Tuesday, March 31, 2009

EU may take action on Deep Packet Inspection Technologies

At last the European Union is investigate so-called "deep packet inspection" technologies (as provided by the likes of Phorm) on the grounds that consumer profiling by online advertising companies based on the technology will breach consumer's "basic rights in terms of transparency, control and risk", writes Martyn Warwick.

There is growing unease over deep packet inspection (or "deep and secret
snooping into an individual's web browsing habits" as it should more properly be called) mainly because the technology can continue to track and record web activity by an individual subscriber even after cookies have been disabled.

The idea behind deep packet inspection system such as that from Phorm is that by tracking a web users browsing proclivities advertisers can send closely targeted ads to individuals based on their particular Internet histories and preferences. In other words, it's all about making more money.

In the UK, BT has controversially trialed the Phorm technology and Virgin Media and Talk Talk believed to be considering doing the same.
ISP's across the rest of the European Union and elsewhere have also evinced considerable enthusiasm for the technology but many users have complained about the sneaky intrusiveness of systems like Phorm's.

The growing groundswell of concern has had little effect on the UK's Labour administration and the government has declined to mount any serious investigation into the implications of deep packet inspection and its possible compromising of an individual's right to privacy.

However, Meglena Kuneva, the EU's Commissioner of Consumer Affairs and
Protection is in the vanguard of European resistance to the spread of deep packet inspection. She is Bulgarian by birth (June 1957) and having lived there when it was a communist state knows a thing or two about an imposed and institutionalised lack of privacy. Ms Kuneva says that the small print of the interminable and usually indecipherable "Terms and Conditions" that web users routinely (have to) accept to surf commercial websites are often in direct contravention of privacy legislation.

She says that the vast majority of Europeans have no idea what personal data is being collected, how it is being collected, how safely it is being stored, who has access to it and how it is used for commercial purposes. They are also unaware that, as things presently stand, even when individuals believe they have opted out of deep packet inspection, the myriad of technological (and invisible) hurdles placed in front of them means that may well have not actually done so.

Later on this week Ms. Kuneva will give a presentation outlining the EU's intent to gather evidence from both users and the broadband industry on exactly what information is being collected and manipulated by ISPs and advertisers.

The intent is to determine whether or not new regulations and controls are necessary. There can be little doubt about that.

In her upcoming speech Ms. Kuneva will say, “Consumers are in fact paying for services with their personal data and their exposure to advertising. This amounts to a new kind of commercial exchange. We need to investigate this quickly, we cannot afford foot-dragging. If we fail to see an adequate response to consumers’ concerns on the issue of data collection and profiling, we will not shy away from our duties.”

The news of the potential regulation of deep packet inspection comes after the European Commission (EC) sent a third letter to the British government demanding to know the details of and legal justification for the secret trials of the Phorm system that were carried out by BT.

Experts in Internet law at the Foundation for Information Policy Research, an independent think tank based at Cambridge University, have long said that Phorm and the incumbent UK telco were in breach of the European Privacy and Electronic Communications Regulations as well as national laws.
BT though maintains it took legal advice prior to running the trials secretly and without informing individual subscribers that their web-browsing habits were being spied upon. However, despite many requests the carrier has declined to make public the legal advice it says it obtained.

Meanwhile, the UK government has stated publicly that any future deployments of deep packet inspection technologies "would be legal", but has refused several requests made under the aegis of the Freedom of Information Act to release the full text of its response to the EC.

It seems likely though that things are now on the move. When the national governments of individual Member States of the European Union do not implement implement European law, the EC has full recourse to the independent European Court of Justice in Luxembourg.

It now seems more likely than ever that Deep Packet Inspection could find itself in the dock there and fighting for its parasitic life in the months to come.

No comments:

Post a Comment