Key lawmaker wants ISPs to get customer approval before tracking their Web activities

UPDATED: See video of Rep. Edward J. Markey discussing ISP snooping.

-----

Your postal carrier can't open your mail then sell information about your interests to marketers. So some lawmakers and privacy advocates argue that Internet service providers shouldn't be able to do the same thing with the digital packets that describe your Web-surfing activities -- unless you specifically say it's OK.

That was the clear message this morning at a House hearing during which several lawmakers grilled the chief executive of NebuAd, a Silicon Valley startup that helps ISPs deliver targeted ads by tracking users' online footprints.

NebuAd allows users to opt out of the service after they're informed of it by their ISP in their billing statement or an e-mail, CEO Robert Dykes said. But that wasn't good enough for Rep. Edward J. Markey, chairman of the House subcommittee on telecommunications and the Internet, and four other subcommittee members.

"That’s basically saying silence is consent and as a result you can do whatever you want with their information," Markey told Dykes after aggressive questioning about the company's policies. “I don’t think, unless you’ve got clear affirmative permission, that you should be able to take this incredible leap into the breaching of the privacy of Americans."

Markey said after the hearing that he believed such an opt-in requirement should be included in online privacy legislation he is working on.

NebuAd has been the focus of congressional attention after it partnered with some ISPs to monitor customers web use. The largest of those was Charter Communications, which indefinitely delayed a planned test of NebuAd's service after complaints from privacy advocates and lawmakers, including Markey.

NebuAd's technology revolves around deep-packet inspection, which involves looking into ...

... the content of online communications, such as specific websites a person visited. Deep-packet inspection has important uses, including law enforcement surveillance and stopping computer viruses. But privacy advocates said allowing ISPs to use it to deliver targeted advertisements raised major concerns, and also probably violated federal and state wiretapping laws.

Those concerns were echoed by Markey and others on his subcommittee, which specifically examined the issue at today's hearing. Unlike a congressional hearing on the same topic last week, during which senators struggled to understand the technology and offered no policy proposals, most of the House lawmakers were up to speed on the issue -- and clear on their view of its implications.

"The fact that I have to take affirmative action so that I can stop you from making money from my transactions on the Internet seems sort of backwards," said Rep. Greg Walden, a Republican from Oregon.

Dykes was on the defensive, particularly as Markey bore in on the company's policies for informing consumers about the service. Here's an example:

Markey: Do you support a policy saying the consumer must say, "Yes," before you’re allowed to roam through their personal data and turn it into an information product which is then sold to other companies? Yes or no to that question.

Dykes: Mr. Chairman, I think you’re forcing me into one of those have-you-stopped-beating-your-wife [questions].

Markey: No no no no no no. Have you stopped beating the consumer is the question.

(For an audio clip of the back-and-forth between Markey and Dykes, which is entertaining as well as interesting, click here.)

Dykes said his company develops anonymous profiles of Web users in "certain innocuous categories" such as travel. The company stays away from sensitive information such as medical issues. He warned that although some people might wish that the delivery of information across the Web was like the post office delivering mail, it is in fact a commercial enterprise supported by advertising.

"To adopt an across-the-board opt-in rule would potentially reduce the value of the advertising across the Internet, so I think major harm could be incurred that way," Dykes said.

But Markey promised to remain vigilant on the issue and highlight any attempts by ISPs to use deep-packet inspection as he works on privacy legislation. Markey sent a letter last week to Kansas-based ISP Embarq that also was signed by Reps. John Dingell, the Michigan Democrat who heads the House Energy and Commerce Committee, and Joe Barton of Texas, the top Republican on the committee.

Markey said the issue goes to the heart of the right to privacy.

"It should be your right as an American citizen not to let people inside your mail, inside your packages, inside your packets," he said.

-- Jim Puzzanghera

Puzzanghera, a Times staff writer, covers tech and media policy from Washington.

Photo: AYV Fotografia Digital via Flickr