is a private company founded in 1997 by Ori Cohen
, who had been in charge of technology development for VDONet
, an early media streaming
It is notable for being the creator of NarusInsight, a supercomputer system which is used by the NSA and other bodies to perform mass surveillance and monitoring of citizens' and corporations' Internet communications in real-time, and whose installation in AT&T's San Francisco Internet backbone gave rise to a 2006 class action lawsuit by the Electronic Frontier Foundation against AT&T. EFF vs AT&T
Management and investors
According to Narus's own website listing of the Board of Directors
, Dr. Cohen is no longer the Chairman of the Board.
Prior to 9/11 Narus worked on building carrier-grade tools to analyze IP network traffic for billing purposes, to prevent what they term "revenue leakage". Post-9/11 they have continued down that path while adding more semantic monitoring abilities for surveillance purposes. In 2004, Narus engaged the former Deputy Director of the National Security Agency, William Crowell as a director. From the Press Release announcing this:
- "Crowell is an independent security consultant and holds several board positions with a variety of technology and technology-based security companies. Since 9/11, Crowell has served on the Defense Advanced Research Projects Agency (DARPA) Task Force on Terrorism and Deterrence, the National Research Council Committee on Science and Technology for Countering Terrorism and the Markle Foundation Task Force on National Security in the Information Age."
Narus has venture funding from companies including JP Morgan Partners, Mayfield, NeoCarta, Presidio Venture Partners, Walden International, Intel, NTT Software and Sumisho Electronics.
The capabilities of the NarusInsight system are alarming to many privacy advocates. Narus lists several partners who provide various technologies similar to the features of insight. It is unclear if any of these partners are responsible for some of the features. Several of the partners are funded by In-Q-Tel
From the Key Features list of NarusInsight
- Universal data collection from links, routers, soft switches, IDS/IPS, databases, etc. provides network view across IP networks.
- Normalization, Correlation, Aggregation and Analysis provide a model of user, element, protocol, application and network behaviors, in real-time.
- Seven 9s reliability from data collection to data processing and analysis.
- Packet processing performance that supports network speeds of up to OC-192 at layer 4 and OC-48 at layer 7, enabling carriers to monitor traffic at either the edge of the network or at the core.
- Scalability to support large, complex IP networks.
- NarusInsight's functionality can be configured to feed a particular activity or IP service such as security, lawful intercept or even Skype detection and blocking.
- Packet-mode data intercepts for Service Providers and Carriers.
- Wireline to wireless and Wi-Fi or dialup to broadband.
- "Instant Compliance" with CALEA and ETSI for simple, fast and hands-free compliance.
- Carrier-grade speeds, performance and scalability.
- Supports all of your services, out-of-the-box.
- Securely manages resources while simplifying audits and reporting.
- Network and vendor agnostic.
- Enables additional application for revenue generation or revenue protection.
This data flows right into NarusInsight Intercept Suite, which enables packet-level, flow-level, and application-level usage information is captured and analyzed as well as raw user session packets for forensic analysis, surveillance or in satisfying regulatory compliance for lawful intercept.
The Lawful Intercept module offers carriers and service providers compliance with regulatory requirements regarding lawful intercept. The Lawful Intercept module provides an end-to-end solution consisting of Administration, Access and Delivery functions. The Lawful Intercept module is compliant with CALEA and ETSI standards. It can be seamlessly integrated with third party products for testing/validation or as a complete law enforcement solution.
The Directed Analysis module seamlessly integrates with NarusInsight Secure Suite or other DDoS, intrusion or anomaly detection systems, securely providing analysts with real-time, surgical targeting of suspect information (from flow to application to full packets). The Directed Analysis module provides industry standard formats and offers tools for archival and integration with third party investigative tools.
These capabilities include playback of streaming media (i.e. VoIP), rendering of web pages, examination of e-mail and the ability to analyze the payload/attachments of e-mail or file transfer protocols. Narus partner products offer the ability to quickly analyze information collected by the Directed Analysis or Lawful Intercept modules. When Narus partners' powerful analytic tools are combined with the surgical targeting and real-time collection capabilities of Directed Analysis and Lawful Intercept modules, analysts or law enforcement agents are provided capabilities that have been unavailable thus far.
According to a company press release, the latest version of NarusInsight Intercept Suite (NIS) is "the industry's only network traffic intelligence system that supports real-time precision targeting, capturing and reconstruction of webmail traffic... including Google Gmail, MSN Hotmail, Yahoo! Mail, and Gawab Mail (English and Arabic versions)."
It is useful to examine the OSI model
of seven layers which underpins all communication on the Internet
. NarusInsight focuses on two layers: number four, the transport layer
, built on standards like TCP and UDP, the physical building blocks of Internet data traffic, and number seven, the application layer
, built on standards like HTTP
, which are dependent on the application using them, i.e. Internet Explorer, Kazaa, Skype, etc. NarusInsight monitors 10 billion bits per second at level four and 2.5 billion bits per second at level seven. For reference, a 256K DSL
line equals 0.25 million bits per second (Mbit/s
), and a 56 kbit/s telephone modem around 0.05 Mbit/s. So a single NarusInsight machine can monitor traffic equal to the maximum capacity of around 39,000 DSL lines or 195,000 telephone modems. But, in practical terms, since individual internet connections are not continually filled to capacity, the 10 Gbit/s capacity of one Narus installation enables it to monitor the combined traffic of several million broadband users.
It can also perform semantic analysis of the same traffic as it is happening, in other words analyze the content, meaning, structure and significance of this entire traffic, as it is happening.
The exact use of this data is not fully documented. A starting point is the Internet Protocol Detail Record, used to record information about usage activity within the telecom infrastructure (such as a call completion). NDM-U stands for "Network Data Management - Usage". It refers to a functional operation within the Telecom Management Forum's Telecom Operations Map. The NDM function collects data from devices and services in a service providers network. Usage refers to the type of data which is the focus of this document. These standards were built into Narus' systems.
- "IPDR.org has been in existence since 1999 and more than a dozen vendors have actual IPDR implementations "etched in code". Their systems are actually able to talk to each other and interoperate. Version 2.5 and up of the NDM-U represents a stable basis for development. IPDR.org's Interoperability Pavilion is a working demonstration of multiple companies exchanging service usage data in that format."
Service usage data. That would be data on the actual usage of the Internet. And what kind of data would this be? Way back in 1999, this article
- "In an effort to provide more complex network traffic analysis, Narus is introducing its semantic network traffic service. The company cites research which predicts the fast-growing ISP sector will become stagnant without the ability to offer differentiated services. In order to gain significant revenues from these services, a technology was necessary to allow usage based pricing.
- "We realized that, at the heart of the data that is needed to accurately measure usage and enable 'pay-as-you-go' business models for Internet service providers, is what we call the 'semantics' of network traffic," said Ori Cohen, Narus' founder and chief executive officer.
- "In short, by seeing the 'semantics' of network traffic, service providers can see 'inside' the data, providing much more detailed insight about the use of the Internet and the perceived value of specific applications than existing technologies allow."
- "Semantic Traffic Analysis uses network technology to consistently capture and analyze all IP data streams on heavily trafficked networks remotely and non-invasively. In addition, the semantics of the data stream are determined also, as well as the protocol used and the application taking place. A variety of other data is available as well."
In this context, semantics
is not just the data, but rather the meaning of the data. It looks at the data in a more comprehensive way than looking for keywords. Each NarusInsight machine does this at 2500 million bits per second, in real-time.
From Narus' Lawful Intercept and Regulatory Compliance page:
- "Explosive Internet growth in recent years has transformed worldwide communications, yielding tremendous efficiencies and benefits, as well as many risks."
- "For example, terrorist attacks around the globe have been carefully orchestrated through Internet-based forms of communications such as e-mail, messaging, hidden Web pages and now VoIP, forcing governmental organizations and law enforcement agencies to re-evaluate how they are providing public security as it becomes so much easier and faster to communicate electronically."
- "Recent mandates and the resulting standards referenced under CALEA in the United States and ETSI in Western Europe aim to preserve the right of law enforcement agencies to conduct authorized electronic surveillance in an effort to protect the public and its right to privacy. However, these mandates create IT headaches for carriers as they struggle to meet the requirements."
- "With a suite of products targeted at meeting lawful intercept requirements, Narus simplifies lawful intercept tasks helping carriers and agencies meet requirements without experiencing any degradation in service quality."