The Rise and Fall of Invasive Isp Surveillance Paul
Total Page:16
File Type:pdf, Size:1020Kb
VER. 1.1:: 8/27/2008 ISP SURVEILLANCE 1 THE RISE AND FALL OF INVASIVE ISP SURVEILLANCE * PAUL OHM ABSTRACT Nothing in society poses as grave a threat to privacy as the Internet Service Provider (ISP). ISPs carry their users’ conversations, secrets, relationships, acts, and omissions. Until the very recent past, they had left most of these alone because they had lacked the tools to spy invasively, but with recent advances in eavesdropping technology, they can now spy on people in unprecedented ways. Meanwhile, advertisers and copyright owners have been tempting them to put their users’ secrets up for sale, and judging from a recent flurry of reports, ISPs are giving in to the temptation and experimenting with new forms of spying. This is only the leading edge of a coming storm of unprecedented and invasive ISP surveillance. This Article proposes an innovative new theory of communications privacy to help policymakers strike the proper balance between user privacy and ISP need. We cannot simply ban aggressive monitoring, because ISPs have legitimate reasons for scrutinizing communications on an Internet teeming with threats. Using this new theory, policymakers will be able to distinguish between an ISP’s legitimate needs and mere desires. In addition, this Article injects privacy into the network neutrality debate—a debate about who gets to control innovation on the Internet. Despite the thousands of pages that have already been written about the topic, nobody has recognized that we already enjoy mandatory network neutrality in the form of expansive wiretapping laws. The recognition of this idea will flip the status quo and reinvigorate a stagnant debate by introducing privacy and personal autonomy into a discussion that has only ever been about economics and innovation. * Associate Professor of Law and Telecommunications, University of Colorado Law School. Thanks to Orin Kerr, Peter Swire, and Phil Weiser for comments. Early versions of this paper were presented to the Privacy Law Scholars 2008 Conference and the Computers, Freedom, and Privacy ’08 conference. I thank all of the participants and my colleagues for their comments, and in particular Brad Bernthal; Aaron Burstein; Bruce Boyden; John Chapin; Samir Chopra; Danielle Citron; Will DeVries; Susan Friewald; Jon Garfunkel; Dale Hatfield; Stephen Henderson; Chris Hoofnagle; Derek Kiernan-Johnson; Scott Moss, Deirdre Mulligan; Frank Pasquale; Wendy Seltzer; Sherwin Siy; Gerard Stegmaier; and Tal Zarsky. Electronic copy available at: http://ssrn.com/abstract=1261344 VER. 1.1:: 8/27/2008 ISP SURVEILLANCE 2 ABSTRACT..............................................................................................................1 INTRODUCTION ...................................................................................................2 I. PRIVACY ONLINE AND HOW IT IS LOST...................................................5 A. A BRIEF HISTORY OF INTERNET SURVEILLANCE...............................................5 B. CHANGES.........................................................................................................11 C. THE THREAT TO PRIVACY ...............................................................................22 II. TOWARDS A NEW THEORY OF COMMUNICATIONS PRIVACY......32 A. ABANDONING THE ENVELOPE ANALOGY ........................................................32 B. CONTEXTUAL INTEGRITY ................................................................................34 C. A CALL FOR MORE SEARCHING, SKEPTICAL BALANCING ...............................35 D. THE THEORY ...................................................................................................38 III. REGULATING NETWORK MONITORING.............................................38 A. ANONYMIZATION AND AGGREGATION ARE USUALLY NOT ENOUGH ..............39 B. REASONABLE NETWORK MANAGEMENT.........................................................43 C. RETHINKING CONSENT ....................................................................................57 IV. THE LAW........................................................................................................59 A. THE LAW OF NETWORK MONITORING.............................................................60 B. AMENDING THE LAW.......................................................................................69 V. WHEN NET NEUTRALITY MET PRIVACY..............................................71 A. FLIPPING THE STATUS QUO...............................................................................72 B. BUT IS THIS REALLY NET NEUTRALITY?........................................................72 C. RESITUATING THE NET NEUTRALITY DEBATE.................................................74 CONCLUSION ......................................................................................................76 INTRODUCTION Internet Service Providers (ISPs)1 have the power to obliterate privacy online. Everything we say, hear, read, and do on the Internet passes first through their computers. If ISPs wanted, they could store it all, compiling a perfect transcript of our online lives. New threats to privacy on the Internet do not want for academic attention. Scholars have discussed the threat to privacy from Google,2 data 1 This Article defines Internet Service Providers (ISPs) as the telecommunications companies that route communications to and from Internet-connected computers. The best-known ISPs are the cable companies that connect users through cable modems, such as Comcast, Cox, and Charter, and the telephone companies that connect users through digital subscriber line or DSL connections, such as Verizon, AT&T, and Qwest. In addition, mobile carriers such as Verizon Wireless, Sprint Nextel, and AT&T Wireless are increasingly important ISPs. Lesser known ISPs serve institutional customers, providing Internet connectivity to companies, universities, and other ISPs. For a more detailed description of the various types of ISPs, see Part III.B.2.b. 2 James Grimmelmann, The Structure of Search Engine Law, 93 IOWA L. REV. 1, 17-23, 39- 41, 56-58 (2007). Electronic copy available at: http://ssrn.com/abstract=1261344 VER. 1.1:: 8/27/2008 ISP SURVEILLANCE 3 aggregators,3 hackers,4 spyware authors,5 identity thieves,6 and the government,7 but they have said nothing about the threat from ISPs. In contrast, regulators and legislators have focused with great interest on ISP monitoring,8 and the media has covered the topic extensively.9 This Article fills a conspicuous void in legal scholarship, providing a complete accounting of the potential threat to privacy from ISP monitoring. A potential threat to privacy, however, is not the same thing as a likely invasion, and this Article provides the tools for distinguishing one from the other. In this case, the evidence points in opposite directions: on the one hand, ISPs have a track record for respecting user privacy. On the other hand, technological hurdles that have prevented providers from monitoring invasively have recently fallen. To resolve this contradiction, Part I, which is both descriptive and predictive, explores the history, evolution, and nature of ISP surveillance. Online wiretapping used to be easy, then it became difficult, and today it is easy again. This Article quantifies this conclusion, importing data and methodologies from computer hardware engineering that have never before appeared in legal scholarship. As technological barriers have fallen, spurring the disintegration of user privacy, markets and norms have done nothing to halt the trend. The market has placed extraordinary pressures on ISPs to find new sources of revenue. Advertisers and copyright owners have risen to meet this need, offering ISPs great sums in return for their users’ secrets. The norms and ethics of network monitoring are full of gray areas and differences of opinion, so ISPs face little fear of social sanction from their engineering peers. Given this confluence of technological, economic, and ethical forces, this Article forecasts a coming storm of unprecedented, invasive ISP monitoring. Specifically, ISPs will embrace the use of what are known as deep-packet inspection (DPI) tools; their use of these tools will lead to the greatest reduction of user privacy in the history of the Internet, and users will suffer dire harms. Part I concludes that ISP monitoring must be regulated. 3 DANIEL J. SOLOVE, THE DIGITAL PERSON: TECHNOLOGY AND PRIVACY IN THE INFORMATION AGE passim (2003) [hereinafter SOLOVE, DIGITAL PERSON]. 4 BRUCE SCHNEIER, SECRETS AND LIES: DIGITAL SECURITY IN A NETWORKED WORLD (2004). 5 Paul M. Schwartz, Privacy Inalienability and the Regulation of Spyware, 20 BERK. TECH. L.J. 1269 (2005). 6 Daniel J. Solove, Identity Theft, Privacy, and the Architecture of Vulnerability, 54 HASTINGS L.J. 1227 (2003). 7 Orin S. Kerr, Internet Surveillance After the USA PATRIOT Act: The Big Brother that Isn’t, 97 N.W.U.L. REV. 607 (2003). 8 See Part I.B.3 (describing four conflicts surrounding ISP monitoring and government responses to each). 9 E.g., Ellen Nakashima, Some Web Firms Say they Track User Behavior Without Explicit Consent, WASH. POST, Aug. 12, 2008 at D1; Stephanie Clifford, Web Privacy on the Radar in Congress, N.Y. TIMES, Aug. 10, 2008; Peter Kaplan, FCC Orders Comcast to Modify Network Management, WASH. POST, Aug 1, 2008; Saul Hansell, I.S.P. Tracking: The Mother of all Privacy Battles, N.Y. TIMES, March 20, 2008. VER. 1.1:: 8/27/2008 ISP SURVEILLANCE 4 In a search for the proper shape of this regulation, Part