Technology

Summary: CRTC PN 2008-19; Requests for Public Disclosure Filings

/ Christopher Parsons / 4 Comments

I’ve just completed a summary document that pulls together the requests for disclosure from the various advocacy groups currently involved in the CRTC’s PN 2008-19 (ISP Internet Management Techniques). A few things that I found of interest:

  1. TELUS is being used as a lever against the other ISPs; the common metric is “TELUS released all this information in public, so what justification can the rest of the ISPs have for filing in confidence?”
  2. Public Interest Advocacy Center (PAIC) really focused on Bell and Rogers, and noted repeatedly that Bell has filed items in confidence in this public notice that it had been forced to file in public previously. Also, where Bell could claim confidentiality last time (Canadian Association of Internet Providers [CAIP] v Bell), this isn’t the case now because all the major ISPs will be forced to show their hands at the same time.
  3. Without historical and projected growth, it is impossible for public groups to argue whether or not current managing practices are appropriate. This data needs to be released so that they can fully response to the CRTC’s public notice.
  4. The Campaign for Democratic Media (CDM) is willing to have all of the ISPs’ traffic aggregated, so long as it is disclosed publicly what the trends are.
  5. CDM notes that without information on the top 5% and 10% of users, that it is impossible to ascertain what their actual impact on total bandwidth has been.
  6. CAIP, PAIC, and the Canadian Film and Television Production Association (CFTPA) all argue that it is important for clear, technical, explanations of congestion be provided – without this, it is challenging to effectively interrogate what is, or isn’t, happening on ISPs’ networks.
  7. PIAC stands that, if Bell didn’t have a congestion metric in place prior to January 2007 then they should be obligated to disclose information in public on the basis that their definitions of congestion need to be examined more closely than others (unstated, but this is in part because they are such a major player in Canada).
  8. CFTPA holds that Bell’s networking diagram is good, because it offers specifics into their network. In light of Bell’s submission, other parties should submit similarly detailed diagrams, with devices clearly labeled, so that members of the public can meaningfully comment on whether the network components use by ISPs are adequate or not.
  9. CAIP, CDM, PAIC, and CFTPA all maintain that knowing what products are being used to manage Internet traffic is critical – without this information it is challenging to actually comment on how throttling is occurring. CDM raises the privacy issue with DPI.

Deep Packet Inspection Analogies

/ Christopher Parsons / 5 Comments

In reading through the recent CRTC filings, something that has been striking me is that the ‘regular’ metaphor for how Deep Packet Inspection (DPI) technologies work seems a bit awkward. When you send packets of data along the ‘net, they are broadly composed of a header and a payload. The metaphor goes as follows: the header is like the addressing information on an envelop, and the payload is the actual letter in the envelop. DPI opens the envelop, sees the content of the letter, examines it, reseals it, and then passes the letter along to its destination (assuming that the contents aren’t of a type that shouldn’t be sent onwards).

I like the metaphor because of its power, but at the same time I have to wonder about its accuracy, at least in the Canadian situation. When reading the ISP’s CRTC filings, I keep reading that they use DPI devices for flow analysis – they’re not looking for the content of your email, they just want to identify whether you’re sending email or an instant message. Rather than assume that the ISPs are being duplicitous, why not reconsider the metaphor to see if it can’t be developed to distinguish between different usages of DPI equipment.

Continue reading →

Comment: Canadian ISPs and Internet Traffic Management

/ Christopher Parsons / 1 Comment

I’ve recently put up a document that summarized most of the first round of filings for the CRTC’s investigation of Canadian ISP traffic management practices (PN 2008-19), and thought that I’d post a few things that I thought were most interesting (for me). Keep in mind that many of my interests revolve around deep packet inspection.

Network Use Averages

  1. Bell filed their specific data points in confidence, though from what they provided we can see that the top 5% of usage on the network has declined from 61.1% to 46.6%, and the top 10% of network usage has declined from 77.1% to 62.6%.
  2. In TELUS’ case, we find that their retail customers have decreased the amount of content they are uploading, though they are downloading more. Their wholesale customers are both downloading and uploading more than in 2006. Specific traffic data was filed in confidence to the CRTC.
  3. Bell finds that P2P and HTTP/Streaming traffic are the most commonly used end-user categories that contribute to bandwidth usage.

Canadian ISPs Admitting to Traffic Management

  1. Bell Wireline (excludes Bell Mobility and Bell Aliant Atlantic). DPI technology is used, though the vendor and products are filed in confidence.
  2. Cogeco uses DPI, but has filed the vendor and products in confidence.
  3. Rogers filed their comments in confidence, but from past information that has emerged we know that they are using DPI equipment.
  4. Shaw Communications Inc. uses Arbor-Ellacoya devices, though the particular products are filed in confidence.
  5. Barrett Xplore Inc. Uses VoIP prioritization, provisioning of modems, and DPI. Specifics are filed in confidence.
  6. While not explicitly stated, is appears as though Bragg Communications Ltd. also uses DPI.

Canadian ISPs Not Using Traffic Management

  1. MTS Allstream Inc.
  2. SaskTel (though they do use Arbor Peakflow SP, dominantly for network security purposes)
  3. Primus Telecommunications Canada Inc.
  4. Telus

What is Being Filtered/Throttled?

  1. Bell acknowledges that they do throttle traffic between 1630 and 0200 each day by limiting bandwidth available to P2P applications. A detailed listing of applications is not publicly mentioned.
  2. Cogeco currently uses management technologies against: eDonkey/eMule, EmuleEncrypted, Kazaa, Fast Track KaZaA Networking, Napster, Bittorrent, Dijjer, Manolito, Hotline, Share, Soulseek, v-share, Zattoo, Joost, KuGoo, Kuro, DHT, Commercial File Sharing, Baidu Movie, Club Box, Winny, Gnitella, Gnutella Networking, WinMX, Direct Connect, PeerEnabler, Exosee, Further, Filtopia, Mute, NodeZilla, waste, Warez, NeoNet, PPLiveStream Misc, BAIBAO, POCO, Entropy, Rodi, Guruguru, Pando, Soribada, Freenet, PacketiX, Feidian, AntsP@P, Sony Location Free, thunder, Web Thunder. They only look at the specific signature of P2P applications.
  3. Rogers “looks at header information embedded in the payload and session establishment procedures.” What is unclear to me is how they are suggesting that header information is embedded in the payload itself – these are two separate spaces in packets, as I understand networking 101. Specifics P2P that are filtered is not mentioned, though they only concentrate on uploaded content.
  4. Shaw doesn’t say – they’ve filed their findings in confidence.
  5. Barrett doesn’t say – they’ve filed their findings in confidence.
  6. Bragg targets: Bittorrent, News, DirectConnect, Blubster, gnutella, KaZaA, WinMX, eDonkey, Filetopia, Hotline, GuruGuru, Soribada, Soulseek, Ares, JoltID, eMule, Waste, Konspire2b, ExoSee, FurtherNet, MUTE, GNUnet, Nodezilla. Bragg focuses on the packet headers and the behaviour of packet exchanges, and avoiding learning about the content of packet flows.

Under What Conditions Non-Management ISPs Would Manage Their Networks

  1. MTS Allstream notes that only if a capital investment analysis found traffic management technologies to lead to enhanced revenue would they invest in management technologies.
  2. SaskTel has three conditions that would lead them to adopt management technologies: (a) customer demand outstrips capacity and augmentation could not be economically accomplished; (b) if competitive forces require the introduction of alternate service definitions; (c) if there was a need to enforce the aUP so that there was sufficient network capacity for end-users.
  3. TELUS does not currently use management technologies such as DPI, and has no plans to do so.

There is more in the document that is of note, but insofar as it pertains to DPI I thought that these were probably core points that people would be interested in.

Summary: CRTC PN 2008-19; ISP Traffic Managment in Canada

/ Christopher Parsons / 13 Comments

As someone who is academically invested in how the ‘net is being regulated in Canada, I’ve been following the recent CRTC investigation into Internet management practices and regulation with considerable interest. Given that few people are likely to dig though the hundreds of pages that were in the first filing, I’ve summarized the responses from ISPs (save for Videotron’s submissions; I don’t read French) to a more manageable 50 pages. Enjoy!

Update: Thanks to Eric Samson and Daniel for translating Videotron’s filings – you guys rock!

Review: Privacy On The Line

/ Christopher Parsons

This updated edition of Diffie and Landau’s text is a must-have for anyone who is interested in how encryption and communicative privacy politics have developed in the US over the past century or so. Privacy On The Line moves beyond a ‘who did what’ in politics, instead seeing the authors bring their considerable expertise in cryptography to bear in order to give the reader a strong understanding of the actual methods of securing digital transactions. After reading this text, the reader will have a good grasp on what types of encryption methods have been used though history, and strong understandings of the value and distinction between digital security and digital privacy, as well as an understanding of why and how data communications are tracked.

The only disappointment is the relative lack of examination of how the US has operated internationally – there is very little mention of the OECD, nor of European data protection, to say nothing of APEC. While the authors do talk about the role of encryption in the context of export control, I was a bit disappointed at just how little they talked about the perceptions of American efforts abroad – while this might have extended slightly beyond the American-centric lens of the book, it would have added depth of analysis (though perhaps at the expense of making the book too long for traditional publication). One of the great elements of this book is an absolutely stunning bibliography, references, and glossary – 106 pages of useful reference material ‘fleshes out’ the already excellent analysis of encryption in the US.

Ultimately, if you are interested in American spy politics, or in encryption in contemporary times, or in how these two intersect in the American political arena, then this text is for you.

Questions of Digitizing Identity

/ Christopher Parsons

A common element of the (various) streams of thought that I’m usually engaged in surrounds the question of identity. What constitutes identity? How is this constitution being modulated (or is it?) in digital spaces? What can past and contemporary theorists offer us, in response to these questions? What are the strengths of these responses, and what are their weaknesses?

Over the next six months or so, I want to begin taking up these questions more seriously. I plan to begin constructing an account in order to gain a better appreciation for both how granularly we often attempt to separate identities, and how at the same time those are often shared, surveyed, or otherwise modified without our ever being aware. My thoughts are that a core difference between ‘analogue’ and ‘digital’ identities follows from the (relative) ease of surveying and modifying digital identities without the source of that identity ever being made aware. While unobtrusive surveillance is possible in an analogue space, there is an emphasis in the West on the development of homogeneous protocols that are intended to facilitate the diffusion of data across digital pathways, and this carries with it new ways of collating and modulating available dataflows. Continue reading →