Free Press Testifies on Dangers of Deep Packet Inspection

Free Press Policy Director Ben Scott will testify
before Congress today about the dangers of "deep packet inspection," a
technology that allows Internet service providers to spy on and control
online content.

At a hearing before the House Subcommittee on Communications,
Technology, and the Internet, Scott will quote the selling points used
by deep packet inspection manufacturers to underscore the chilling,
anti-competitive effect this technology can have on an open Internet.

A live webcast of the hearing will be available at www.energycommerce.house.gov

The 10 a.m. hearing, titled "Communications Networks and Consumer
Privacy: Recent Developments," will focus on technologies that network
operators utilize to monitor consumer usage on broadband and wireless
networks. While much of the hearing will focus on the privacy
implications of these technologies, Scott will discuss them within the
context of the Net Neutrality debate.

Prepared testimony of Ben Scott, policy director of Free Press

Chairman Boucher, Ranking Member Stearns, and members of the
subcommittee, I thank you for the opportunity to testify today. I will
focus my testimony this morning on deep packet inspection technology,
or DPI.

You have already heard about the uses of DPI for the collection of
personal information about Internet users for advertising. But I'd like
to focus on other uses of DPI technology. Because any time a network
monitors Internet traffic, we have a potential privacy problem. That
harm is compounded by DPI tools that violate Network Neutrality with
anti-competitive practices.

Let me offer some context. Three years ago, we had a robust debate
over the necessity of Net Neutrality and privacy rules to protect
consumers. That debate turned on whether the harms were hypothetical.
Indeed, the technology did not exist in 2006 that would permit
wide-scale violations of either.

Today those technologies do exist. They are deep packet inspection
devices, and they are now widely deployed. Worse still, an entire
industry has emerged that markets DPI explicitly to monitor and control
consumer behavior. All a network owner has to do is flip the switch.

DPI use will have a broad impact on the Internet. Without this
technology, everything you do online is sent through the network
anonymously. E-mail, sports scores, family photos -- the network
doesn't know or care what you're doing. Online anonymity also has the
virtue of nondiscrimination.

But with DPI, it's a whole new ballgame. This technology can track
every online click. Once a network owner can see what you are doing,
they have the power to manipulate your online experience. They can sell
your personal information to advertisers. They can block content. They
can slow things down or speed things up.

There is no better way to describe what DPI can do than to quote
from the manufacturers' marketing materials. Their selling points are
exactly the uses that trouble me the most. Let me offer these examples:

Zeugma Systems describes its technology as a way for network owners
to "see, manage and monetize individual flows to individual
subscribers."

A company called Allot promises that their equipment empowers ISPs
"to meter and control individual use of applications and services" --
including to help network owners "reduce the performance of
applications with negative influence on revenues (such as competitive
VoIP services)."

Now, that sounds blatantly anti-competitive to me.

Procera Networks went so far as to publish a brochure with the title "If You Can See It, You Can Monetize It."

This is chilling stuff. And there are more than a dozen of these
companies. They sell products marketed to help ISPs make more money by
spying on consumers and controlling how they use the Internet.

Let me be clear: the technology itself is not necessarily
problematic. However, in the past year, deep packet inspection has
evolved from basically innocuous to downright insidious. DPI was
created as a network security tool. But it has become a mechanism of
precise surveillance and content control.

We have already begun to see incidents of bad behavior. This
subcommittee has had hearings on Comcast and NebuAd, which both used
DPI in secret, questionable ways. Today, Cox Communications is using
DPI to speed up some applications and slow others.

These types of practices may have short-term traffic management
benefits. But the trade-off is the unprecedented step of putting the
network owner in control of consumers' online options. After this first
step, it is a slippery slope.

We could soon see every major ISP in the country adopt a different
traffic control regime. Without oversight, this could easily balkanize
the Internet so that applications that work on a network in Virginia
may not work in Kansas or Florida.

The critical question is how best to protect consumers from these kinds of harms.

Let me offer an analogy. Think of these DPI technologies as similar
to complex financial instruments like credit-default swaps. Properly
regulated, they can be used as a constructive part of our banking
system. Without oversight, they can run amok and severely harm
consumers. What we need are bright line rules of consumer protection.

The negative implications for privacy and Network Neutrality are already clear.

But the new uses of deep packet inspection may also reduce
incentives for infrastructure investment. Installing DPI offers a
tempting alternative to building a robust network. At a fraction of the
cost, DPI can discourage users from high-bandwidth applications or
charge higher fees for priority access.

Before these technologies become firmly entrenched, we encourage
Congress to open a broad inquiry to determine what is in the best
interest of consumers. Once DPI devices are activated across the
Internet, it will be very difficult to reverse course.

The full written testimony is available at https://www.freepress.net/files/FP_DPI_House_testimony.pdf