I'd like to throw a story into the privacy discussion. Do you know what a full content packet capture is? It’s when you’re able to grab every piece of data tra

I'd like to throw a story into the privacy discussion. Do you know what a full content packet capture is? It’s when you’re able to grab every piece of data transmitted over a network using a tool called tcpdump. You can use another tool to reassemble those collected data packets into complete applications, movie or music files, even video chats and phone calls. Safari Books defines full content data as, “the most flexible form of network-based information. It is a rich form of evidence offering detail and opportunities seldom found elsewhere. Once full content data has been acquired, analysts can derive session, alert, and statistical data if necessary.” As a joke, an instructor once told me that when they went onsite to do security investigations, they would do a full content dump; if someone was downloading videos at the time, my instructor would say, “Thanks for the movie, guys!” This is what the Utah Data Center is doing. All packets are collected using a tool like tcpdump, and then the Center reassembles them and categorizes the content into data cubes (e.g., movies, video calls, emails) that are easily findable with open source search engines such as Lucene and Solr. Is this taking security seriously? You bet! When you ask a security professional what they recommend is the most reasonable approach to protecting sensitive health records, they will say, “Its all about Penetration Tests, Risk Assessments, and IDS.” Mass Traffic Collection is currently one example that’s being taken very seriously as an approach to security. If a hosting provider like Akamai — which, runs 30% of the world’s web traffic — is able to reassemble your packets, and even archive them, is that what you want security to be? Probably not, but when a security professional says “let’s take security seriously”, to them it means just watch all the things. That may sound a bit paranoid but check out this pretty spooky Hacking Team Commercial[1] where they specifically say, “Is passive monitoring enough? You want to look through your target’s eyes.” I remember in 2006, after my IDS training, I was all for collecting every single packet (no matter what) because I was taught as a security professional, that was the only way I could do my job: watch everything, since we need to know everything about anything. If you watch everything, that’s inherently security, and the world is protected. That was my modus operandi for many years. This is why taking privacy and security seriously really means taking compliance seriously. Compliance lassos in “watch everything” while also providing validation and proof of security. If we’re doing good hygiene (e.g. Key rotation, Log review, Code review, Change control, etc. ) in our forts, there’s no reason to collect and watch everything. If compliance fails as an approach to security, IDS could expand to a massive data collection agent running on every company in the world. The recipe to collect everything already exists but that means only security is being taken seriously. I hope we start to take compliance seriously because I think that is the intersection for good privacy and good security. [1] https://www.youtube.com/watch?v=R63CRBNLE2o https://www.youtube.com/watch?v=R63CRBNLE2o