One of the largest network vendors in the world is planning to offer their ISP partners an opportunity to modify HTTP headers to get ISPs into the advertising racket. Juniper Networks, which sells routers to ISPs, is partnering with Feeva, an advertising solutions company, to modify data packets’ header information so that the packets will include geographic information. These modified packets will be transmitted to any and all websites that the customer visits, and will see individuals receive targeted advertisements according to their geographical location. Effectively, Juniper’s proposal may see ISPs leverage their existing customer service information to modify customers’ data traffic for the purposes of enhancing the geographic relevance of online advertising. This poses an extreme danger to citizens’ locational and communicative privacy.

Should ISPs adopt Juniper’s add-on, we will be witnessing yet another instance of repugnant ‘innovation’ that ISPs are regularly demonstrating in their efforts to enhance their revenue streams. We have already seen them forcibly redirect customers’ DNS requests to ad-laden pages, provide (ineffective) ‘anti-infringement’ software to shield citizens from threats posed by three-strikes laws, and alter the payload content of data packets for advertising. After touching the payload – and oftentimes being burned by regulators – it seems as though the header is the next point of the packet that is to be modified in the sole interest of the ISPs and to the detriment of customers’ privacy.

Advertisers that have been gathering demographic information on citizens for decades are looking to harness their existing databases with the services offered through Juniper and Feeva to target ads at the neighbourhood level. As noted by a recent Wired article detailing Juniper’s integration;

IP-address detection is only accurate within 25 miles or so, and cookies that track users’ surfing habits don’t tell marketers about users’ location. Neither system meshes directly with all the demographic data marketers gathered about neighborhoods in the offline world…Feeva claims its software doesn’t tell marketers anything about web surfers except for their nine-digit zip codes. All their other personal information remains safe with their ISP.

The information that is included in the packet header is encoded in such a way that only ‘trusted third parties’ can translate the packet data to correlate it with geographical locations. Neither Feeva or Juniper are giving any indication that individuals will be able to opt-out of this information disclosure to third-parties. While one of Feeva’s VPs insists that their approach to advertising is privacy protective – on grounds that they “never see any personally identifying information, we don’t track online usage like behavioral [advertising does], and we only aggregate at the neighborhood level” – I have to question just how ‘protective’ any system is that lets advertisers link cookie information, IP information, and geographic information. Both Feeva and Juniper seem to be portraying the technology as an entirely discrete advertising system, but in reality any partners will likely be using the tried-and-true cookie surveillance practices that are widespread online. Now the data contained in cookies will be supplemented by certified-accurate information by the ISP. Moreover, I’m doubtful that geographic information will be limited to ‘trusted third parties’ forever: while the information might be kept from relatively uninterested attackers, a dedicated attacker/hacker should be able to reverse engineer the random data to geographic information in relatively short order. I trust the masses of curious hackers to defeat any corporate system that is meant to massively integrate with corporate systems than those corporations – who have no real reason, save for market exclusivity reasons, to do everything in their power to prevent the sharing of this information – to genuinely do everything in their power to secure individuals geo-locational privacy.

We should recognize that this kind of ISP ‘innovation’ is exactly the opposite of what most customers actually want. The cool stuff that customers genuinely enjoy on the ‘net has largely been produced by over-the-top services, not ISPs. While there are high returns in the Canadian telecommunications industry and abroad, even in times of recession, the present returns are seemingly insufficient: ISPs want into Google and Apple’s marketing pie and will use their monopoly power over data pipes to take ‘their fair share’. The problem, of course, is that most customers don’t want their ISPs to monetize data traffic beyond selling particular data speeds and capacity. They are happy when ISPs innovate in a manner that improves network efficiency, security, and customer service, but are far from pleased when they integrate packet-sniffing technologies for copyright enforcement purposes, packet modification services for advertising, or onerous packet delay systems.

Moreover, while individuals in a privileged position in society are less likely to be terribly nervous about the association of their geographic location with data packets, anyone who has even glancingly studied the impacts of demographic advertising and targeting realizes that the underprivileged are often disproportionately disadvantaged on the basis of their residency location(s). The underprivileged ‘enjoy’ food deserts, systemic discrimination at the hands of the state (see: Gilliom’s Overseers of the Poor), and limitations on their capacity to operate as fully integrated social participants (see: Curry’s Digital Places: Living with Geographic Information Technologies). In each of the above cases, additional surveillance technologies were not necessarily created with the intentions of harming underprivileged members and communities of societies, but simultaneously the technologies (arguably) lacked a genuine analysis of the responsibilities and potential harms accompanying them. It is critical that before we release new technologies into the wild that we both bake in privacy and reflect on the possible consequences for democratic social organization.

The ability to put something on a map is incredibly powerful. It locates, marginalizes, fixes, and focuses. Humans have gone to war over maps, over the power contained in depicting the world. Visual manifestations of the world-as-such carry philosophical, societal, religious, civil, racial, and ethnic overtones and thus must be treated with respect. While Juniper’s technology only draws on the customer database (and individual’s residence) to provide information to marketers, might this map-to-packet technology become integrated with mobile products in the future? Can the geographic location of a customer on a mobile device be transmitted using this technology to facilitate true proximity-based advertisements?

As concerned citizens and consumers, we should also ask: is the linking of previously separate database records (those of the ISP and those of the advertisement agencies) constitute a breech of the privacy agreements between end-users and their ISPs? Can any ISP unilaterally modify their privacy and business practices – can they extend to whom data is shared and conditions under which data packets are treated – or should they be held to account by the FTC and related national and international regulatory organizations?

Unlike the usage of deep packet inspection technologies, which ostensibly are used for security, billing, and traffic management purposes, the modification of packet headers for advertising purposes clearly falls well outside of the activities that are permitted by Canadian regulators. Attempting to integrate this technology into the Canadian telecommunications infrastructure should, and presumably would, be challenged by the Office of the Privacy Commission of Canada, civil and customer advocates, and the CRTC. Perhaps ISPs might attempt to fend off the CRTC by claiming that no content is inspected – the routers would only be adding a bit of information to the packet header itself – but the companies would presumably run afoul of the CRTC’s obligations to protect consumers’ privacy and the fact that a massive material change to contracting terms would have taken place. This is to say nothing of the absolute resistance to the technology that should be projected by advocates and the federal Privacy Commissioner’s Office.

Perhaps, however, the Canadian regulatory environment is well-enough established following the traffic management hearings that Juniper’s new add-on technologies will be unable to establish a hold amongst Canuck telcos and cablecos. In turning our gaze to the US, however, the FTC might be the best suited to protect consumers by way of enforcing existing privacy policies (and, I will note, that American technology companies such as Microsoft and Yahoo! are worried that FTC might begin doing just this) and preventing ISPs from actually rolling out this anti-privacy, anti-consumer networking technologies. As nations around the world mount regulatory meetings about how data packets can and cannot be handled over the coming months and years we will see whether technology add-in’s like those proposed by Juniper will be left to wither or blossom on the ISP-advertising vine.