new addition on IP analysis systems

This set of controls is targeted at ip camera a very narrow class of products, moreso than we would have liked to have seen. In order for a product to get caught in these controls, it would need to fulfill all of the above criteria – which is no easy feat. Here are a few of the problems:

Carrying out analysis on “carrier class IP network” is aimed at targeting powerful analysis systems – specifically those that have the capacity to carry out large-scale analysis reliably. What constitutes “carrier class” will however be open to interpretation by member states, given that there are a number of definitions that could be cited by any of the competent bodies. (here and here)
“Analysis at the application layer” surveillance camera greatly restricts the scope of the control, given that many surveillance products operate at layers other than the application layer, which is usually thought to refer simply to applications such as IMAP and BitTorrent among many others.
Extraction of selected data and its indexing  means that the product needs to be actively retrieving the metadata and content from the IP traffic as well as actively storing this data.
Further, the controls call for the product to be “specially designed” to search through the captured data based on certain characteristics of an individual (such as name, political affiliation, tribe etc) and must use this data to deliver what’s known in the industry as “actionable intelligence”, meaning it has to be able to collate the captured data to identify relationships between the targeted individual or group.

A full analysis of how far this control goes to capturing some of the surveillance systems we’ve seen exported in the last few years is also underway. Additional questions need to be answered by national export control authorities on how far they will interpret this element of the control.

What does this mean?

Taken together, the new addition on IP analysis systems is extremely narrow – and as a result risks failing to adequately catch some of the systems that are of most concern. It does however, control complete system that extract data, analyse it and map it. Conversely, the new controls  security systems on intrusion software, suffer from overly broad definitions and could result in more products being caught than intended unless clarifying statements are made.