The Daily Network Monitor

Prologue:

Don’t understand what all the huff in the media is about regarding the big telecom companies receiving amnesty for aiding the FBI in warrant-less wiretapping? Here are the Cliff Notes on the erosion of civil liberties in the United States of America and what it could mean to your network.

Act 1: FISA and The Patriot Act

The 1978 Foreign Intelligence Surveillance Act, requires a warrant to intercept international communications involving American citizens. In 2002, not satisfied with the prompt speed of the secret court that has granted these warrants, President Bush, under the auspices of the Patriot Act, ignored the law and ordered the NSA to intercept telephone calls and emails between people outside of and inside of the United States as long as the target was not in this country.

In 2003, the big telecoms (AT&T, Verizon and MCI) entered into contracts with the Federal Bureau of Investigations, receiving compensation for turning over records. Between 2003 and 2005, the telecoms further aided the FBI in warrant-less wiretaps by complying with at least 739 terrorist-related National Security Letters, circumventing current privacy laws. These emergency letters are self-issued subpoenas. As required by law, for an agent to issue a NSL, the inquiry must be related to an open investigation and partnered with a request for a proper subpoena. However, regarding the 739 letters, few were legitimate.

In an interview with Wired News, FBI Assistant Director John Miller stated, “The contract essentially pays for the man hours or the personnel cost for the people who have to do the work. We want dedicated people who handle our requests or do nothing else.”

In 2006, Mark Klein, a telecommunications technician with AT&T’s San Francisco branch, detailed in a statement, on behalf of a class-action suit by the Electronic Frontier Foundation against AT&T, that the National Security Agency, had been granted access to two massive databases that contained records such as phone numbers dialed and internet addresses visited by AT&T’s subscribers. Klein further suggested that access was being granted to the NSA in other facilities in metropolises throughout the United States.

Nearly a year ago, President Bush and Congress pushed the FISA Amendment Act through, granting the intelligence community the ability to spy without court approval for one year, with the caveats listed above, and retroactively legitimizing five years of illegal activity by the Bush administration.

Act 2: Protect America Act & RESTORE Act

(To Be Continued)

The House of Representatives recently passed bill HR4137, raising troubling questions about privacy rights on college campus networks. While the bill itself is a tremendous education package, one section covering “Campus-based Digital Theft Prevention” is igniting heated debate throughout the blogosphere. Bill HR4137 requires administrators to perform network filtering, profiling and monitoring students for potential illegal activities.

In addition, the bill requires that colleges provide a P2P file-swapping alternative, which may be as simple as public link to the iTunes Music Store or as complex as a suite of network monitoring tools for administrators and file-sharing applications for students. Failure to comply with these mandates could result in the withholding federal funds fromdelinquent campuses, though there is currently no pressure to adopt new technology foran un-passed bill. If federal funding were affected, universities could venture to lose access to Pell grants, Safford and Perkins student loans, which could directly effect applications and admission rates.

While the use of peer-to-peer networks does not necessarily constitute illicit illegal activities, this kind of network monitoring could harbor many negative feelings among users. For this reason, EDUCAUSE, the foremost association of network administrators amongst college campuses, have consistently opposed these kinds of privacy invasions, as the use of VPN tunneling and encryption can easily be subverted by resourceful and persistent users.

While many believe this provision in HR4137 is nothing more than a concerted effort by lobbyists championing the broken business model of the entertainment industry, it should be noted that the Motion Picture Association of America recently revamped their numbers regarding film piracy losses from college campuses (they cut their estimate of 44 percent by two-thirds). And while it is not news that the MPAA is hardly a credible source for metrics in the creation of law, the impact of their influence in Washington DC remains to be seen. Without the opinions of industry professionals, I fear this bill could result in something far more sinister and start us down a slippery slope of profiling and restrictions on innovation and research. Academic officials should not allow legislators far removed from the complexities and needs of college campuses to determine how to run their networks. HR4137 is just another overreaching attempt by the government to pry into student’s lives and play with our equipment.

Voting history on bill HR4137 can be found here at opencongress.org. Whichever side of the fence you fall on regarding this issue, I encourage all of you to contact your Congressional representative and voice your opinion.

The SaaS web-based application delivery model provides corporations with hosted set of business centric applications without a need to purchase, maintain or customize the application to fit their unique needs. 

Many organizations have adopted this model for sales, procurement, CRM and human resources applications for example. Unlike the traditional software acquisition model, where a corporation invests in an application and is required to build the infrastructure to support the application, SaaS requires negligible upfront investment beyond user training. Application maintenance, upgrades and development are the SaaS provider’s responsibility. This is a very attractive value model for many companies. 

When SaaS web-based applications are being evaluated and purchased by a corporation, the IT and network management functions are usually not included in the planning, evaluation and decision process, as IT is perceived as a roadblock. Most frequently, this effort is driven by the business unit or department accessing the application.

This lack of cooperation can cause problems to IT and network management after the application is brought on-line. IT and network management discover the application is deployed and being accessed after the fact. Usually when users contact IT or network management to complain about application performance as the application is bandwidth intensive or existing network infrastructure is near capacity. Another factor to consider is since all SaaS based applications are connected through the Internet outside of the managed corporate network infrastructure, they are subject to any number of issues including forwarding delays, connection reliability and traffic contention. 

Business units evaluating SaaS as an option need to include IT and network management to allow for resource planning and monitoring of end-to-end SaaS specific application traffic to ensure that availability and performance expectations are achieved.