The increased monitoring and profiling of Internet users by companies such as Google and its DoubleClick online advertising subsidiary is widely seen as one of the biggest threats to online privacy. But in reality, said university professor Paul Ohm, the potential for the same kind of activities by ISPs poses a much greater privacy risk.
Ohm, an associate professor of law at the University of Colorado Law School, published a research paper titled "The Rise and Fall of Invasive ISP Surveillance" late last month. The 77-page document chronicles the different market pressures and technology advances that are shaping the behavior of ISPs and warns of "a coming storm of unprecedented and invasive" surveillance of users by such companies.
It isn't an opinion that is shared by everyone, but the issue has been getting an increasing amount of attention from privacy advocates and lawmakers.
Much of Ohm's concern has to do with the vantage point that ISPs have on the Web and their ability to take advantage of it in a hitherto unprecedented manner. In many ways, ISPs are far more able to track, monitor and profile user behavior than Google and other online advertising vendors are, he said in an interview.
"I'm not saying that they are invading your privacy right now," Ohm said. "What the paper does is to play out the possibilities. ISPs have the power to obliterate privacy."
According to Ohm, ISPs have been fairly good custodians of online privacy -- until recently, at least. But a couple of factors are driving a change in the status quo, he claimed. One of them is the growing availability of sophisticated deep-packet inspection technologies that enable companies to collect and mine huge amounts of very granular information about Internet usage. ISPs looking to broaden their revenue sources could increasingly look to monetize this data -- for instance, by selling it to behavioral advertising firms, Ohm said.
Google's enormous success in the online advertising market has "redefined expectations for both profitability and privacy online," Ohm wrote in his report. He predicted that ISPs will attempt to replicate Google's success by trying to monetize user data at the expense of privacy protections. Offering them potential help are advertising firms such as NebuAd and Phorm, which are looking to partner with ISPs to access, analyze and categorize the behavior of users for targeted advertising purposes.
Another incentive for ISPs to be more intrusive about gathering usage information comes from copyright owners that are offering service providers "great sums for their users' secrets," Ohm said in his report. As an example, he noted that the recording and movie industries "view ISP monitoring as an avenue for controlling what they see as rampant infringing activity, particularly on P2P networks."
In addition, ISPs, which already are saddled with a requirement that they comply with a 1994 US federal wiretapping law called the Communications Assistance for Law Enforcement Act, or CALEA, are feeling increased pressure from the federal government to configure their networks so they are able to quickly assist monitoring activities by law enforcement agencies, Ohm said.