Office of the Privacy Commissioner of Canada

Broadband providers increasingly use deep packet inspection technologies (DPI) that examine consumers’ online activities and communications in order to tailor advertisements to their unique tastes.[1] Although providers emphasize the market efficiencies that DPI provides, they have not adequately addressed the privacy concerns that it raises. Providers insist that because they discard consumers’ communications after analyzing them, any privacy concerns are illusory.[2] Nonetheless, privacy concerns remain despite these assurances because nothing prevents providers from simply altering their policies—in the U.S., the law does not restrict the secondary use of DPI data.[3] And the public has no means to oversee what broadband providers are actually doing because DPI operates invisibly.[4] In the future, network providers could collect our online communications and sell them, including medical data and private correspondence, to employers, insurance companies, credit bureaus, and landlords.[5] Broadband providers could morph into powerful data brokers of our online communications. But even if providers only retain DPI data and do not sell it, their databases are vulnerable to accidental leaks and theft.[6] These scenarios would be permissible and possible if broadband providers decide to retain such data.

Another concern is the government’s ability to subpoena the digital surveillance of a person’s online life from broadband providers. Consumers may deserve notice and an opportunity to be heard before the disclosure of such information to governmental actors, if courts construe the data as implicating an individual’s important property or liberty interests.[7] More generally, if DPI becomes a fact of life, informed consumers may curtail their online communications rather than risk its release to others. This would stunt our creativity and intellectual privacy, so critical to the development of our ideas and free speech.[8]

Network providers dismiss these concerns on the grounds that consumers can opt out of DPI tracking of their online life with a single click.[9] Optimism about a properly functioning marketplace, however, is misplaced. Network providers bury notice of their inspection practices in densely worded privacy policies and do not email users to note the change in policy.[10] Thus, a basic information asymmetry problem arises—consumers cannot reasonably be expected to know about, and protect themselves from, opaque practices. Even if consumers opt out of the creation of behavioral profiles for use in delivering ads, they may not be opting out of the copying of their traffic. And if some network providers switch to an opt-in approach or reject DPI entirely, consumers still cannot totally control the use of DPI technologies by those with whom they communicate, thus rendering consumer choice illusory.[11] As a result, privacy concerns may not be self-correcting and thus consumers can safeguard their privacy only through costly encryption practices.

Given the difficulties of opt-in and opt-out solutions, should law curtail the use of DPI? One solution may be to ban the use of DPI for commercial benefit. Alternatively, law could insist upon greater oversight over providers’ use of DPI. To that end, the Center for Democracy and Technology suggests a variety of ways to enhance the transparency and oversight over DPI practices, including instituting a “Do Not Track” list, requiring providers to disclose their data collection practices, establishing an Online Consumer Protection Advisory Committee, and providing remedies for abuses of DPI data.[12] These solutions would enable providers to continue to use DPI to combat spam, assist prosecutors who obtain warrants, and identify child porn traffickers, precisely the sort of “Good Samaritan” monitoring efforts that Section 230 of the Communications Decency Act[13] anticipates, without compromising consumers’ privacy.

The Privacy Implications of Deep Packet Inspection5.051

---

RSS Comment Feed 2 Comments

---

Tags: DPI, Inspection, Packet, Privacy

---

• Delicious
• Digg
• Twitter
• Reddit

---

Link to this:

---