U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

58–071 PDF 2008

WHAT YOUR BROADBAND PROVIDER KNOWS 

ABOUT YOUR WEB USE: DEEP PACKET 

INSPECTION AND COMMUNICATIONS LAWS AND 

POLICIES 

HEARING 

BEFORE THE

SUBCOMMITTEE ON TELECOMMUNICATIONS AND 

THE INTERNET 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TENTH CONGRESS 

SECOND SESSION 

JULY 17, 2008 

Serial No. 110–137 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

COMMITTEE ON ENERGY AND COMMERCE 

JOHN D. DINGELL, Michigan, Chairman 

HENRY A. WAXMAN, California 

EDWARD J. MARKEY, Massachusetts 

RICK BOUCHER, Virginia 

EDOLPHUS TOWNS, New York 

FRANK PALLONE, JR., New Jersey 

BART GORDON, Tennessee 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

BART STUPAK, Michigan 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

Vice Chairman 

LOIS CAPPS, California 

MIKE DOYLE, Pennsylvania 

JANE HARMAN, California 

TOM ALLEN, Maine 

JAN SCHAKOWSKY, Illinois 

HILDA L. SOLIS, California 

CHARLES A. GONZALEZ, Texas 

JAY INSLEE, Washington 

TAMMY BALDWIN, Wisconsin 

MIKE ROSS, Arkansas 

DARLENE HOOLEY, Oregon 

ANTHONY D. WEINER, New York 

JIM MATHESON, Utah 

G.K. BUTTERFIELD, North Carolina 

CHARLIE MELANCON, Louisiana 

JOHN BARROW, Georgia 

DORIS O. MATSUI, California 

JOE BARTON, Texas 

Ranking Member 

RALPH M. HALL, Texas 

FRED UPTON, Michigan 

CLIFF STEARNS, Florida 

NATHAN DEAL, Georgia 

ED WHITFIELD, Kentucky 

BARBARA CUBIN, Wyoming 

JOHN SHIMKUS, Illinois 

HEATHER WILSON, New Mexico 

JOHN SHADEGG, Arizona 

CHARLES W. ‘‘CHIP’’ PICKERING, 

Mississippi 

VITO FOSSELLA, New York 

ROY BLUNT, Missouri 

STEVE BUYER, Indiana 

GEORGE RADANOVICH, California 

JOSEPH R. PITTS, Pennsylvania 

MARY BONO MACK, California 

GREG WALDEN, Oregon 

LEE TERRY, Nebraska 

MIKE FERGUSON, New Jersey 

MIKE ROGERS, Michigan 

SUE WILKINS MYRICK, North Carolina 

JOHN SULLIVAN, Oklahoma 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

PROFESSIONAL STAFF

DENNIS B. FITZGIBBONS, Chief of Staff 

GREGG A. ROTHSCHILD, Chief Counsel 

SHARON E. DAVIS, Chief Clerk 

DAVID L. CAVICKE, Minority Staff Director 

(II)

(III) 

SUBCOMMITTEE ON TELECOMMUNICATIONS AND THE INTERNET

EDWARD J. MARKEY, Massachusetts, Chairman 

MIKE DOYLE, Pennsylvania 

Vice Chairman 

JANE HARMAN, California 

CHARLES A. GONZALEZ, Texas 

JAY INSLEE, Washington 

BARON P. HILL, Indiana 

RICK BOUCHER, Virginia 

EDOLPHUS TOWNS, New York 

FRANK PALLONE, JR., New Jersey 

BART GORDON, Tennessee 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

BART STUPAK, Michigan 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

LOIS CAPPS, California 

HILDA L. SOLIS, California 

JOHN D. DINGELL, Michigan (ex officio) 

CLIFF STEARNS, Florida 

Ranking Member 

FRED UPTON, Michigan 

NATHAN DEAL, Georgia 

BARBARA CUBIN, Wyoming 

JOHN SHIMKUS, Illinois 

HEATHER WILSON, New Mexico 

CHARLES W. ‘‘CHIP’’ PICKERING, 

Mississippi 

VITO FOSELLA, New York 

STEVE BUYER, Indiana 

GEORGE RADANOVICH, California 

MARY BONO MACK, California 

GREG WALDEN, Oregon 

LEE TERRY, Nebraska 

MIKE FERGUSON, New Jersey 

JOE BARTON, Texas (ex officio) 

(V) 

C O N T E N T S 

Page 

Hon. Edward J. Markey, a Representative in Congress from the Commonwealth of Massachusetts, opening statement .................................................... 1 

Hon. Cliff Stearns, a Representative in Congress from the State of Florida, 

opening statement ................................................................................................ 3 

Hon. Gene Green, a Representative in Congress from the State of Texas, 

opening statement ................................................................................................ 4 

Hon. Bart Stupak, a Representative in Congress from the State of Michigan, 

opening statement ................................................................................................ 5 

Hon. John D. Dingell, a Representative in Congress from the State of Michigan, prepared statement ...................................................................................... 132 

WITNESSES

Alissa Cooper, Chief Computer Scientist, Center for Democracy and Technology .................................................................................................................... 6 

Prepared statement .......................................................................................... 8 

Robert R. Dykes, Chairman and CEO, NebuAd, Inc. ........................................... 40 

Prepared statement .......................................................................................... 43 

David P. Reed, Ph.D., Adjunct Professor, The Media Lab, Massachusetts 

Institute of Technology ........................................................................................ 61 

Prepared statement .......................................................................................... 64 

Bijan Sabet, General Partner, Spark Capital ....................................................... 85 

Prepared statement .......................................................................................... 88 

Scott Cleland, President, Precursor LLC ............................................................... 94 

Prepared statement .......................................................................................... 96 

(1) 

WHAT YOUR BROADBAND PROVIDER KNOWS 

ABOUT YOUR WEB USE: DEEP PACKET INSPECTION AND COMMUNICATIONS LAWS 

AND POLICIES 

THURSDAY, JULY 17, 2008 

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON TELECOMMUNICATIONS

AND THE INTERNET, 

COMMITTEE ON ENERGY AND COMMERCE, 

Washington, DC. 

The subcommittee met, pursuant to call, at 9:40 a.m., in room 

2123 of the Rayburn House Office Building, Hon. Edward J. Markey (chairman) presiding. 

Members present: Representatives Markey, Doyle, Gonzalez, Inslee, Eshoo, Stupak, Green, Solis, Stearns, Radanovich, and Walden. 

Staff present: Amy Levine, Mark Seifert, Tim Powderly, David 

Vogel, Philip Murphy, Neil Fried, and Garrett Golding. 

OPENING STATEMENT OF HON. EDWARD J. MARKEY, A REPRESENTATIVE IN CONGRESS FROM THE COMMONWEALTH 

OF MASSACHUSETTS 

Mr. MARKEY. Good morning, and welcome to the Subcommittee 

on Telecommunications and the Internet and our hearing on deep 

packet inspection technology and consumer privacy and issues that 

are related to it. 

Privacy is a cornerstone of freedom. Without question, the digital 

era in communications technologies will heighten concern about the 

sensitivity of personal information that can be collected or disclosed 

about individual citizens and the ever-increasing pervasiveness of 

such data collection. Obviously this is happening across our society, 

from video cameras at crosswalks and federal buildings, checkout 

scanners in supermarkets to the collection of information by national security entities and the gleaning of information from a consumer’s Web use. I have long fought for privacy provisions to be 

added to our Nation’s communications statutes to keep pace with 

changes in technology and markets. I successfully offered amendments that became law in previous Congresses to protect children’s 

online privacy, to extend the privacy provisions of the Cable Act to 

direct broadcast satellite television providers, to add privacy protections for wireless location information and to strengthen telemarketing privacy protections. In previous Congresses, I also offered legislative proposals to establish a privacy bill of rights for 

Internet users that would have covered Web sites like Google, 

2 

eBay, Amazon, and others, as well as separate legislation that required search engine sites to destroy data collected from users that 

was no longer needed for any legitimate purpose, and so I obviously 

have long supported the idea of legislating where needed and to do 

so in a way that strengthened and harmonized our Nation’s communications privacy laws. In this subcommittee, we have direct jurisdiction over the Federal Communications Commission and providers of telecommunications capabilities and services. As such, 

providers of broadband access to the Internet fall squarely into our 

oversight role. 

Today we look at how so-called deep packet inspection technologies affect consumer privacy and related issues following up on 

letters that ranking Republican Joe Barton, Chairman John Dingell, and I have recently sent raising questions about these technologies. There are a couple of notable differences between the 

data-gathering that individual Web sites can and do conduct and 

that posed by the deployment of deep packet inspection technologies in broadband networks. First, there is a distinction in the 

detail, the type and the amount of data collected. As opposed to individual Web sites that know certain information about visitors to 

its Web sites and affiliates, deep packet inspection technologies can 

indicate every Web site a user visits and much more about a person’s Web use. Second, there is already an array of laws on the 

books that arguably address a broadband provider’s treatment of 

these technologies and services, including the Cable Act, the Electronic Communications Privacy Act, and the Communications Act, 

among other laws. 

From a privacy perspective, given the sheer sophistication of the 

technology capability and the obvious sensitivity of the personal information that can be gleaned from a consumer’s Web use, I believe 

broadband providers deploying deep packet inspection technologies 

must adopt clear privacy policies. In my view, consumers deserve, 

at the least, at the minimum, one, clear, conspicuous and constructive notice about what broadband providers’ use of deep packet inspection will be; two, meaningful opt-in consents for such use; and 

three, no monitoring or data interception of those consumers who 

do not grant consent for such use. 

Deep packet inspection technologies can be deployed not only 

with the intent to serve targeted advertisements tailored to a user’s 

Web habits, they can also be utilized to manage traffic on the network, detect network threats, and discover the presence of copyrighted or illegal material and other applications. As a result, these 

technologies raise not only significant privacy concerns, but also 

highlight broader policy questions, including how they impact the 

evolution of the Internet itself and its future prospects for driving 

innovation and fostering competition and job creation. Today’s 

hearing will allow the subcommittee to better understand the implications of deep packet inspection technologies on consumers, 

broadband providers, and the broader Internet. 

We welcome our witnesses to the subcommittee. We thank them 

for their willingness to be here today. 

Mr. MARKEY. Now I turn and recognize the ranking member of 

the Subcommittee on Telecommunications and the Internet, the 

gentleman from Florida, Mr. Stearns. 

3 

OPENING STATEMENT OF HON. CLIFF STEARNS, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF FLORIDA 

Mr. STEARNS. Good morning, and thank you, Mr. Chairman. The 

use of consumer Internet information for marketing purposes is not 

a new issue to all of us. Both the Energy and Commerce Committee and, of course, this subcommittee have previously held hearings to examine a multitude of concerns under the broad banners 

of online privacy and marketing, including the online collection of 

personally identifiable information and the use of cookies and other 

tracking tools. 

My colleagues, our goal today should be to broadly examine how 

companies are using consumer Internet behavior to tailor online 

advertising; both the benefit to consumers, as well as any potential 

concerns that have not already been addressed by industry. Why 

then are we just focusing on broadband providers? Why are we not 

talking about search engines and Internet advertising networks as 

well? Wouldn’t we have the same concerns with those folks? 

Broadband providers are considering limited trials of tailored 

Internet advertising, but companies such as Google and Yahoo and 

Microsoft all have search engines, have long used tailored Internet 

advertising. Certainly we cannot have this discussion without addressing them as well. Whatever the appropriate standards are, I 

think everybody agrees they should apply to everyone. 

We can all agree that consumers should be notified, but one of 

the questions is whether we should require explicit consent 

through opt-in procedures or whether opt-out procedures are sufficient. That is the core question. Whatever we decide, we need to 

be consistent. Consumers don’t care if you are a search engine or 

a broadband provider. They want to ensure you are not violating 

their privacy either way. 

I am particularly interested in learning from the witnesses the 

ways in which the use of behavioral information for marketing has 

been shown to have already harmed the consumers. It is imperative that there be some evidence of harm if we are going to regulate this practice or we run the risk of prematurely restricting the 

latest technological advancements that are related to online marketing. 

As the overall economy continues to take a significant downturn, 

the government should not be contemplating how to make it harder 

for small businesses to succeed. Targeted advertising may be essential for small businesses to compete with larger ones. They don’t 

have the budget of General Motors or Ford. Small businesses don’t 

have hundreds of millions of dollars to spend on this advertising. 

So being able to target their ads on the Internet to consumers most 

likely to use their products gives them a better chance to succeed. 

Overreaching privacy regulation at this time could possibly do 

more damage to this fragile economy. Companies should be as 

transparent as possible about what information they collect and 

how they are using it. That way, consumers will be empowered 

with better information to make obviously better decisions. 

The Federal Trade Commission began inquiring into targeted online advertising practices with workshops. This effort culminated 

with it publishing proposed industry self-regulatory principles. 

Those principles were designed to ensure that companies that enVerDate Nov 24 2008 15:59 Oct 08, 2010 Jkt 037690 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 C:\DOCUMENTS AND SETTINGS\CWELLS1\HEARINGS\110-137 SCOM1 PsN: JIMC
4 

gage in behavioral targeting voluntarily adopt best practices that 

provide increased transparency and choice to consumers about 

these practices. This approach seemed to be working. In fact, the 

FTC testified in a Senate Commerce Committee hearing just last 

week that it continues to believe we have not reached the point 

where legislation to address online behavioral targeting is immediately necessary. 

I have a long track record of talking very seriously about this 

committee’s mandate to consider online privacy and marketing 

issues, which was evidenced by the many hearings I helped organize in my former role as chairman and ranking member of the 

Subcommittee on Commerce, Trade, and Consumer Protection. I 

look forward to working with the chairman and continuing that 

work on privacy issues as a member and ranking member of this 

subcommittee. I think the hearing is important. I look forward to 

its results. 

As we examine these issues today, I hope this panel can keep in 

mind that premature regulation of such practices, particularly in 

the absence of evidence of consumer harm, could have a significant 

negative economic impact at a time that many businesses, and particularly small businesses, are struggling, so I will look very closely 

at these issues before we leap to legislative proposals that even the 

FTC is not calling for at this time. 

And with that, Mr. Chairman, thank you. 

Mr. MARKEY. I thank the gentleman. The chair recognizes the 

gentleman from Michigan, Mr. Stupak. I apologize. I should have 

recognized the gentleman from Texas, Mr. Green, first. Excuse me. 

OPENING STATEMENT OF HON. GENE GREEN, A 

REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. GREEN. Thank you, Mr. Chairman, for holding this hearing 

on the deep packet inspection technology, and I want to thank you 

and Chairman Dingell and Ranking Member Barton for your leadership and action on this issue over several months. 

It is important we look at this issue in light of recent news regarding Embarq and Charter Communications. The potential for 

invasion of privacy posed by DPI technology if used in the wrong 

way is extremely troubling. There are necessary and legitimate 

uses for DPI, specifically for quality of service reasons, monitoring 

for worms or viruses, use by law enforcement and using it to monitor traffic to the extent necessary to maintain network integrity 

and prevent congestion in the last mile of the network. Use of DPI 

by a service provider network operator to protect network infrastructure and systems is one thing; using DPI to monitor Web 

users’ patterns and habits by a third party to direct advertising or 

other content their way is a separate and troubling issue. 

I am most concerned about the privacy implications of targeted 

advertising based on data collected on Internet users without their 

knowledge, and our subcommittee has a history of being concerned 

about it, whether a few years ago it was called a cookie or whatever. At the minimum, this should be something that a consumer 

is notified of and must opt into specifically outside of agreeing to 

some service terms and conditions, and I can’t imagine most of my 

constituents agreeing to have their activities monitored. Some peoVerDate Nov 24 2008 15:59 Oct 08, 2010 Jkt 037690 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 C:\DOCUMENTS AND SETTINGS\CWELLS1\HEARINGS\110-137 SCOM1 PsN: JIMC
5 

ple may want this kind of information directed toward them, but 

I and I imagine most of my folks, want to know if data being collected on us and should not have to opt out or install a cookie on 

our own Web site browser to prevent the collection of data. The 

idea that this would take place without the affected consumers or 

Web sites knowing it, without consumers having to specifically 

agree to have their information collected and analyzed for uses 

other than for the network operator to ensure quality service, is 

contemptible. 

I am aware Google and Yahoo and others do similar targeting 

using other technology, and I believe this should be looked into as 

well, but primary jurisdiction for that falls under another subcommittee. To the extent we can address privacy issues under this 

subcommittee’s jurisdiction, I believe we can and should. 

Again, Mr. Chairman, I want to thank you for the hearing today 

on deep packet inspection, and I look forward to hearing more 

about the various uses and impacts it has both in improved network performance but also the potential privacy implications. 

Thank you. 

Mr. MARKEY. The gentleman’s time has expired. The chair recognizes the gentleman from Michigan, Mr. Stupak. 

OPENING STATEMENT OF HON. BART STUPAK, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF MICHIGAN 

Mr. STUPAK. Thank you, Mr. Chairman, and thank you for holding this hearing on deep packet inspection technology. It is important that we discuss the policy implications of this newest advancement in network technology. 

Applications of DPI technology provide a number of benefits. 

Internet users are protected from the latest viruses through better 

filtering security, network administrators have more efficient 

means of managing traffic, and law enforcement can use these powerful tools to combat cybercrime. However, while we stand to gain 

from DPI technology, we need to ensure the protections Congress 

has put in place on behalf of a consumer’s personal information are 

upheld. One of our witnesses today, NebuAd, offers targeted and 

behavioral advertising services by taking information from the network to create detailed profiles of the Internet service provider subscribers. While NebuAd has stated that the information they collect 

is completely anonymous, there are legitimate consumer privacy 

questions. The ISPs that partner with NebuAd should be offering 

consumers an option to opt in for having their data collected, not 

opt out. If the hardware of the network is configured to collect their 

data, they are only opting out of having their information sold 

while it continues to be collected. This is especially important to 

broadband subscribers with only one choice for an ISP. They do not 

have the option to choose a different ISP if they feel uncomfortable 

knowing that the network they are accessing tracks their every 

move. As broadband providers continue to integrate this technology, will future application of DPI technology be as transparent 

to the public? 

Mr. Chairman, thank you again for holding today’s hearing. I 

look forward to hearing from our witnesses about the application 

6 

of DPI technology and its implications, good and bad, for the future 

of the Internet. 

Mr. MARKEY. The gentleman’s time has expired. The chair recognizes the gentleman from Pennsylvania, Mr. Doyle. 

Mr. DOYLE. Thank you. Mr. Chairman. I am going to waive an 

opening statement and just add it on to my questions. 

Mr. MARKEY. The gentleman from Pennsylvania will have that 

time added to his question period, and seeing no other members 

here to make opening statements, we will turn to our panel, and 

we will recognize our first witness, Alissa Cooper, who is the chief 

computer scientist for the Center for Democracy and Technology. 

Her work focuses on the intersection of computer and networking 

technologies with consumer privacy. We welcome you, Ms. Cooper. 

Whenever you are ready, please begin. 

STATEMENT OF ALISSA COOPER, CHIEF COMPUTER 

SCIENTIST, CENTER FOR DEMOCRACY AND TECHNOLOGY 

Ms. COOPER. Chairman Markey and members of the subcommittee, on behalf of the Center for Democracy and Technology, 

I thank you for the opportunity to testify today. CDT is a nonprofit 

public policy organization dedicated to keeping the Internet open, 

innovative and free. The legal and policy implications of the technique known as deep packet inspection are of great importance to 

us. 

The Internet was built on the principle that data could travel 

from one end of the network to the other, largely without interference along the way. Likewise, privacy laws in this country were 

crafted to protect our communications, whether they be phone calls, 

e-mails, or Web site visits, from being intercepted in transit. The 

confluence of technology and policy in this respect was no accident, 

and it has resulted in the emergence of the Internet that we know 

and love today, a trusted platform that supports astounding levels 

of economic activity and individual expression. Deep packet inspection, or DPI, could be used in ways that upend this paradigm by 

giving network operators the ability to intercept and analyze the 

Internet communications of their subscribers. While some uses of 

DPI technology are benign and even beneficial, others raise serious 

questions about the future of privacy, innovation and openness online. Though all these issues are near and dear to CDT, today I will 

focus specifically on privacy. 

The bottom line is this: Certain uses of DPI allow consumers’ 

communications to be centralized, scrutinized, and monetized. Absent careful privacy safeguards, DPI systems run the risk of damaging the consumer confidence in the Internet that has allowed the 

medium to flourish. DPI has recently been put to a new use: the 

tracking of consumers’ online activities for the purpose of showing 

them targeted ads. Traditionally, ad network companies have contracted with Web sites to collect data about consumers. In the new 

model, ad networks partner instead with Internet service providers 

and do their collection using DPI. 

As it has been implemented thus far, this model poses unique 

risks to consumer privacy. CDT values advertising as potent fuel 

for Internet growth, and we all cherish the free content that it supports, but ad networks that use DPI may gain access to the bulk 

7 

of consumers’ Web-browsing activities, including visits to political, 

religious, and government Web sites. While traditional ad networks 

may be large, few, if any, provide the opportunity to collect information as comprehensively as with DPI. Furthermore, most consumers would be quite surprised to find a middleman lurking between them and the Web sites they visit. The DPI model defies 

consumer expectations. 

As several members of this subcommittee have rightly pointed 

out, the Cable Act prohibition against collecting or disclosing personally identifiable information without consent is relevant here. 

We believe that a view into most everything a person does on the 

Web constitutes personally identifiable information, PII, under the 

statute. So far, cable ISPs have not only failed to obtain consent, 

but also they have not even told their subscribers that their Internet communications will be captured and shared with a third 

party. 

The Federal Wiretap Act is also applicable. The Wiretap Act prohibits the interception and disclosure of electronic communications 

without consent. Importantly, the Act applies regardless of whether 

communications are highly personal and sensitive or completely 

anonymous. Think of it this way: if an eavesdropper were listening 

in on your phone calls but didn’t know your identity or record the 

calls, you would likely still feel that your privacy had been violated. 

The same logic applies to DPI systems. 

Though consent is merely one of many critical factors in designing a DPI system, these laws raise the question: how should consent be obtained? Notice must be uncomplicated and unavoidable, 

and it should mention the third party if one is involved. Consent 

should be expressly provided, not assumed. If a consumer does not 

consent, her communication should not be intercepted, and consumers should have the opportunity to change their minds, revoking their consent at any time through an easy-to-find, simple-to-use 

process. DPI has not emerged in a vacuum but rather in a digital 

environment where more data is collected and retained for longer 

periods than ever before. Although our communications privacy 

laws apply to the model I have described today, our Nation still has 

no comprehensive consumer privacy law to protect personal data 

across the board. 

Congress needs to take a broad look at both DPI and online privacy concerns at large. Among other recommendations, my written 

statement suggests that, one, the subcommittee should urge the 

Federal Trade Commission to address DPI in its proposed privacy 

guidelines and to exercise its full enforcement authority over online 

advertising, and two, the subcommittee should set a goal of enacting in the next year baseline consumer privacy legislation that 

would protect consumers from inappropriate collection and misuse 

of their information. 

Thank you, and I look forward to your questions. 

[The prepared statement of Ms. Cooper follows:] 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

Mr. MARKEY. Thank you, Ms. Cooper, very much. 

Our second witness is Mr. Robert Dykes. He is the founder, 

chairman, and chief executive officer of NebuAd, a behavioral advertising firm. Prior to forming NebuAd, Mr. Dykes held senior positions with Symantec Corporation and the Ford Motor Company. 

We welcome you, sir. Whenever you are ready, please begin. 

STATEMENT OF ROBERT R. DYKES, CHAIRMAN AND CEO, 

NEBUAD, INC. 

Mr. DYKES. Thank you, Mr. Chairman, Mr. Stearns, and other 

members of the committee. My name is Bob Dykes, CEO of 

NebuAd, a recent entry into the online advertising industry. 

My objectives today are to recognize that our business process, 

which involves partnering with the Internet Service Providers, the 

ISPs, raises legitimate privacy issues, but also I want to explain 

how we have addressed those issues and continue to do so and to 

enlighten the members of the subcommittee in as much detail as 

possible within the time allotted about NebuAd’s service and technology. In doing so, I hope to dispel the many myths and misconceptions that have surfaced about our company. 

In many ways, I feel like Galileo when he was viewed with skepticism on demonstrating that the earth revolved around the sun. 

Members of the subcommittee, the science exists today, and 

NebuAd is using it to create truly anonymous profiles that cannot 

be hacked or reverse-engineered, and it is possible to provide ISP 

subscribers prior robust notification and a meaningful opportunity 

to express their informed choice whether to participate in NebuAd’s 

targeted advertising so that they are in control of their online experience. 

I come from a security background, serving for many years as executive vice president of Symantec Corporation. When we launched 

NebuAd several years ago, it was a time when many people had 

particularly heightened concerns about data security. As part of its 

mission, NebuAd sought to address these privacy and security concerns. As you will see, NebuAd systems are designed so that no 

one, not even the government, can determine the identity of our 

users. 

Currently, online advertising solutions and data collection methods operate in many locations throughout the Internet ecosystem, 

from users’ computers to individual Web sites to networks of Web 

sites. The NebuAd service, in partnership with ISPs, provides consumers with significant benefits, serving them with more relevant 

ads, which they want, while ensuring they have robust privacy protections and control over their online experience. 

NebuAd’s ad network also is designed to benefit two groups that 

provide substantial value on the Internet, the many smaller Web 

sites and general use sites that have difficulty maintaining free access to their content and the ISPs who need to upgrade their infrastructure to provide increased bandwidth for consumers who increasingly want access to Internet-delivered videos. NebuAd creates these benefits by using a select set of a user’s Internet activities to construct anonymous inferences about likely interests, which 

are then used to select and serve the most relevant advertisements. 

41 

We appreciate that there are groups who would like the Internet 

service providers to be like the post office, but ISPs and the many 

other entities that operate the Internet are in fact commercial enterprises, not nonprofit, quasi-government organizations. As such, 

they can see that much of the Internet is well supported by advertising revenue, and it is legitimate for them to seek ways to also 

increase their advertising revenues. NebuAd enables that endeavor 

while allowing its ISP partners to maintain their subscribers’ trust 

by giving them control over their online experience. The NebuAd 

service is architected and its operations are based on principles 

central to strong privacy protection. That is, we provide users with 

prior robust notice about the service and the opportunity to express 

informed choice about whether to participate both before the service takes effect and persistently thereafter. We do not collect or use 

personally identifiable information, that is PII. We do not store raw 

data linked to identifiable individuals, and we provide state-of-theart security for the limited amount of information we do store. 

I listened to comments from members of the Senate Commerce 

Committee last week and the CDT’s testimony during that hearing. 

Immediately after the Senate hearing last week, I made plans to 

sit down with the CDT to discuss practical solutions to issues they 

and Members of Congress have raised around notice and informed 

choice. We met yesterday with staff of the CDT for a few hours and 

believe that a common ground can be reached on a framework that 

involves prior and unavoidable, simple, but complete notice to ISP 

subscribers about NebuAd’s operations and an easy and obvious 

means for consumers to express their informed choice both before 

NebuAd’s behavioral advertising takes effect and thereafter. We 

also reached a high level of understanding of how a mechanism can 

be designed that would honor consumers’ choice not to participate 

in NebuAd’s targeted advertising and not to have information 

about their browsing behavior flow to our service. I am extremely 

encouraged by this and have set a goal of being a privacy leader 

since I started NebuAd. I will continue to work with CDT on the 

framework we discussed yesterday, and I am happy to keep members of this committee informed of our progress. 

In the meantime, we continue to innovate on privacy. NebuAd 

last week announced that it was enhancing the industry standard 

notice options of regular mail and e-mail with a new interstitial or 

online service, which would appear on a user screen prior to the 

NebuAd service being enacted. We have designed this notice to be 

easily readable and understandable, so that users can exercise informed choice. In addition, we are working with our ISP partners 

to make users’ choice of participating in the service more persistent. The NebuAd opt-out system is a more robust mechanism 

than traditional cookie-based opt-out systems, and as a default, 

users are considered opted out of the NebuAd system until such 

time that the system can confirm the consumer has not opted out. 

So for example, if your Web browser blocks cookies, the NebuAd 

system will consider you to be an opted-out user and will exclude 

you from NebuAd’s information collection and targeted ads. Further, we are developing a network-based opt-out and working with 

ISPs on other mechanisms that can be offered to users to honor 

even more robust and persistent choice, and these will be able to 

42 

be configured to ensure that traffic from opted-out users is not diverted. 

We understand that to gain the public’s trust, we need to adopt 

strong privacy protections. Ours have been reviewed by such entities as the Ponemon Institute, and we are engaging a Big Four 

audit firm to conduct an audit to verify that we do what we say 

we do. 

This committee has long been involved with the creation of privacy statutes covering the cable and telecommunications industries, as well as specific statutes addressing online privacy for children and telemarketing. Yet even these and other privacy statutes 

have been developed one at a time. There is a common thread running through them all, that is, the more sensitive data that is collected and when the collection or disclosure of the data could harm 

or embarrass a consumer, more rigorous disclosure and consent requirements tend to be imposed. When raw data is linked to identifiable individuals, there is an emerging trend that more rigorous 

disclosure, consent, and security requirements should be imposed. 

NebuAd supports this privacy paradigm, which provides users 

with consistent expectations and substantial protections. This paradigm also is technology and business neutral, and it is the basis 

on which NebuAd built its technology and operations. NebuAd 

urges the committee to maintain both the paradigm and the principle of technology and business neutrality, and we are in favor or 

a baseline privacy law consistent with that principle. Thank you. 

[The prepared statement of Mr. Dykes follows:] 

43 

44 

45 

46 

47 

48 

49 

50 

51 

52 

53 

54 

55 

56 

57 

58 

59 

60 

61 

Mr. MARKEY. Thank you, Mr. Dykes. 

Our next witness, Dr. David Reed, is an adjunct professor of engineering at the Massachusetts Institute of Technology. He is affiliated with MIT’s renowned media lab, where he focuses on communications technologies, and he was also a pioneer in the development early on of the Internet. We welcome you, Dr. Reed. Whenever you are ready, please begin. 

STATEMENT OF DAVID P. REED, PH.D., ADJUNCT PROFESSOR, 

THE MEDIA LAB, MASSACHUSETTS INSTITUTE OF TECHNOLOGY 

Mr. REED. Thank you. Mr. Chairman and distinguished members, good morning. I want to thank you all for the opportunity to 

testify on this matter, which I think is very important. I have been 

involved, as you mentioned, with the Internet’s design and development since 1976, when I joined the Internet project as one its architects working with Vint Cerf and Bob Kahn and many others. 

As one of those who designed the Internet, I feel I have a duty to 

those who use the Internet today and will use it tomorrow. That 

personal duty, rather than any commercial interest, is why I am 

here today. 

Though we all use the Internet, let me set some context that relates to its technology and that can explain my testimony. First of 

all, participating in the Internet as a transport or access provider 

implies adherence to a set of technical protocols and standards and 

standard technical practices that are essential for the proper functioning of the collective Internet as a whole. These rules and practices are analogous in many ways to the rules and practices of global banking or international commerce. There is a strong distinction 

made in the Internet design between information needed to transport Internet datagrams, or packets, and the information that the 

end users request to be transported. This distinction is crucial to 

the scalability, innovation rate, and economic impact of the Internet, as well as playing an important role in ensuring the privacy 

and safety of users of the Internet and limiting liability for the 

companies that invest in providing the Internet infrastructure. 

The speed of digital systems has changed dramatically over the 

last 30 years and has led to a new, innovative technology that allows the inspection of packets as they transit the Internet at full 

speed and in complete depth. This set of technologies, often called 

deep packet inspection, make it possible on a large scale to dig into 

the content of all end-to-end messages at almost any point in the 

network, do selective recording and analysis of such messages, and 

to modify and to inject messages into the Internet that appear to 

be messages from a particular source but in fact are partially the 

result of actions by a third party unrelated to that source and without the ability of the end-point system to detect the modifications 

or insertions. 

These technical innovations are being packaged into applications 

and sold as solutions to Internet access providers and Internet 

transport providers by a number of vendors, notably Phorm, 

NebuAd, Sandvine, and Ellacoya Networks, but hardly limited to 

those vendors. A subset of these technologies, called deep packet inspection technologies, targeted at marketing are particularly worriVerDate Nov 24 2008 15:59 Oct 08, 2010 Jkt 037690 PO 00000 Frm 00067 Fmt 6633 Sfmt 6633 C:\DOCUMENTS AND SETTINGS\CWELLS1\HEARINGS\110-137 SCOM1 PsN: JIMC
62 

some because they involve inspection of end-user to end-user information content, decoding that content and making of inferences 

about the meaning of that content and modifying the content in 

flight without particularly making that inference or the other activities an aspect of the agreement between the end-users on both 

ends. 

In my testimony today I draw several conclusions that Congress 

may want to consider as it explores use of these technologies. First, 

and this is most important, that DPI technologies are not at all 

necessary to operating the Internet or to profitable operation of 

Internet operators. In fact, they actually violate long-agreed standards and principles of Internet design since the beginning, and 

these principles that have been around from the beginning have led 

to the Internet’s enormous impact and continued success. 

Second, DPI technologies pose major risks to the economic success of the Internet as a whole. They do so by normalizing nonstandard and risky technical activity on the part of telecom operators and broadband operators who may choose to exploit their captive customers rather than transparently deliver the communications services for which their customers have paid. 

Third, that protecting themselves from the negative impact of 

these technologies on their private business imposes significant additional costs on the knowledgeable customers of Internet transport 

operators and on developers of new Internet services while at the 

same time exploiting the unwitting and captive customers of service providers who choose to deploy them. 

Let me start off by saying, it is best to think of the Internet as 

a shipping service, in some sense a collection of shipping modes 

like airplanes and ships and railroads and so forth, that carry 

packages. The end-users put their information in these packages, 

which will be called packets, and put addressing information on the 

outside of the packet, and they present them to a shipping agent, 

who chooses a path and a set of warehouses along the way, that 

might be called routers, that deliver these packets. What makes 

deep packet inspection deep is the use of this technology to collect 

and modify the internal contents of these packages as if they were 

a high-speed X-ray technology that was able to examine packets 

without changing them and also high-speed manufacturing technology that can actually open up the packets, manufacture something new, stick it in, and send it along, and I think that analogy 

is actually very strong. Note that it is unnecessary for the carriers 

to look inside the packages to do their job. This separation of concerns that was built into the Internet, that of transport versus 

packet access, is part of the economic success of the Internet and 

also part of the privacy functionality that was built in from the beginning. There should be no reason to look inside these packets. 

One more thing about the Internet that is different is that the 

Internet is constructed based on protocols or conversations between 

the endpoints, and these protocols are an understanding between 

the end-users, not the end-users and their carrier. 

When DPI systems make inferences about packet contents, they 

do not have access to the meaning that is intended by the 

endpoints of those protocols, and because of that, it poses signifiVerDate Nov 24 2008 15:59 Oct 08, 2010 Jkt 037690 PO 00000 Frm 00068 Fmt 6633 Sfmt 6633 C:\DOCUMENTS AND SETTINGS\CWELLS1\HEARINGS\110-137 SCOM1 PsN: JIMC
63 

cant risks, and with that, I will finish here and await your questions. 

[The prepared statement of Mr. Reed follows:] 

64 

65 

66 

67 

68 

69 

70 

71 

72 

73 

74 

75 

76 

77 

78 

79 

80 

81 

82 

83 

84 

85 

Mr. MARKEY. Thank you, Dr. Reed, very much. 

And our next witness is Mr. Bijan Sabet. He is a general partner 

at Spark Capital, a venture capital fund focused on the media, 

technology, and entertainment industries. Mr. Sabet has led numerous investments in startup technology companies and has 

worked for Apple Computer. We welcome you, sir. Please begin. 

STATEMENT OF BIJAN SABET, GENERAL PARTNER, SPARK 

CAPITAL 

Mr. SABET. Thank you, Mr. Chairman and Ranking Member 

Stearns, for the opportunity to testify today. I am from Boston, but 

I am a Yankee fan, so please don’t hold that against me. 

Mr. MARKEY. Thank for you helping us to win the All-Star Game 

so the final game in the World Series can be at Fenway Park. We 

thank all the Yankee players for helping us. 

Mr. SABET. All right. Well, my name is Bijan Sabet. I am a general partner at Spark Capital based in Boston, Massachusetts. 

Spark Capital, as you said, is a venture capital firm, and we are 

managing and investing in excess of $620 million. We make direct 

investments in early-stage companies, in the Internet, media and 

technology industries. To date, we have made 25 investments in 

this area. We are being very aggressive, and it probably will be 

over 30 companies next year, and our companies are generating 

real value, real technology, real revenue, and real jobs. 

Deep packet inspection is something I care a great deal about, 

as well as my partners, and will directly impact the Internet ecosystem, which is beginning to thrive. As a technology, I believe 

there is nothing wrong with DPI. It is a significant technology 

breakthrough, and up until fairly recently, DPI could not be 

achieved at scale at any reasonable cost. So I don’t have any criticism about NebuAd specifically or any vendors that have DPI technology. The issue at hand is how DPI is implemented and how it 

is managed. It is less about whether these vendors have certain 

features or not. It is about what can and cannot be done with DPI. 

So to start off, just a quick definition of DPI. I think Wikipedia 

cites it well when it states that deep packet inspection, or sometimes complete packet inspection, is a form of computer network 

packet filtering that examines the data or header form of packets 

as it passes an inspection point searching for non-protocol compliance, viruses, spam, intrusion, or predefined criteria to decide if 

the packet can pass or if it needs to be routed to a different destination or for the purpose of collecting statistical information. This 

is in contrast to shallow packet inspection, usually just called packet inspection, which just checks the header portion of a packet. 

So we need to understand the impact of DPI. DPI can provide 

significant economic and consumer benefit if used correctly, but it 

can cause significant problems if used incorrectly. There are really 

two issues to consider. One is privacy, which I think Dr. Reed and 

Ms. Cooper summarized very well, and I largely agree with them. 

I think the other issue is how DPI relates to the open Internet. 

My interest in providing this testimony is less about privacy per 

se and more about DPI’s impact on the open Internet and the 

Internet ecosystem. The important question is, do we want an open 

Internet or a closed Internet, where ISPs can decide what content 

86 

and applications should be available? Specifically, should ISPs decide if a competitor’s product will be able to flow to the home or 

not? That is just one example. That is the topic I would very much 

like to discuss with all of you. 

We have all seen the explosion and growth of the Internet in the 

business and consumer markets. It has been a large success. Highspeed Internet to the home has fueled this growth, with applications such as Apple iTunes, Google’s YouTube, joint ventures such 

as Hulu by NBC and Fox. This world is moving quite fast. Consider 

Netflix, which was once only a mail order DVD rental company. It 

is now streaming full-length movies on demand over the Internet. 

Thus, the impact of high-speed Internet has just begun. Hundreds 

and hundreds of startups by venture capitalists like myself are investing in this space, because entrepreneurs and investors alike see 

the value in the open Internet. 

And while the Internet is growing rapidly and investors are 

pouring money into the new ideas and new opportunities and new 

businesses and new jobs funding new technology, U.S. broadband 

penetration is not as good as it should or could be. The chart I provided in my testimony is from the Organization for Economic Cooperation and Development, and it shows that as recently as 2007, 

the United States was ranked 15th in terms of broadband penetration, so we are behind many countries such as Canada, France, 

Germany, Korea, Iceland, Denmark, etc. 

The other interesting note here is there is not a very good definition of what high-speed or broadband access is. Up until recently, 

broadband in this country was defined as 200 kilobits per second, 

which by today’s standards would not be considered high-speed 

data. 

Hopefully, we would all believe that it is in our economic self-interest to explore ways to make the United States a leader in highspeed Internet. We need more applications and consumer benefit to 

increase broadband adoption in the United States. We need lower 

cost of service, and we need a national coverage plan. The open 

Internet and growing broadband penetration are the key economic 

drivers of the Internet ecosystem and economy from my perspective 

as a venture capitalist. 

And that brings me back to the topic of DPI and its potential 

negative impact on the open Internet. Many are calling this topic 

of the open Internet and DPI a discussion around network neutrality, which is the principle about an open network with restrictions potentially only for legal purposes. The danger is that ISPs 

would and could use DPI as a way to turn off or slow down thirdparty applications or third-party services. Recently, the FCC discovered that this was happening with a large ISP and a third 

party. In this case, it was a startup called BitTorrent. 

We don’t have to imagine what would happen if ISPs continue 

to do this. We have only to look at the mobile industry. Many venture capital firms like mine are investing in the mobile space, but 

cautiously compared to the open Internet sector. Why are we doing 

that? Well, consider the biggest success startup stories in the last 

15 years, and the vast majority of them were companies that were 

a result of the open Internet ecosystem. Ask yourself, which startup companies have created billions of dollars of value and thouVerDate Nov 24 2008 15:59 Oct 08, 2010 Jkt 037690 PO 00000 Frm 00092 Fmt 6633 Sfmt 6633 C:\DOCUMENTS AND SETTINGS\CWELLS1\HEARINGS\110-137 SCOM1 PsN: JIMC
87 

sands of jobs in the mobile space? There are few, but these examples are far less than those that are coming from the open Internet 

ecosystem. That is because the mobile Internet, the mobile system, 

is closed. There is no ecosystem in the United States. Carriers are 

able to block Web sites. They are able to block third-party applications and services, and as a result of this closed network, most consumers in the United States are not signing up for Internet access 

on their mobile phones, which means a less attractive market for 

innovation, a less attractive market for investors, a less attractive 

market for entrepreneurs—— 

Mr. MARKEY. Mr. Sabet, could you summarize, please? 

Mr. SABET. So we need a healthy and growing broadband market 

in the United States. I would like to see our cable companies and 

telephone companies thrive and grow their businesses with new 

technology and capabilities and new applications. New applications 

will help them sell services, too, but it should not be at the consumer’s expense or the Internet ecosystem’s expense. 

Thank you for your time and consideration. 

[The prepared statement of Mr. Sabet follows:] 

88 

89 

90 

91 

92 

93 

94 

Mr. MARKEY. Thank you, Mr. Sabet, very much. 

Our final witness, Mr. Scott Cleland, is a founder and President 

of Precursor LLC, a research and consulting firm. He blogs and 

speaks frequently on issues related to the Internet economy. We 

welcome you, sir. 

STATEMENT OF SCOTT CLELAND, PRESIDENT, PRECURSOR 

LLC 

Mr. CLELAND. Mr. Chairman and members, thank you for the opportunity to testify. I am Scott Cleland, President of Precursor 

LLC, an industry research consulting firm. Full disclosure: I am 

also chairman of NetCompetition.org, which is a pro-competition eforum funded by telecom, cable, wireless, and broadband companies. My testimony today reflects my personal views, not those of 

my clients. 

I believe the real problem here is not necessarily the prospect of 

deep packet inspection but the current patchwork of U.S. privacy 

laws, a lack of holistic approach to Internet privacy, and selective 

oversight of privacy problems. I believe they all combine to create 

perverse incentives for some companies to arbitrage privacy laws 

and to push the privacy envelope. As a result, abuse of privacy is 

among the most serious problems that face users of the Internet. 

I believe the lack of a holistic, comprehensive, and balanced approach to privacy law and oversight is a serious threat to Americans’ privacy. 

Now, broadband companies have long been subject to strict privacy laws, sections 222, 551, and the ECPA. These laws create serious consequences for the misuse of private information without a 

user’s permission. Consequently, broadband companies have developed extensive policies, practices, and procedures to respect users’ 

privacy and protect private information. Now, the subcommittee’s 

oversight of deep packet inspection for advertising purposes is very 

appropriate, and existing laws, I believe, appear to cover these 

practices. 

What I am concerned about is that the selective oversight of only 

broadband privacy matters fosters a blind eye to the arbitrage of 

privacy laws by companies like Google, Yahoo, and others. This creates perverse incentives for companies not covered by U.S. privacy 

laws to push the envelope on privacy to gain competitive advantage. Now, Americans’ privacy should not be an unrestricted commodity to sell to the highest bidder or to gain competitive advantage. Specifically, I am troubled with the broadband focus of this 

hearing, because privacy is a cross-cutting, big picture issue that 

knows no boundaries between the application, the transport or the 

content layers of the Internet. By turning a blind eye to Google, 

which I believe is the worst privacy offender on the Internet, it is 

systematically invading and abusing Americans’ expectation of privacy. 

Now, my feeling about this hearing is, it is here to create fear 

about what broadband providers could do while it is ignoring what 

Google and others are actually doing today that hurts Americans’ 

privacy. Now, the irony here is the worry about whether broadband 

privacy blinds are perfect when the Internet house has no privacy 

walls at all. Let us consider the depth and the breadth of the intiVerDate Nov 24 2008 15:59 Oct 08, 2010 Jkt 037690 PO 00000 Frm 00100 Fmt 6633 Sfmt 6633 C:\DOCUMENTS AND SETTINGS\CWELLS1\HEARINGS\110-137 SCOM1 PsN: JIMC
95 

mate blackmailable information that Google already collects on 

you: everything you have searched for; everywhere you have gone 

on the Web; what you watch through YouTube; what you read 

through Google news Feedburner blogger; what you say in your emails; what you produce in Google Docs; what your family and 

friends look like through Picasa; your medical conditions and history, through Google Health; your purchase habits through Checkout; your call habits and voice prints through Google Talk; your 

travel habits and interests via Google Maps; your interest in places 

through Google Earth and StreetView; your personal information 

through Orca, G-mail, Checkout, and otherplaces where you go and 

hang out, which will come through Android; where you will be or 

where you work through Google Calendar. 

The scale and scope of Google’s unauthorized Web surveillance, 

and I use that term, that should be as concerning to people as deep 

packet inspection, unauthorized Web surveillance, and I commend 

the chairman today in the Washington Post for talking about this. 

He said surreptitiously tracking individual users’ Internet activity 

cuts to the heart of consumer privacy. I couldn’t agree more with 

the chairman on that. So this is truly Orwellian Big Brother stuff. 

While Google is not the government, all this information that 

Google collects is on Google’s servers, it is not on your PC where 

you own it, and it is available to the government via subpoena. 

So in sum, information is power. Power corrupts. Absolute power 

corrupts absolutely. Google’s market power over private information is corrupting Google. Just like former FBI Director J. Edgar 

Hoover was corrupted by his power and mastery of personally sensitive information, Google’s unprecedented arbitrage of privacy law 

combined with its exceptional lack of accountability is fast creating 

this era’s privacy-invading, unaccountable equivalent, which I call 

J. Edgar Google. Remember the timeless insight: Those who don’t 

learn from the past are doomed to repeat it. 

Thank you for the opportunity to testify. 

[The prepared statement of Mr. Cleland follows:] 

96 

97 

98 

99 

100 

101 

102 

103 

104 

105 

106 

107 

108 

109 

110 

Mr. MARKEY. Great. Thank you, Mr. Cleland, very much. 

Now we are going to turn to questions from the panel, and I 

want to begin by agreeing with Mr. Cleland, that absolute power 

corrupts absolutely. So Mr. Dykes, not only do you get access to all 

of Google, but you get access to all of eBay, Amazon, everyone. If 

there were 56 companies up here, not just Google but everyone else 

at a company, you would get access to all of the information, so you 

are Google times 100 in terms of the information you can with this 

deep packet inspection coordinating with a broadband carrier get 

access to. So I would like to get crystal clear, Mr. Dykes, what your 

privacy position is, and I would like a simple yes or no, please. 

One, do you support giving consumers clear, conspicuous notice? 

Mr. DYKES. Yes, sir. 

Mr. MARKEY. Two, do you support a meaningful opt-in standard 

for authorizing use of a consumer’s data? 

Mr. DYKES. Well, sir, I would say that to characterize opt-in or 

opt-out is probably not as important as to say there has to be a 

very robust notice—— 

Mr. MARKEY. No, no, no. The difference is that you have got to 

get the consumer to say yes, OK. Do you support a policy that says 

the consumer must say yes before you are allowed to roam through 

all of their personal data and turn it into an information product 

which is then sold to other companies? Yes or no on that question. 

Mr. DYKES. Mr. Chairman, I think you are forcing me into one 

of those, ‘‘Have you stopped beating your wife recently.’’ 

Mr. MARKEY. No, no, no, no, no, have you stopped beating the 

consumer is the question, OK, and I want to know, Mr. Dykes, do 

you support getting permission affirmatively from the consumer before you start beating them up by sending them other information 

that they have not asked for? Mr. Dykes, yes or no. 

Mr. DYKES. I really must protest and say that it is much more 

important to ensure that the consumer is well informed on the decision being made than to use the—— 

Mr. MARKEY. Oh, I already asked you that first question. You already answered that one. That is yes. Now I want to know what 

you mean by that, and by that, should you get permission from the 

consumer first, Mr. Dykes? You have absolute power, as Mr. 

Cleland just pointed out. You are going to have access to all the 

information. Do you want to give them—will you give them opt-in? 

Mr. DYKES. Mr. Chairman, I really have to say that how what 

we do is characterized is going to be characterized by—— 

Mr. MARKEY. All right. Let me ask you the third question. Do 

you agree that consumers who do not grant consent should not 

have their Web use tracked, intercepted, or profiled? 

Mr. DYKES. Yes, Mr. Chairman, we in fact have explained that 

recently we have created innovation that will enable that. 

Mr. MARKEY. So that is a yes, they should not get information 

if they have not granted consent? 

Mr. DYKES. That is right. If they have opted out, for example, 

they should not be tracked. 

Mr. MARKEY. No, I am not saying that. I am saying, if they have 

not granted consent, that they should not have their Web use 

tracked. 

111 

Mr. DYKES. As we go through this process of informing them, if 

we are not convinced that somebody has not opted either way—— 

Mr. MARKEY. Are you going to then consider that to be consent 

if they have not—— 

Mr. DYKES. If they have not opted either way, then they are not 

tracked. For example, if somebody has deleted all their—— 

Mr. MARKEY. Well, I don’t think that is a high enough standard, 

Mr. Dykes. I think that that is basically saying that silence is consent and that as a result you can do whatever you want with their 

information. I don’t think unless you have gotten their affirmative 

permission that you should be allowed to be able to take this incredible leap into the breaching of the privacy of Americans. It is 

like saying that the mailman can open up any letter, can open up 

any package, find out what is in it, and then start to partner with 

other companies, letting them know what individual Americans are 

receiving in the mail, what kind of packages are coming to their 

house, but it is OK because the consumer doesn’t know that you 

are doing it and hasn’t given you the opportunity to say to the 

mailman, stop opening my packages, stop opening my mail, I don’t 

want anyone to know about it, and so we have a real problem here. 

Dr. Reed, can you tell me, sir, how this concept is consistent with 

the history of the Internet or inconsistent with the history of the 

Internet? 

Mr. REED. Sure. I should clarify that the definition of deep packet inspection used by Mr. Sabet is not quite right. It doesn’t involve 

only looking at label information. It does indeed involve looking at 

everything in the packet, so the Wikipedia is wrong, as sometimes 

it is. 

What is inconsistent about the history of the Internet, the history of the Internet was designed with the shipping of goods and 

essentially the ideas that lurk behind common carriage as its background, and it relates to the idea that the only people who should 

be interested in the actual contents of these messages are the 

endpoints involved that are the addressee or source of the message, 

and we carefully chose that design in the original design because 

we didn’t want to make the network more complex, and we knew, 

A, and B, we knew that the Internet, it was the first network that 

had multiple jurisdictions involved in the transport of packets. 

AT&T was only one company but the packets in the Internet flow 

through many autonomous systems, all of which could potentially 

cause trouble to the endpoints and which are not under control of 

a central authority. So the reason we built into the design that the 

contents of the packets was sacrosanct from both examination and 

action was specifically to deal with the diversity of the network and 

to deal with the expectations that could be standardized at the 

endpoints, that when you sent a packet, it would get there with 

best efforts. That was the fundamental principle and without examination. 

Mr. MARKEY. Thank you, Dr. Reed. 

My time is expired. The chair recognizes the gentleman from 

Florida, Mr. Stearns. 

Mr. STEARNS. Thank you, Mr. Chairman. 

Mr. Dykes, I can give you a little help on your answers from Mr. 

Markey. You can say ‘‘I don’t know.’’ We oftentimes have—— 

112 

Mr. DYKES. No, I think the way Mr. Chairman further explained 

it, I think the answer would actually be yes, that we do not track 

people who we are convinced don’t want to be tracked. 

Mr. STEARNS. Obviously if the chairman wants to say every time 

this occurs there has to be an opt-in, then a dialog box would come 

up all the time, and I am saying if Congress mandated that, isn’t 

it possible that when I go on the Internet and whether we are 

doing deep packets of information exploration or whether we are 

doing, as Mr. Cleland talked about, unauthorized surveillance, a dialog box would pop up? Isn’t that true under what Mr. Markey— 

there would be a constant dialog box, and every consumer would 

have to click in, click out? I mean, isn’t that what would happen? 

Give me the practicality if we went along the reasoning that Mr. 

Markey is saying is, we need to have an opt-in every time something happens, whether it is a surveillance—because Dr. Reed 

made a very good point. He is making the analogy between sending 

a box from Europe to the United States, and there is an address 

on this box, and we are supposing we let your company go into the 

box, and there is an implication, Dr. Reed is saying, that you are 

messing up the box. So you have to make the case here strongly 

this morning that this is not the same analogy and that the personally identifiable information has nothing to do with health, it has 

nothing to do with financial records. The compilation that Mr. 

Cleland is talking about is onerous, and there is lots of stuff coming together, I understand that, but the only way they can get back 

is through an IP address, and you have to be very clever to do that, 

but some of the things you are doing are very simple things that 

you are trying to say, does Stearns enjoy this type of DVD, does 

he like this movie or does he like such and such, and maybe we 

will advertise to let him know there is a new war novel coming out 

that he might like. So I mean, you are on the pivotal point here. 

Whether opt-in or opt-out, this is the key question. So you have to 

make the case, and maybe, Mr. Cleland, you can comment too. 

Mr. DYKES. So, the laws—Congress over time has balanced a 

whole series of factors in deciding what laws require opt-in, and 

opt-in is actually pretty rare, when there is sensitive information, 

personal information that could harm or embarrass somebody, and 

so we made a particular point of not having any personally identifiable information, not having any sensitive information, and so by 

staying at a very high level, broad categories characterized against 

anonymous profiles, we believe that in the general sense of the law 

that this country has, we are really in the opt-out mode. But I really don’t think the opt-in or opt-out is nearly as important as robust 

notice to the consumers, so that they truly understand what is 

going on and then the opportunity to control that. So obviously you 

don’t want to be too intrusive with the notices, but I think there 

is—— 

Mr. STEARNS. Tell me how you are giving notices today. How do 

you give notice to the average consumer? 

Mr. DYKES. Today our ISPs generally give notice by either a separate letter in the mail or separate notice in the billing statement 

or an e-mail in—— 

Mr. STEARNS. Does that come before or after you have gone 

through the deep packet information? 

113 

Mr. DYKES. Before. We need to have a notice happen at least 30 

days before any of the service commences so that we can be sure 

that people have the opportunity to opt out, and people do opt out. 

Mr. STEARNS. So you are saying you already have an opt-out notice in place? 

Mr. DYKES. Yes, sir, we do. We have these notices, and these are 

the notices that in general privacy rules are considered to be very 

robust notice today. We are going to go beyond that when we introduce or are introducing technology to allow that notice to be online. 

Mr. STEARNS. OK. 

Mr. DYKES. And we will work with CDT to improve that process 

and ensure that we find a way to meld the needs of privacy with 

users’ expectations and good user—— 

Mr. STEARNS. Mr. Cleland? 

Mr. CLELAND. Yes. Thank you. The point I want to reiterate is, 

broadband companies are subject to strict privacy laws. They respect privacy laws. They have cultures that embed policies, practices, and procedures that respect privacy. That is the law. My 

point here is, we are worried about whether the blinds on the window are perfect when the house doesn’t have any walls, and so people are worried about broadband and deep packet inspection that 

is covered by the law, and there is oversight like this hearing, and 

there are regulators that can look into it, yet what happens with 

Google and Yahoo and some of these others is, there is no privacy 

law, and there is no oversight, and so there is huge arbitrage. 

Mr. STEARNS. Dr. Reed? 

Mr. REED. Yes, I will just comment that two broadband providers, one noted in this document from Robert Tolpolski, who 

works with Free Press and Public Knowledge, and another, Charter 

Communications in the United States, are considering using—or 

have used, so they have already violated the privacy laws if the privacy laws apply, or are considering using this technology with 

American citizens with whatever is going on, and Phorm Technology has been actively operating a very similar service based on 

similar technology in partnership with British Telecom in the UK. 

So it is a little bit unreasonable to claim that the providers feel 

they are constrained from using this technology by those laws 

today. Maybe they haven’t consulted their legal department. 

Mr. MARKEY. The gentleman’s time is expired. The chair recognizes the gentleman from Michigan, Mr. Stupak. 

Mr. STUPAK. Thank you, Mr. Chairman. 

Mr. Dykes, if you are on one of the ISPs, how do I know, how 

am I given notice that your company is tracking my information? 

Mr. DYKES. Today, sir, we provide notice via a—— 

Mr. STUPAK. You provide notice or the ISP? 

Mr. DYKES. The ISP provides notice. There is a separate note in 

your billing statement or separate letter, or if they are confident 

it will be read, an e-mail to you. But as I said previously, we are 

now introducing newer technology so that notice can be online so 

you can read it directly there as well. 

Mr. STUPAK. And if I opt out and I don’t want to be part of this 

program, you can still track everything I do and every site and 

where my interests might lie, correct? 

114 

Mr. DYKES. Well, the very point of your opting out is that we 

then don’t do that, and if we were already doing it and you opted 

out, we immediately delete all of the records that we have on such 

an opted out—— 

Mr. STUPAK. And you don’t track after that? 

Mr. DYKES. Correct, sir. We don’t collect any data once you have 

opted out. We delete all the data we might have had. But by providing that notice 30 days before a system begins in your neighborhood, there is a good chance that it never would have been collected. 

Mr. STUPAK. What if people don’t return, don’t respond? Do you 

just start tracking them? 

Mr. DYKES. Sir, that is why we make sure that we are not tracking any personally identifiable information or—— 

Mr. STUPAK. So the answer is, if I don’t respond, I get tracked? 

Mr. DYKES. Sir, that is the way the general privacy laws are 

written today is that where there is no personally identifiable information or sensitive information—— 

Mr. STUPAK. Well, I think most Americans would state that is 

not the law. I think most Americans would believe that the information they have about themselves is theirs. Just because I belong 

to an ISP doesn’t give you the right to track me. If I want to be 

tracked, it should be affirmative. As I said in my opening statement, there really should be an opt-in. Why do I have to opt out? 

Why should the burden be on the American consumer? Should it 

not be on the ISP or your company that wants to track my information? 

Mr. DYKES. Well, sir, I think that there should be a common set 

of laws around privacy in this country that generally treats the 

various technologies in exactly the same manner. What we do with 

the Internet or offline, et cetera, should have a common set of principles, and I don’t think that one set of companies should be penalized versus another set of companies. Given a general law, we are 

very happy to comply with however that law is set up. 

Mr. STUPAK. So if we pass a law that says you can’t do any deep 

packet unless the consumer actually opts in, you would be satisfied 

with that? 

Mr. DYKES. Well, we would be satisfied with any law you pass, 

sir, so we will work within that. 

Mr. STUPAK. OK. Dr. Reed, you spoke about how deep packet 

technology can be used to assist law enforcement, but you also expressed concerns regarding how it may negatively affect the network’s ability to function. How do you reconcile the two? 

Mr. REED. In specific law enforcement or—— 

Mr. STUPAK. Yes. 

Mr. REED. Well, first of all, there are two things going on here. 

Law enforcement use of these technologies, which is in some cases 

mandated by CALEA, the law you have passed, generally only inspects the packets, generally uses the information derived from 

those packets in legally sanctioned ways and I presume is using 

the rules of the government to guard and safeguard that information and how it is used. So while I am—— 

115 

Mr. STUPAK. So law enforcement more goes for an information 

packet. From there if there is reason to believe a crime may be 

committed, that is when they go deeper to identify the individual? 

Mr. REED. Well, in fact, a number of these technologies I believe 

are used currently by law enforcement selectively and by intelligence agencies on foreign traffic—— 

Mr. STUPAK. Sure, like—— 

Mr. REED [continuing]. And those technologies are collecting the 

information but in very safeguarded locations, government-owned 

or controlled locations. The analysis performed on them is subject 

to review by various processes ranging from—so they are not just 

used immediately to react, and the review is a legal review in 

many cases where, for example, the standards of evidence are required to actually act on that information, so an FBI agent may in 

fact be using deep packet inspection to derive information, but 

whether it can be presented in court or used for exploration, those 

are matters that I, not being a lawyer, am not deeply expert in, but 

my understanding is that that is quite a different kettle of fish 

than here. I don’t think commercial companies have the ability to 

carry out such a duty of care. 

Mr. STUPAK. Are DPI devices accessible remotely? In other 

words, what I mean, are they susceptible to hackers who may wish 

to commit identity theft, in your estimation? 

Mr. REED. They could be. I have not examined them. I would be 

happy to examine, for example, NebuAd’s devices and technology, 

but what I know about them is based on observations by people 

who detect them in the network and analyze them as black boxes 

based on what they do and what they seem to do plus their marketing materials, and I have no specific knowledge of how easy it 

is to break into them. I believe Mr. Dykes is correct that you can 

make them quite secure if you put that amount of energy into 

them, but nearly every technology can be broken. 

Mr. STUPAK. Thank you. 

Mr. MARKEY. The gentleman’s time is expired. The chair recognizes the gentleman from Oregon, Mr. Walden. 

Mr. WALDEN. Thank you, Mr. Chairman, and I appreciate the 

hearing on this very important matter, I think, and I concur with 

the chairman’s comments and others that I think the average consumer out there views this more, or wants to, their time on the 

Internet more like they view the postal system, and I realize that 

is in disagreement with some on the panel, but I thought the chairman hit it on the head. If I order a package from some site, I don’t 

expect the postal person to go through it on the way, figure out 

what it is—I thought that was a great analogy, Mr. Chairman— 

and then decide who they think ought to come and market me, and 

that is different than walking into a store and realizing I am public 

and shopping around, I think. And so I think for the Internet to 

really survive as an engine of commerce, you have to have opt-in, 

and I think that is what consumers want. That is what I would 

want. I get enough junk mail. I am not sure I am going to plow 

through every letter I get or every whatever it is you are—do you 

have a copy of what you send out, by the way, Mr. Dykes? 

Mr. DYKES. Yes, sir, we can provide that to you. 

116 

Mr. WALDEN. I would love to see it, but the fact that I have to 

take affirmative action so that I can stop you from making money 

on my transactions on the Internet seems sort of backwards. Isn’t 

that really what you are saying I have to do? I have to opt out 

under your scheme. 

Mr. DYKES. Sir, as I said, I think it is most important that we 

inform you what we are doing. That is—— 

Mr. WALDEN. That you do what? 

Mr. DYKES. That we inform you of what we are doing, robust information, a notice that you can clearly understand what is happening, and then you can make your choice. The—— 

Mr. WALDEN. But why is the burden on me to make the choice, 

because the choice you are asking me as a consumer to make is to 

prevent you from taking an action that enriches you, right? 

Mr. DYKES. Sir, the—— 

Mr. WALDEN. You are in this to make money. That is not a bad 

thing. But you are building a business model here, and aren’t you 

in part betting that there are going to be consumers who ignore 

those notices or don’t understand them or whatever, so you get to 

work that angle, plus those who affirmatively say you bet, I like 

your concept, and there will be some who say yes, update me on 

the latest from whatever organization. 

Mr. DYKES. Sir, the Internet is not like the post office inasmuch 

as it is actually run by commercial organizations, and the ISPs 

have noted that more than half of Internet funding is coming from 

advertising today, and I think it is a legitimate desire on their part 

to increase the amount of advertising that they receive to help fund 

the Internet, and so this is a manner to do it with very robust privacy controls. 

Mr. WALDEN. Wouldn’t the most robust privacy control be that 

of opt in? 

Mr. DYKES. Well, as long as we are not collecting any personally 

identifiable information or sensitive information, then we believe it 

is possible to note innocuous commercial categories mapped against 

anonymous profiles so that there is no consumer harm in that regard and then derive additional value from that. 

Mr. WALDEN. But you have the ability to personally track identifiable sensitive information, right? You could get access to that. 

Mr. DYKES. Well, we can’t access any secure information. If it is 

an HTTPS transaction, for example, it is just physically not possible for us to track secure transactions such as when you go to 

your bank. So no, sir, we can’t track everything on—— 

Mr. WALDEN. But if you are an Internet consumer and you are 

just looking at different sites, you are planning a vacation somewhere and so you go to the site on the Virgin Islands or Crater 

Lake Lodge in Oregon, you could track that I am looking at that 

site? 

Mr. DYKES. That is an example where we wouldn’t then keep 

track of the fact that you went literally to that site. We would note 

the fact that you are interested in travel. 

Mr. WALDEN. Right, but you would know who I am. 

Mr. DYKES. No, we do not know who you are. 

Mr. WALDEN. You just know that my IP address? 

Mr. DYKES. We don’t keep the IP address either, sir. 

117 

Mr. WALDEN. But you have access to it? 

Mr. DYKES. We don’t keep it. We don’t—— 

Mr. WALDEN. That is a different question. Do you ever have access to it? 

Mr. DYKES. What we do with the IP address is, we translate 

them immediately in real time to an anonymous identifier in a oneway cryptology so that we can’t find our way back to the IP address. So we don’t have access to the IP address. 

Mr. WALDEN. Dr. Reed, does that track? I am not questioning 

what you said. I am just trying to figure out how all this—— 

Mr. REED. Actually, there is a distinction that I am making that 

Mr. Dykes may not be making, which is that he is talking about 

the Internet including all the services that are on the Internet, 

such as Google and so forth, and I am speaking specifically of the 

transport part of the Internet. It is the case that banks, for example, while they take your password over a secure link, present 

things like account information and so forth using HTTP transactions in the clear. That is not true of all banks, but it relates to 

the point I made earlier about the extra expense. If the banks were 

to respond properly to this and to their mandate to keep consumer 

information private, they would have to start using encrypted links 

for far more than they are currently using them for, and we could 

have an escalation on encryption. We might have an encryption 

war, at which point if every piece of traffic were encrypted, there 

would be no market if you add services. I think there are policy implications to having all the traffic encrypted, and I am not sure I 

want to go there. But the user at great cost to themselves and the 

services could avoid this problem, and it just shifts the problem 

elsewhere. 

Mr. WALDEN. My time has run out. I just have a unanimous consent request. I know that the ranking member had sent letters to 

the chairman of Google in 2007 and 2008, and I wondered if I can 

just ask for those to be put in the record? 

Mr. MARKEY. Without objection, they will be included into the 

record. 

Mr. WALDEN. Thank you, Mr. Chairman. I appreciate it. 

[The information was unavailable at the time of printing.] 

Mr. MARKEY. And I say to the gentleman from Oregon as well 

that Mr. Dykes said that the postman is public and he is private, 

but FedEx and UPS are also private, but they can’t open up our 

packages. They can’t open up the mail that we put inside. They are 

private, too, but we all have an expectation when we put something 

in FedEx that Mr. FedEx can’t open it up before he puts it at our 

front door. 

Mr. WALDEN. Exactly. 

Mr. MARKEY. So let us not confuse that issue. It is the same level 

of privacy expectation. 

Let me turn now and recognize the gentleman from Pennsylvania, Mr. Doyle. 

Mr. DOYLE. Thank you, Mr. Chairman. I think the post office 

analogy is important, because it is the way most Americans can relate to what is going on. People would be shocked if they thought 

the post office or FedEx or anybody else was looking at what is inside their packages, whether they knew who they were or not. PeoVerDate Nov 24 2008 15:59 Oct 08, 2010 Jkt 037690 PO 00000 Frm 00123 Fmt 6633 Sfmt 6633 C:\DOCUMENTS AND SETTINGS\CWELLS1\HEARINGS\110-137 SCOM1 PsN: JIMC
118 

ple would be shocked to know that. And this all gets down to implied consent. Mr. Stearns talks about a dialog box popping up 

every time, you would have to say whether you opt in or opt out. 

It doesn’t need to be like that at all. It really should just be with 

the Internet service provider. When I subscribe to America Online 

or when America Online changes its privacy policy to accept your 

service, Mr. Dykes, there should be something that pops up on my 

AOL site when I go on saying something has changed, or if I am 

just a new subscriber, and it should ask me clearly whether or not 

I want to be in on a service that is going to look at my information 

and possibly share that with other people, and do I want to do that 

or not, and if I say no, I don’t want anybody knowing where I go 

online or what I am doing or if I travel or if am going and looking 

up information on prostate cancer, I don’t want anybody to know 

that, that I can just check that ‘‘no’’ box, and I don’t have to do 

anything after that. Any site I visit, I am saying I don’t want anybody to be inspecting that packet. It could be a simple one opt in, 

opt out that is presented to you. 

Now, I don’t know anybody that reads their privacy statements 

in their bills. If you ever saw them—I have looked at them a couple 

of times. Your bill comes. There are a couple pages, they are in 

that real thin paper that is folded. It is about a 2-point print, and 

if you are old like I am, you can’t even see it, and then you are 

going through that with a magnifying glass, and somewhere in 

there I guess it tells you that if you don’t want somebody to be able 

to know where you are going to check some sort of opt-out, but if 

you want to—the big print says if you want to enhance your experience on the Internet, then just we will just take it from here, and 

you don’t have to do anything, we are going to make sure you have 

a great experience on the Internet. 

People don’t know this is happening. People do not know that 

they are implying their consent by saying nothing or the fact that 

they don’t read the fine print in these boxes, and the idea that anybody can examine where you go, what you say, anywhere without 

expressly saying it is OK with me, I think goes against everything 

that the country has been founded on and what most Americans 

understand as their right to privacy under the Constitution of the 

United States, and I don’t care whether an Internet service provider is doing it or Google is doing it, it shouldn’t happen, and 

there should be a clear policy where Americans say I want this, 

and it should be right up front, and it doesn’t need to be a box on 

every Web site you visit, just your ISP when you are looking at it. 

Now I will ask some questions. 

Mr. DYKES. May I respond? 

Mr. DOYLE. Yes, go ahead. 

Mr. DYKES. I would like to say I agree with everything you said 

there. That is exactly my thinking, that there has to be a robust 

notice, not some big 20-page document, not something in a little 

box online. This is why I keep emphasizing robust notice as the 

most important—— 

Mr. DOYLE. Well, I don’t know how you define robust notice, but 

I know you should have to check the box that says I want you to 

be able to do this, OK, and no implied consent. It has to be robust, 

I want to do this consent, and anything short of that I think is a 

119 

violation of what most Americans understand as their right to privacy. 

Ms. Cooper, I have a question for you. Some people may not 

know, one of my constituents has released a new record: Girl Talk. 

He’s a mash-up DJ. He released this new album, Feed the Animals, 

on the Internet, and he is charging like Radiohead, it is pay whatever you want. Now, if record companies and other companies encourage ISPs to use deep packet inspection for tracking copyrighted 

content and punishing copyright infringers, is it reasonable to 

worry that the technology would also scoop up consumers of lawful 

content and other fair uses of copyrighted material? 

Ms. COOPER. Well, I will say that I am a huge fan of Girl Talk, 

and I did download the most recent album at a very low price, but 

I think you have hit the nail on the head, which is that using technologies like deep packet inspection for applications like copyright 

filtering raise the question of how to know when you recognize a 

copyrighted work, whether it is an authorized use of that work or 

not, and the technology itself of inspecting the packets, assembling 

the packets into a piece of data that you could recognize as a copyrighted work cannot tell you whether a use is authorized or not. 

That is a judgment that needs to be made by a person, perhaps 

multiple people. It depends on the context. It depends on if it is a 

fair use or not. And so you cannot rely simply on this technology 

to be able to say yes, this is an illegal use of someone’s work or 

no, it is not. 

Mr. DOYLE. Dr. Reed, first of all, thank you for your years of 

service to the Internet. Tell me, I think you touched on this briefly, 

will deep packet inspection—don’t you think this is really just 

going to lead to an encryption arms race, where everybody is just 

going to start to encrypt their packets to avoid detection, and what 

do you think the implications of that would be to the Internet if 

that starts to happen? 

Mr. REED. Well, first of all, it would be a great boon for the sellers of encryption technology. But I think it would raise the barrier 

for many applications, because it is not simple to design actually 

secure encryption technologies. Although the basic idea of 

encrypting a packet from end to end is easy, the handing out of 

specific keys to the right set of people that need to receive that 

stuff is quite complex, and it depends on a notion of a key distribution network which would then have to exist over the top of the 

Internet, because everyone would need to get their keys reliably 

from reliable sources, so it would create a rather elaborate network 

structure for distribution of keys and security of those keys that is 

not currently in place to make it actually work. I have been involved in the research on that topic actually since about the same 

time the Internet started, and industry has not succeeded in doing 

it, partly because the demand has not been there, the expectation 

of privacy was good enough, but also for two other reasons. One is 

the reason that there is public interest in not having too strong 

encryption for law enforcement reasons. You want to be able to not 

depend on breaking the keys but hope that the bad guys will do 

something bad for at least discovering bad things, and then the 

other reason is that the actual physical security of those keys and 

physical distribution involves trust relationships that don’t exist in 

120 

society today. Who would you trust to get your key from? Maybe 

you trust your ISP, maybe not. 

Mr. DOYLE. Thank you. 

One last question. Mr. Dykes, your testimony says basically that 

when I surf the Web and I don’t opt out, I give you implied consent 

to share everything that I do, and that is a one-sided consent. 

Pennsylvania, where I come from, requires both ends of a conversation to consent to any wiretaps. Your service listens to all Web conversations that you sought or obtained consent from millions of 

people, if not billions of Web pages and content providers. If you 

have not specifically obtained consent from all these millions of 

Web page and content providers, why do you think that your service doesn’t violate Pennsylvania’s wiretap law, or why it wouldn’t 

apply to you? 

Mr. DYKES. Sir, I am not a lawyer, but I have spoken to my lawyers, and they have not identified any legal barriers to our entry 

in any States, but we would be happy to work with you or your 

staff to go through that in more detail. 

Mr. DOYLE. I see my time is up, Mr. Chairman. 

Mr. CLELAND. Mr. Doyle, can I make a comment? 

Mr. MARKEY. I am sorry. The gentleman’s time has expired. I am 

sorry. 

The gentleman from California, Mr. Radanovich. 

Mr. RADANOVICH. Thanks, Mr. Chairman, for this hearing. 

I do have a question of Dr. Reed. Mr. Cleland gave what I 

thought was a very interesting analogy about dealing with ISPs 

and trying to perfect the window shade on a window in a house 

with no walls. Would you respond to his comments about the difference between search engines and ISPs? I would be curious to 

know your comments on that. 

Mr. REED. Well, I can respond on different levels. I agree with 

Mr. Cleland that there are strong concerns about the amount of 

private information that is captured and used by search engine 

companies and others and that there needs to be some thought 

given to that scale of collection. It is a different kind of collection, 

because it is captured by a site that you go to, but in the case of 

Google, for example, I know that they are kind of the only game 

in town for a certain kind of thing, not because of a mandate but 

because they are really good. So I see this particular focus on the 

transport part as relevant to this committee, and I am not really 

prepared to talk about the technology inside Google much further 

than that. 

Mr. RADANOVICH. All right. Thank you. 

Mr. Cleland, do you have a solution for this? Is it one type of— 

is it DPI, is it cookies? What is your answer to all this? 

Mr. CLELAND. Well, I think, sir, the question also allows me to 

respond to Mr. Doyle and what he had said. There is a holistic 

problem here with privacy, and don’t be fooled of thinking that 

there is only one way to be tracked or there is only way for somebody to violate your privacy. Now, packets going through, the expectation is that these packets should be delivered and not interfered with. OK. That is understood. Now, what you do when you 

are not an ISP, like when you are Google or Yahoo or these others, 

and they want to track you, they track clicks. Now, they can do the 

121 

same thing. You said you didn’t want anybody to know if you went 

to the prostate cancer page. Well, there is a packet that could 

transmit that, or a click. So there is more than one way to skin a 

cat, and the problem here is that you are focusing only on 

broadband deep packet inspection as one way to invade your privacy and turning a complete blind eye to the way that you can 

track clicks and a myriad of other ways that you can glean the 

same information and actually potentially a whole lot more. Does 

that answer your question? 

Mr. RADANOVICH. Yes, it does. 

Ms. Cooper, I would like to get a comment from you, as well. Do 

you recognize the advantage of DPI insofar as the potential protection of piracy and those issues as well, the value of something like 

DPI? 

Ms. COOPER. So I think DPI does have some beneficial uses. The 

one that comes to mind immediately is for detection of network attacks, viruses, spam, distributed denial of service attacks, and 

those sorts of things where an ISP might have an indication that 

an attack is coming from a certain IP address or from a certain location, and being able to look a little bit more deeply into the packet can help to thwart those kinds of attacks. So I certainly think 

that DPI has some beneficial uses, but I really think it needs to 

be evaluated on a case-by-case basis where you can weigh the risks 

against the benefits and evaluate the other protections around how 

it is deployed with the notice and what the limits are on the data 

collection, so I really think it is a neutral technology. I don’t think 

it is a good or a bad technology, as most technologies are, but I 

think it deserves a contextual evaluation. 

Mr. RADANOVICH. Consumers have to be able to check the box, 

basically, and say you consent. 

Ms. COOPER. Well, in some cases, yes, I think you can imagine 

certain applications of DPI that you would only want to have consumers, you know, fully informed and consenting to and other examples like with the spam example. If you had to consent to every 

time your ISP or your e-mail provider blocked a spam for you, that 

might be something that you would only want to consent to once, 

or the model would probably look different. So I really think it deserves a case-by-case evaluation. 

Mr. RADANOVICH. Thank you. 

Thank you, Mr. Chairman. 

Mr. MARKEY. The gentleman’s time is expired. The chair recognizes the gentleman from Texas, Mr. Gonzalez. 

Mr. GONZALEZ. Thank you very much, Mr. Chairman. 

Let me preface this question with a story, and actually the reporter’s name is Luis Story. I think it was the New York Times. 

In January 2008, 14.6 billion searches were conducted. Yahoo, 

Google, Microsoft, AOL, and MySpace record at least 336 billion 

transmission events in a month, not counting their networks. 

Yahoo has the most data collection points in a month on its own 

sites, about 110 billion collections, or 811 for the average user, plus 

1,709 other opportunities to collect data about the average person 

on partner sites such as eBay, at which Yahoo sells the ads. 

So my question, should privacy rights and obligations begin and 

end at the doors of the ISPs solely? Ms. Cooper, just a yes or no. 

122 

Should we only be—and I know that my colleague from California 

touched on it. Should that be our only concern? Do privacy rights 

and obligations that we seek to protect and impose on all players 

really begin and end only at the doors of the ISPs? Just a yes or 

no. 

Ms. COOPER. No, we should have comprehensive privacy protections. 

Mr. GONZALEZ. Mr. Dykes? 

Mr. DYKES. I agree, we should have comprehensive privacy protection that is technology-neutral. 

Mr. GONZALEZ. Dr. Reed? 

Mr. REED. Yes. 

Mr. GONZALEZ. Mr. Sabet? 

Mr. SABET. Yes. One point, by the way, is Dr. Reed agrees with 

my definition from Wikipedia offline. 

Mr. GONZALEZ. Mr. Cleland? 

Mr. CLELAND. It should be holistic. It shouldn’t just be on ISPs. 

Mr. GONZALEZ. All right. And I know that we are concentrating 

on certain technology utilized by ISPs, but I would hope that no 

one leaves this room today or a viewer or listener thinks that this 

committee is not concerned about the overarching responsibility 

and duty that we wish to impose on everyone out there. Mr. Doyle 

is saying it is another jurisdiction, but we are actually discussing 

many things that may go way outside the jurisdiction of this committee and such, but nevertheless, you are going to have a collaboration along the way. It seems to me that everyone is—the holy 

grail here is some sort of an opt-in as opposed to what we generally 

follow in other models of opt-out, an affirmative act saying that you 

will agree after there is full, and as the chairman indicated, clear 

and conspicuous disclosure, which we all agree on, and then some 

affirmative act, in this case it would be an opt-in. So there are different ways to opt in, and I am just wondering, and I will be asking 

a couple of the witnesses if they would agree that this would be 

adequate and sufficient across the board, whether it is an ISP or 

an application company. What if they were able to obtain the optin in the following manner? One, that would tell the consumer 

check this box, whether it is on the screen or whatever or an envelope saying after full disclosure, conspicuous clear language, simply 

using the service will be interpreted as an opt-in. Would you be 

satisfied, Ms. Cooper, with an arrangement, simply using the service would be an affirmative act of opting in to all conditions and 

terms of the provider? 

Ms. COOPER. I think it depends on the service. I think at times 

affirmative express consent is absolutely necessary, and at other 

times it is not. I think it is dependent upon the data being collected, the sensitivity of the data, the laws that we have in place. 

All of those things are important to the decision—— 

Mr. GONZALEZ. We would have to have different standards on 

that type of opt-in language, depending on the type of information 

that is being gathered. I just think that may be an impossible task. 

I am not sure. 

Dr. Reed, would you be satisfied with that kind of an opt-in arrangement? Simply using the service equates to an affirmative act 

of opting in. 

123 

Mr. REED. No, not in the case of ISP access to the Internet. 

Mr. GONZALEZ. No, I am talking about everyone that should have 

a responsibility and duty to safeguard this particular information 

when they gather it and making sure there is full disclosure to the 

consumer that it is being collected and shared. What does it matter 

whether it is Embarq or whether it is Google? It is still my information. One, full disclosure; two, an adequate opt-in process. Why 

are we making that distinction is the real curious question. I think 

for the most part you all have distinctions without differences. It 

is whether we have—maybe because of the scope of the technology 

and the ISP status. You are saying, well, that is a mortal sin, we 

will let everyone get away with venial sins. Well, I hate to tell you, 

I think the consumer is just going to be concerned with the tremendous information out there that may constitute a lesser sin, but it 

is still a sin. And by the way, all these centers are all worshipping 

at the common altar of the advertising dollar, which promotes and 

supports the entire system, whether you are a network, ISP, or an 

application company, and that is the reality, and I know, I think 

the chairman has been very reasonable and generous with me, and 

he has let me go over my amount of time, and I yield back. 

Mr. MARKEY. The gentleman’s time has expired. The gentlelady 

from California, Ms. Eshoo. 

Ms. ESHOO. Thank you, Mr. Chairman, for yet another substantive hearing on an all-important issue. It is great having you 

be chair, because that is what we have done since you have taken 

over, so thank you. And thank you to all the witnesses. 

First of all, I can’t help but think of the following with my Intelligence Committee cap on, and that is that the penultimate intelligence is to know how people think, and I think that that applies 

to a lot of what we are talking about here. I think that users 

should be notified in the most meaningful way on what information 

is being collected, how it is being used, how they can opt out of certain forms of data collection, and I think that medical information 

collected really should be treated as one of the most sensitive or 

the most sensitive data. So I just want to state that. 

I apologize for coming in later than other members, but it gave 

me an opportunity to read what we didn’t have yesterday and that 

is some of the testimony. Mr. Cleland, I derived from your testimony, from your statement, that you are not for net neutrality. Is 

that—that is pretty obvious. 

Mr. CLELAND. Exactly. 

Ms. ESHOO. Yes, not for net neutrality. Let me ask you this. Are 

you paid any consulting fees by any of the Bells, cable or anyone? 

Mr. CLELAND. As I disclosed when I came in here, I am testifying 

on my own behalf. However, another—— 

Ms. ESHOO. Are you paid by anyone—— 

Mr. CLELAND. I am chairman of NetCompetition.org. It is funded 

by wireless telecom and cable companies. So that is—— 

Ms. ESHOO. So the answer is yes? 

Mr. CLELAND. Yes. I have always disclosed it every place I go. 

Ms. ESHOO. Well, I wasn’t here when you disclosed that, so I am 

glad to hear that, and I think it is important for the record, and 

I think it is important to highlight it for the record. 

124 

Now, in your statement, you said that broadband companies are 

subject to section 222 of the Communications Act. Now, I think for 

the record, we need to clarify this, because for telephone services, 

that is so, but not for broadband service. Do you agree with that? 

Mr. CLELAND. Well, where we are is an evolution on that in the 

sense of telecom—— 

Ms. ESHOO. Well, I mean, just yes or no. We don’t have to—— 

Mr. CLELAND. No, because it is a very complicated question in 

the sense that law enforcement and other things—— 

Ms. ESHOO. I mean, it is very important about the obligations 

under 222. Telephone services come under that obligation, but 

broadband services do not. So what I am doing is, I am differing 

with you in terms of what it is in your statement, so we are just 

going to leave it at that. 

Now, let me get to this whole issue of how we achieve the kind 

of privacy and the implementation of that as all of this continues 

to be broadened out, because the Internet is going to keep growing. 

There always are going to be new ways of getting to people, trying 

to attract them to buy things, to sell things, but we don’t want that 

used against them. So let me ask you, Mr. Dykes, do you think that 

there should be legislation that provides a statutory framework for 

what data can be collected, how it can be used, and how consumers 

can either opt in or opt out of the collection? 

Mr. DYKES. Yes, I do. 

Ms. ESHOO. You do? 

Mr. DYKES. Yes, absolutely. I said in my testimony, we differently support a base privacy law across all industries that is 

technology neutral. 

Ms. ESHOO. Let me ask the whole panel this. I am concerned 

that greater innovations in network capacity, data speeds, storage, 

and that more data containing potentially harmful software will be 

encrypted and then escape the current network of firewalls. Is this 

a legitimate fear? I mean, should government be addressing this? 

Mr. DYKES. Well, in my view, no, it isn’t. The Internet today operates with secure sites such as banks that do for the most part 

display their information in a secure manner, and that is appropriate because there really isn’t—people shouldn’t be looking at 

that date, and it doesn’t really have commercial value for advertisers anyway. In other areas where it is a travel site, the innocuous categories that we track such as travel or automotive, for example, those are also subject to the search engines wanting—and 

they want the search engines to know that they have those subjects 

and so there is a natural process for sites to not want to be secure 

so that in fact they can be part of the search process and other 

links, et cetera, and so—— 

Ms. ESHOO. But I don’t know from your answer whether this is 

a legitimate fear on my part. 

Mr. DYKES. Well, my point is that—actually Mr. Reed previously 

expressed that fear, and what I am saying is, that I don’t think 

that that is a fear, because we keep our characterizations at a sufficiently high level that people are not going to be fearful, and that 

is why we have to continue to publicize this, that we have very 

strong privacy controls, no personally identifiable information, and 

125 

we are only tracking innocuous categories mapped against those 

anonymous profiles. 

Mr. MARKEY. The gentlelady’s time has expired. 

Ms. ESHOO. Thank you, Mr. Chairman, and can I just make a 

very quick observation? It is the first time in telecommunications 

testimony that J. Edgar Hoover has come into it. I don’t know 

whether Mr. Cleland is referring to some kind of telecom crossdressing, or what. I just wanted to highlight that. 

Mr. MARKEY. I thank the gentlelady. The chair recognizes the 

gentlelady from California, Ms. Solis. 

Ms. SOLIS. Thank you, Mr. Chairman, and I want to applaud you 

for having this very important hearing. When I read about the 

background on this, of course I am concerned coming from California where we have, I think, a lot of stricter rules in place that 

look at two-party wiretapping, and I want to get feedback from Ms. 

Cooper and Mr. Dykes on that and how you are going to deal with 

States like mine, but I have a couple of questions, two concerns. 

One is, you are able to profile who I am because I go on the Internet. You can see my likes, dislikes or whatever. But what about 

those people that may have language barriers or that may be senior citizens who could be gullible to specific types of unscrupulous 

advertisers or individuals who at a certain point can determine 

some vulnerabilities, and people in my community, Latinos and 

others, at a certain age, what have you, could be vulnerable to folks 

that take advantage of them, and specifically targeting advertisements at them, which we know happens now even in the print 

media and television, but mostly print. Many in our community are 

taken advantage of. I am concerned about predatory types of movement that could happen and how we detect that and how we can 

really help consumers who are maybe not language literate or because they speak only Spanish. So I want to ask Ms. Cooper if you 

can talk about what I have raised. But those are some of the concerns that I am thinking about out loud right now. 

Ms. COOPER. I think the concern that you raise is legitimate, and 

the broader context in which we have discussed this concern is how 

these behavioral profiles that are getting created about consumers 

are really used. It is one thing to target a car ad to someone who 

has been interested in buying cars, but it is another thing to abuse 

the profiles as you are talking about to target vulnerable populations or to use the profiles for decisions about things like credit 

or employment or insurance, and because it is kind of a black box 

and we don’t really know all of the ways that these profiles are 

being used and it is really invisible to the consumer. They, as we 

discussed already, don’t even know that this kind of tracking is 

going on, but even if they do know, it is extremely difficult, if not 

impossible, for them to find out what the profile says, who it has 

been sold to, who else is using it, how it is being used, and so I 

think we still have a lot of work to do to find out what all of those 

secondary uses are and who is conducting them and if that is even 

OK. I think if information is collected for one particular purpose, 

even if consumers are informed and they opted in to that, that 

doesn’t mean that there is a license to use it for all these other purposes. 

Ms. SOLIS. Can you address the two-party wiretapping issue? 

126 

Ms. COOPER. Sure. So there are some States like California 

whose wiretapping laws require consent from both parties to the 

communication, so on the Internet, that would be both the consumer and the Web site that the consumer is visiting. In the context of the wiretapping laws, there is not a lot of case law about 

how those apply specifically to the Internet. There are telephone 

cases, and in some cases, if you have a call going from one State 

to another, the one-party-consent case trumps, so there only needs 

to be consent from one party. If you have a call coming from a twoparty State to a one-party State, in California, there is some case 

law that shows that you still need consent from both parties, but 

it has only been applied in the telephone context. 

Ms. SOLIS. So would you encourage us as our subcommittee kind 

of mulls through this to look at potential frameworks or something 

that could address this issue? 

Ms. COOPER. Absolutely. I mean, there is the federal wiretapping 

laws on the books, which we think are fairly clear on their application to this model, but as we have been discussing today, there are 

all these other kinds of data collection going on which don’t fall 

under that framework, and we certainly think that is an area of 

work good for this committee. 

Ms. SOLIS. I have 17 seconds. I am sorry. Mr. Dykes. 

Mr. DYKES. Well, on your first question, I agree with Ms. Cooper. 

It really is the responsibility of all advertisers and advertising companies to have responsible behavior, and so the questions that you 

raise are really not specific to ISP-based advertising because, as 

the panel has noted, there is lots of this data collected in many 

ways, and so, for example, as an industry, we don’t advertise and 

the laws require us not to advertise to children, for example, and 

so—but as responsible advertisers, we observe the types of concerns 

that you have, and I don’t think people in our industry would cross 

them, responsible companies. 

With regard to your second question, as I said previously, I have 

spoken to my lawyers on that, and they have not identified any 

legal barrier to operating in any State, but we would be happy to 

work with your staff to further elaborate on that. 

Ms. SOLIS. You said something earlier though that business has 

a legitimate role because they are paying for this access. So where 

do you draw the line to say that maybe some of these folks that 

are paying may not be—how could I say—honest in the way that 

they are targeting, for example, alcohol and tobacco? There are certain populations that we know industries target. Those are questions that I have concerns about. 

Mr. DYKES. So the way that is generally handled is that the industry through industry associations certifies certain companies to 

say that we act responsibly, we operate within these standards, 

and the advertisers advertise with companies who meet those 

standards, and so there is a role for the advertisers themselves to 

have some policing to only advertise with companies that operate 

in a responsible—— 

Mr. MARKEY. The gentle—— 

Mr. DYKES [continuing]. Manner, and that I think is the effective 

way short of a law on the subject. Self-policing does occur in this 

industry and I think has been reasonably effective. 

127 

Mr. MARKEY. The gentlelady’s time has expired. The gentleman 

from Florida has an additional question. 

Mr. STEARNS. Just two questions, Mr. Chairman. 

The first is just to clarify. The gentlelady from California brought 

up Mr. Cleland, what his invested interest was. He disclosed it, 

and I think just to set the record straight, Ms. Cooper, since the 

gentlelady brought up funding, I note that according to CDT 

records, your organization received almost 10 percent of its funding 

from e-commerce companies such as Google and Yahoo. I just wanted to confirm that. Are you still receiving funding from these companies? 

Ms. COOPER. We are. We actually have a very broad base of 

funding. It is about 50 percent from foundations and 50 percent 

from high-tech companies, all kinds of different high-tech companies. 

Mr. STEARNS. Including Google and Yahoo? 

Ms. COOPER. Yes. 

Mr. STEARNS. And Mr. Dykes, I think this discussion we had 

today—and I commend the chairman for having this hearing. I 

think it is very enlightening, and I think you can sense from 

everybody’s feelings that people are concerned that these deep 

pockets of information packets that you are going into without anybody knowing about it is a concern. Maybe you should just summarize and tell us this information you are seeking, what is it that 

everybody is getting so alarmed about so maybe you would allay 

their fears by just outlining just very simply what is the stuff that 

you are looking at? 

Mr. DYKES. The end result is simply our noting that an anonymous profile qualifies for certain innocuous categories such as travel, automotive, other subjects like that. So they are very innocuous 

categories, because we don’t want to get into sensitive subjects, 

pharmaceutical ads, for example. We stay away from the sensitive 

subjects, so it is innocuous categories mapped against anonymous 

profiles is the end result, and that is why—— 

Mr. STEARNS. Mr. Doyle mentioned health information, going to 

look for prostate cancer. 

Mr. DYKES. We avoid that. 

Mr. STEARNS. I mean, how do we know that you avoid that? Do 

we just take your word for it? 

Mr. DYKES. Well, that is one of the reasons why we are having 

our system audited, so a Big Four firm can actually say that yes, 

they do what they say they do. So that is one important element. 

The other is industry standards around sensitive subjects that they 

are still being formed, but to the extent that the FTC or other government bodies create a definition around sensitive subjects, we 

certainly observe that. Meantime, we stay very, very conservative 

on—— 

Mr. STEARNS. Who does this auditing? When you say you are audited, who—— 

Mr. DYKES. We haven’t named the firm, but we have indicated 

that we would have one of the Big Four audit firms audit our systems to ensure that we do what we say we do. 

Mr. STEARNS. An accounting firm is going to audit you? 

128 

Mr. DYKES. Well, those firms—correct. Those firms also do auditing of the subject, as well on privacy standards, as well as accounting standards. 

Mr. STEARNS. I don’t know if that is going to provide a degree 

of confidence to think that an accounting firm is going to audit you 

to—— 

Mr. DYKES. There is such a thing as—— 

Mr. STEARNS [continuing]. Whether you are going into sensitive 

boxes of information, deep packets. I don’t know, Mr. Dykes, 

whether that is going to calm the fears. 

Mr. DYKES. Sir, there are actually standards on privacy audits. 

Mr. STEARNS. And you can’t announce how that accounting firm 

is today? Have you selected that—— 

Mr. DYKES. It hasn’t been finally selected. 

Mr. STEARNS. So you don’t even have an accounting firm doing 

it yet? 

Mr. DYKES. Well—— 

Mr. STEARNS. You are speculating that you will. 

Mr. DYKES. Sir, we are a startup, so we are just—this is just—— 

Mr. STEARNS. This is the first stage, the early stage? 

Mr. DYKES. Yes. 

Mr. MARKEY. Can you try to pick a company, Mr. Dykes, that 

wasn’t the accounting firm for the subprime loan scandal or the 

dot-com bubble or the Enron? Can you find an accounting company 

that maybe has a good track record over the last 6 or 7 years, not 

missing every major accounting scandal, and I don’t know what 

company that might be, but you will be held responsible for anything they miss, by the way. I unfortunately have to say this. In 

most instances, the accounting firms miss the stuff that the industries want them to miss because they also have consulting contracts. It is not a good situation. 

Do any other members have any questions that they might want 

to ask? Yes, Mr. Gonzalez. 

Mr. GONZALEZ. Thank you very much, Mr. Chairman. Just quickly because as you can tell, I think we may have some differences 

of opinion on application, the exact answer, but make no mistake 

about it, we all really share the chairman’s concern regarding privacy and the duties and obligations that are out there, because we 

truly believe the American public will be concerned about it. I don’t 

want to overlook the fact that many consumers today are the beneficiaries of, quote, ‘‘free services through application companies,’’ 

and that is very, very valuable, and the reason that they are free 

is because of advertising dollars, and we have to really understand 

the role of the advertising dollar out there in the Internet and how 

it has actually promoted its use and the quality of it and so on, and 

that can be a scary proposition, depending on what we do. If we 

do act, I think we have to be careful again of going about business 

models and then going on what Mr. Sabet said about broadband, 

and that is, if those pipes are big enough and we keep increasing 

them, we take excuses away from people who may want to manage 

them in a way that really deprives the fair use of the Internet the 

way Dr. Reed envisioned it and has envisioned it for a number of 

years. So we can’t do anything again to impact or restrict the buildVerDate Nov 24 2008 15:59 Oct 08, 2010 Jkt 037690 PO 00000 Frm 00134 Fmt 6633 Sfmt 6633 C:\DOCUMENTS AND SETTINGS\CWELLS1\HEARINGS\110-137 SCOM1 PsN: JIMC
129 

out. Again, I am going to use the word robust in a different context 

of a broadband network, and that really does concern me. 

Lastly, I am going to make this last observation. Whether it is 

an ISP and how they got to where they are or whether it is Google 

and how they got who they are, whatever we come up, I think we 

still have to acknowledge the reality of what Dr. Reed said, but I 

am going to go and use real quick, Mr. Chairman, a quote, and this 

was in regards to service by an ISP, and a Mr. Bob Williams said 

there really should be an onus on the regulators to see this kind 

of thing is done correctly, meaning the information sharing and collection, and Mr. Williams deals with telecom and media issues at 

Consumers Union, and this is what he said. He could have read 

some of the terms earlier when placing the order online, but he just 

clicked the accept button. Quote: ‘‘I am a hard-nosed consumer advocate type. I really should have examined it better than I did,’’ he 

said. But he added he acted like most consumers because of the 

lack of alternatives. ‘‘You click the accept button because it is not 

like you are going somewhere else.’’ And that is the backdrop and 

that is the reality, and I believe that we will be acting responsibly 

understanding those market forces. 

Thank you very much, Mr. Chairman. 

Mr. MARKEY. The gentleman’s time has expired. Does the 

gentlelady from California have any additional questions? 

So we are going to turn to our panel, and we are going to ask 

each of you to give us your 1-minute summary of what you want 

us to remember about this issue of privacy and the American people, and it might help if you told us whether or not you thought 

opt-in was a good standard. We are talking privacy generally here, 

not individual companies but just tell us what you think. Should 

that be the standard? Mr. Cleland? 

Mr. CLELAND. Well, I think that we need to have a holistic, comprehensive, balanced approach to privacy law. 

Mr. MARKEY. Would that be opt-in? 

Mr. CLELAND. Since you have asked, I think what the problem 

is, when we now go to opt-in or opt-out and it is that binary question, we are a little bit like the problem we have with do-not-call, 

and because it is complicated, we may end up with a do-not-track 

where people, just because nobody is minding what is going on in 

the Internet, people get fed up, and they say well, just let me say 

somewhere that I don’t want to be tracked with anybody, and so 

when we go with just opt-in or opt-out, what we are doing is, we 

are basically making something that is not simple real simple 

when there are a lot of different ways to skin this cat. So I am big 

on privacy, but one size doesn’t fit all. But you do need to look at 

it comprehensively. 

Mr. MARKEY. Mr. Sabet? 

Mr. SABET. Yes, a quick summary here is, we really believe that 

privacy and the open Internet are directly linked, and what you do 

with the data as a customer of DPI technology is the key. So if you 

violate people’s privacy to manage the Internet, the open Internet, 

we think that is the real harm here for consumers and the Internet 

ecosystem. 

Mr. MARKEY. Thank you. 

Dr. Reed? 

130 

Mr. REED. Well, I think opt-in is too glib. It really should be informed consent and understanding of what will happen to the information, that you are being tracked and in the case of the Internet where, for example, you could predict reliably the political affiliation and beliefs of somebody literally by who they are talking 

to, so if you just monitor who they are talking to, you don’t have 

to know whether they are a Democrat or a Republican. You actually have a much more complex notion of—you have to know what 

kind of analysis and use will be made of the information and what 

limits are placed on it, whether it is just for advertising, just for 

advertising by certain advertisers, just for something, as opposed 

to selling the unvarnished analytical information for any possible 

use, and that I think is something that ought to be kept in mind. 

So start with opt-in, but go beyond it, to opt in to what. 

Mr. MARKEY. Mr. Dykes? 

Mr. DYKES. I think we need to recognize that the Internet today 

is more than 50 percent funded by advertising, and to adopt an 

across-the-board opt-in rule would substantially reduce the value of 

the advertising across the Internet, so I think that major harm 

could be incurred that way. So I think a more holistic view of it, 

but also a more fine-tuned view, such that we are sensitive to the 

type of data being collected before we decide what the rules should 

be, I think is the most appropriate way to answer that. 

Mr. MARKEY. Ms. Cooper? 

Ms. COOPER. I think consumers deserve to have informed, meaningful control over their data. Whether it is opt-in or opt-out, consumers need to be in the driver’s seat with respect to what is happening to their data when they go online and when their data is 

existing offline. They need to be the ones who decide how their 

data gets to be used. 

Mr. MARKEY. Thank you, Ms. Cooper, very much. 

When people use the World Wide Web, they don’t want it to turn 

into the wild, wild west when it comes to their personal information, and I think that this analogy which Dr. Reed introduced today 

is a good one, and it extends to the post office, it extends to FedEx 

or UPS, that this is just another means of delivering something 

that a consumer is interested in, and there should be a barrier that 

exists unless the consumer determines that they do want, in other 

words, this information to be compromised. What we have learned 

from Embarq and we have learned from Charter is that in their affiliation with NebuAd that these questions weren’t asked from the 

get-go. 

This is a very serious subject. It is one that goes right to the 

heart of who we are as Americans. Back in 1775 in my congressional district in Lexington, one of the things that was just absolutely agitating the colonists was that the British felt they could 

come right into your home. There was no search warrant. There 

was no one that could stop them, and they could just come in. And 

so the very principles of individual freedom, individual liberty, you 

are right not to have either the government or a private sector 

company coming into your life without your permission, is central 

to who we are as Americans. That is what we fought for. That is 

what we continue to fight for and try to spread around the rest of 

the world. We don’t believe that either the government or private 

131 

sector companies have a right to come in without your permission 

unless there is a legally obtained warrant, and that is why we are 

talking about wiretapping laws here today. That is why we are 

talking about broad privacy laws that have been put on the books 

over the years. It is because it is a subject of constant debate in 

our country from our very inception. 

So I think that what we are hearing today is strong sentiment 

from most members that clear notice and meaningful opt-in must 

be the standard by which cable and phone companies like Verizon 

or Comcast, to take the names of two companies that are more well 

known than Charter or Embarq, but if this trend extends, then 

that is who we will be talking about. We will be talking about 

these larger carriers who will have the capacity, unless we have 

some standards, to be able to use this information as a product, 

and I don’t think that Americans really want that to be the standard, notwithstanding the advertising base that the Internet might 

be based upon. There might be a few companies that suffer if 

Americans decide that they don’t want all of their information to 

just become something that is put together as an advertising profile of that individual. That is a price just a little bit too high to 

pay in order to have the Internet the way that a private sector 

company might want it to be there, and the same way that politicians might want to know all of the private sentiments of voters 

in their district and be able to get access to it, we can’t get access 

to it. We can hope that they are going to vote for us on Election 

Day, but there is a certain limit beyond which we can’t go in intruding into the privacy of Americans. But it is a natural instinct. 

Each of us up here would love to know everything that is going on 

in the homes of all 650,000 people in our district with regard to 

their political attitudes. That would be very helpful to us. But we 

can’t, and there is a good reason why we can’t, because these individuals have a right to their privacy, and the same thing extends 

over to their right to privacy from advertisers, their right to say no, 

I don’t want you in my front door. When your mother is saying to 

you as a little kid, when you tell the person knocking on the door 

they are not home, tell them your mother is not home, but what 

are they really saying? What your mother is really saying is, we 

are not home to you, sir, on the front door knocking trying to get 

inside my home, and that is your right, and it should be your right 

as an American citizen not to let people inside your mail, inside 

your packages, inside your packets. 

This packet-switched network that Dr. Reed and others invented 

is something that really goes right to the heart, and the principles 

that were established really go right to the heart of who we are, 

and Ranking Member Joe Barton, Chairman John Dingell, and I 

have already written to a cable and a phone company where either 

the notice or the opt-in choice was inadequate or missing. So we 

need to have remedial legal courses for some corporate general 

counsels, and we need to have the phone and the cable companies 

step up and clearly say what their policies will be, and as I have 

proposed previously, we need a comprehensive online privacy bill 

to close the gaps that exist with search engines and other sites. 

So we thank each of you for your testimony. We intend on working very closely. We intend on really raising the profile of this issue 

132 

and any companies that are engaging in it so they can become 

more famous, more well known in terms of what they are doing, 

and this is going to become an escalating subject of attention for 

this committee and for the Congress, because any time anyone 

learns about it, their first thought is, I didn’t know that that was 

happening with all of my information, and that just demonstrates 

that there has not been notice given to people. 

So we thank all of you, and we intend on following up on this 

issue in the months and years ahead. With that, this hearing is adjourned. 

[Whereupon, at 11:47 a.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

STATEMENT OF HON. JOHN D. DINGELL 

Thank you, Mr. Chairman, for holding this hearing, and I thank the witnesses 

for being here. 

Deep packet inspection (DPI) is part of the Internet now, and it will be part of 

the Internet in the future. That much is clear. However, any industry that includes 

a company whose motto is, ‘‘See Everything. Know Everything.’’ is worthy of close 

scrutiny. 

Our job today is to consider how best to balance the deployment of DPI with adequate protection of consumers’ privacy. We must also consider the effects of DPI on 

competition and investment across the Internet. 

An immediate concern is the targeted advertising that DPI makes possible. On 

Monday, Chairman Markey, Ranking Member Barton, and I sent a letter to the 

phone company Embarq. We expressed concern that Embarq conducted a trial in an 

unnamed community in its service area of a targeted advertising system that 

tracked customers’ Web use without providing clear notice of the trial to subscribers. Not only did Embarq fail to give its subscribers a chance to opt in to the 

tracking, but it did not directly notify affected customers that they had a chance 

to opt out. I find the notion that a broadband provider would implement such tracking with no real notice to the customer to be deeply troubling. 

We are in this position, because the Federal Communications Commission (FCC) 

has yet to establish any clear privacy protections for customers of wireline 

broadband services. In its rush over the last several years to deregulate broadband 

services, the Commission has failed to adequately protect consumers. When Chairman Martin testified before this Committee in March of 2007, I asked him when 

he would remedy this problem. He responded that the Commission would endeavor 

to act by the end of 2007. Clearly, much work remains to be done at the FCC. 

We must also consider what DPI means for the future of the Internet. DPI can 

be used for legitimate and necessary purposes by broadband providers, such as to 

reasonably manage network congestion and protect against viruses. To the extent 

that they utilize DPI for these purposes, I have no quarrel with broadband providers. Unfortunately, DPI can also be used for nefarious purposes, such as unfairly 

blocking certain applications or slowing one Web site’s traffic at the expense of another. We in Congress must be vigilant in the face of these and other abuses. The 

importance of an open and competitive Internet cannot be understated. 

I hope today’s witnesses will help the Committee in its examination of DPI by addressing a few questions. How should broadband providers notify subscribers they 

are planning to track customer Web use? Should providers be required to obtain optin consent? What privacy rules should apply to broadband providers? And how do 

we ensure that DPI does not stifle innovation on, and investment in, the Internet? 

I thank the witnesses for being here, and I look forward to the testimony. 

Æ