Agentless Backup is Not a Myth

A little brouhaha started last week with a post to the Vuln-Dev mailing list, in which a contributor called J Edgar Hoover observed that Comcast's cable Internet service was using an Inktomi traffic server capable of recording the individual comings and goings of its subscribers.

Several days later the Associated Press' Ted Bridis ran the story after doing some legwork, but unfortunately neglecting to credit the original source.

The questionable equipment isn't necessarily a problem, though it could be if it were misused. ISPs and NSPs routinely use caching hardware to serve pages more quickly and balance traffic loads. Companies also gather aggregate traffic data which they sell to the ever-inquisitive advertising industry. This is all routine, and relatively harmless in and of itself.

The upshot is that Comcast has publicly stated that it wasn't tracking individual users' surfing habits and wasn't selling user-specific marketing data. The company further issued a guarantee that they won't do any such thing in future.

"Comcast reassured customers Wednesday that the information had been stored only temporarily, was purged automatically every few days and 'has never been connected to individual subscribers,'" Bridis writes.

Meanwhile, on the strength of the AP story, US Representative Edward Markey (Democrat, Massachusetts) got his privacy-advocacy knee a-jerking (not that it takes much to effect this phenomenon), and contacted Comcast warning them that they might or might not be in violation of federal law, depending on what they were or weren't doing with the data, which of course no one knows, and now probably never will.

But if we look at the Comcast subscriber agreement, we get the feeling that they wouldn't dream of collecting user-specific data, unless they happen to feel like doing so.

"Comcast considers the personally-identifiable Customer information that is collected to be confidential. Comcast will disclose to third parties personal information that Comcast maintains related to Customers only when it is necessary to deliver the Service to customers or carry out related business activities, in the ordinary course of business, for ordinary business purposes, and at a frequency dictated by Comcast's particular business need, or pursuant to a court order or order of any regulatory body having jurisdiction over matters which are the subject of this Agreement."

Mostly that's a lot of idiotic legal boilerplate meant to discourage frivolous lawsuits. The fact is there are laws which make it a crime to intercept a person's communications without their knowledge and consent; and subscriber agreements aren't quite at the point where they absolve companies of responsibility for criminal activity.

Not yet, anyway. ®

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider