ITU Approves Deep Packet Inspection Recommendation

http://www.itu.int/ITU-T/workprog/wp_item.aspx?isn=7082

by mtgx • 14 years ago

209 155 14 years ago

jug6ernaut• 14 years ago

If this were some form of physical information transit it would have never passed. While ill be the first to admit I do not know what will come from this, or really even the basic understanding of DPI, this can not be good for those who value there privacy.

I imagine that forcing encryption over all connections would be a counter measure to this? Going about getting all websites to offer encryption might be another story...

gergles• 14 years ago

And of course you can't even read what they approved, because this extra-governmental body inexplicably restricts the text of their decisions to a nebulous list of "TIES users".

Fucking awful.

mtgx3• 14 years ago

The technical PDF is here (I shortened it because it was a long Google link):

http://bit.ly/Yx0Sya

josh26002• 14 years ago

I note that they're not applying DPI to encrypted traffic per the spec, but they do note that unencrypted portions of encrypted packets will still be inspected.

The example they give is that if a PDU is encrypted, but all of the other sections of the packet are not, then only the PDU won't be inspected.

Still, DPI is scary as all hell.

lwat• 14 years ago

http://www.google.co.il/url?sa=t&rct=j&q=&esrc=s...

Sniffnoy• 14 years ago

Non-Google version: http://committee.tta.or.kr/include/Download.jsp?filename=cho...

nitrogen• 14 years ago

A useful feature of HN is that it will elide links if they get too long.

mtgx3• 14 years ago

More info here (there's also a PDF for DPI in one of the links):

http://broabandtrafficmanagement.blogspot.com/2012/12/itu-ap...

mullingitover• 14 years ago

I recently approved my own proposal to encrypt all my packets via VPN. Inspect away.

Jabbles• 14 years ago

Section 6.8 of the PDF deals with those pesky encrypted packets.

jrabone• 14 years ago

Only insofar as it talks about 1) partially encrypted traffic, 2) using local copies of the keys for decryption, or 3) flow identification of IPSEC. Properly done I don't see an IPSEC/L2TP VPN being vulnerable to DPI - although you will want a constant stream of "filler" packets going back and forward to thwart traffic analysis.

Otherwise, the whole thing is a disgrace and the engineers responsible for working on it need to take a long look at themselves. Dressing it up with examples of "Detection of Malware" is disingenuous, it's abundantly clear what the use case is here.

spindritf• 14 years ago

If this gets widespread enough, they'll just inspect traffic when it leaves your VPN gateway/server. VPN is fine for public wifi, or connections between predetermined networks but you can't stretch it much past that.

hnolable2• 14 years ago

Which is why you should use a VPN with shared ips.

venomsnake• 14 years ago

Or the VPN-s connect to each other if it gets widespread enough and you get Overnet, where only minority of your traffic needs to go outside. And when that gets regulated there will be OverOverNet etc.

est• 14 years ago

a recent Chinese paper (its author is the creator of GFW) suggests that the GFW is capable of using SVM to filter SSH tunnel traffic, at the success rate of 95%, without affecting normal SA use.

http://www.solidot.org/story?sid=32532

josh26002• 14 years ago

The hardest thing for me to understand is how every telco can complain of congestion, but they're perfectly willing to introduce unnecessary overhead for DPI.

This is not a good day, not a good day at all.

MichaelGG6• 14 years ago

How is DPI related to needing more bandwidth needed per base station or residential area?

kcbanner• 14 years ago

I think he is referring to the fact that significant CPU resources are required for DPI and if the DPI can't keep up, things will slow down.

politician3• 14 years ago

Bandwidth is the measure of data over time. DPI is a process which inspects each piece of data and that takes time. Therefore, the bandwidth will decrease.

ffk• 14 years ago

Other restrictions besides bandwidth exist. For example, DPI requires more CPU and memory, which are some of the major constraints of networking equipment, especially when the equipment resides at the edge (borders) of a Tier 1 ISP.

aidenn03• 14 years ago

The main limit to bandwith is speed of routing the packets. This is why QoS typically fails for IP; it is usually cheaper to just use a faster dumb router than to use a slower smart router.

sliverstorm• 14 years ago

Perhaps they are of the opinion that DPI will better-enable them to apply QoS rules, resulting in a net improvement in perceived performance?

noselasd3• 14 years ago

Monitoring systems are usually extra boxes that you place as either pass-through on the cables, or you tap the signals with attenuators on electric cables, or you bend the fiber enough to tap about 10% light off them, enoufg to regenerate the signal. Other solutions such as just using mirror ports on an ethernet switch exists as well.

This only costs money, not bandwidth.

jstr• 14 years ago

Can someone explain what this means from a practical point of view for telecommunications end users? Does it mean that NGN traffic will all undergo deep packet inspection in transit? What exactly are NGNs?

revelation• 14 years ago

Good luck with that. What they have just "approved" is the IP-equivalent of opening every single piece of mail. That is, wiretapping.

gknoy3• 14 years ago

They won't need luck, they have the rubber stamps of "National Security" and "We Promise We'll Only Use It For Bad Guys". I imagine that someone somewhere could find a way to apply the interstate commerce clause to let the US gov do what it wants there, too.

They've already been effectively wiretapping and storing a lot, if you believe some of the recent whistleblowers, and so far there's been no effective pushback.

jeremiep• 14 years ago

Is it me or "National Security" really means National Insecurity? Where's freedom in the illusion of safety?

noselasd3• 14 years ago

I'm not sure what you're getting at, but network operators have been doing this for years.

Even the ones that say they don't do it, I will bet you can go and find a box somewhere on their network running Snort that does DPI.

MichaelGG6• 14 years ago

Can someone explain the problems with the ITU creating specifications? I thought I understood it, but all the recent excitement and anti-ITU sentiment tells me I must be missing something.

How is what the ITU does different from any standards body? They can propose standards for DPI, censoring, etc., but that won't magically make Level3 or Comcast or any particular ISP start playing with my packets.

What am I missing? Where does the stuff the ITU does somehow change the policies and actions of my ISP?

akozak• 14 years ago

They're re-negotiating the ITRs, which are the provisions in the ITU's underlying treaty.

Some general information (PDF): https://www.cdt.org/files/file/Global%20Internet%20Governanc...

On the DPI issue: https://www.cdt.org/blogs/cdt/2811adoption-traffic-sniffing-...

ajb• 14 years ago

They are negotiating the underlying treaty, but I don't think this is a treaty provision. It's a standards document, adopted by World Telecommunication Standardization Assembly (WTSA), not WCIT, which is renegotiating the treaty. Basically, this is not a law, it's a spec.

MichaelGG6• 14 years ago

I still haven't seen exactly how this would possibly be enforced. Just like products selectively choose features, even if the IETF or ITU says "mandatory", does not somehow create a law. The ITU can't just vote itself to tell an ISP how to handle traffic, even internationally.

They could create a standard and then let individual countries tell vendors "hey, you must comply with B.123 in order to sell in our country" -- but they can do that anyways. If a government wants snooping capabilities, you can bet every vendor will add it to get their business. It's still the government that decides if it's mandatory to turn on or not.

Again, I'd like to hear the full path from the ITU taking a vote, to my ISP suddenly snooping in on stuff. I can't figure it out.

aidenn03• 14 years ago

It let's individual governments "pass the buck" of responsibility. When the objection in parliament is brought up of "This seems like a bad idea" the response is "We're just doing what the ITU recommends"

Lukeas14• 14 years ago

I can see that working in countries who might be reliant on others for parts of their tech infrastructure. But would that actually work in the UK?

Here in the U.S., we like to be the ones creating recommendations for the rest of the world, not following them (at least not blindly). The excuse of "We're just doing what the ITU recommends" would never fly here.

beagle35• 14 years ago

I think it is a good time to start incorporating DJB's NaCl into ... everything. And also run HTTP Everywhere in the meantime. And set up opportunistic IPSEC.

Sad day.

On a related note, I suggest we stop calling the heads of state and bureaucratic organizations like the UN "Leaders" and starting referring to them by their real self appointed role, "Rulers".

Language shapes perception, and we've been using the wrong term for too long.

saraid216• 14 years ago

> Language shapes perception

Isn't this an argument to to continue using the term "leaders"? Surely calling them "rulers" would, under your logic, push them further towards "rulership"?

legutierr• 14 years ago

Seriously, though, who are these people? I mean, how can I get a cushy gig like that?

You have to wonder about them as individuals, right? What path has their lives taken that they step into a room make a horrible decision like this and not retch. Is it a perverse sense of superiority over the people who are left out from the decision-making? Is it a complete lack of personality and individual thought? Or is it just an attempt to climb one more rung up the ladder, maybe move into that slightly nicer home in McClean or DuPont Circle?

mark-r• 14 years ago

The argument is that they need no push, they act that way already. It's everybody else who needs to recognize them for what they are.

beagle35• 14 years ago

They already know they are rulers. It's for the rest of the people.

I have heard people seriously say "Of course I prefer it with copy protection! It protects my copy!" back in the day when DRM was called copy protection. I'm sure they would have been wiser if the thing was called "Copy Restriction", because that's what it does. Similarly, I'm sure more people would realize what DRM means if it was called Digital Restriction Management (which is what it really is).

These things run deep. Who would dare oppose the PATRIOT act? Real patriots should, but none would. These terms run very, very deep.

etherael• 14 years ago

Ruler sounds a little too majestic, how about dictators? with or without the prefix "tin pot" depending on desire for brevity vs accuracy.

beagle35• 14 years ago

Try it in conversation:

"US Rulers have recently made file sharing a crime carrying the death penalty" vs. "US Dictators have recently made file sharing a crime carrying the death penalty". I think Rulers sounds better (but I think "dictators" is still preferable to "leaders")

lukejduncan• 14 years ago

I'm unsure if this is "requirements on how to implement deep packet inspection, if you choose to do so" vs "requirements to perform deep packet inspection."

Can anyone give context?

hosay123• 14 years ago

Context is that Google says it impacts profit^W^W^W it's evil, so it must be. Because hey, standardizing what every government is doing already must be evil.

TazeTSchnitzel• 14 years ago

IPSec to the rescue?

MichaelGG6• 14 years ago

IPSec by itself isn't going to really help. If they are doing DPI, they can MITM your IPSec connections. You still need a key management system, and I am not aware of any large-scale systems that are in-place to just "switch on" IPSec, that is, suddenly provide you with the certificates for every IP you want to connect to.

andrewcooke• 14 years ago

If they are doing DPI, they can MITM your IPSec connections.

what, how? dpi just means looking at packets inside ip. it doesn't somehow grant you the ability to do man-in-the-middle attacks.

deep packet inspection is already possible. that doesn't mean that tls or ipsec or any other protocol is broken.

(i agree with the need for key management etc; it's just the quoted statement above that seems wrong).

lttlrck2• 14 years ago

You'll be forced into submission. Your link will be throttled by the ISP based on bandwidth alone regardless of content. This is not new.

bdg• 14 years ago

You know we're about to have a bad time when the highly tech savy crowd on HackerNews is left asking "what does this mean?" All over the comments in the thread...

suyash• 14 years ago

What is the big deal?

liquidise• 14 years ago

Appendix I & II are frighting in their casual use of major headings. Looks an awful lot like the fabled "tier-ed internet".

Heck, one of the diagrams even categorizes IP traffic in 4 levels: Gold, Silver, Bronze, P2P. I'm not an owner of tinfoil hats, but this has a lot of implications to a distributed web.

Appendix Examples: I.2.1 Differentiated services based on service identification

I.2.2 Traffic monitoring

I.2.4 Traffic statistics and services-based billing

I.3.1 DPI used as a bidirectional tool for service control

I.5 DPI use case: Traffic control

I.5.3 DPI-based policing of peer-to-peer traffic

I.9.2 DPI engine use case: Simple fixed string matching for BitTorrent

II.4.11 Example “Identify uploading BitTorrent users”

II.4.13 Example “Blocking Peer-to-Peer VoIP telephony with proprietary end-to-end application control protocols”

grecy• 14 years ago

Are they recommending Deep Packet inspection to the governments of the world in the name of "security" or are they recommending it to the ISPs as a means of packet prioritization?

georgeorwell• 14 years ago

One way to think of this is as a cat and mouse game.

Another way is that some people are developing high-bandwidth, distributed, and anonymous internet software and some other people are writing tests that this software is expected to fail presently but that the developers must pass in order to make it to the next level of hardened security and reliability.

bstpierre3• 14 years ago

This is not worthy of "the sky is falling" levels of panic.

My experience with standardization efforts is that they generally run well behind the technology innovators. DPI has been around for a while. A DPI standard (or series of standards) out of the ITU will simply make public the baseline expectations of vendors and users of DPI systems.

On the other hand, CALEA has been on the books for over 15 years, and that is the kind of thing to watch out for -- it does mandate features that provide snooping to the government on demand.

(Speaking as someone who has implemented [shallow] inspection/filtering and CALEA-type features on comms equipment for markets both in and outside of the US.)

throwit1979• 14 years ago

Speaking as someone who has implemented [shallow] inspection/filtering and CALEA-type features on comms equipment for markets both in and outside of the US.)

I'm not trying to flame you here, but I really must ask: How do you live with yourself?

I know how trollish that sounds, but I seriously don't understand engineers who voluntarily work against our own ethos. It's not like this is an industry in which implementing CALEA is the only possible way to feed a family. Job opportunities are practically endless.

bstpierre3• 14 years ago

Every feature I've implemented has been security/stability related. Inspection/filtering/shaping/limiting are absolutely critical on ISP networks. Taps/mirrors are critical to troubleshooting. If ISPs didn't deploy all kinds of filtering, the Internet would be mostly unusable.

enraged_camel• 14 years ago

>>I'm not trying to flame you here, but I really must ask: How do you live with yourself?

It's not the tool itself that matters, but how it is used and by whom.

tptacek• 14 years ago

This comment was so emptily mean that I took the time to flag it.

Nrsolis13• 14 years ago

Allow me to add my $0.02 to this discussion.

I've implemented CALEA type features for a major ISP. I did it because it was the law that we implement it. I'm generally in favor of following the law.

Mind you, CALEA doesn't do anything that couldn't already be done with the law. And you get more protections via CALEA than you'd get otherwise.

For one thing, there are warrants that are delivered to a judge for review which then find their way to a company attorney. Only then does any interception take place. I can live with the checks and balances that are in place under this system.

I sometimes find it incredible that people are so quick to embrace lawlessness and then expect their duly-elected governments to follow those laws to the letter. Believe me, if enough people actually cared and went to their legislature, things would change. Of course, most people agree that we should pursue criminals using all legal means.

BTW, I'm in agreement that this system could be abused. Of course, that's always been the case. Laws are just words on paper unless there are people who will enforce them. If those folks look the other way, well, you're right back where you started.

And before you go into privacy rights, let me suggest to you that the millions of people posting their personal information on FB and getting their email via Google provide a pretty substantial counterweight to your position.

npsimons3• 14 years ago

No employee boycott is going to help, they'll just hire someone else. We won't see change until we start electing better leaders, or changing the system. Reduce the demand.

signa114• 14 years ago

well, standardization or not, things like these have been going on for years (http://www.wired.com/science/discoveries/news/2006/05/70908). standardization would/should just level the playing field amongst various equipment vendors.

Jimega36• 14 years ago

Against big governments, nothing is stronger than the little men and women getting together.

If this is so bad (which I am not technically capable of understanding...), what shall we DO about it?

Signing the petition is probably not enough. Get people to have a minute of 'no internet' across the world? Similar to the Anti-SOPA movement? Suggestions welcome.

bluedanieru• 14 years ago

Replace the Internet with a wireless meshnet. Problem solved.

beagle35• 14 years ago

We need to start establishing a DPI/MITM resistant secret sharing protocol, and a related IP protocol.

E.g., a series of simple recaptcha-style tasks that need to be solved within 3 seconds each to be considered secure - in order to avoid active MITM with either machine or manual labor. Once a secret key is established, it can be used from that moment on.

Otherwise, opportunistic encryption can be MITMed and becomes useless.

Less secure: Require committing the equivalent of 10 seconds of a modern i5 processor to establish the shared secret within 20 seconds. That would be acceptable for two side of a connection, but not for a server or a MITM attacker.

jessaustin3• 14 years ago

Historically the ITU was a forum through which Ma Bell marketed her switching equipment to national phone companies outside North America. Presumably this is more of the same, except Ma Bell was divested of most equipment manufacturing and it's all IP now so other companies (USA, Japan, Germany, with a few others) are driving. The capacity for spying on and shaping the internet use of customers/subjects is appealing for many decision-makers. Among "first world" nations, we probably shouldn't discount the persuasiveness of the various American TLAs with their various evil projects. Don't you want your national constabulary to buy the same crap the DHS buys?

I suspect that if all of this was for reasonable network maintenance then the ITU wouldn't need to be involved. The equipment manufacturers have the researchers; they don't need the ITU to tell them how to shut down open mail relays.

What makes me less concerned about these proceedings is that all this is happening anyway, whether we're told or not. Yes Virginia, there are bad people in the world, and some of them run phone companies, while others spy on the citizens who pay their salaries. Eventually they'll all be routed around, and we have encryption anyway. Sure key management is hard, but if your opponent controls national network operators then you'll use something better than TLS.

noselasd3• 14 years ago

I do find that description a bit odd, since all the early ITU specifications were made mostly by Europeean vendors, and were incompatible with the American versions of protocols, etc.

Anyway - a lot of these specs are made by the very researchers of the various vendors that you talk about - ITU is just a forum they use to collaborate.

mtgx3• 14 years ago

Keep in mind that this DPI system, besides making it easier to monitor people's communications and even censor them, would also make it very easy for them to identify the type of traffic that goes through the pipes, so they can know exactly how to charge it differently, which brings us to another one of ITU's proposals, which is to kill net neutrality and charge for "premium services" like watching Youtube, or using other type of P2P traffic (Skype, WebRTC, torrents, etc):

http://itu4u.wordpress.com/2012/10/25/proposal-for-ict-and-i...

They want to do this, they say, to help "grow the Internet" (hasn't the Internet grown fast enough without their help in the past 20 years?), despite the fact that evidence suggests that the sender-pays system would slow down the growth of the Internet, not make it any faster (research paper):

http://mercatus.org/publication/do-high-international-teleco...

ripperdoc3• 14 years ago

Note that a kind of sender-pays is already used in practice as all big content providers pay for CDN on a per GB basis, and the CDN company in turn pays for bandwidth.

guessWhy• 14 years ago

Sure, but this was the case before CDNs as well. Unless you are a Tier 1 network you usually pay a fee to your upstream carrier.

However, the ITU would like to charge across many networks and discriminate based on the type of service provided.

So if data from your network A reaches the customer through networks B, C and finally D, then D would like to charge you to deliver it and not slow down things artificially.

jayfuerstenberg• 14 years ago

So let me get this straight?

Governments who are fighting to keep these negotiations as 'closed' as possible want our communications to be as 'open' as possible?

War = Peace

Freedom = Slavery

...

ripperdoc3• 14 years ago

There's a lot of misconceptions on DPI going on here. Without taking position, let me just share a few facts (I work with this...).

- DPI is used in most networks in the world, and is mainly used for throttling P2P or for traffic analysis. Legal interception e.g. classical wiretapping is a different thing, although it could use same hardware.

- DPI does cost some resources to the operator but the impact on end users is negligible (except for malfunctions or improperly dimensioned DPIs). It only adds a tiny amount to latency, which puts an upper limit on bandwidth. In many cases, the bandwidth is limited somewhere else on the link.

- DPI hardware works in several stages, typically: analyze IP flow (shallow inspection), if not enough to decide, to DPI (analyze HTTP headers etc), if not enough to decide, rely on heuristics based on traffic pattern etc.

- DPI is not very good at all at dealing with encrypted traffic, and most DPIs will not be able to do anything else than shallow inspection. (some claim to do traffic flow analysis, and some (normally transparent proxies) can break the HTTPS flow in two, but it would generate client errors).

- ITUs specifications won't have much impact on what ISPs do at the moment (as they already do it) but I guess could be a part of the wider regulatory discussion.

ITU Approves Deep Packet Inspection Recommendation

Related Stories