Who Uses Covert Channels? (cont) Internal users who Want to use forbidden protocols: SSH to personal mail machine Access P2P networks Instant Messaging Want to have non-malicious back door access: Work from home via inbound SSH tunnel. Access company-internal websites from home. Want to avoid having management/etc see their actions: Access questionable content from work Applying for job with competitors Corporate 'spies'