my rant for the day.

      • by eth1 (94901)

        Please, folks, remember when you go to vote that both Obama and Biden have taught constitutional law so they at least know that programs such as this one violate the First and Fourth amendments.

        If they're such experts, why do they keep trying to violate the 2nd?

    • Seems to me that if a user attempts to download a file that happens to have the same hash as a "known bad" file, they could be in for a world of hurt unless the system does verification of some kind. And if the verification step is conducted manually rather than automatically -- in the interest of expediency, of course -- what do you bet the odds are that some law enforcement types aren't going to be bothered with niceties like actually checking that some file is indeed prohibited material?

      Try mounting you

    • by lysergic.acid (845423) on Thursday October 16, 2008 @07:39PM (#25407403) Homepage

      absolutely. U.S. ISPs continue to justify overselling while complaining about "power users" using too much bandwidth and overloading their network.

      when will they realize that packet shaping and other intrusive network filtering/monitoring technologies such as this generate more overhead and are a waste of resources. instead of trying to manipulate/control subscribers, they should be upping bandwidth supply to meet the growing demand. then perhaps the U.S. wouldn't be left in the dust both in terms of average broadband speeds as well as cost of broadband.

      you don't employ mandatory property searches to combat child pornography. not only would it be ineffectual, but even if it did it still wouldn't be worth the encroachment of our civil liberties. frankly, idiots who use the banner of fighting child pornography to pass stupid laws to destroy our democratic freedoms or strip away the rights of individuals are a much greater threat to society than someone who just downloads child pornography. those are the real sociopaths IMO.

      if you want to protect children, give them free access to health care. give them free access to high education. create outreach programs to at-risk youth. employ social workers at school to watch for warning signs of abuse and provide counseling services at school for victimized children. narrow the disparity in education between the rich and poor so that poor children have equal opportunity to succeed in life.

      you don't protect children by creating a fascist society around them.

  • This could have an upside....

  • Starts with porn... (Score:3, Informative)

    by Izabael_DaJinn (1231856) <slashdot&izabael,com> on Thursday October 16, 2008 @05:11PM (#25406109) Homepage Journal
    ends with the MPAA and RIAA suing you for your mp3s and .mpgs.
  • Huh? (Score:5, Insightful)

    by LoRdTAW (99712) on Thursday October 16, 2008 @05:11PM (#25406113)

    "The tool can 'check every file passing through an Internet provider's network -- every image, every movie, every document attached to an e-mail or found in a Web search -- to see if it matches a list of illegal images.' "

    How exactly is this going to be accomplished? The equipment cost must be staggering and would consume allot of power. Way to conserve electricity, I thought we were trying to reduce the amount of power the Internet consumes. Does also this remove the common carrier status of ISP's?

    I hope this never comes to fruition.

    • Re:Huh? (Score:5, Interesting)

      by fred fleenblat (463628) on Thursday October 16, 2008 @05:25PM (#25406277) Homepage

      TFA says they're going to use hash values. This will take a stateful packet inspection filter to catch, but the amount of state is only enough do the hash, and they can throw it away if it doesn't match anything on the blacklist.

      While hashing seems easy enough to get around, I think the real thing they're looking for is a repeated pattern of someone sending blacklisted images. If you send/receive thousands of images, there's a good chance that you'll screw up and maybe a dozen of them won't get resampled (or use some other trick) to change the hash value. you'll pop up on a screen someplace, they'll get a search warrant, and you are busted.

      • Re: (Score:3, Interesting)

        by thogard (43403)

        Did anyone do that "out of order packet" hack for the linux kernel yet? The idea is you send 99% of the packets in the correct order but 1% of the time you swap the order around. It does nasty things for programs like this. Also someone needs to look at claims of this software compared to what it does and let them know where they are in breach of local truth in advertising laws.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Does also this remove the common carrier status of ISP's?

      That's a myth. They don't have it.

    • Re:Huh? (Score:4, Informative)

      by maugle (1369813) on Thursday October 16, 2008 @05:59PM (#25406613)
      Every time this topic comes up, someone posts something about how this could remove the common carrier status of ISPs.

      Repeat after me: ISPs do not have common carrier status.
  • by Anonymous Coward on Thursday October 16, 2008 @05:13PM (#25406133)

    Wasn't that the Aussie spyware company attached to Sharman Networks/KaZaA?

    Before it got raided, I mean?

    I call shenanigans.

    • by therufus (677843) on Thursday October 16, 2008 @07:14PM (#25407229)

      I was about to bring up that point. KaZaA was linked to BDE (maybe a parent company or something). I'm not too sure of the exact relationship, but there definitely was one there.

      Now correct me if I'm wrong, but wasn't one of the defenses in the KaZaA court case the fact that they couldn't tell what files users were sharing, therefore they claim they weren't responsible for the distribution of copyrighted material? If this was the case, BDE's new "we can tell what you're sending/receiving" crap could land an A-Bomb worth of trouble in someone's lap.

  • One question (Score:5, Insightful)

    by MathFox (686808) on Thursday October 16, 2008 @05:13PM (#25406137)
    Can it decrypt SSL/SSH in real time?
    • Re:One question (Score:5, Informative)

      by whoever57 (658626) on Thursday October 16, 2008 @05:26PM (#25406291) Journal

      Can it decrypt SSL/SSH in real time?

      Exactly. They claim that the can search "every document attached to an e-mail .. -- to see if it matches a list of illegal images. Apparently, they have never heard of SMTP-TLS, POP3S, etc.. Or perhaps they have and they are just like many others -- selling snake oil.

      • Re: (Score:3, Interesting)

        by jimicus (737525)

        Can it decrypt SSL/SSH in real time?

        Exactly. They claim that the can search "every document attached to an e-mail .. -- to see if it matches a list of illegal images. Apparently, they have never heard of SMTP-TLS, POP3S, etc.. Or perhaps they have and they are just like many others -- selling snake oil.

        SMTP-TLS and POP3S are pretty bad examples, because they secure the connection but you're still likely to be talking to a mail server that you don't control, and therefore can't guarantee isn't connected to such a thing.

        That being said, this is yet another case of "Product which doesn't need to exist and offers little to no real benefit being sold to idiots with some superficially-plausible benefit." Spend any length of time working as a systems manager and you'll see dozens of these.

        Right now my favourite

    • One answer (Score:4, Insightful)

      by Willbur (196916) on Thursday October 16, 2008 @05:52PM (#25406533) Homepage

      Can it decrypt SSL/SSH in real time?

      According to the article they use man-in-the-middle attacks. This is probably quite easy if the server is using self-signed certs.

    • If they can, then (all joking aside) it's time to go back to SneakerNet [wikipedia.org] because NOTHING on the Internet would be safe anymore. At that point you may as well remove the word "private" and all it's derivatives from human language.
    • Re:One question (Score:5, Informative)

      by unlametheweak (1102159) on Thursday October 16, 2008 @07:22PM (#25407285)

      No. RTFA. CopyRouter merely pretends to be a server and tells the client the client to send data unencrypted. Bittorent just needs to upgrade it's encryption mechanisms.

  • So what happens when the malware guys decide to have their malware fire off images that are on this list of banned files/images?

    Suppose that their 'smart' and have the image embeded in the malware (or otherwise obscured). the malware sits there for a while and infects as many systems as possible... then the SPAM event happens. With this crap... I mean "wonderful, keep-our-kids-safe" software kicks in and drags even more of the internet down, who's gonna pick up the tab?

    I know... have the **AA morons... I me

    • You don't have to actually have the "perverted" pictures to do this, just send out lots of data files that have the same hash. (depending on the lenght of the hashes, its really easy to do) Not to mention, changing just a bit in a file will mess with its hash, so the real kiddie porn traders will just randomly change a pixel or two. Might be fun to send out multiple 25MB files that have the same hash. That would drop their servers to their knees....

      • Are there any programs currently available that will generate a file that matches a certain hash?
  • by genw3st (1373507) on Thursday October 16, 2008 @05:15PM (#25406159) Journal
    ... what is going to prevent this proverbial snowball from building into a full-blown avalanche? I guess it has already become one to some extent... I can't recall a time in history when the WORLDS rights and privacy were as stripped and neglected as it is now, and then everyone suddenly got their right to privacy and freedom back. Despite its amazing capabilities, technology sure has put us into an interesting position when in the hands of people like "Brilliant Digital Entertainment" ... yeah, real brilliant. Crackheads.
    • by Shados (741919)

      Technology evolves faster than moral values and society, thus keeping people in a constant state of panic over it, and causing a mess in the short term (and benefits in the long term). That was always true throughout history, from the discovery of fire (at least according to the theories), to the internet. This will be the same. It may take a civil war, or a nuclear bomb going boom, but we'll either all die, or we'll be better of.

  • Won't work. (Score:5, Informative)

    by Xtense (1075847) <xtense AT o2 DOT pl> on Thursday October 16, 2008 @05:16PM (#25406181) Homepage

    Ok, on really simple protocols, like HTTP or FTP, maybe - but most, if not all, p2p traffic is safe, i think. This is of course because of the chunky nature of transmission - you can't really tell what part of the file went through your pipe just by looking at it, and since parts are sent at random, you cannot rebuild the file with your chunks without guiding information, be it a torrent file, a list of parts for emule, or whatever else there is. And you need the whole file to get your hash-check. That's one. Two: encryption totally kills the effort, as the ISP can in no way examine your file without interfering with your transfer, and SSL exists solely to protect you from this.

    Even if my line of thinking is really misguided here, this would require lots and lots of processing power - i mean, on a routing line with a hundred users on one end, it's thousands of hash-checks to be made for every stupid rebuilt file - both processes of course painfully CPU-eating, unless you want false-positives, since you didn't bother to use a proper hashing algorithm.

    All in all, this looks to me like a terrible waste of money.

    • Re:Won't work. (Score:5, Interesting)

      by Anonymous Coward on Thursday October 16, 2008 @05:42PM (#25406401)

      They claim they can scan Gnutella and BitTorrent.

      Gnutella I don't know, but BitTorrent, almost certainly.

      The common forms of BitTorrent encryption uses a "shared secret". The shared secret for BitTorrent is a 20-byte key known as the "infohash". This infohash is ALSO used as the unique hash to uniquely identify a given set of files. So its ALWAYS given to the tracker, and if the tracker isn't using SSL, that means its in the clear.

      Making the encryption in BitTorrent almost laughably insecure. It's good enough to block non-stateful packet filters. It's not good enough to prevent people from listening in.

      As for getting a file hash with BitTorrent, that's even easier.

      It does it for them.

      The ".torrent" file contains a list of hashes. They don't even need to look at the file contents.

      I dunno about other P2P systems, but BitTorrent is definitely not safe from this.

    • Re: (Score:3, Interesting)

      i mean, on a routing line with a hundred users on one end, it's thousands of hash-checks to be made for every stupid rebuilt file

      Actually, it gets worse than that. Say that I have an "illegal" image that I want to transmit to you. All I would have to do is embed it in a random frame of some 700 MB DivX movie. Then, not only do files have to be checked, but every frame of every video too.

      And the age-old question of "is this MP3 file legal"? That is an example of an uncomputable question.

      More likely, thi

    • There is a method in cryptography hat is called packaging. The encryption key is stored within the file but you must have the complete file to get the key from it. Now you can send your last blue ray film. If they store it completely for uncrypting it they have a lot of money to drop by the windows :D

  • by Anonymous Coward on Thursday October 16, 2008 @05:19PM (#25406227)

    Time to make a utility that puts a file into an encrypted 7Zip archive, with the password stored in some reversable encryption method (encrypt the password with all zeroes as a key 1 million to 2 million times), so it would take x CPU seconds on some hardware to decrypt it.

    This would allow files to still go across the net without requiring passwords or keys, but prevent utilities like this from just passively obtaining traffic, just due to the CPU cycles involved.

    Of course, just stuffing a password in the comments field works too, but with a decent text parser, it can be extracted.

    Its just more of the same cat and mouse game. The real crooks will not be affected while Joe ISP User will lose his privacy even more.

  • Evil (Score:5, Informative)

    by Anonymous Coward on Thursday October 16, 2008 @05:20PM (#25406231)
    According to the Wikipedia entry on Australian copyright law [wikipedia.org] "[...]Brilliant Digital Entertainment in Australia were raided for copyright violations[...]" in 2004.
    It looks like someone switched sides but taking a closer look they only seem to be in charge of the adware that came with Kazzaa, so I guess they were always evil.
  • by straponego (521991) on Thursday October 16, 2008 @05:44PM (#25406417)
    You could easily joe-job specific or random people with this. You could make a million torrent users look like child molesters.

    They're claiming they'll man-in-the-middle p2p users to disable encryption. Major problems there.

    They're using a hash for the images/movies. Alter the image tags, or change a pixel, you've beat it. The more they ignore diffs, the more false positives they'll get.

    There's my five seconds of thought on the efficacy/ethics of this. If you manage to solve all those problems, come back and I'll give it another five seconds. See you in ten years.

    But hey, once it's in place they can use it for the *AA! Which is really what this is about, more free handouts to obsolete business models.

    • by thogard (43403)

      What if the masthead graphics for something like google had the wrong checksum? Then everyone would look guilty.

  • This is Fantastic (Score:4, Insightful)

    by pnotequalsnp (1077279) on Thursday October 16, 2008 @05:44PM (#25406427)
    This is fantastic, since the amount of money required by an ISP to implement this will sink them. This will filter all "idiot" ISPs, who think they are rulers of the internet.
  • by thenewguy001 (1290738) on Thursday October 16, 2008 @05:46PM (#25406447)
    is to have ISPs scan all downloading files to make sure they do not contain malware or viruses so we don't have so many botnet zombies around the web from idiots opening britneysex.exe
  • by robo_mojo (997193)
  • So ngrep [sourceforge.net], in other words? It's not as though this is particularly new or exciting technology.
  • by Jimmy_B (129296) <slashdot@nOSpaM.jimrandomh.org> on Thursday October 16, 2008 @05:53PM (#25406545) Homepage

    The problem with all the hysteria around child pornography is that it's too easy to frame someone. A little research, five minutes alone with your computer, and an anonymous phone call are all someone needs to ruin your life and reputation.

    Let me be perfectly clear: Even if you're completely innocent, this is a serious threat to you. If someone decides to frame you, you won't be able to prove your innocence, and it won't matter even if you can. That's unacceptable. Yes, child porn is bad, but a society where anyone can anonymously destroy anyone else is much, much worse.

  • This can be filed in the Really Dumb Idea bin. It would be so easy to make a server that always alters images/movies by a few random bits to defeat hash checks. However, if the RIAA would pay me M$10, then I'll gladly make them yet another copyright infraction detection scheme...
  • I'm categorizing this as "alarmist crap". Unless it's done clandestinely, there would be lawsuits, and as many have already stated in comments here, there's almost no chance that it could foil encrypted transfers, and there's a likelihood that it doesn't work at all. Not getting worried until I hear that it's actually being implemented.
  • How much would you bet that the MPAA and RIAA are going to try to get laws passed that require ISPs to install and use this software?

  • They actually use an army of low-wage Chinese and Indian workers to scan all that data. It's cost effective, but the side effect is that in a few years millions of Asians, who might otherwise have become normal, productive, law-abiding citizens of their respective countries, will instead have become deranged pedophiles.

  • ...and take up a collection to pay the spammers to send a regular smattering of these files in their usual spam loads. ...and both overwhelm the filter and crush the ISP NAPs. ...and express our displeasure at the rapidly coming destruction of probable cause on the Internet.

    Because we know that shortly after the 'authorities' can do this, they will be asking to investigate the intended recipients, on the premise that they have 'probable cause'.

    I can't hardly tell the difference between the NY Attorney Gener

  • by farbles (672915) on Thursday October 16, 2008 @07:00PM (#25407141)

    You know what? In a dozen years of actively surfing porn, I've never encountered kiddie porn in the wild. This great big threat to all mankind so severe that we all need to put woolly pullovers over all our electronic gear and filter all telecommunications is simply and plainly crap. It's a ruse.

    There are some people who want to control everyone else. They want to control what you see, what you hear, and as much as is humanly possible, what you think. They want to monitor us all (but not themselves, of course) and make us all cookie-cutter little clones who all think the same harmless little thoughts and are all scared of their authority.

    F * U * C * K them.

    Anyone telling you this sort of "protection" is necessary is deluded or a liar. Either way, such people should be ignored or in extreme cases, put somewhere they cannot bring harm to others.

  • False positives? (Score:3, Informative)

    by Isao (153092) on Thursday October 16, 2008 @07:26PM (#25407307)
    And good luck trying to teach a jury about hash collisions [wikipedia.org].
  • by advocate_one (662832) on Friday October 17, 2008 @12:29AM (#25408965)
    OK, why are they being allowed to treat electronic content differently from sealed letters and packages? Do they steam open your letters and parcels to see if anything contentious is being sent? No, and I'll bet that's because it is unconstitutional... so why are they treating electronic delivery differently? There should be massive protests against this... no way should they be able to use the protecting you from child-porn line either... With snail mail, they have to get a warrant to intercept and open your mail and packages... the same should apply for electronic content...
  • by mrpacmanjel (38218) on Friday October 17, 2008 @03:24AM (#25409625)

    "...Internet service providers could easily be seen by the public as "overreaching," making it harder to get public support for efforts of law enforcement. What's needed, said the group's executive director, Grier Weeks, is for cops to investigate the leads they already have..."

    and

    "The Department of Justice and all 50 attorneys general are sitting on a mountain of evidence leading straight to the doors of child pornography traffickers," Weeks said. "We could rescue hundreds of thousands of child sexual assault victims tomorrow in America, without raising any constitutional issues whatsoever. But government simply won't spend the money to protect these children. Instead of arrests by the Federal Bureau of Investigation, the child exploitation industry now faces Internet pop-ups from the Friendly Bus Investigators. That was always the fundamental difference between the Biden bill and the McCain bill. Biden wanted to fund cops to rescue children. McCain wanted to outsource the job."

    This my friends is about the money! The U.S. Government and Brilliant Digital (ironic business name!) both know this won't work. Brilliant Digital see this as a market to exploit and make millions of dollars. The U.S. Government get a "cheap" way of "dealing" with child pornography and a perception from the general public as "something being done".

    I'm sure the Government know about Brilliant Digital's dubious past but the percieved "benefits" are too good to miss.

    It's a win-win for both parties!

    I have children myself and I find developments like this horrifying.

    Someone does not become a paedophile by looking at images on the internet, it's deeper and more complex then this - blocking content will not cure the problem or reduce related crimes in any way.

    The last quoted paragraph sends chills down my spine and really makes me angry.
    Children can be rescued if the funding is available but a company like Brilliant Digital will recieve the funding instead and the problem is never solved - people are made richer instead.

    I really mean Think of the children

"Hey Ivan, check your six." -- Sidewinder missile jacket patch, showing a Sidewinder driving up the tail of a Russian Su-27

Working...