All ISP’s have the ability to not only track everywhere their users browse, but can determine all the programs they use to connect to the internet, each open port on every system, each file downloaded, everything broadcast from each user, including each email sent, if a system is broadcasting a virus etc.
This is a privacy issue, but also a security issue though, not in the ways that most people think. If these abilities are used responsibly they could help make the internet safer, cleaner and better for all users. If used irresponsibly, everyone is at risk. The possible uses and abuses are unlimited.
From simple bandwidth monitoring and management to detailed packet inspection: what is being done? What should and should not be done?
Starting with a more basic though still controversial area, there is a lot of talk about bandwidth management: mostly negative. Here are just a few recent articles on Bell’s throttling:
The question really comes down to this: you pay to access the internet, should the ISP throttle your connection? Yes and No: they should be able to throttle bandwidth hogs allowing other users to continue to have a high speed connection. The most responsible way of handling this though, would be to sell different packages to people and charge them accordingly; only using throttling to enforce the package each user agreed to upon signing up. If you want a huge amount of bandwidth and the fastest connection possible without limitations on your downloads and uploads, you should be willing to pay a premium and get your own channel so your use does not affect other paying customers. This eliminates the need for bandwidth throttling, however, others would say it encourages file sharing/piracy. This is a completely different topic though and will not be discussed here.
In basic terminology: you should get what you pay for and you should be willing to pay more if you want more. ISP’s should only monitor bandwidth to determine the package each user should be on and then give the user the option to upgrade/downgrade if their use does not fit the package they purchased. If a user who passes their package quota decides not to upgrade, the ISP is protecting all users by limiting that account or charging for each overuse. Bandwidth monitoring and throttling is not a bad thing, it is a useful tool for ISP to protect the rights of all users. Each user signs an agreement when they connect. These agreements should include the right of the ISP to monitor bandwidth usage and throttle accounts if they are abused and to charge premiums for any overuse. This makes bandwidth monitoring and throttling a positive function.
The fact that an ISP can determine what browser, operating system, ftp and antivirus programs you use when you connect is a little more controversial, however most sites you browse to can do the same thing. If you are using an insecure outdated operating system or other program, this can be determined and you can be alerted. This is definitely a positive as it would keep your computer more secure, but it’s getting close to “big brother”. In the future, ISP’s may decide to block certain software as it is older, but what if your computer can’t handle the new software, or you cannot afford it, or a new computer? What if the decision is based on other things such as the almighty advertising dollar? Things are starting to look less positive…
Moving on to the ability of ISP’s to determine what your system is sending and receiving, and the responsibilities of ISP in this; how far should it go? Looking at this in a positive way, if an ISP determines a user’s computer is broadcasting a virus or being used as a “bot” in a “DOS” attack; they can and SHOULD block the access of that system until the owner has proven they cleaned it up. Looking at this in a negative way – anyone connected to the internet really has NO privacy at all due to this ability. Many people think email is private, but in reality, not only can an ISP read it, but anyone able to intercept it can read it. People need to think of emails as postcards: anyone who sees it can read it à UNLESS you use encryption. Logically, most employees will not bother to look, a job is more important than possibly finding something of value in the thousands of emails sent and received by an ISP’s users each day. Even if this ability is not used to snoop and pry at this time, it CAN be used that way. As programs and computers become more adept at collecting and sorting data, it is a very real possibility that all emails will be scanned for certain information. Different governments think this is their right to do. What if they give ISP’s the power to do it for them, or even force them to? Things are looking more negative, or are they? It depends on what they are looking for.
Now considering user downloads: should they be monitored at all? From the positive angle: yes, each download should be inspected for a virus and the ISPs server should have security in place to detect this and block the download from taking place. A warning popup for the user would also be a positive part of this function. Another positive: any time child porn is detected the info could be passed on to the authorities. This however is definitely going to have some complaints. Thinking about children: anything that protects a child is a good thing. What is necessary is the agreement a user signs with an ISP to include a waiver allowing the ISP to contact the authorities if it is determined that a user is sending or receiving child porn. The users’ privacy in all other matters should be maintained. It would be up to the police to then examine the actions of the suspect and determine if it is in fact the user or some infection that is doing this.
Looking at the ability to use “behavioral” tracking for advertising, such as the Phorm projects, this is definitely controversial to say the least. To class this as a negative is obvious, but how negative can this get? This sort of thing has been around since before the internet, but it is more “in your face” and more dangerous because of the internet.
The offline uses of “behavioral” tracking for advertising include the old direct mail, where if you bought something from one store/service they would then trade or sell your contact details to a related business. People would then get contacted by this other business trying to sell them something related to their previous purchase = Junk mail.
The same thing occurs online and people end up on spam lists. At its basic level “behavioral” tracking for advertising can be useful, but in most cases is an irritant.
When we compare the dangers of “behavioral” tracking for advertising on the internet, we see that even government agencies cannot track on the levels possible on the internet. This is one reason many governments are secretly pushing through laws that allow them to “monitor” the internet. This takes “behavioral” tracking for advertising to the extreme end of “big brother” - everything done on the internet can be inspected and if what you do not conform…?
Leaving government and conspiracies out of this, consider how “behavioral” tracking data can be used. Positive: you love to travel; you get more ads and specials and can compare the competition getting the best trip and best price. If you don’t drink you get no ads about alcohol, etc. Negative: you or a family member has an illness and you research it on the internet. This data could then be given or sold to insurance agencies resulting in your premiums increasing or even losing your policy. If you are having debt problems and look for debt consolidation information or a debt counselor, just think what would happen if the credit agencies get this information before you start to get things under control.
Where does this leave the ISP = I Spy and the issues of privacy, protection and security? Obviously the abilities are there, personal protections are limited, the abuses and uses are unlimited. Can ISP’s be trusted to create a balance? Can governments be trusted to create and enforce a balance? The obvious answer is No. Everyone must do what they can to protect themselves. Use anti-virus, anti-spyware, anti-malware, encryption and common sense. For protection against website tracking try a proxy service, for protection against both website and ISP tracking try a “tunneling” service. Protest any “behavioral” tracking, by canceling your account with your ISP if they start using it. Support privacy protection agencies and be sure everyone you know does the same. People have always had the power to affect changes, even more so now with the internet. There are no longer any borders that can stop communication. We can see the world and each other without governments or big corporations telling us their versions of everything. These groups only have power because of the ignorance they promote. They get power from regular people. It is time that all people recognize this and take back that power and demand these groups start to behave. Money talks; take yours to responsible companies who realize you are not just a cow to be milked, but a person who pays their salary and deserves privacy and respect.
