I've done some speculation on how AT&T might actually implement their proposed copyright-filtering mechanism, without actually having to do deep-packet inspection or even providing new hardware. After all, if their motive is to save money, they will select a mechanism which doesn't cost money.
The idea is to rely on someone else (MPAA or an affiliate) to spider the torrents and identify participants, and once the graph of participants is generated, to dynamically block just that graph using router ACLs, which would allow the MPAA to play Whak-a-mole on individual torrents. This would be very different in practice compared with either deep packet inspection or traffic analysis. I think such speculation is useful because if AT&T really does follow through on their stated goals, we should get ahead of the curve and understand what this might look like in practice, and how to detect the difference between possible techniques (DPI vs generic traffic analysis vs spider-blocking). The solution space is actually pretty limited. More details/thoughts on my blog: http://nweaver.blogspot.com/2008/01/security-thought-at-copyright-fighting.html
