CENTER FOR DEMOCRACY & TECHNOLOGY Statement of Alissa Cooper Chief Computer Scientist, Center for Democracy & Technology Before the House Committee on Energy and Commerce, Subcommittee on Telecommunications and the Internet " What Your Broadband Provider Knows About Your Web Use: Deep Packet Inspection and Communications Laws and Policies" July 17, 2008 ! I. Summary !"#$%&#'()#%*+,(#'-()+&.+%/(01(2"+(34.50&&$22++6( 7'(.+"#81(01(2"+(!+'2+%(10%(9+&05%#5,(:(;+5"'080<,(=!9;>?(@(2"#'*(,04(10%(2"+( 0AA0%24'$2,( 20( 2+/2$1,( 20-#,B( C+( #AA8#4-( 2"+( 34.50&&$22++D/( 8+#-+%/"$A( #'-( 10%+/$<"2( $'( +E#&$'$'<( 2"+( +&+%<$'<( A08$5,( #'-( 8+<#8( $&A8$5#2$0'/( 01( 2"+( 2+5"'$F4+(*'0G'(#/(H-++A(A#5*+2($'/A+52$0'BI( J%+/+%K$'<(2"+(@'2+%'+2(#/(#(2%4/2+-(0A+'(A8#210%&(10%(/A++5"(#'-($''0K#2$0'?( G$2"042(<#2+*++A+%/(0%(5+'2%#8(50'2%08?("#/(.++'(#(-+1$'$'<($//4+(10%(!9;(/$'5+( $2/( $'5+A2$0'B( ;"+( @'2+%'+2( G#/( .4$82( #%04'-( 2"+( H+'-L20L+'-I( A%$'5$A8+6( 2"+( '02$0'( 2"#2( #AA8$5#2$0'/( #%+( .+22+%( 8+12( 20( .+( $&A8+&+'2+-( #2( 2"+( @'2+%'+2D/( +'-A0$'2/( %#2"+%( 2"#'( $2/( 50%+?( 8+#K$'<( 2"+( '+2G0%*( $2/+81( 4'1+22+%+-( .,( #',( A#%2$548#%( A#%2,D/( $'2+%+/2/BM( J4%/4#'2( 20( 2"$/( +'-L20L+'-( -+/$<'?( -#2#( "#/( 2%#-$2$0'#88,( 2%#K+%/+-( 2"+( @'2+%'+2( G$2"042( $'2+%1+%+'5+( 1%0&( $'2+%&+-$#%$+/B( N+<$/8#2$K+( #'-( 8+<#8( -+5$/$0'/( A%02+52$'<( @'2+%'+2( /+%K$5+( A%0K$-+%/( 1%0&( $'2+%&+-$#%,(8$#.$8$2,(=!"#"?(8$#.$8$2,(10%(50'2+'2(2"#2(0%$<$'#2+/(G$2"(4/+%/>("#K+( .++'(104'-+-(0'(2"+(A%$'5$A8+(2"#2(2"+('+2G0%*(0A+%#20%($/('02(&#'$A48#2$'<(2"+( 50'2+'2(2"#2(A#//+/(2"%04<"($2/('+2G0%*B(O0%(-+5#-+/?(#-"+%+'5+(20(2"+(+'-L20L +'-( A%$'5$A8+( "#/( A%+/+%K+-( 2"+( @'2+%'+2( #/( #( 2%4/2+-( A8#210%&( #'-( "#/( /4AA0%2+-( #/204'-$'<( 8+K+8/( 01( $''0K#2$0'?( +50'0&$5( #52$K$2,?( #'-( $'-$K$-4#8( +EA%+//$0'B(( (((((((((((((((((((((((((((((((((((((((((((((((((((((((( 1 J.H. Saltzer, D.P. Reed & D.D. Clark, End-to-End Arguments in System Design, 2 ACM Transactions on Computer Sys. 277 (1984). 1634 I St., NW, Suite 1100, Washington, DC 20006 • v. +1.202.637.9800. • f. +1.202.637.0968 • http://www.cdt.org CENTER FOR DEMOCRACY & TECHNOLOGY @'(%+5+'2(,+#%/?("0G+K+%?(&#//$K+(<%0G2"($'(-#2#(A%05+//$'<(A0G+%("#/(/A4%%+-( 2"+( -+K+80A&+'2( 01( '+G( H-++A( A#5*+2( $'/A+52$0'I( =9J@>( +F4$A&+'2( 2"#2( A02+'2$#88,(#880G/(@3J/(#'-(02"+%($'2+%&+-$#%$+/(20(5088+52(#'-(#'#8,P+(#88(01(2"+( @'2+%'+2( 2%#'/&$//$0'/( 01( &$88$0'/( 01( 4/+%/( /$&482#'+04/8,B( ;"+( 4/+( 01( 9J@( 2+5"'080<,?( 2"04<"( /2$88( $'( /0&+G"#2( 8$&$2+-( -+A80,&+'2?( %#$/+/( /+%$04/( F4+/2$0'/(#.042(2"+(1424%+(01(2%4/2?(0A+''+//?(#'-($''0K#2$0'(0'8$'+BQ(( ;"+(482$&#2+($&A8$5#2$0'/(01(9J@(-+A+'-(8#%<+8,(0'(.02"("0G($2($/($&A8+&+'2+-( #'-(2"+(A4%A0/+/(10%(G"$5"($2($/(4/+-B(9J@(#AA8$5#2$0'/(%#'<+(1%0&(&#'#<$'<( '+2G0%*( 50'<+/2$0'( 20( -+2+52$'<( '+2G0%*( 2"%+#2/( 20( &0'+2$P$'<( $'-$K$-4#8( @'2+%'+2(-#2#(/2%+#&/(2"%04<"(2#%<+2+-(#-K+%2$/$'<B(30&+(01(2"+/+(#AA8$5#2$0'/( #%+( 8$*+8,( 4'0.R+52$0'#.8+?( G"$8+( 02"+%/( %#$/+( 1#%L%#'<$'<( A08$5,( #'-( 8+<#8( F4+/2$0'/(#11+52$'<(+K+%,2"$'<(1%0&(A%$K#5,(#'-($'2+88+524#8(A%0A+%2,(%$<"2/(20( 1%++-0&(01(+EA%+//$0'(#'-(@'2+%'+2($''0K#2$0'B(S82"04<"(!9;(K$+G/(#88(01(2"+/+( #/( 50%+( @'2+%'+2( A08$5,( $//4+/?T( &,( 2+/2$&0',( 20-#,( G$88( 1054/( 0'( 2"+( A%$K#5,( $&A8$5#2$0'/(01(9J@?(#/('+#%8,(+K+%,(50'2+E2($'(G"$5"(9J@(&#,(.+( 4/+-(%#$/+/( /4./2#'2$#8(A%$K#5,(50'5+%'/B( @'(A#%2(.+5#4/+(01(2"+(@'2+%'+2D/("$/20%,(01(-+5+'2%#8$P+-(50'2%08(#'-(4'1+22+%+-( 50&&4'$5#2$0'/?( 50'/4&+%/( #%+( '02( #554/20&+-( 20( "#K$'<( 2"+$%( @'2+%'+2( 2%#'/&$//$0'/($'2+%5+A2+-(0%(#'#8,P+-(+'(%042+(.,(#'($'2+%&+-$#%,B(9+A+'-$'<( 0'("0G(2"+,(#%+(-+A80,+-?(9J@(/,/2+&/(5#'(-+1,(2"$/(+EA+52#2$0'?(2"%+#2+'$'<( 2"+(.#/$/(10%(50'/4&+%(2%4/2(0'8$'+B(!+%2#$'(#/A+52/(01(9J@(#%+(#8/0(#2(0--/(G$2"( G+88( #55+A2+-( H1#$%( $'10%&#2$0'( A%#52$5+/?I( 5#'( .+( -$/%4A2$K+( 20( @'2+%'+2( #'-( C+.(14'52$0'#8$2,?(#'-(&#,(%4'(#1048(01(50&&4'$5#2$0'/(A%$K#5,(8#G/B(( ;"0/+(G"0(4/+(9J@(10%(2"+(A4%A0/+(01(2%#5*$'<(50'/4&+%/D(0'8$'+(#52$K$2$+/(20( /+%K+(2#%<+2+-(#-K+%2$/+&+'2/(/2%+//(2"+(#'0',&04/(#'-(8$&$2+-('#24%+(01(2"+( A%01$8+/(2"+,(50&A$8+B(U0G+K+%?(2"+(&#$'(1054/(01(04%(A%$K#5,(50'5+%'(G$2"(2"$/( (((((((((((((((((((((((((((((((((((((((((((((((((((((((( 2 Packet inspection or data analysis that a user conducts on his or her own data stream is a different matter and does not raise the same questions. There are many reasons why a user may want to conduct such analysis, and the ability to do so empowers users to better understand their own Internet service plans. This testimony focuses exclusively on packet inspection and analysis by intermediaries at the middle of the network rather than at the endpoints. 3 CDT has a long history of opposing government mandates that require ISPs to filter content at the middle of the network, which is certainly one potential use of DPI. See, e.g., CDT, Summary and Highlights of the Philadelphia District Court’s Decision in Center for Democracy & Technology v. Pappert (Case No. 03-5051 (E.D. Pa. Sept. 10 2004) (Sept. 15, 2004), http://www.cdt.org/speech/pennwebblock/20040915highlights.pdf. CDT has also been an active participant in policy debates surrounding Internet neutrality and network congestion management, both of which potentially implicate DPI as a tool that can be used to distinguish certain Internet data streams from others. We have called for focused Internet neutrality legislation that, if enacted, would likely have the effect of restricting certain uses of DPI that facilitate discrimination between Internet data streams. See CDT, PRESERVING THE ESSENTIAL INTERNET (2006), http://cdt.org/speech/20060620neutrality.pdf. More recently, we recommended to the Federal Communications Commission that ISPs’ endeavors to manage congestion on their networks – which may include the use of DPI – be transparent, evenly applied to all services and applications, and consistent with core internetworking standards. See Comments of CDT, In the Matter of Broadband Industry Practices, WC Docket No. 07-52 (Feb. 13, 2008), http://cdt.org/speech/20080213_FCC_comments.pdf. 2( CENTER FOR DEMOCRACY & TECHNOLOGY &0-+8(#/($2(+E$/2/(20-#,($/('02(0'(2"+(A%01$8+/(2"+&/+8K+/(.42(%#2"+%(0'(G"#2($/( %+F4$%+-( 20( 50&A$8+( 2"0/+( A%01$8+/?( '#&+8,( 2"+( -$K+%/$0'( 0%( 50A,$'<( 01( /4./2#'2$#88,(#88(01(2"+(C+.(2%#11$5(01(#88(/4./5%$.+%/B(;"+(1#52(2"#2(#/(01('0G(2"+( #-K+%2$/$'<('+2G0%*/(4/+(0'8,(#(/&#88(A0%2$0'(01(G"#2($/(5#A24%+-(#'-(-0('02( /20%+(02"+%($'10%&#2$0'(-0+/('02(-$&$'$/"(2"+($'2%4/$K+'+//(01(2"+($'$2$#8(-#2#( 5#A24%+B(C+(#%+(50'5+%'+-(G$2"(2"+($'2+%5+A2$0'(#'-(#'#8,/$/(01(-#2#($'(2%#'/$2( 10%(A4%A0/+/("#K$'<('02"$'<(20(-0(G$2"(2"+(-+8$K+%,(01(2"#2(-#2#(0%(2"+(/+54%$2,( 0%($'2+<%$2,(01(2"+(@'2+%'+2(/+%K$5+B()0%+0K+%?(#/(2"+(+E$/2$'<(&0-+8/(#%+('0G( 50'1$<4%+-?( '0( 0'+( 5#'( 0A2L042( 01( 2"#2( -$K+%/$0'( 0%( 50A,$'<( 01( 2"+$%( @'2+%'+2( 2%#11$5V(+E$/2$'<( 0A2L042/(&+%+8,(-$/50'2$'4+(2"+(5%+#2$0'(01(.+"#K$0%#8(A%01$8+/( 10%(4/+($'(-+8$K+%$'<(#-/B( 9J@(/,/2+&/(/"048-('02(.+(K$+G+-($'($/08#2$0'B((;"+,(#%+(.+$'<(-+A80,+-(G$2"$'( 2"+(50'2+E2(01(#'(0'8$'+(+'K$%0'&+'2(G"+%+(&0%+(-#2#($/(.+$'<(5088+52+-(W(#'-( %+2#$'+-(10%(80'<+%(A+%$0-/(W(2"#'(+K+%(.+10%+B(X+2(04%('#2$0'(/2$88("#/('0(.#/$5( 50'/4&+%(A%$K#5,(8#G(#'-(+E$/2$'<(/+520%#8(A%$K#5,(A%02+52$0'/("#K+(.++'(1#%( 042A#5+-(.,(2+5"'080<$5#8($''0K#2$0'B(( Y+5+'28,?( 2"+( O;!( "#/( .+<4'( 5%#12$'<( /+81L%+<48#20%,( A%$'5$A8+/( 10%( A%$K#5,( A%02+52$0'($'(0'8$'+(#-K+%2$/$'<BZ(C+(#AA8#4-(2"+(O;!(10%(2#*$'<(2"$/(/2+A?(.42( 2"+(A%$'5$A8+/(-0('02(#--%+//(9J@?[(#'-(0'8$'+(A%$K#5,(50'5+%'/(#%+('02(8$&$2+-( 20(0'8$'+(#-K+%2$/$'<B(S82"04<"(!9;(<+'+%#88,(/4AA0%2/(/+81L%+<48#2$0'?($2("#/( A%0K+'(20(.+($'/411$5$+'2($'(2"+(0'8$'+(A%$K#5,(50'2+E2B(O0%(#88(01(2"+/+(%+#/0'/?( !0'<%+//( '++-/( 20( 2#*+( #( 50&A%+"+'/$K+( 800*( '02( 0'8,( #2( 2"+( 54%%+'2( #'-( +&+%<$'<(A%#52$5+/(#//05$#2+-(G$2"(9J@?(.42(#8/0(#2(0'8$'+(A%$K#5,(50'5+%'/(#2( 8#%<+B(C+(%+50&&+'-(2"#2(!0'<%+//(2#*+(2"+(10880G$'<(/2+A/6( ! ;"+( 34.50&&$22++( /"048-( /++*( #--$2$0'#8( $'10%&#2$0'( -$%+528,( 1%0&( @3J/( #'-(2"+$%(A#%2'+%/(#.042("0G(2"+,(#%+(4/$'<(9J@B( ! ;"+(34.50&&$22++(/"048-(/+2(#(<0#8(01(+'#52$'<($'(2"+('+E2(,+#%(#(/$&A8+?( 18+E$.8+(.#/+8$'+(50'/4&+%(A%$K#5,(8#G(2"#2(G048-(A%02+52(50'/4&+%/(1%0&( $'#AA%0A%$#2+( 5088+52$0'( #'-( &$/4/+( 01( 2"+$%( A+%/0'#8( $'10%&#2$0'?( .02"( 0'8$'+(#'-(0118$'+B( ! ;"+( !0&&$22++( /"048-( /2%0'<8,( 4%<+( 2"+( O+-+%#8( ;%#-+( !0&&$//$0'( 20( #--%+//( 9J@( $'( $2/( A%0A0/+-( <4$-+8$'+/( #'-( +E+%5$/+( $2/( 1488( +'10%5+&+'2( #42"0%$2,(0K+%(0'8$'+(#-K+%2$/$'<(A%#52$5+/B(( (((((((((((((((((((((((((((((((((((((((((((((((((((((((( 4 See FTC, Online Behavioral Advertising: Moving the Discussion Forward to Possible Self-Regulatory Principles (Dec.