| |
| META TOPICPARENT | name="WebPreferences" |
|---|
ISP Side Advertising Unlikely | |
<
< | A little over a year ago was the official launch of NebuAd, a company that, from the very beginning, saw itself as partnering with Internet service providers to produce targeted advertising based on the ISPs’ users’ use of the Internet. They claimed to be creating data-driven marketing without gaining access to the identities of the ISPs’ users. In fact, while they were hashing the users’ identities, Bob Dykes, co-founder and CEO, admitted that “[they] can see that same user coming back onto the Internet.” They accomplished this act of spying, by convincing ISPs to allow them to install an appliance inside the ISPs’ own networks, which allowed them to “get a 360-degree, multidimensional view over a long period of time of all the pages users visit….taking a totality of…behaviors.” In other words, they got us. They got our search terms, our page views, our page and ad clicks, our time spent on specific sites, our zip codes, our browser info and our connection speed. Using this information, NebuAd chose what it considered the optimal ad, and would display it. | >
> | NebuAd and companies like it have two purposes: (1) spying on the customers of ISPs, and (2) using that information to add behavioral advertising to the packets coming through the ISPs’ servers. These companies pick up search terms, page views, page and ad clicks, time spent on specific sites, zip codes, browser information and connection speeds; and using this information, they choose an “optimal ad” to display. While commentators and congressmen have struggled to find a means of stopping these companies based on the privacy concerns involved, no arguments have addressed the ruinous liability that ISPs would expose themselves to if they permitted these companies to change the packets coming through their servers. | | | | |
<
< | For NebuAd and its advertisers, this was a boon. Up until NebuAd’s entrance into the market, the only sites that targeted advertising companies could use to determine who you were and what you would be likely to purchase were the limited number of sites that contracted with the advertising company. NebuAd’s deep packet inspection technology allowed them to track everything you did while on the internet regardless of what websites you visited. NebuAd was also a windfall for the ISPs, they received, in exchange for installing the NebuAd device, their 30 pieces of silver in the form of $2–4 per subscriber. | >
> | When NebuAd? came on the market, it claimed to be creating data-driven marketing without gaining access to the identities of ISPs’ users. However, it quickly became apparent that while they were hashing user identities, “[they] could see that same user coming back onto the Internet” by installing an appliance inside the ISPs’ networks, which allowed them to “get a 360-degree, multidimensional view over a long period of time of all the pages users visit….taking a totality of…behaviors.” | | | | |
<
< | The outcry from the privacy community was fairly immediate. For John Palfrey of Harvard’s Berkman Center and many other privacy advocates, transparency was essential: "Consumers need to know exactly what is going on and they need to know it at all times….Today they say they are using consumer information for ads, but it could be something completely different tomorrow. The ISPs and the companies they are working with need to share as much information as possible." | >
> | Before these companies, advertisers could only create behavioral ads based on the activity of users on sites that contracted with them. Deep packet inspection technology changed that by allowing the tracking of everything done on the Internet regardless of the websites visited. In exchange for this information, ISPs received their 30 pieces of silver in the form of $2–4 per subscriber. | | | | |
<
< | In July of this year, the House opened an investigation of a trial of NebuAd’s service conducted by Embarq. The hearing ended with an open letter from Congressmen Markey and Barton urging ISPs to stop using such services. By September 3, the social pressure proved too much for NebuAd. Dykes resigned, various ISPs either cancelled or suspended trials of the device, and the company fired its PR firm and some of its staff. Additionally, various legal arguments were made regarding NebuAd’s service, including that the technology might be considered wiretapping. | >
> | Privacy advocates cried out immediately by insisting that transparency was essential: "Consumers need to know exactly what is going on and they need to know it at all times….Today they say they are using consumer information for ads, but it could be something completely different tomorrow. The ISPs and the companies they are working with need to share as much information as possible." | | | | |
<
< | At the end of September, the Senate Committee on Commerce, Science, and Technology held a hearing focused on broadband providers and consumer privacy. At that hearing, AT&T, Verizon and Time Warner Cable admitted that behavioral tracking shouldn’t be used without the meaningful consent of web users. However, they also stated that they would prefer to regulate themselves (who wouldn’t) stating that, “[They weren’t] prepared to embrace legislation.” | >
> | In response, both houses of Congress conducted hearings, and by September 3 NebuAd? was cracking under the pressure: its co-founder and CEO resigned, various ISPs either canceled or suspended trials of the device, and it fired its PR firm and some of its staff. Despite NebuAd? ’s collapse, however, broadcast providers are adamant that they should be allowed to regulate themselves and are “[not] prepared to embrace legislation.” | | | | |
<
< | While the media and congressional pressure seems to have quieted NebuAd and its bretheren for the moment, it is unlikely that deep packet inspection will ever truly be gone. The benefits to the corporate whores involved are too high, and the costs involved are all paid by consumers, most of whom have no meaningful choice when it comes to choosing their ISP, and are far too willing to give up their privacy without thinking. When these companies return, they will need to smooth over relations with the appropriate congresspeople (read: bribe them), and insure that if there is a government regulator involved, it is sufficiently toothless (read: the FTC). However, I see an additional hurdle for NebuAd and its ISP stooges: copyright holders. | >
> | While the media and congressional pressure seems to have quieted NebuAd? and its brethren for the moment, it is unlikely that deep packet inspection will ever truly be gone. The benefits to the corporate whores involved are too high, and the costs involved are all paid by consumers, most of whom have no meaningful choice when it comes to their ISP, and are far too willing to give up their privacy without thinking. When these companies return, they will not only face the same political pressure (unless, of course, they bribe Congress) and government regulator (of course, the FTC is fairly toothless), but legal claims, such as potential wiretapping charges. However, I see an additional hurdle for NebuAd? and its ISP stooges: copyright holders. | | | Copyright holders have been trying to hold ISPs secondarily liable for the infringement of the ISPs’ users for years. It was the prospect of such ruinous liability that urged the ISPs to lobby Congress for exemptions from copyright liability, and, in 1998, have Congress pass the Digital Millennium Copyright Act. | | | Once the ISPs are no longer under the 512(a) shield, copyright holders will only need to establish that the ISPs (1) materially contributed to the infringing conduct, and (2) knew of infringing activity. It should be a simple matter to show that the ISP materially contributed to the infringing conduct since without the ISPs aid the user would be unable to access the copyrighted material. Furthermore, the standard has generally been applied loosely. As for the second prong, given that NebuAd and the ISPs would be touting their ability to inspect every aspect of their users’ online activity, it shouldn’t be difficult to establish the requisite knowledge. | |
<
< | If the ISPs see such liability as a viable threat, they may attempt to turn to Congress for further amendment of the Copyright Act to extend their protection. However, given the DMCA’s concern for the protection of personally identifying information (Copyright Act § 1201(i)), Congress and the public’s new found crusade for privacy protection, and the wealth that copyright holders could squeeze from ISPs, that fight may turn out to be politically infeasible. | >
> | This argument leaves two questions unanswered: (1) how do you address the spying in the first place, and (2) is this business model really viable when technology exists to block web-based advertising.
First, it is possible to construct two sets of arguments against ISP surveillance. The privacy-based arguments, such as wiretapping, have been discussed by privacy advocates, and are beyond the scope of this piece. However, one could construct a DMCA-based argument from § 512(a)(4), which requires that transient storage be maintained “in a manner ordinarily [not] accessible to anyone other than anticipated recipients.” Providing NebuAd? copies of the material even for merely surveillance purposes would cause the ISPs copyright liability to reassert itself.
Second, although products such as AdBlock? are able to block advertising, they do so based on links to aggregation websites (e.g., ad.adlegend.com, and googlesyndication.com). NebuAd? , on the other hand, resides inside the network, which means it can choose advertising without directing users to a centralized website, and can monitor clicks based on page views. From AdBlock? ’s perspective, these advertisements will simply look like regular content from the website’s author.
Without a change in the DMCA, which seems unlikely given Congress and the public’s reticence, ISPs would be opening themselves up to an unquantifiable legal risk by joining up with a NebuAd? -type company. | | | -- JoshS - 01 Dec 2008 | |
>
> | Further Reading
Comments | | |
- When you find that you need to use multiple "may" clauses and "might" suppositions in your conclusion, you have probably
| | | AdBlock to remove
anyway. | |
<
< | Further Reading
Comments | | |
| META TOPICMOVED | by="JoshS" date="1231362356" from="LawNetSoc.ISPSideAdvertisingUnlikely" to="LawNetSoc.JoshuaSimmonsPaper2ISPSideAdvertisingUnlikely" |
|---|
|
|