ISP Embarq Monitors User Traffic 106
Deli Korkmaz writes "The Washington Post reports that Sprint-Nextel spin-off Embarq, currently the US's fourth largest DSL provider, monitored Internet activity on some 26,000 customers in Kansas using deep-packet inspection technology NebuAd in order to deliver targeted advertising to users' desktops. CNet provides coverage as well. The House of Representatives Committee on Energy and Commerce is investigating whether any privacy laws were broken. Users were informed of this test and invited to opt out only via Embarq's online Privacy Policy; a mere 15 subscribers did so."
wow (Score:5, Funny)
Re:wow (Score:4, Funny)
Re: (Score:1)
Wouldn't that depend on what pr0n you were surfing in the first place?
Re: (Score:3, Informative)
Opt-out should be replaced by opt-in, always!
was it limited to inspection? (Score:5, Insightful)
was this deep packet "inspection", or did they actually alter traffic? Like modifying web pages to insert ads, or change IP addresses of banners?
Or something more hands-off like monitoring customer browsing and using it to deliver better targeted ads when the customer browsed their own web pages?
Re:was it limited to inspection? (Score:4, Informative)
Re:was it limited to inspection? (Score:5, Interesting)
How is this legal?
I thought warrantless wiretapping only covered law enforcement.
Re: (Score:2)
It's not so simple, obviously. The fact that in any given spot in the US you only have 2 or 3
Re:was it limited to inspection? (Score:5, Informative)
It was used to better target the advertisements on MyEmbarq.com and on the DNS redirection pages for server not found. If there was any more past that, then the general work force was not aware of it. No modifying of pages or redirecting others' advertisements.
This system would only work if you used Embarq's DNS servers.
Re:was it limited to inspection? (Score:5, Interesting)
If they are using the NebuAd services, it IS both deep packet inspection and inserting javascript in all pages.
The fact that it uses the information it gathers to give better targeted ads on your DNS redirection (a separate kind of internet breaking evil you should be ashamed of, BTW) is just gravy.
You as an employee have only received half the story, and it makes it sound a whole lot better that way.
Wikipedia's article on NebuAd will give you some of the real scoop, but it gets worse the more you find out about it..
http://en.wikipedia.org/wiki/NebuAd [wikipedia.org]
Re: (Score:2, Insightful)
From wikipedia, a quote allegedly from NebuAd's privacy policy:
The information we collect is stored and processed on NebuAd's servers in the United States. As a result, that information may be subject to access requests by governments, courts or law enforcement
So, the gov't doesn't need to do wiretapping without permission... NebuAd does it for them, with my ISP's permission. All that's needed is a subpoena.
NICE!
Re: (Score:2)
Re: (Score:2)
Out with those servers for my machines then....
Re:was it limited to inspection? (Score:4, Interesting)
Why aren't we encrypting everything already? (Score:5, Interesting)
If we can get web servers to support TLS (for multi-domain encryption on a single IP vs. SSL), and create a non-identity framework for encryption, we should just start encrypting everything end to end. ISPs are asking for it with these behaviors.
Re: (Score:3, Insightful)
Not sure if that'll work. Some internet companies apparently block all encrypted traffic. I'm thinking of Rogers Cable as my example (feel free to correct me though). I mean really it's their own business if they want to shaft their customers. Unfortunately most people either don't care that this sort of stuff is going on, or don't know of any other ISPs they can go to as alternatives.
Re: (Score:1, Troll)
Re:Why aren't we encrypting everything already? (Score:4, Informative)
You seem to be in favour of ISPs respecting their customer's privacy but then went on to mock an anonymous coward for opting to remain anonymous.
That doesn't make much sense to me.
Yes, you are wrong. Rogers Cable throttles encrypted traffic, but doesn't block it.
Re: (Score:2)
Any ISP who blocks SSL wont get very far.
Everything from Internet banking to eBay uses SSL.
Stuff that normal people notice.
Re: (Score:3, Insightful)
You just lost 99.9% of the intarweb using population.
Re:Why aren't we encrypting everything already? (Score:4, Insightful)
Just add a privacy light to browsers. "When that thing is on, your communications are between you and whoever you are communicating with, when it isn't on, anybody can see them". Then compare it to a postcard and a letter in an envelope.
Re: (Score:2)
OK, you made me look up http://en.wikipedia.org/wiki/Server_Name_Indication [wikipedia.org]
Now, it says Firefox and Apache have it implemented... what's the problem?
Re: (Score:2)
All versions of IE on XP do not support it. Nor does IE 6 on Vista.
That's at least 50% of web surfers right there.
Re: (Score:3, Interesting)
I believe this de
Re: (Score:1, Informative)
IP addresses are not useful as global identifiers of services: (i) their scope of validity is limited in time (DHCP, renumbering); (ii) their scope of validity is topologically limited (NAT, anycast); (iii) they may be shared resources (NAT, multiple web servers sharing one address); (iv) a address:resource correspondence that is valid may insuficiently describe that resource's reachablitity (same service, multiple addresses).
These are not theoretical problems; this is all stuff that is in the Internet now,
Only 15 people opted out... (Score:5, Insightful)
Re: (Score:2)
One reason that you can't consumers responsible is that you can hardly consider a "privacy policy" verifiable. They are all a sad joke foisted on the public so they feel secure. Nothing could be farther from the truth. Congress must prohibit all monitoring by the ISPs. But that's not going to happen, because we must think of the children, and protect the copyright monopolies from the taarrarists.
Re: (Score:1)
Congress must prohibit all monitoring by the ISPs
Yeah...more Gov't involvement, that's what we need! We can create a whole new bureaucracy to feed with 10's or 100's of millions of tax dollars! Which will bring more jobs!! Which is good, right!?!!
...or we can just let the free market sort it out. And if we personally care about it, then we can personally tell our friends who are using Embarq to complain, and threaten to discontinue their patronage, or we can even show them how to anonymize their browsing.
Re: (Score:1)
Yeah...more Gov't involvement, that's what we need!
I guess you haven't noticed the government is pushing for more monitoring, logging, and storage now. There's your bureaucracy at work. If they prohibit it, then we can take the ISPs to court. The government bureaucrats would actually lose their jobs. Of course they can't have that. Bureaucrats are more powerful than the president.
Re: (Score:2)
Congress must prohibit all monitoring by the ISPs.
But that would require them to act in the intrests of the people!!!!
Re:Only 15 people opted out... (Score:5, Insightful)
Or a really, really, really long scroll in a narrow, non resizeable window.
Re: (Score:1)
Re: (Score:1)
Yeah, long statement and in the last paragraph, second or third line the "opt-out" clause, where skim readers would probably miss it. I mean WTF, why is everything "opt-out" and not "opt-in"?
WTF!
Re: (Score:2)
Re: (Score:2)
They are not disclosing it to all users, that is not possible. They have only notified the customer not the user.
I don't pay for the Internet in this house so I won't be getting any notification that my privacy is being violated, and what if the bill payer is away? since it's opt out users on the home network would be violated until the bill payer returns and even then they may not get the letter or understand the ramifications involved.
What the United States need are some privacy laws (you apparently have
Re: (Score:2)
Douglas Adams put it this way
"But Mr Dent, the plans have been available in the local planning office for the last nine month."
"Oh yes, well as soon as I heard I went straight round to see them, yesterday afternoon. You hadn't exactly gone out of your way to call attention to them, had you? I mean, like actually telling anybody or anything."
"But the plans were on display ..."
"On display? I eventually had to go down to the cellar to find them."
"That's the display department."
"With a flashlight."
"Ah, well the
Re:Only 15 people opted out... (Score:5, Insightful)
Opt-out?
How is this not wiretapping? You're intercepting and monitoring the exchange of information between two entities, possibly even "bugging" at least one of them if you're also introducing cookies or similar devices.
Can the phone company introduce something into their privacy policy that all communications may be tapped without the request of law enforcement and have that be legally sound because I didn't "opt-out"?
Furthermore, even if the subscriber had the opportunity to opt-out, did the second entity? No they didn't. Therefore the privacy of at least one party has been unquestionably violated.
Opt-out... WTF?
Re:Only 15 people opted out... (Score:5, Funny)
It was apparently on display next to Arthur Dent's home demolition notice.
Re: (Score:1)
Re: (Score:1)
So, in other words, EMBARQ will disclose CPNI to anyone it feels like, as long as it's legal?
Re: (Score:1)
Sell your own private data? Sure, why not! (Score:5, Insightful)
Whenever you have to search long and hard to find new 'features', this can only mean one of several things:
Even more on-topic are these quotes from the Wiki article [wikipedia.org] (provided by spinkham above):
According to Nebuad's sales pitch less than 1% of users opt-out. One ISP expects to earn at least $2.50 per month for each user (..) Generally, NebuAd provides an additional income stream to network operators, which may maintain or lower consumers' internet access bills.
As we've all known for a long time, ordinary people's surfing habits are worth money. What when you'd ask people up front: "Do you want your surfing habits to remain private, or give up this privacy in exchange for a discount?"
I'm afraid the vast majority of people would go for the discount. The anything-connected-to-everything world of today has gotten us so used to data breaches and 'unknown parties' snooping through our private info, that we just don't seem to care anymore. Which seems strange: the less (privacy) you have left, wouldn't you value those last remains more than you used to?
Re: (Score:2)
Not only that, but the privacy policy was posted on the ISP's home page, and said change to the privacy policy wasn't announced. I don't know many people who visit their ISP's priva
Re: (Score:2)
about:blank is the best page ever to start with.
Sigh - I hate to suggest this... (Score:5, Insightful)
I think that very simply worded new legislation is required...
"Opt Out" is the new default for any new program, feature, change of any kind for any kind of product or service provider.
Any new programs or offerings will default the individuals to opt-out status, and require the user to notify the provider (without being hampered by phone calls, e-mails, etc) to opt-in.
Any company failing to comply with this policy shall have all of their assets liquidated and deposited into the bank account of the person(s) they elected to opt-in by default.
Re:EXACTLY (Score:5, Informative)
Please be careful with the terminology.
Opt-out means that you're in and you have to opt-out to stop your membership/subscription/whatever.
Opt-in is what you want: it's your choice to subscribe/join/whatever, and if you don't, there is no membership/subscription/whatever.
For example: The do-not-call list is an opt-out scheme. Unless you take action and put your name on the list, they're allowed to call you. Most newsletters are opt-in: You only receive the newsletter if you subscribe. Spam is neither opt-in nor opt-out: You get spam without doing anything. If you try to opt-out, you get more spam.
When did the world change? (Score:2)
Now, they secretly 'invite' you to not do something, like selling off your privacy, unless you sign up... or sign out, down, whatever... what does 'opt out' even mean anyway. Get off my lawn!
Re: (Score:2)
The world changed when Reagan gutted the education system and this country began a long, slow slide into ignorance.
Re: (Score:3, Informative)
Re: (Score:3, Funny)
That started when the education system was introduced.
Re: (Score:3, Interesting)
Re: (Score:2)
The current system is almost word for word exactly what Woodrow Wilson wanted the education system to become. I wouldn't blame Reagan for more than accelerating the process.
"We want one class to have a liberal education. We want another class, a very much larger class of necessity, to forego the privilege of a liberal education and fit themselves to perform specific difficult manual tasks."
-- Woodrow Wilson [wikiquote.org]
There we go...bringing class into it again... it makes life difficult for some when things aren't easily classified as "will be exploited" or "will exploit".
Hell, we're almost at the centennial anniversary of this plan.
Re: (Score:2)
I would like to see the context from which that quote was taken. It seems to me like something he would have said as a lead-in to a criticism of that point of view.
Re: (Score:2)
It is straight from an address of his to the New York City High School Teachers Association from january 9th 1909 (when he was the principal at Princeton). I infuriated my AP US History teacher no end by harping on those points back in the day when we read the speech, but to be fair i cannot remember enough to absolutely be sure of the context nor can i seem to find a copy of it. If you manage to get access to the Princeton copies of the Papers of Woodrow Wilson prior to his innauguration, check the jan 190
Re: (Score:1)
I think that very simply worded new legislation is required...
"Opt Out" is the new default for any new program, feature, change of any kind for any kind of product or service provider.
Any new programs or offerings will default the individuals to opt-out status
That is actually opt-in. Opt-out means that you are on the the list (in the program, etc) unless you opt-out.
Spam is opt-out. Opt-out is theft.
Re: (Score:2)
I was thinking along the lines of a radio button or toggle... two settings "Out" or "In" - with the label "Opt".
Default being "Out"...
Thanks for pointing out the definition of an "Opt-In" vs an "Opt-Out" - however, that wasn't quite what I was shooting for...
Semantics... /sigh
Deep packet inspection (Score:4, Funny)
I find the phrase 'deep packet inspection' interesting because it simultaneously describes the technique used and a large subset of the results acquired.
The majority of middle America is unaware (Score:1, Insightful)
Re: (Score:2, Insightful)
thats the brutal and unfortunate truth. Its not to say that everyone is unaware in areas where there is less exposure to different types of people, which you gain in major cities. For the most part, in large numbers, people will remain ingnorant and complacent until there is some form or ability to organize and invoke change.
I'm going to start randomly pasting this into comments on new stories, it's generic enough to work with almost every story and will probably soak up the insightful mod points.
Re: (Score:1)
Re:The majority of middle America is unaware (Score:5, Insightful)
I might go along with the Insightful were it not for the gratuitous (and most likely inaccurate) use of "middle America." There are a number of things wrong with this:
1) I can think of a lot of places in world (having lived there) where people are at least as technologically clueless as the average American. There is nothing special about Americans - either positive or negative - in that regard;
2) If you meant "middle" as in "middle class" you missed. The most technologically clueful income strata in America is most likely the middle class. One of the things that keeps the poor in poverty is lack of clue combined with means to acquire it; rich people, on the other hand, have middle class people who are paid to do all that stuff for them, and thus don't acquire clue about computers unless they are very interested in them or were once middle class;
3) If you meant "middle" as in "geographic center" it is still likely that you missed. Even in the Silicon Valley area, where I live, computer cluefulness remains largely the province or those who are in the industry or who are computer enthusiasts on their own. Everyone else is as clueless as they are everywhere else. Those who aren't clueless are, again, mostly in the middle class.
If you'd written that the majority of people (everywhere) are unaware, I might have spent one of my remaining mod points to mod you up. As it is, I was tempted to use to mod you troll, but decided to take the time to explain why I consider your post a troll instead.
Re: (Score:2)
When people say "middle America", they are talking about the average American. Average in skill set, or income, or number of kids, or whatever statistic is relevant to the discussion. Imagine a bell curve, start at the mean and grab maybe one and a half sigmas. Again, this is for whatever variable is relevant to the discussion (in this one, maybe computer skills, or political activism).
Yeah, it's a tortured term referring to imaginary peopl
Re: (Score:1)
And that's exactly what's wrong with the post I replied to. There is nothing special about middle Americans WRT computers and clue, or the lack of it. Thus, the use of "middle American" was a troll. And yes, I was insightful. Not only do I think so, a lot of others did, too.
You're a troll, too. HAND.
Tom Gerke (Score:5, Informative)
tom.gerke@embarq.com was the contact for the CEO back in March. I assume it is still legitimate...
Disclosure laws... (Score:5, Insightful)
We had this problem with the credit card industry before. People were signing up and had no clue what they were agreeing to because the most important terms weren't properly exposed. Then we got a law that made the current interest rate and the formula by which it is computer and how it may be changed in regulated-size type.
Time for a format for privacy policies to match that...
Actually a fairly high number of opt-outs (Score:5, Interesting)
Obviously there is no good way to do this experiment; but I'd be quite interested to see an estimate of the "expected baseline opt-out rate" for various sorts of disclosure, calculated by disclosing a ludicrously and absolutely unacceptable term or condition and seeing how many people opt-out. From that, you could then more accurately gauge the real level of unhappiness that a given opt-out percentage implies(For example, what percentage of people would opt-out if a term authorizing the CEO and the board to seize subscriber's assets at any time, for any reason, in any quantity appeared deep in the privacy policy? That value would, in effect, constitute the 100% opposition value.)
Or, we could just do the easier thing and make opt-in absolutely mandatory, perhaps with brutal mob justice for violators.(a man can dream, can't he?)
Re: (Score:1)
I bet people read privacy policies even less than EULAs, but hey.
It's clear they are abusing their customers.. (Score:3, Informative)
To me, it looks like unilaterally changing the terms of a lease, after the fact, to allow me to go into your apartment an install cameras on every room.
I'd be switching providers right about... now.
Re: (Score:1)
I agree, I don't see any difference between this and spyware. There is nothing "experimental" about this test except to find bugs in their advertising software. They should run the same kind of targeted advertising test using almost identical wording but this time default to opting out.
If it was a real experiment they would run it again using the same people, without modifying adverts, they would count the number of clicks on non-targeted adverts and targeted adverts and compare them.
My expectations are t
long past time for encryption by default (Score:3, Insightful)
Re:long past time for encryption by default (Score:5, Informative)
HTTPS presents a significant load on servers. It can easily demand 3 times the hardware and support to transfer a large, busy set of servers to HTTPS for all traffic. If it *didn't* present a noticeable load, it would be fairly useful as a normal encryption channel.
It's also awkward to proxy and manage the encryption securely, because HTTPS is very careful about checking hostnames and IP addresses to avoid people forging your site. This makes it more awkard for usrs, as their browsers complain about untrusted keys or the server owners have to invest in registering keys.
NebuAd's Website (Score:1)
NebuAd is quite nebulous (Score:1)
Television programs are specifically designed to reach a particular demographic so that the ad time can be sold for the highest price possible, with the premise being something like, "this thirty seconds at this time slot will give you the eyeballs of 1,500,000 males between 15-24." Then the ratings, the collection of which is automatic for Tivo users and cable subscribers, confirm to what extent the advertiser got that. (If not, they have to run the ad extra times until it does earn all eyeballs promised
Embar...? (Score:2)
Re: (Score:2)
Woosh?