Surveillance technologies and ISP’s
I worked for an ISP as a webmaster about 20 years ago. So my knowledge is very dated.
With the FCC abolishing the rules put in place by Tom Wheeler, I’m asking many questions about how they actually conduct the data collection that I think they would need in order to provide the information to buyers.
This article is a gedanken experiment, and I’m not sure that I’m at all correct here. So I honestly am looking for feedback from anyone with thoughts and/or corrections about this.
Here it is:
The FCC is turning the clock back a year. But it’s turning it back in favor of these businesses being more invasive over time. Part of what Pai passed says that the FCC can never propose rules like this in the future! So, even if things get more invasive, the FCC won’t be able to stop it.
ISP’s don’t have to make more profit from our information. We pay them for a service, and they can pay their bills and return a profit to their shareholders. While technology MUST require collection of information, and business policy MAY demand historical storage of that information, the most interesting part of rules about this class of data is that if you don’t store it, you can’t give it to the government when they ask for it. Now that’s going to bat for customer privacy.
There’s a great youtube video about this — it is from 2012, so its a bit dated, but you can get a gist of the complexity of the competing interests here:
Here’s the complexity that I think about when I venture into these areas in my head.
ISP’s authorize your modem for network access, and then transit packets from your network to the internet backbone. At the end of the day, that’s all they do. What information MUST they have and store to do this?
They have some identification of the modem that you have in place and an authorization mechanism for it.
They use a DHCP server to lease you an address.
Their router (and perhaps switches) store routing table information from your modem’s MAC to the internet.
So how do they get my web requests, when all they see is the packet header information?
Here’s what they need if they want to see my full http requests:
Some kind of deep packet inspection firewall device or a VERY large and fast proxy server.
A proxy server is a simpler choice, because it can fill two jobs:
1) Store you’re your actual http requests
2) Allow the reconstruction of the clicks you took at a website.
The limitation here is HTTPS, since most sites are moving to https by default, this makes a proxy server harder to use. Heck from what I understand even Deep Packet Inspection can’t see https. You only get to reconstruct that if you are the NSA.
So under the right circumstances, they have the data and now they need to store it. Many ISPs say they store this information for up to 7 years. AT&T seems to indicate that they store it indefinitely. I can’t even imagine how much data this is, but its vast.
This is just the beginning of the process — the gathering of the information — some of which is necessary for operations. The rest is icing. The only reason to do it is if it’s so valuable to their buyers that it is easy to afford having the technology and a team in place to manage it.