Slashdot is powered by your submissions, so send in your scoop


Forgot your password?
Privacy Your Rights Online

ISPs Using "Deep Packet Inspection" On 100,000 Users 309

dstates writes "The Washington Post is reporting that some Internet Service Providers (ISP) have been using deep-packet inspection to spy on the communications of more than 100,000 US customers. Deep packet inspection allows the ISP to read the content of communications including every Web page visited, every e-mail sent and every search entered, in short every click and keystroke that comes down the line. The companies involved assert that customers' privacy is protected because no personally identifying details are released, but they make money from advertisers who use the information to target their online pitches. Deep packet inspection is a significant expansion over tools like cookies in the ability to track a user. Critics liken it to a phone company listening in on conversations."
This discussion has been archived. No new comments can be posted.

ISPs Using "Deep Packet Inspection" On 100,000 Users

Comments Filter:
  • So? Use https, ... (Score:2, Insightful)

    by Anonymous Coward
    ..., ssh, pgp all the time!
    • Re: (Score:3, Informative)

      Let me add OTR messaging [] to the list.

      Available for Pidgin (aka GAIM), Adium X, mICQ, Kopete, Miranda, Trillian and as a proxy for people that use other clients. Works on any IM network.

      (I've been using it on GAIM for some time and I recommend it)
  • by Anonymous Coward on Saturday April 05, 2008 @09:37AM (#22972492)
    DNSSec and opportunistic IPSec should put an end to the snooping and throttling once and for all.
    • I read the wikipeadia article on DNSSec, and it does not seem like it's ready to me. Opportunistic encryption is good, but it doesn't work from behind a NAT from what I understand, which makes it basically useless since NAT is the poor man's firewall!
  • by ookabooka ( 731013 ) on Saturday April 05, 2008 @09:42AM (#22972508)
    Thats it, I say webservers move to SSL only transactions. All other plaintext transmissions should get encrypted at the endpoints transparently. Then when the government whines about not being able to find the terrorists they can blame datamining companies that paid for their election campaign. Then they can make a law that forces a back-door, which would create a need for some nifty-ass steganography [] which would lead to massively excessive processor and network overhead (encryption and steganography respectively) for the most basic of transactions which would lead to NSA funded algorythms to find these hidden messages which would. . .holy shit it's almost 10AM, I need to hit the sack.
    • by cs02rm0 ( 654673 )
      Seconded. It's beyond me why this hasn't happened already. Google do it fairly well as an option with gmail and google reader for example but not with their searching?
      • Sounds like a good case for a new firefox plugin! Render all the urls to be https, it shouldn't be that hard. You'd probably have to put an option in the right click menu to open as http in case the server didn't support ssl when you clicked the first time though...
      • Re: (Score:3, Funny)

        What about Slashdot? After all, you might not want your ISP to know that you read such subversive web sites! :-)
      • by darkpixel2k ( 623900 ) <> on Saturday April 05, 2008 @12:48PM (#22973582) Homepage
        It's beyond me why this hasn't happened already.

        As far as I know, IIS and Apache don't quite support TLS yet (although it's in-progress) which means every SSL-enabled website would have to be on it's own unique IP/port...making the IP 'crunch' even more of an issue.
        • Not necessarily (Score:3, Informative)

          by davidwr ( 791652 )
          You could have 10,000 domains that share a common cert provided by the hosting provider. It does squat for authentication but it does prevent snooping.

          With ISPs starting to snoop, suddenly this has real value.

          Combine this with 3rd-party SSL-enabled DNS, and you've got some reasonable countermeasures.

          Your ISP will know you talked to over an encrypted channel and then immediately carried on a series of conversations with over port 443, but he won't know which of the thousands o
    • by pla ( 258480 ) on Saturday April 05, 2008 @10:18AM (#22972758) Journal
      Thats it, I say webservers move to SSL only transactions.

      I agree completely, but keep in mind that even with encryption, ISPs can still collect quite enough information on us to put together a truly impressive profile. Sure, they won't know exactly what you read, but if you visit Erowid, I'd call it a good bet you don't want recommendations on a cheese to go with dinner.

      For targetted advertising purposes, the simple "where" counts for 90% of the "what".
    • Re: (Score:2, Insightful)

      by seneces ( 839286 )
      SSL's general uptake is held back by two unfortunately major points. Firstly, it costs money to buy a SSL certificate, and you have to deal with all sorts of shit (or spend more money) if you use subdomains, alternate domains, etc. Something like CACert could fix this issue if it were widely accepted, but of course that would make the entire system less trustworthy..

      Secondly, there is no normally implemented way to do name-based virtual hosting with SSL, and most people don't want to or can't give each d
      • I second this! I was trying to get SSL working on our different domain names just the other month and when I found out you can only have one cert per IP address, I was like "who the fuck though this was a good idea?? Like no one ever had multiple domains point to one IP before? GAAAAHH!!" Sorry, I get worked up :(
        • by DaleGlass ( 1068434 ) on Saturday April 05, 2008 @11:02AM (#22972990) Homepage
          The problem is that SSL happens before any HTTP does, and SSL is a general mechanism that can be used for any kind of TCP connection.

          How does the webserver know what to give you when and map to the same IP address, and the browser requests something like index.html that exists on both? This works only because when the browser makes the request it also tells the webserver which domain it was trying to access. The browser sends something like this:

          GET /index.html HTTP/1.1
          Now, this breaks for SSL, because SSL happens before the connection is established, so there's no way to decide which certificate to use based on the domain.

          To fix to this is adding the support directly to SSL. rfc4336 contains a mechanism to do this with TLS.

    • standing up for our rights is the answer. unfortunately, corporations listen only to once voice, money, so hit them where it hurts.

      Cancel your internet, refuse to pay your bills... boohoo, then you won't have internet? you won't have internet anyway, if they get their way.
  • by Thruen ( 753567 ) on Saturday April 05, 2008 @09:45AM (#22972524)
    If ISPs are monitoring traffic so closely, doesn't that make them more responsible for what people are using their service for? Namely piracy.
    • Re: (Score:3, Interesting)

      I do believe that one could make that point. Comcast already has ways to throttle Bittorrent. If they are doing deep packet inspection, I would think that they would know down to the data block what files were being transferred.

    • Re: (Score:3, Interesting)

      by budgenator ( 254554 )
      Not yet, but it seems that they are bound and determined to get there. I figure if they want to crawl that far up my ass, I'll just write a Perl script to spider every link on a page, and let it run recursively, give them enough data they start to buffer-overflow and fill up their hard-disks until they puke. Sure I probably can't do much to them, but ten thousand of us crawling the web can.
  • ISPs have always been notorious for secretly compressing your images, caching your traffic, proxying stuff, slipping their own content into your web pages, etc. They look at the contents of your mail, since you can't spoof from anyone to anyone via their servers. How is this different, other than some joker gave it an ominous sounding name like 'Deep Packet Inspection' ?
    • by Ernesto Alvarez ( 750678 ) on Saturday April 05, 2008 @10:44AM (#22972884) Homepage Journal
      The difference is that in the first case, the data passes through a dumb machine that compresses, caches, etc. The result is cached like it is expected (RFC 2616 is pretty clear about that), even though it is done transparently. No need to keep logs about who downloaded what.

      In this case, the data is explicitly mined, by a company interested in building a profile of each user. It doesn't say it is limited to web traffic only, only that "Nor does NebuAd record a user's visits to pornography or gaming sites or a user's interests in sensitive subjects -- such as bankruptcy or a medical condition such as AIDS.", which I doubt both on technical grounds and because it is a market and someone will want to take advantage and "The company said it processes but does not look into packets of information that include e-mail or pictures." which I think is in contradiction with other parts of the article and even if they didn't, it's a matter of time before they do.

      Basically, it's the intent that counts. The ISP can intercept everything they want because they're in the middle. When they start doing so for reasons that are not part of maintaining the communications as specified (like forwarding, maybe firewalling and proxying depending on the conditions), alarms should go off.
  • by jollyreaper ( 513215 ) on Saturday April 05, 2008 @09:55AM (#22972586)
    Let's start turning over rocks in the private lives of telcom CEO's and see what scurries out. I'm sure they won't mind, it's in the interests of an open society and free debate, don'cha know.
    • zomg HACK THE PLANET
  • by TheMohel ( 143568 ) on Saturday April 05, 2008 @09:56AM (#22972594) Homepage
    Never mind that it's evil, or that it's a great step to losing their common-carrier status.

    Never mind that it's a true violation of privacy.

    Never mind that I block cookies pretty well and I run with NoScript most of the time and I don't see very many ads, and besides, half of the time I'm inside my employer's VPN.

    But even more than that, I have seven other users in my household, half of them teenagers. If they want to sniff all of my NAT-ed packets coming out, they're going to discover that I'm a geek who has four Facebook sites, likes art and hates it, plays Runescape incessantly (the 10-year-old), likes the Wiggles, and works as a beauty consultant. So go ahead and hand me the ad for the latest XBox game (I hate games). Offer my kids server hardware, and see if you can get my wife to click on fun games to play with the Backyardigans. Oh, wait, you already do. It's called "not targeting advertising", and it's free.

    So what we have is a thoroughly broken high-cost borderline-illegal absolutely-unethical service offered to advertisers in a difficult economic period. By people who we all hate a lot, and who will rapidly become targets for everything from blocking to legislative action to you name it.

    I knew there would be some kind of career move for spam kings in the future. I just thought it would pay better.

    I predict a less than stellar outcome for these idiots, and they deserve every painful moment.
    • by ChowRiit ( 939581 ) on Saturday April 05, 2008 @10:45AM (#22972900)
      However, you still get more accurate data on user trends as a whole - you no longer have the old problem of the fact that only the sort of people who fill in surveys will fill in your surveys, and they're not generally a representative sample.

      Any data at all on user trends more than their competitors will help advertising companies make money.
    • by mpaulsen ( 240157 ) on Saturday April 05, 2008 @10:46AM (#22972904) Journal
      Never mind that it's evil, or that it's a great step to losing their common-carrier status.

      They don't have a common-carrier status to lose.
    • by Nimey ( 114278 )

      it's a great step to losing their common-carrier status.
      HA HA HA! You underestimate the power of bought congressweasels. One will slip in an amendment into a big must-pass bill, and Bob's their uncle.
    • by nurb432 ( 527695 )
      Thats all and good when it just about 'targeting' advertisements to you.

      But when it turns to the government doing profiling on your 'habits', its not so harmless. And we all know that is next.
    • by jmorris42 ( 1458 ) * <jmorris@beau . o rg> on Saturday April 05, 2008 @11:22AM (#22973112)
      > If they want to sniff all of my NAT-ed packets coming out, they're
      >going to discover that I'm a geek who has four Facebook sites, likes
      > art and hates it, plays....

      Silly person, they are much smarter than that. Each of those PCs can be identified, see previous slashdot articles on the subject. Especially since each PC in a network serving a diverse family as you are describing will probably have obvious differences in OS and browser versions. Then there is detailed packet header inspection (DEEP INSPECTION, remember?) to seperate out OS subtle version differences, etc. And each PC/account will offerup different cookies to the same websites like Google.

      NAT won't stop them. SSL won't stop them. Laws might. This sort of snooping isn't 'like' listening in on phone conversations. It IS listening in on conversations.
    • Never mind that it's evil, or that it's a great step to losing their common-carrier status.

      Another common misperception. I don't know of any major United States Internet Service Provider that operates under common carrier regulation. The Telcos still do, but only for phone service. Their data services are considered exceptions to common-carrier regulation.

      They obviously looked at the legal situation and decided the lack of immunity from lawsuits over the use of their equipment was a risk worth taking
  • Isn't this the real issue with clogging 'tubes'? How can the government and ISPs keep up with the computational resources needed to continue this as we demand greater and greater amounts of bandwidth? OK, so they could only inspect http traffic, rather than say, bittorrent traffic, but OMG what happens when 'terrorists' start communicating with other protocols?
  • by Orp ( 6583 ) on Saturday April 05, 2008 @10:03AM (#22972652) Homepage
    I pay for a dedicated server (essentially colo but they provide the hardware) from a company with a decent AUP. I put linux on the server and run squid on a non-standard port, allowing connections from localhost only. Then from the machine I'm surfing from I tunnel into the squid server. Say squid is running on port 1234 and sshd is running on 4567:

    ssh -f -N -L 1234:localhost:1234 -p 5678

    Configure firefox to use a proxy to localhost:1234 and all traffic is encrypted to the squid server.

    Of course, I could just use Tor, which is great, but can be slow. In fact, you could run a tor server on your colo machine and have all tor traffic bounce off of the server, which would be pretty fast if you leave tor running as a daemon and dedicate a decent amount of bandwidth to the tor network.
    • Re: (Score:3, Insightful)

      by jmorris42 ( 1458 ) *
      > I pay for a dedicated server (essentially colo but they provide
      > the hardware) from a company with a decent AUP. I put linux on
      > the server and run squid.....

      And you are a fool with more money and tech knowledge than you have the brains to use wisely.

      Exactly what are you hoping to accomplish by going to all of that bother? Your last mile ISP can't monitor you but the hosting company and THEIR ISP can so you have just shifted the point of attack.

      And the government (which is what you are afraid
      • by nxtw ( 866177 )

        Exactly what are you hoping to accomplish by going to all of that bother? Your last mile ISP can't monitor you but the hosting company and THEIR ISP can so you have just shifted the point of attack.

        Well, his traffic is flowing through a datacenter that's normally used for hosting websites, not visiting sites. Why would anyone look at outgoing traffic?

        And that hosting provider might have more than one ISP.
      • Re: (Score:3, Informative)

        by Orp ( 6583 )
        You presume I am doing anything illegal in the first place. And if using ssh raises red flags for the gov't then they are going to be very very busy as it's really the de facto remote login protocol for all Unix machines.

        My example is a case where if the AUP of the colo company explicitly states that they do not monitor traffic, and your ISP for the last mile does, you can avoid your ISP's deep packet sniffing.
  • If everyone offered https, ( or only ) and all email is encrypted then this would become a moot point really quick.

    All they would know then is where you went, not what you did. ( Tho in this country, just going there is enough to get you put in jail it seems )

    Or we can all move to freenet and really stick it to them.
  • by nysus ( 162232 ) on Saturday April 05, 2008 @10:09AM (#22972696)
    It's illegal for anyone to open mail not intended for them. The same should be done for electronic communication.

    And if I hear one libertarian say we need less laws, I'll puke. It's as if they though they had a magic wand and all the troubles of the world would disappear by removing government. Unfortunately, the world hasn't worked that way since we left the caves 12,000 years ago.
    • by nurb432 ( 527695 ) on Saturday April 05, 2008 @11:12AM (#22973042) Homepage Journal
      We *do* need fewer laws. However, the ones that remain need to be effective and of value, and actually enforced.

      The law to protect your right to privacy already exists, it just needs to be enforced. Creating more laws doesn't help with lack of enforcement of what is already there.
      • Re: (Score:3, Insightful)

        by chunk08 ( 1229574 )
        Brilliant post! The problem, though, is that the citizens will not stand up for their rights, because our current culture is taught to depend on the government to fix all of the problems. If citizens were to take a stand on the issue, government and corporations would see that it is not in their best interest to continue these practices. What needs to happen is (as has previously been posted) citizens encrypting their communications and taking other steps (Tor, Freenet, etc.) to prevent snooping, governmen
        • Where are my mod points when I need them? This is *exactly* right!

          The biggest barrier to getting everyone to use encryption, though, is the relative difficulty in configuring it. For example, I'm on a Mac running OS X right now. This is generally regarded as an "easy to use" OS, and one often recommended for people's parents, relatives, etc. Nonetheless, if I want to encrypt my outgoing email using the included with the OS, what are my options? So far, the best I can do for my OS X Leopard 10.
    • Re: (Score:2, Insightful)

      by Anonymous Coward
      And if I hear one libertarian say we need less laws, I'll puke.

      Pesky semantics....

      While it may be true that the actual raw number of laws presently on the books is huge and unwieldy, and while it may be true that the removal of many of those laws would actually bring a good deal of efficiency while also eliminating some loopholes that are routinely exploited to the detriment of the majority, and while it may be true that a common knee-jerk response to any kind of exploitive behavior is to cry "pass a law th
    • It's illegal for anyone to open mail not intended for them. The same should be done for electronic communication.

      And if I hear one libertarian say we need less laws, I'll puke. It's as if they though they had a magic wand and all the troubles of the world would disappear by removing government. Unfortunately, the world hasn't worked that way since we left the caves 12,000 years ago.

      In fact it is already illegal to open USPS mail not intended for you. It's a federal crime. The problem is that the laws of the real world that have been in place and working for a very long time have not yet been interpreted to apply on the internet. I fail to see the difference between physical mail and electronic mail.

      • It is just like all of the new patents related to the internet and computers:

        Laws are different when it is "on the internet", or "using a computer"

        Reading mail not intended for you isn't a problem, "on the internet"

        I agree with you that it shouldn't be like that at all, though.
  • by Skapare ( 16644 ) on Saturday April 05, 2008 @10:10AM (#22972712) Homepage

    If these are the ISPs (as opposed to the visited web sites) doing the spying, then how are the advertising companies involved supposed to deliver the content? Are they going to use the same "deep packet" method to inject the advertising? If the advertising delivery is away from that deep packet inspection, then how do they identify which user was interested in penis enlargement products vs. which user was interested in replica watches? Or are the ISPs going to lock-in the IP address, now?

    • by NotQuiteReal ( 608241 ) on Saturday April 05, 2008 @10:49AM (#22972928) Journal
      After all, your ISP knows your street address.

      Search for info on heartburn... get some post cards advertising the latest antacid. Search for info about Lasik eye surgery... gee handy flyers about your local providers appear.

      You get the idea. If I were selling a service and an ISP offered to sell me names and addresses based on keyword searches, why wouldn't I buy that list?

    • Re: (Score:3, Informative)

      by jmorris42 ( 1458 ) *
      > If these are the ISPs (as opposed to the visited web sites) doing
      > the spying, then how are the advertising companies involved supposed
      > to deliver the content?

      Because the visited web sites already aren't the ones delivering the advertising. You go to and view a page. The ads come from an outside site. That site partners with your ISP. They toss a packet with the IP and perhaps other info (like browser info so the ISP can determine which PC behind the home NAT is making the request a
    • It would have great value just for the demographic research and usage patterns.  That's probably what they're after--at this time.
  • Fact is that if there is packet inspection going on, this is slowing down traffic on that one connection. Imagine now that there is many users traffic who is being "scanned", redirected or filtered, et al.

    Now; has anyone else noticed that the net is getting slower and slower recently?? We already know that sites such as and other similar types, have special applets that download and attempt to arrange items on the page so that you are forced to see specific adds for a specific period of time bef
    • by Thing 1 ( 178996 )

      Time for those magical host lists again!!

      I love synchronicity. I read "real" news at the Excite portal, and "tech" news here. Lately Excite has put interstitial ads in their pages, so you have to "Click here to skip this ad." Once you do so, though, the Back button is still disabled so you can't get back to the ad (which I sometimes want to, so pity for the idiot who architected this).

      The issue is that sometimes due to this, a page will sit there spinning and no more pages will load. To "fix" this

  • by Perp Atuitie ( 919967 ) on Saturday April 05, 2008 @10:25AM (#22972792)

    Critics liken it to a phone company listening in on conversations.
    Um, my ISP IS my phone company. If they can get away with reading my emails and stuff like this comment, what's to stop them from listening to my phone calls? We're really at a crossroads: either the law makes ISPs common carriers with no interest in, or control over, content like a real phone company, or we lose most of the potential of the communications tech revolution.
    • Technically, it is more difficult to parse out possible ad targets from the content of your phone calls. The information of where you are calling and when might be the only thing that is more or less useful for their evil advertising schemes.
    • by Reziac ( 43301 ) *
      I was just wondering something like that myself: at what point does this sort of datamining overstep privacy to the point that it revokes common carrier status??

      Also, AOL's little fiasco proved that you CAN identify individuals through their searches... what's to prevent this from being used similarly?

      I also have to wonder about what if the ISP is "clean" but their backbone is datamining??

    • by argent ( 18001 )
      If they can get away with reading my emails and stuff like this comment, what's to stop them from listening to my phone calls?

      Apart from the law, the fact that speech recognition is a much harder problem?
  • I expect that they will combine this snooping with throttling of all encrypted (or otherwise random) looking packets.
  • by gweihir ( 88907 ) on Saturday April 05, 2008 @10:49AM (#22972924)
    If you do this in the EU. Packet pauyloads are off-limits without court order. You may not even store them.
    • by yuna49 ( 905461 )
      From TFA:
      In England, Phorm is expected in the coming weeks to launch its monitoring service with BT, Britain's largest Internet broadband provider.

      Last I heard the United Kingdom was a member of the European Union. Perhaps BT's attorneys have a different interpretation of the laws than you?
      • by Stevecrox ( 962208 ) on Saturday April 05, 2008 @01:03PM (#22973696) Journal
        Phorm argues it doesn't break the law because they offer an "opt out" clause and so isn't effected by the RIPA act. BT's trial last year of Phorm against 10,000 users is being investigated as potentially illegal as users wern't given the chance to opt out. It should be a easily won case since BT by supplying 121media and not asking if they can share this information have broken the Data Protection Act. BT maintains plans to implement Phorm with the ability to opt out (through a cookie on your PC.)

        I've already sent a letter to my service provider (virgin media) informing them I want no part of Phorm and if they implement it (which they are considering) I will be prosecuting them under the Data Protection Act. I suggest all BT, Talk Talk and Virgin Media users do the same.

        The Data Protection Act in the UK is the best defense against this sort of thing, it defines how companies my handle personal data, the right a person has to that data and what responsibilities the organisations have with it. The biggest problem with it tends to be phone operators who've never read it trying to tell you the section you read to them is wrong.

        I believe someone is trying to prosecute Facebook because they were unable to remove their information from Facebook (when you leave a service you have a right to have all information on a companies database to be deleted) If I were to go into a police station and demand all the CCTV footage they have on me they would have to supply it (my right to see) finally if I don't agree that companies can share my information with 3rd parties then they aren't allowed to share it full stop if they do you can prosecute.

        121Media argue phorm doesn't violate the Data Protection Act because you are visiting public websites (it being akin to walking along a public highway and so no right to privacy) Hopefully the Information Commisson won't see it that way and will enforce the view that sending unencrypted http packets through port 80 is the same as making a phone call and so falls under the same protections.
  • "Customer revolt" (Score:5, Insightful)

    by frdmfghtr ( 603968 ) on Saturday April 05, 2008 @10:53AM (#22972942)

    For all its promise, however, the service providers exploring and testing such services have largely kept quiet -- "for fear of customer revolt," according to one executive involved.
    Guess what pal..the word is now out.

    Ever get the feeling the the Internet just isn't worth it anymore?
    • Re: (Score:3, Insightful)

      by Inda ( 580031 )
      Was it ever worth it? Maybe the homepages of 1997 were worth it...
  • Enough! (Score:4, Informative)

    by iamacat ( 583406 ) on Saturday April 05, 2008 @11:19AM (#22973092)
    Time has shown that nobody will protect your privacy besides yourself. It's time for ALL Internet traffic and ALL phone traffic to be encrypted with an option to get SSL keys for each machine or phone from trusted authorities in different countries. This way a particular person asserting privacy is not labeled a terrorist, Comcast can not selectively block bittorrent, Chinese firewall is out of business and phone companies do not need immunity for spying on subscribers. IPV6 will have to be adopted anyway in the next 10 years and it included encryption, so the time is right to make both switches at once with little extra IT overhead.
  • Encrypt everything! (Score:4, Interesting)

    by IGnatius T Foobar ( 4328 ) on Saturday April 05, 2008 @11:25AM (#22973126) Homepage Journal
    The government may have the resources to break strong encryption in real time, but even the largest ISP's do not. So maybe now the FreeS/WAN project no longer sound like tinfoil-hatted paranoiacs when they push opportunistic encryption at every node []. Everything gets encrypted automatically and transparently when talking between two OE nodes, regardless of the protocol.

    This was their goal, but hostility and forking ensued when most people really wanted to just have an IPsec implementation on Linux. OE is still a good idea, though, and that's what they're focusing on now.

    The obvious design win would be if Linksys and Netgear built OE into their consumer grade firewall/routers. Then everyone would have it, not even know it, and when large site operators started deploying it on their network edges, massive amounts of crypto would start traversing the Internet, and no one would be bothered by it.

    That's really the key to good system design: add complexity, but don't bother the end user -- it's not his problem.
  • VPN FTW (Score:2, Informative)

    by billcopc ( 196330 )
    Funny, while loading this page I got a "bandwidth cap warning" from my ISP, stealthily inserted into the page (Rogers Cable).

    I expect nothing less from the despicable scam shop that is Rogers, but it's still kind of creepy.

    For me, it's not a huge deal because I run a number of geographically diverse servers, I can VPN or proxy my traffic through any combination of them, should the need arise. Like any invasion of privacy, I'm not concerned about the marketing uses, it's the inevitable abuse that scares me,
    • Re: (Score:3, Interesting)

      by corsec67 ( 627446 )

      Funny, while loading this page I got a "bandwidth cap warning" from my ISP, stealthily inserted into the page (Rogers Cable).

      Doesn't that violate the copyright on the page held by /.? (Rogers made a derivative of the page, and distributed that to you)
  • by Animats ( 122034 ) on Saturday April 05, 2008 @11:44AM (#22973226) Homepage

    I just checked NebuAd's Privacy policy []:

    NebuAd products do collect and use the following kinds of anonymous information:

    • Web pages viewed and links clicked on
    • Web search terms
    • The amount of time spent at some Web sites
    • Response to advertisements
    • System settings, such as the browser used and speed of the connection
    • ZIP code or postal code

    Now that's way out of line for an ISP to collect, let alone send to an ad agency.

    We may be able to do something about this.

    We run SiteTruth AdRater [], which rates advertisers. We have a Firefox extension which displays a rating icon for each ad served. When an ad link goes by, and it's not in the browser cache, the extension contacts our server for a rating of the advertiser. So we collect, over time, a list of advertisers for various ad systems. We're not collecting data about users; we're interested in advertiser behavior. (You can read the source code for the plug-in, so there's no mystery about what we're doing.)

    We're not currently tracking NebuAd, Front Porch, or Phorm ads; we've been focusing on the bigger players. It looks like we need to be tracking this behavior. If anyone can find ad links from those services, please post the ad link here, or mail it to "". We need some examples so we can modify the plug-in to recognize them.

    If we can collect sufficient information about this class of advertisers, we may publish their customer list, which would be useful for boycott purposes. Thanks.

  • by ffejie ( 779512 ) on Saturday April 05, 2008 @12:20PM (#22973412)
    I have a bit of history with two large service providers in the US. While I have not been involved directly with the deep packet inspection teams, I have had direct contact with all of them and helped them design networks using this technology. The technology was never sold to upper management as a way to track our users and target ads to them. It was never intended to capture a web page hit that was directed at a specific company to see what that consumer was interested in. Instead, it was always meant to monitor users (and more importantly, user aggregates) and determine what kind of traffic they were sending.

    It was, and is, always about the network profile. If they find out that 10% of the traffic on the network is VoIP traffic, they want to design the network shift this traffic to have lower latency.** If they find out that 50% of the traffic is BitTorrent, they may put rules in place around such services. In my opinion, the service providers that I have dealt with do not have the technology in place to target down to the user. Also, they do not appear to be developing this technology.

    **Some can argue that providers are instinctively evil and want to destroy this traffic, but I'm not going to fight this here.
  • Who wins? (Score:3, Insightful)

    by edmicman ( 830206 ) on Saturday April 05, 2008 @12:28PM (#22973460) Homepage Journal
    From the article:

    Advocates of deep-packet inspection see it as a boon for all involved. Advertisers can better target their pitches. Consumers will see more relevant ads. Service providers who hand over consumer data can share in advertising revenues. And Web sites can make more money from online advertising, a $20 billion industry that is growing rapidly.
    So the consumers' benefit is better targeted ads? Woohoo? Sounds like the only ones who are winning are the corps and that's it.
  • Every datacom box supplier is developing DPI features for their products. The main driver is not targeted marketing, but QoS. When you're able to identify traffic on the application layer, it gives you a lot of extra options in determining how to route the traffic.
    This way you can decide to route P2P traffic flows on best effort basis, but "over-the-top" video (eg. Youtube) flows you route through a higher quality connection. This improves user satisfaction.
    That's the idea anyway, saying it's for targeted a
  • by edmicman ( 830206 ) on Saturday April 05, 2008 @12:41PM (#22973540) Homepage Journal
    So which ISPs are doing this? What can we do to protect our selves? It sounds like it's "enabled" by a cookie placed there by your ISP or NebuAd? Would Adblock and/or PeerGuardian be enough? Implementing blocking at the home router level? What can home users actually do?

    It'd be nice at least to know who's actually participating in this so we could know who to avoid.
  • I'm as concerned about third parties snooping into things that aren't their damned business, but there's another concern here too: if this is actually going on, then we're all paying for it, too! We're footing the bill for the technology that's being used to snoop into every freakin' packet sent or received. That's complete bullshit; I'm paying for bandwidth, not for motherfuckers at Comcast (or wherever) looking at what I'm buying online, or personal communications I'm sending to friends, or whatever I'm d
  • Hrmmm... I never got the TOS/AUP for my ISP (then again it was just switched on me when Verizon sold it)

    gotta contact them, and say "Hey, what's the deal"
  • The Quick Fix (Score:3, Informative)

    by Nom du Keyboard ( 633989 ) on Saturday April 05, 2008 @01:50PM (#22973962)
    The quick fix to this is web-sites all allowing https, ssl, and vpn connections to them. That will end deep-packet inspection, leaving only a list of web-pages visited available. gMail already allows https, but you have to ask for it.

MESSAGE ACKNOWLEDGED -- The Pershing II missiles have been launched.