ISP Embarq Monitors User Traffic

Deli Korkmaz writes "The Washington Post reports that Sprint-Nextel spin-off Embarq, currently the US's fourth largest DSL provider, monitored Internet activity on some 26,000 customers in Kansas using deep-packet inspection technology NebuAd in order to deliver targeted advertising to users' desktops. CNet provides coverage as well. The House of Representatives Committee on Energy and Commerce is investigating whether any privacy laws were broken. Users were informed of this test and invited to opt out only via Embarq's online Privacy Policy; a mere 15 subscribers did so."

wow

All up into a dude's business just to sell ads. Disgusting.

Re:wow

Nice...surf pr0n, Embarq dynamically sends you goatse adds.

was it limited to inspection?

was this deep packet "inspection", or did they actually alter traffic? Like modifying web pages to insert ads, or change IP addresses of banners?

Or something more hands-off like monitoring customer browsing and using it to deliver better targeted ads when the customer browsed their own web pages?

Re:was it limited to inspection?

It is exactly like Phorm. They monitor your surfing habits to identify your likes and feed the info to a partner website that is displaying an ad based on your habits.

Re:was it limited to inspection?

How is this legal?

I thought warrantless wiretapping only covered law enforcement.

Re:was it limited to inspection?

Disclaimer: I am an Embarq employee.

It was used to better target the advertisements on MyEmbarq.com and on the DNS redirection pages for server not found. If there was any more past that, then the general work force was not aware of it. No modifying of pages or redirecting others' advertisements.

This system would only work if you used Embarq's DNS servers.

Re:was it limited to inspection?

If they are using the NebuAd services, it IS both deep packet inspection and inserting javascript in all pages.
The fact that it uses the information it gathers to give better targeted ads on your DNS redirection (a separate kind of internet breaking evil you should be ashamed of, BTW) is just gravy.
You as an employee have only received half the story, and it makes it sound a whole lot better that way.
Wikipedia's article on NebuAd will give you some of the real scoop, but it gets worse the more you find out about it..
http://en.wikipedia.org/wiki/NebuAd [wikipedia.org]

Re:was it limited to inspection?

Catch is on ADSL system it is an illegal monitoring of telephone activity. It is a telephone line and whether the communications are straight voice or digitised content it is still illegal. The ISP and the advertising agency should be prosecuted to the full extent of the law including imprisonment and government that lets this get by in criminally complicit.

Why aren't we encrypting everything already?

If we can get web servers to support TLS (for multi-domain encryption on a single IP vs. SSL), and create a non-identity framework for encryption, we should just start encrypting everything end to end. ISPs are asking for it with these behaviors.

Re:

Not sure if that'll work. Some internet companies apparently block all encrypted traffic. I'm thinking of Rogers Cable as my example (feel free to correct me though). I mean really it's their own business if they want to shaft their customers. Unfortunately most people either don't care that this sort of stuff is going on, or don't know of any other ISPs they can go to as alternatives.

Re:Why aren't we encrypting everything already?

You seem to be in favour of ISPs respecting their customer's privacy but then went on to mock an anonymous coward for opting to remain anonymous.

That doesn't make much sense to me.

Yes, you are wrong. Rogers Cable throttles encrypted traffic, but doesn't block it.

Re:Why aren't we encrypting everything already?

Just add a privacy light to browsers. "When that thing is on, your communications are between you and whoever you are communicating with, when it isn't on, anybody can see them". Then compare it to a postcard and a letter in an envelope.

Only 15 people opted out...

...because the opt out was buried in a 5000 word privacy policy. If anything, this story should lead the house to realize that merely posting a privacy policy on your website doesn't mean the customers are bound by it especially in terms of rights, privacy and willingness to be subjected to monitoring merely for advertising sake.

Re:Only 15 people opted out...

Opt-out?

How is this not wiretapping? You're intercepting and monitoring the exchange of information between two entities, possibly even "bugging" at least one of them if you're also introducing cookies or similar devices.

Can the phone company introduce something into their privacy policy that all communications may be tapped without the request of law enforcement and have that be legally sound because I didn't "opt-out"?

Furthermore, even if the subscriber had the opportunity to opt-out, did the second entity? No they didn't. Therefore the privacy of at least one party has been unquestionably violated.

Opt-out... WTF?

Re:Only 15 people opted out...

It was apparently on display next to Arthur Dent's home demolition notice.

Sell your own private data? Sure, why not!

Whenever you have to search long and hard to find new 'features', this can only mean one of several things:

• It's not really a feature that people want (because if it were, it would be announced loud & clear)
• It's just ammo for lawyers to shoot with, or
• They don't want you to see it (eg. what they're doing might be illegal)

Even more on-topic are these quotes from the Wiki article [wikipedia.org] (provided by spinkham above):

According to Nebuad's sales pitch less than 1% of users opt-out. One ISP expects to earn at least $2.50 per month for each user (..) Generally, NebuAd provides an additional income stream to network operators, which may maintain or lower consumers' internet access bills.

As we've all known for a long time, ordinary people's surfing habits are worth money. What when you'd ask people up front: "Do you want your surfing habits to remain private, or give up this privacy in exchange for a discount?"

I'm afraid the vast majority of people would go for the discount. The anything-connected-to-everything world of today has gotten us so used to data breaches and 'unknown parties' snooping through our private info, that we just don't seem to care anymore. Which seems strange: the less (privacy) you have left, wouldn't you value those last remains more than you used to?

Re:Only 15 people opted out...

5,000 words is going to be 9-10 pages.

Or a really, really, really long scroll in a narrow, non resizeable window.

Sigh - I hate to suggest this...

I think that very simply worded new legislation is required...

"Opt Out" is the new default for any new program, feature, change of any kind for any kind of product or service provider.

Any new programs or offerings will default the individuals to opt-out status, and require the user to notify the provider (without being hampered by phone calls, e-mails, etc) to opt-in.

Any company failing to comply with this policy shall have all of their assets liquidated and deposited into the bank account of the person(s) they elected to opt-in by default.

Re:EXACTLY

Please be careful with the terminology.

Opt-out means that you're in and you have to opt-out to stop your membership/subscription/whatever.

Opt-in is what you want: it's your choice to subscribe/join/whatever, and if you don't, there is no membership/subscription/whatever.

For example: The do-not-call list is an opt-out scheme. Unless you take action and put your name on the list, they're allowed to call you. Most newsletters are opt-in: You only receive the newsletter if you subscribe. Spam is neither opt-in nor opt-out: You get spam without doing anything. If you try to opt-out, you get more spam.

Deep packet inspection

I find the phrase 'deep packet inspection' interesting because it simultaneously describes the technique used and a large subset of the results acquired.

Tom Gerke

[e-mail] was the contact for the CEO back in March. I assume it is still legitimate...

Disclosure laws...

We had this problem with the credit card industry before. People were signing up and had no clue what they were agreeing to because the most important terms weren't properly exposed. Then we got a law that made the current interest rate and the formula by which it is computer and how it may be changed in regulated-size type.

Time for a format for privacy policies to match that...

Actually a fairly high number of opt-outs

Frankly, I'm surprised by the number of people who opted out. For something that was done to ~30 thousand people, disclosed only in the byzantine back layers of some policy somewhere(I'm guessing this is one of those policies that get to change without notice) and, so far as I know, not previously known to the geek news sources at large, 15 opt outs is pretty high.

Obviously there is no good way to do this experiment; but I'd be quite interested to see an estimate of the "expected baseline opt-out rate" for various sorts of disclosure, calculated by disclosing a ludicrously and absolutely unacceptable term or condition and seeing how many people opt-out. From that, you could then more accurately gauge the real level of unhappiness that a given opt-out percentage implies(For example, what percentage of people would opt-out if a term authorizing the CEO and the board to seize subscriber's assets at any time, for any reason, in any quantity appeared deep in the privacy policy? That value would, in effect, constitute the 100% opposition value.)

Or, we could just do the easier thing and make opt-in absolutely mandatory, perhaps with brutal mob justice for violators.(a man can dream, can't he?)

Re:The majority of middle America is unaware

I might go along with the Insightful were it not for the gratuitous (and most likely inaccurate) use of "middle America." There are a number of things wrong with this:

1) I can think of a lot of places in world (having lived there) where people are at least as technologically clueless as the average American. There is nothing special about Americans - either positive or negative - in that regard;

2) If you meant "middle" as in "middle class" you missed. The most technologically clueful income strata in America is most likely the middle class. One of the things that keeps the poor in poverty is lack of clue combined with means to acquire it; rich people, on the other hand, have middle class people who are paid to do all that stuff for them, and thus don't acquire clue about computers unless they are very interested in them or were once middle class;

3) If you meant "middle" as in "geographic center" it is still likely that you missed. Even in the Silicon Valley area, where I live, computer cluefulness remains largely the province or those who are in the industry or who are computer enthusiasts on their own. Everyone else is as clueless as they are everywhere else. Those who aren't clueless are, again, mostly in the middle class.

If you'd written that the majority of people (everywhere) are unaware, I might have spent one of my remaining mod points to mod you up. As it is, I was tempted to use to mod you troll, but decided to take the time to explain why I consider your post a troll instead.

Re:long past time for encryption by default

HTTPS presents a significant load on servers. It can easily demand 3 times the hardware and support to transfer a large, busy set of servers to HTTPS for all traffic. If it *didn't* present a noticeable load, it would be fairly useful as a normal encryption channel.

It's also awkward to proxy and manage the encryption securely, because HTTPS is very careful about checking hostnames and IP addresses to avoid people forging your site. This makes it more awkard for usrs, as their browsers complain about untrusted keys or the server owners have to invest in registering keys.