Revealed: ITU's deep packet snooping standard leaks online

Boring tech doc or INTERNET-EATING MONSTER?


Updated A moment of inattention has allowed the ITU’s proposed deep packet inspection (DPI) standard to escape.

The slip-up happened when an Australian CryptoParty activist Asher Wolf put out a public call on Twitter asking for a copy of the text. The ITU duly sent it by e-mail – only later realising its mistake and asking her to treat it as for her eyes only.

By which time, Vulture South and other journalists had seen the document…

So what is the ITU proposing?

The document – all 95 pages of it – is exactly what it purports to be: a proposed technical interoperability standard for deep packet inspection systems (its very existence comes as something of a surprise to this vulture: in the context of network performance, I asked several vendors when this would be standardised, and the unanimous response was “never”).

The standard describes itself as applicable to “application identification, flow identification, inspected traffic types” – which The Register would highlight as the most sensitive functions – along with how DPI systems manage signatures, report to network management systems, and interact with their policy engines.

A block diagram is going to be needed.

A thumbnail outline of the ITU's concept of DPI

What’s odd about the ITU’s decision to standardise DPI is this: the point of standardisation is interoperability – and interoperability matters most where systems interact with the outside world.

Looking at this block diagram, the biggest question that occurs to The Register has been the same question throughout the life of DPI: if the interfaces behave themselves, passing packets in and out as they should, what’s the point of standardising the internals?

Yet that is what the ITU is attempting – whether or not this can be taken as an endorsement of DPI is another matter.

At the high level, there’s nothing remarkable. Packet identification – unidirectional or bi-directional – is specified as a necessary component of DPI because it is. The ITU spec says that the flow identification should comply with IETF RFCs 5101 and 5102.

The next piece defines the existence and operation of the signature library, the specification for which requires “only” that the signature library exist and what signatures it contains. It also demands that the library be secured. And – naturally enough – that signatures can be added, removed, modified and so on.

There’s a lot more, but the first thing to understand is this: much of the standard does nothing more than describe the functional components of DPI systems that already exist.

What about the impact on the network?

Here, at least, the ITU seems aware that DPI can carry risks, so it insists that deployments don’t impact emergency telecommunications (for example, by introducing excessive, unwanted latency or packet loss).

The devil's in the appendices

If you’ve stayed with me this long, congratulations. It’s in the appendices that we reach the part of the spec that has people worried. Specifically, Appendix I: application scenarios.

This section looks at various use-cases: service differentiation (which, of course, raises the debate about network neutrality); traffic monitoring for resource allocation based on subscriber policy (ie, “premium” versus “best effort” services – neutrality again); malicious traffic identification (which isn’t a bad idea); service-based billing (which could, again, tie back to the neutrality question)…

...and so on, ad infinitum.

Having read the document – twice now - this Register author is starting to form the opinion that for a 95-page epic, the ITU proposed DPI standard is less than the sum of its parts.

As has been pointed out to me privately, and will no doubt give rise to extensive public condemnation, the proposed standards use-case examples include VoIP blocking, BitTorrent detection, SIP blocking and so on.

I don’t suspect for a moment that the ITU conceived such ideas on its own. They read as if they were drawn from vendor configuration manuals. In other words the examples were provided - because they already existed.

And if the standard were adopted, what then?

The argument that the standard will act as an enabler to repressive regimes seems to ignore the long history of DPI deployment that already exists, across both democratic and non-democratic countries. It’s already there.

Also, the argument against the WCIT’s proposed International Telecommunications Regulations runs that the ITU’s involvement will stifle innovation and hamper the Internet. Why would the same body’s involvement become an enhancer and enabler to DPI?

It seems to me that DPI could do with the kind of stifling that the ITU is accused of threatening to the online world.

Unless, of course, the outcry over the DPI standard is intended as another rallying cry against the virtual black helicopters of the ITU… ®

Updated to add

The ITU has now announced that the DPI standard has been approved. Its announcement spins the standard in the direction of performance management, managing not to dwell on unwelcome issues such as BitTorrent or VoIP blocking.

It states that the standard will soon be available for download. ®


Other stories you might like

  • Japan picks AWS and Google for first gov cloud push

    Local players passed over for Digital Agency’s first project

    Japan's Digital Agency has picked Amazon Web Services and Google Cloud for its first big reform push.

    The Agency started operations in September 2021, years after efforts like the UK's Government Digital Service (GDS) or Australia's Digital Transformation Agency (DTA). The body was a signature reform initiated by Prime Minister Yoshihide Suga, who spent his year-long stint in the top job trying to curb Japan's reliance on paper documents, manual processes, and faxes. Japan's many government agencies also operated their websites independently of each other, most with their own design and interface.

    The new Agency therefore has a remit to "cut across all ministries" and "provide services that are driven not toward ministries, agency, laws, or systems, but toward users and to improve user-experience".

    Continue reading
  • Singaporean minister touts internet 'kill switch' that finds kids reading net nasties and cuts 'em off ASAP

    Fancies a real-time crowdsourced content rating scheme too

    A Minister in the Singapore government has suggested the creation of an internet kill switch that would prevent minors from reading questionable material online – perhaps using ratings of content created in real time by crowdsourced contributors.

    "The post-COVID world will bring new challenges globally, including to us in the security arena," said Minister for Defence Dr Ng Eng Hen at a Tuesday ceremony to award the city-state's 2021 Defense Technology Prize.

    "For operations, the SAF (Singapore Armed Force) has to expand its capabilities in the digital domain. Whether for administrative or operational purposes, I think that we will need to leverage technology to the maximum," he declared.

    Continue reading
  • China Telecom booted out of USA as Feds worry it could disrupt or spy on local networks

    FCC urges more action against Huawei and DJI, too

    The US Federal Communications Commission (FCC) has terminated China Telecom's authority to provide communications services in the USA.

    In its announcement of the termination, the government agency explained the decision is necessary because the national security environment has changed in the years since 2002. That was when China Telecom was first allowed to operate in the USA.

    The FCC now believes – partly based on classified advice from national security agencies – that China Telecom can "access, store, disrupt, and/or misroute US communications, which in turn allow them to engage in espionage and other harmful activities against the United States." And because China Telecom is state-controlled, China's government can compel the carrier to act as it sees fit, without judicial review or oversight.

    Continue reading

Biting the hand that feeds IT © 1998–2021