We get fussy about the erosion of our privacy, but compromise it time and time again for the sake of communication.  As we gain connectivity, we compromise our privacy.  It’s a very similar to the internet security situation.  If security is the highest priority, disconnect the data.  Obviously, it’s more important for the data to be accessible to the exclusive few who’s jobs/well-being depends on it. 

The compromise exists and we must prioritize appropriately.  DPI is a sensible, though potentially infuriating, evolutionary technology.  Yes, it erodes our privacy.  Yes, we will continue to utilize privately owned circuits to access the internet, because the cost of communication loss outweighs loss of personal privacy.

Upcoming generations embrace diminished privacy.  The rise of social networks is a pretty good indicator of that, I think.  Anecdotally, this reminds me of a story about a snow day incident.  A high school or jr. high school student called the dean of his school at home asking why the school wasn’t closed.  His wife called the child back, leaving him a voice mail scolding him about privacy which he promptly posted to his facebook/myspace page.  Incidentally, he got their number from the phone book.  Privacy is dead.

It’s hard for me to understand why DPI is generating news now.  It’s been around for a long time and is inherent in most networks in many different kinds of devices.  There are many devices that inspect traffic and act on it for a variety of reasons.  DPI is generating news now because of the Comcast / BitTorrent issue.  But there are so many things on the Internet that in some way proxy for traffic or users.  Take NAT/PAT for instance.  As far as the web site is concerned, it’s not really seeing a request from the actual user but a NAT device and the IP address in front of it.  Is this a fraudulant act by the ISP that has not acquired enough public IP addresses to cover its service and has chosen to use private addresses and NAT?  Should they be scolded and forced to go to public addressing (a whole other issue)?  Another example is a cache engine, which delivers content that is not exactly from the web site directly but an “old” copy (“old” depends on when the cache was refreshed, but you could certainly be getting stale content that has since been updated.)  These things are common, but are they too somehow interfering with traffic, or sending what could be perceived as counterfeit traffic, or hijacking a session, or masquerading illegally as the actual user?  We can go on with other examples including firewalls, intrusion detection / prevention systems, content filters and yes, bandwidth management devices that perform traffic prioritization and peer-to-peer traffic throttling.  They’ve been there a while, they are necessary for many reasons, and they won’t go away even if how they are implemented changes.  It’s not a privacy thing.  They are tools to make sure the Internet can not only work better, but that services can be created and sold to residential consumers at low retail prices.

Hopefully the backlash that’s emerging against Comcast will encourage ISPs to start looking at other options than DPI. I buy that in some cases bandwidth needs to be conserved, but that isn’t a free pass to do whatever the ISP wants to achieve this. There are other ways to accomplish the same goal without having to resort to DPI (see netequalizer). DPI seems like it will be hard to defend from the standpoint of the ISP if these alternate options start to catch on and get developed on a larger scale.

DPI is not just a danger with ISPs. Wi-fi providers (Hotels, Cafes, Airports, Parks) are also going to be increasingly tempted to generate revenue by tracking viewing habits, tweaking Google results, and inserting or replacing advertisements. I’m sure we’ll also start to see this behavior on compromised routers and wireless access points.

Some of the problems can be mitigated with SSL, but the man-in-the-middle can still track URIs and silently redirect sub-requests (like images or ads embedded in the requested page) to other secure domains, without alerting the user.

And a very useful tool for security. Feel free to blame its abuse if you wish. But dont knock DPI for that.

Hi Susan,

Thanks for bringing light to the privacy concerns related to DPI.  While privacy is a legitimate concern, I hope it is one that will be overcome and minimized through innovation. 

The analogy game is always a fun one. 

What if the US Postal Service offered:
- no options for priority delivery
- no capability to inspect packages other than the address and return address
- policies that restricted commercial innovation in the postal arena (UPS, FedEx)

https://www.dpacket.org is a good resource to learn more about deep packet inspection.