ISP Side Advertising Unlikely

NebuAd and companies like it have two purposes: (1) spying on the customers of ISPs, and (2) using that information to add behavioral advertising to the packets coming through the ISPs’ servers. These companies pick up search terms, page views, page and ad clicks, time spent on specific sites, zip codes, browser information and connection speeds; and using this information, they choose an “optimal ad” to display. While commentators and congressmen have struggled to find a means of stopping these companies based on the privacy concerns involved, no arguments have addressed the ruinous liability that ISPs would expose themselves to if they permitted these companies to change the packets coming through their servers.

When NebuAd? came on the market, it claimed to be creating data-driven marketing without gaining access to the identities of ISPs’ users. However, it quickly became apparent that while they were hashing user identities, “[they] could see that same user coming back onto the Internet” by installing an appliance inside the ISPs’ networks, which allowed them to “get a 360-degree, multidimensional view over a long period of time of all the pages users visit….taking a totality of…behaviors.”

Before these companies, advertisers could only create behavioral ads based on the activity of users on sites that contracted with them. Deep packet inspection technology changed that by allowing the tracking of everything done on the Internet regardless of the websites visited. In exchange for this information, ISPs received their 30 pieces of silver in the form of $2–4 per subscriber.

Privacy advocates cried out immediately by insisting that transparency was essential: "Consumers need to know exactly what is going on and they need to know it at all times….Today they say they are using consumer information for ads, but it could be something completely different tomorrow. The ISPs and the companies they are working with need to share as much information as possible."

In response, both houses of Congress conducted hearings, and by September 3 NebuAd? was cracking under the pressure: its co-founder and CEO resigned, various ISPs either canceled or suspended trials of the device, and it fired its PR firm and some of its staff. Despite NebuAd? ’s collapse, however, broadcast providers are adamant that they should be allowed to regulate themselves and are “[not] prepared to embrace legislation.”

While the media and congressional pressure seems to have quieted NebuAd? and its brethren for the moment, it is unlikely that deep packet inspection will ever truly be gone. The benefits to the corporate whores involved are too high, and the costs involved are all paid by consumers, most of whom have no meaningful choice when it comes to their ISP, and are far too willing to give up their privacy without thinking. When these companies return, they will not only face the same political pressure (unless, of course, they bribe Congress) and government regulator (of course, the FTC is fairly toothless), but legal claims, such as potential wiretapping charges. However, I see an additional hurdle for NebuAd? and its ISP stooges: copyright holders.

Copyright holders have been trying to hold ISPs secondarily liable for the infringement of the ISPs’ users for years. It was the prospect of such ruinous liability that urged the ISPs to lobby Congress for exemptions from copyright liability, and, in 1998, have Congress pass the Digital Millennium Copyright Act.

For the purposes of this discussion, it is only one safe harbor that need concern us: § 512(a) of the Copyright Act, which protects ISPs from liability for the transmission of copyrighted material. That protection is provided to any service provider who acts as a mere conduit for the copyrighted material. However, the only ones who get this relief from liability are service providers, and § 512(k)(1)(A) defines a service provider for purposes of subsection (a) as “an entity offering the transmission…of material of the user’s choosing, without modification to the content of the material as sent or received.”

It is important to note that modification is mentioned twice. When it is mentioned in 512(a)(5) it involves the specific material being transmitted, but when it is mentioned in 512(k)(1)(A) it refers to material generally. Thus, if ISPs use NebuAd, in any way, to track their users and then change or adapt the content seen by those users to better fit their behavioral profile, they are no longer mere conduits in the system and no longer protected by the DMCA safe harbor. This is true whether or not they purchase media or ad space on the original websites.

Once the ISPs are no longer under the 512(a) shield, copyright holders will only need to establish that the ISPs (1) materially contributed to the infringing conduct, and (2) knew of infringing activity. It should be a simple matter to show that the ISP materially contributed to the infringing conduct since without the ISPs aid the user would be unable to access the copyrighted material. Furthermore, the standard has generally been applied loosely. As for the second prong, given that NebuAd and the ISPs would be touting their ability to inspect every aspect of their users’ online activity, it shouldn’t be difficult to establish the requisite knowledge.

This argument leaves two questions unanswered: (1) how do you address the spying in the first place, and (2) is this business model really viable when technology exists to block web-based advertising.

First, it is possible to construct two sets of arguments against ISP surveillance. The privacy-based arguments, such as wiretapping, have been discussed by privacy advocates, and are beyond the scope of this piece. However, one could construct a DMCA-based argument from § 512(a)(4), which requires that transient storage be maintained “in a manner ordinarily [not] accessible to anyone other than anticipated recipients.” Providing NebuAd? copies of the material even for merely surveillance purposes would cause the ISPs copyright liability to reassert itself.

Second, although products such as AdBlock? are able to block advertising, they do so based on links to aggregation websites (e.g., ad.adlegend.com, and googlesyndication.com). NebuAd? , on the other hand, resides inside the network, which means it can choose advertising without directing users to a centralized website, and can monitor clicks based on page views. From AdBlock? ’s perspective, these advertisements will simply look like regular content from the website’s author.

Without a change in the DMCA, which seems unlikely given Congress and the public’s reticence, ISPs would be opening themselves up to an unquantifiable legal risk by joining up with a NebuAd? -type company.

-- JoshS - 01 Dec 2008

Further Reading

Comments

• When you find that you need to use multiple "may" clauses and "might" suppositions in your conclusion, you have probably been hyperventilating for a couple sentences already. Your point about the DMCA safe harbor is interesting, and, so far as I know, fresh. It would have been sufficient to call attention to an additional and unquantifiable legal risk run by any ISP who gives the behaviorial marketers the power to change the packet coming through. This is not quite the same as saying he has a liability if he permits the surveillance and sells the resulting information to someone else. This point should be remembered before claiming that the usually-black-hat DMCA is here the white-hat cavalry coming to the defense of privacy.

• Other reasons to doubt the long-term effectiveness of the Phorm model also exist, and for now the immense plunge in consumer demand is likely to restrain business' mad desire to pay substantial amounts of money for the eyeballs of people who don't spend much. So perhaps rather than getting all alarmed about this we could step back and ask just how much damage can be done by guys trying to show me ads I'm going to use AdBlock to remove anyway.