Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Mesmer]

Originally Posted by unicus

Phorm, as far as I know, checks the user agent that is sent from your browser and with Firefox you can pretend to be any browser (or even make one up), just use the add-on 'User Agent Switcher'

https://addons.mozilla.org/en-US/firefox/addon/59

And there's a large import of user agents here-

http://qainsight.net/content/binary/...gs20070304.xml (right click and download)

Thank you for the urls. I already have user agent switcher.

My idea would be to make it impossible for Phorm to know in advance (from the user agent) whether or not a Firefox browser could be intercepted and profiled by them. Hopefully, the add-on wouldn't interfere with the rendering of web pages because they would still be tailored for Firefox. If we could find a way to force Phorm to exclude Firefox then we will have rescued over 20% of their potential victims.

[popper]

BTW Tarquin, you might want to read this and explain the EU parliament view on his confusion
http://www.openrightsgroup.org/2008/...ikes-approach/

[bishbosh]

Now I'm confused. If the french are implementing snooping for illicit file sharers - how does that impact on the PEC?

Also quote about filesharing in the uk from

http://news.bbc.co.uk/1/hi/technology/7059881.stm

The Internet Service Providers Association has always maintained that it cannot be held responsible for illegal peer-to-peer traffic because it is "merely a conduit" of such material.

"ISPA does not support abuses of copyright and intellectual property theft," said an ISPA spokesman.

He said: "However, ISPs cannot monitor or record the type of information passed over their network. ISPs are no more able to inspect and filter every single packet passing across their network than the Post Office is able to open every envelope."

"ISPs deal with many more packets of data each day than postal services and data protection legislation actually prevents ISPs from looking at the content of the packets sent," he added.

[mark777]

Informed consent to opt-in

Perhaps a question for Tuesday? Will all opt-in pages include the words :-

“As you browse, we’re able to categorize all of your Internet actions, we actually can see the entire Internet.”

It might be worth pointing out that anyone who wants to know more, merely has to google the phrases :-

"we actually can see the entire Internet"
or
"we’re able to categorize all of your Internet actions"

Worryingly, from the search terms returned, this seems to be a quote universally associated with Phorm.

Have Phorm a trademark on these phrases?

Not a very good result for a company barking on about "privacy".

------------------------------- addition ----------------------------

Very good points bishbosh & popper

[popper]

mark777, go and post that to Andrew B's question here
http://www.lightbluetouchpaper.org/2...#comment-28928

it might be interesting to see the answer.

richard's answer to my 'mere conduit' loss is interesting too, so it "has not caused the sky to fall" as he puts it.

but its still a potential part of the being pecked to death..., never underestimate the power of legal pecking

[mark777]

Originally Posted by popper

mark777, go and post that to Andrew B's question here
http://www.lightbluetouchpaper.org/2...#comment-28928

it might be interesting to see the answer.

done!

And also at :-

http://blogs.guardian.co.uk/technolo...acetoface.html

where interestingly Simon Davies has just posted a reply to another comment.

I still can't post against the latest BBC blog though. (Server error).

[popper]

readers might want have a read of the http://www.cableforum.co.uk/board/34...-post2809.html
thread, simon Davies posted there about the PIA.

---------- Post added at 07:08 ---------- Previous post was at 06:19 ----------

thanks to Mark H over on the

http://www.beta.bt.com/bta/forums/me...ID=17476#17476 thread.

"Re: BT Webwise Discussion Thread
Posted: Apr 13, 2008 6:02 AM [img]Download Failed (1)[/img] in response to: Mark H

Mark H wrote:
http://www2.hemscott.com/scripts/AFX...&SerialNumber=
2150&NewsType=CDP&Indate=02/05/2007

RNS Number:9753V
121Media Inc
02 May 2007

121Media, Inc. ("121Media" or the "Company")

Trading update

<snip>

So does that mean that 121media as it was, phorm as it is now was let
loose on the BT network with no contract in place for the trials?

So basically with there being no way to know who was on the trial according to BT, they let an outside company loose on the network and put the private data of everybody at risk?

its Interesting in that it was infact in May 2007 then "121Media Inc", so the BT due diligence if it infact took place, was under that companies name, and we all know what that turns up, rootkit anyone, US court battles etc.

---------- Post added at 08:56 ---------- Previous post was at 07:08 ----------

its speading now thanks to the UK ElReg and Uk users efforts perhaps, werth keeping an eye open and helping were you can...

http://www.zeropaid.com/news/9404/CI...acking+Adverts
"
CIPPIC Comments on FTC Proposal on Consumer Tracking Adverts
"
posted by DrewWilson in security // 12 hours 25 minutes ago

The Phorm storm may be taking place far away, but few are aware of a similar storm brewing in the United States. Should advertising have the ability to track online users? The FTC seems skeptical about the proposition.

A recent posting on the Canadian Internet Policy and Public Interest Clinic official website says that they passed along comments to the Federal Trade Commission regarding behavioral tracking advertisements which push targeted advertisements to various users.

The FTC had a proposal (PDF) on the issue saying, among other things:

.....
The FTC then proposed the following principles:



Transparency and consumer control
Reasonable security, and limited data retention, for consumer data
Affirmative express consent for material changes to existing privacy promises
Affirmative express consent to (or prohibition against) using sensitive data for
behavioral advertising
Call for additional information: Using tracking data for purposes other than
behavioral advertising....
"

---------- Post added at 09:41 ---------- Previous post was at 08:56 ----------

Alexander, notice how they finally got around to talking about planting a cookie 2 days ago.

and still mostly missed the current BT graphic about storeing and reading a cookie if you say no in this upcoming BT DPI trial, how come we can find these things but they, we assume are on the ball, mostly miss it?

are we going to have to do a bank charges style CAG on this ISP/Phorm thing and just bring lots of small claims using the online forms or an N1 from the local county court and peck them to death i wonder?.

http://www.chiark.greenend.org.uk/pi...to/2008-April/

[3x2]

RE : FTC

In examining the practices, the FTC has applied a broad definition of online “behavioral advertising,” one meant to encompass the various tracking activities engaged in by diverse companies across the Web.

It seems clear from the document that what the FTC were considering is the general use of consumer data for advertising. Google keeping your searches for example.

I would be very interested to hear what they would have to say about a company proposing to routinely wire-tap customers at their point of access.

[Cobbydaler]

An interesting link surfaced in the ukcrypto mailing list...

You can be identified by your browsing habits, even when anonymised.

[popper]

Originally Posted by 3x2

RE : FTC



It seems clear from the document that what the FTC were considering is the general use of consumer data for advertising. Google keeping your searches for example.

I would be very interested to hear what they would have to say about a company proposing to routinely wire-tap customers at their point of access.

i think it is two canadian ISPs that are using the NebuAd phorm like DPI system, so if we go looking we will probably find something mentioned there already , dont forget NebuAd have offices here now and are waiting on Phorms outcome before they strike.

ohh, and the wiki i linked in the other day got reverted back so NebuAd are still hard to find any info on there again.

its almost as if they have teams reading and reverting their old company names away, Phorm style but far better at doing it.

perhaps some wiki experts should make the time and make a new NebuAd etc link as i said before.....

[Ravenheart]

Originally Posted by amateria

Thanks, I think I've attached it: template letter to bank or credit card company

An excellent letter Amateria, do you think the best person to send it to would be the Chief Information Officer at my bank who is "responsible for overseeing technology capabilities across the Group" or should I go right to the Chief Executive?

Having the bank's on our side would put another nail into the Phorm coffin.

I have taken on board the points that Dav made in post #3030

Originally Posted by dav

A few observations...

...I don't think the servers in China are confirmed for a fact, therefore, I wouldn't include that bit. I remember Phorm refuting that rumour categorically, so until positive evidence to the contrary emerges then it is just speculation.

...I would tar all the ISPs involved with the same brush. VM may be important to you, but this is likely to affect 70% of the bank's online customers which makes it a much greater concern for them. Name and shame them all.

I've amended the letter slightly to reflect his input, I hope you don't mind Amateria, as I also feel that letting the banks know that it could affect a huge number of online customers is a better option.

I'll upload the amended letter and I'll link to it shortly.

Keep up the great work folks, I feel that I'm not doing enough but the legal side of things has me stumped.

[80/20Thinking]

On a purely logistical note, you have all sent us a note to say you're coming haven't you? I haven't had a chance to speak to our floor manager this weekend but we do need to have some idea how many people are coming. No conspiracy theories please: this is all about management for the night, such as ensuring that we have enough roving mikes, that the fire and health & safety rules are being followed etc etc.

[manxminx]

Hia again 80/20 Thinking.

Any further details yet about a possible webcast?

Ali.

[lucevans]

I have a question that I would like someone to ask the Phorm people at the meeting on Tuesday, as I can't attend.

I don't think that compiling our list of questions on this forum is a good idea; it gives Phorm an unfair advantage, as they can pre-prepare responses to all of our concerns , while we have no such access to their preparation process in return. (Just look at how often one of their droids is seen lurking here!)

So if I PM them, would anyone who is attending consider asking my question please?

Apologies for the cloak-and-dagger stuff, but I don't think we should give Phorm an unfair advantage...

[80/20Thinking]

Originally Posted by lucevans

I have a question that I would like someone to ask the Phorm people at the meeting on Tuesday, as I can't attend.

I don't think that compiling our list of questions on this forum is a good idea; it gives Phorm an unfair advantage, as they can pre-prepare responses to all of our concerns , while we have no such access to their preparation process in return. (Just look at how often one of their droids is seen lurking here!)

Depends whether you can trust us to do the right thing. I'm more than happy to accept questions direct to simon@8020thinking.com and put them into the pot.

---------- Post added at 13:32 ---------- Previous post was at 13:31 ----------

Originally Posted by manxminx

Hia again 80/20 Thinking.

Any further details yet about a possible webcast?

Ali.

I'm meeting a techie tomorrow about this. There are some messy rules about using the SOAS bandwidth though. We'll try and work through the problem.

Simon