Gogo is under pressure to use alternative methods for preventing airline passengers from accessing YouTube, after a Google executive cried foul over the inflight Wi-Fi provider’s practice of using fake Google.com web security certificates in a bid to preserve bandwidth to aircraft.
The Chicago area company came under fire when Adrienne Porter Felt, a Google engineer who serves as tech lead for Google Chrome’s usable security team, observed Gogo’s intentional use of false Google SSL certs in-flight.
Passenger reaction was swift and fierce, with some calling the Gogo protocol “nefarious” and a flagrant violation of privacy. “There’s no reason for any organization anywhere to try and fake certificates. Hard-block, or traffic-shape anything from https://www.youtube.com/, but don’t mess with TLS/SSL,” says computer software engineer Stefan Paetow.
“It may be considered a challenge for a certain set of flyers who believe they should be able to watch YouTube videos in full HD, other passengers be damned… but then again, Gogo needs to understand that if they want to manage [a] finite resource, they will need to actively manage white/blacklists.”
For its part, Gogo insists that the only reason it used the fake SSL certs is to block YouTube, not to snoop on passengers’ email and web searches.
In a statement Gogo CTO Anand Chari said: “Gogo takes our customer’s privacy very seriously and we are committed to bringing the best internet experience to the sky. Right now, Gogo is working on many ways to bring more bandwidth to an aircraft. Until then, we have stated that we don’t support various streaming video sites and utilize several techniques to limit/block video streaming. One of the recent off-the-shelf solutions that we use proxies secure video traffic to block it. Whatever technique we use to shape bandwidth, it impacts only some secure video streaming sites and does not affect general secure internet traffic. These techniques are used to assure that everyone who wants to access the Internet on a Gogo equipped plane will have a consistent browsing experience.
“We can assure customers that no user information is being collected when any of these techniques are being used. They are simply ways of making sure all passengers who want to access the Internet in flight have a good experience.”
Even so, aviation industry insiders and many tech savvy travelers say the practice is perceived as shady no matter the intent. Noted travel analyst Henry Harteveldt called the situation “ugly”.
Gogo is now under increasing public pressure, not to mention apparent Google pressure, to use alternative methods to block YouTube. The company has various options at its disposal, and is understood to have employed alternative methods in the past.
ViaSat, a competitor to Gogo in the United States with Wi-Fi installations on JetBlue Airways and United Airlines, offers airlines the option of blocking by service type. For instance, social media and short form video could be permitted but long-form video blocked. And it employs black- and whitelists that overrule such categorization. But its Ka-band satellite-supported connectivity solution also doesn’t currently face the same type of bandwidth constraints as Gogo, which operates an air-to-ground network that supports a max of 10 Mbps to the plane, if the aircraft is fitted with the company’s latest generation ATG-4 system.
Whatever Gogo’s decision, assuaging passenger fears by blocking YouTube in another way is paramount because this “is destroying the trust relationship between a service provider and their customers”, says a source.