Banning deep packet inspection would have ‘damaging consequences across the Internet,’ says Sandvine

Deep packet inspection (DPI) technology doesn’t threaten people’s privacy. People threaten people’s privacy. Or that’s what Canadian network policy control solutions company Sandvine Inc. suggests in a recent submission to the privacy commissioner. The Office of the Privacy Commissioner of Canada will be holding consultations on the privacy implications of emerging technologies, such as DPI, in April, May and June in Montreal, Toronto and Calgary. DPI is a networking technology currently used by Internet service providers (ISPs) to monitor and control data traffic. While DPI can be used to maintain the integrity and security of networks, it can also provide third parties the ability to view private information sent over the Internet. The technology can be used for targeted advertising, scanning networks for unlawful content, surveillance for criminal investigation purposes, and monitoring traffic to measure network performance. In a consultation submission to the privacy commissioner, obtained by The Wire Report through federal access-to-information law, Sandvine argues that the debate should be on how people use technology to acquire personal information online, not on the technology itself. The company says the commissioner’s review of emerging technologies should be technology-neutral. “Banning the use of DPI, as some have suggested is necessary based on privacy implications, would have far-reaching and damaging consequences across the Internet, where the technology is used extensively. Instead, when considering the privacy implications of DPI, as with any technology, the focus should be on the use case, not the technology itself,” the company says. Sandvine cites Single Lens Reflex camera technology as an example. “Single Lens Reflex (SLR) technology underlies cameras that can be used to take photos at family birthday parties or applied for surveillance of individuals and public places … Nobody questions the value or validity of SLR technology. DPI should not be questioned either,” the company argues. Rick Wadsworth, director of investor relations at Sandvine, told The Wire Report that DPI has been unfairly given a bad reputation. “I think that some negative associations were made very much in the United States, when there was some concern about targeted advertising techniques. Basically, there was a company that was using DPI, or was planning to use DPI, to do some targeted advertising down in the United States,” Wadsworth said. “Because of that one instance, basically any targeted advertising was sort of associated with DPI, and it’s just so incredibly not the case. Most advertisement that takes place over the Internet would be to date with means that have nothing to do with deep packet inspection.” Although DPI supporters argue that the technology is used for network management, and not to collect personal information, privacy and digital rights advocates express concern about its use. In its October 2009 telecom decision on traffic management, the CRTC issued guidelines for the use of DPI. “The Commission finds it appropriate to establish privacy provisions in order to protect personal information. The Commission therefore directs all primary ISPs, as a condition of providing retail Internet services, not to use for other purposes personal information collected for the purposes of traffic management and not to disclose such information,” says the CRTC policy. “The Commission directs all primary ISPs, as a condition of providing wholesale services to secondary ISPs, to include, in their service contracts or other arrangements with secondary ISPs, the requirement that the latter not use for other purposes personal information collected for the purposes of traffic management and not disclose such information.” The Canadian Bankers Association (CBA), in its submission to the commissioner, says banks address the concerns about DPI technology. “Banks use DPI technology only for the purpose of protecting information security—to monitor and maintain the security and integrity of their IT systems, prevent malicious code from breaching their websites, and protect their clients’ information and accounts,” the CBA says. John Lawford, legal counsel at the Public Interest Advocacy Group (PIAC), said the “guns don’t kill people, people kill people” argument is not a new one, but that companies must abide by the CRTC’s ruling when applying new uses of DPI technology. “The commission said that whatever purposes the companies had put to by the date of the decision, those are all okay. If they plan to bring in something that might interfere with other business models, theoretically they shouldn’t do it,” Lawford said in an interview. Wadsworth said DPI’s image problem could be mended by educating the public about its application. “It’s just a process of education, which is what we are hoping to do with submissions we’ve made,” he said. kfournier@thewirereport.ca

Banning deep packet inspection would have ‘damaging consequences across the Internet,’ says Sandvine

Broadcast | April 20, 2010

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us