Originally Posted by R Jones (Post 34588176)

I've just reminded her of those issues today as well. She also mentioned in her reply to me that the interstitial page in the ICO/FOI bundle was a draft and that she was confident that the final one would meet requirements of the legislation. So I have reminded her that she was confident that the 2006/2007 trials were legal but the ICO differs, and that no one had mentioned the Consumer Protection from Unfair Trading Regulations 2008 in respect of the interstitial/invitation page.

My email included the following:

IMHO - in order to be remotely legal the "interstitial page" will need to

a) only be offered to customers while they are logged in to and visit a bt.com or BTYahoo page, and only while the customer is logged in as the primary account holder. (not offered to minors, not offered to sub account holders). If the page pops up during ordinary browsing of non BT sites it will constitute an illegal interception - effectively a browser hijack.

If it is offered to minors, then the change in the T&C's of the primary account holder that their acceptance will involve, is UNenforceable, and if it is offered to sub account holders, then the change in T&C's that their acceptance will involve is unenforceable.

You will also need to address the issue of targeting of adverts to minors and explain that in the invitation page so that the primary account holder can fully evaluate that particular issue.

b) contain adequate information about Webwise technology which the copy sent to the ICO certainly does NOT, in order to conform to the Consumer Protection from Unfair Trading Regulations 2008. Representing Webwise simply as a means of reducing irrelevant adverts, or antiphishing protection, will be a breach of these regulations.

c) only be offered if the informed consent of website owners that the customer might visit while participating in the trials, can be obtained and verified BEFORE their unique data exchange with their customers is profiled, before the content of their websites is copied and exploited, before derivative copies of their websites are made for commercial gain (a CRIMINAL offence) and before forged cookies are made incorporating their domain name. You should be aware that there are many websites out there waiting for Webwise customers to visit their sites, at which point they will commence reporting BT for criminal (yes - criminal) breaches of the copyright laws.

d) the trials can only proceed if there is absolutely NO way that ANY traffic from non-opted in customers goes anywhere near the Phorm software. I am unable at present to see ANY way in which you can legally intercept traffic of all customers to find out whether they are opted in to the trial without access to BT Wholesale equipment or by illegally intercepting the traffic of non-opted in customers.

Hopefully that will give ES something to think about, and at the very least, they can't say they weren't warned.

Originally Posted by Dephormation (Post 34588101)

I believe the only things they will get from SSL is the destination IP address/domain, date & time of your request, and a block of random garbage on which to run their profiling engine.

That could still be valuable, for example it would allow them to know which bank you use, when you use it, how often, how long, whether you visit after or before making a purchase, but not much else.

If they did eventually decide it was permissible to use that data (noting they currently claim not to, I'm so reassured I left Virgin) then you might see loan ads, savings ads, or competitive banking ads shortly after doing your normal online banking for example. Or ads for ASDA, after completing an SSL checkout at Sainsbury. Or ads for Dabs, after completing an SSL checkout at Maplin.

You get the picture I'm sure.

Once you pawn the privacy of your connection to Phorm, you may be suprised how much they learn about you and/or your customers even from snooping on encrypted traffic.

Phorm has to be stopped. You can't operate an economy with parasites snooping on private communication traffic.

Originally Posted by Ravenheart (Post 34588174)

I've just had a reply from Liz Lynne one of my MEP's who was very quick to raise questions in the EU about Phorm.

Her latest update is as follows

Dear Ms ***************

I am writing to you further to my previous letter regarding your concerns over Phorm advertising software. I have recently received a reply from Baroness Shriti Vadera of the Department for Business Enterprise and Regulatory Reform regarding a letter I sent to her outlining your fears.

Baroness Vadera informs me that the Information Commissioner’s Office (ICO) is currently examining the proposed use of Phorm to ensure that any use of the technology is compatible with the current legislation relating to privacy. The ICO has published its preliminary view on Phorm, which can be found at

http://www.ico.gov.uk/about_us/news_...e_and_oie.aspx.

Baroness Vadera also states that the Home Office has been in contact with ISPs to discuss how the use of Phorm relates to the Regulation of Investigatory Powers Act. However, she notes that not all applications of Phorm will necessarily contravene this act.

Finally, I am assured by Baroness Vadera that both she and the ICO have been in contact with those ISP’s hoping to run trials involving Phorm to discuss their plans and will be maintaining close contact with ISPs and Phrom throughout any subsequent trials.

Yours sincerely

Liz Lynne MEP

Which doesn't really tell us any more than what we don't already know, but my respect goes to her for at least keeping me informed on developments, and the fact she's still asking questions on the issue.

Originally Posted by R Jones (Post 34588203)

What bothers me is that none of these oversight bodies seem to want to talk to anyone other than BT or Phorm. It's a bit like the Metropolitan police holding a press conference in November 1967 and saying "we have been involved in extensive discussions with the Kray family, and we are assured by them that the incident involving Jack the Hat McVitie did not involve anything other than a slight technical breach of the laws on homicide and we are accordingly letting the matter rest."

Originally Posted by R Jones (Post 34588203)

What bothers me is that none of these oversight bodies seem to want to talk to anyone other than BT or Phorm. It's a bit like the Metropolitan police holding a press conference in November 1967 and saying "we have been involved in extensive discussions with the Kray family, and we are assured by them that the incident involving Jack the Hat McVitie did not involve anything other than a slight technical breach of the laws on homicide and we are accordingly letting the matter rest."

Originally Posted by bluecar1 (Post 34588208)

they could always ask their favourite IT partner "EDS" and be charge a fortune to look over the system, but then the project to look at the system will be underspeced, over budget and delayed until dropped and EDS compensated, ooops sorry just thinking of gov IT in general there

he he

peter

---------- Post added at 17:50 ---------- Previous post was at 17:48 ----------

peter

Originally Posted by AlexanderHanff (Post 34588201)

OK I have added a new post to NoDPI so everyone can keep track of how much money we still need to raise for the event and what it is going to be spent on.

Are the people who have offered to contribute to the printing of fliers going to bring them to the event or are they sending them directly to me? Please let me know via PM as time is running out so I need to make sure everything is organised by the end of this week.

Alexander Hanff

Originally Posted by SelfProtection (Post 34588200)

So what we really need if this sort of System becomes active is SSL or VPN proxy systems which incorporate DNS lookups at the proxy Server through an encrypted tunnel.

Originally Posted by popper (Post 34588249)

Alexader, i dont know if its just the files or the server is down but
http://www.paladine.org.uk/phorm_paper.pdf

and...
if anyone is interested I am currently writing a new article summarising the last 4 months. The first 5 pages are available as a pdf here:
http://www.paladine.org.uk/phorm.pdf

dont work anymore.

---------- Post added at 18:58 ---------- Previous post was at 18:39 ----------

http://www.inphormationdesk.org/Phorm_Factsheet.pdf missing too

---------- Post added at 19:03 ---------- Previous post was at 18:58 ----------

interesting that the mirror was mentioned in the CF thread above by a helpful new member as a reminder, it seems someone finally bumped that Phorm thread there and filled in some missing information ;)
http://forums.mirror.co.uk/viewtopic...257448#1257448

Originally Posted by warescouse (Post 34588293)

Oddly enough I just noticed VM main website down and ftp to home pages on ntlworld are not working either.

Originally Posted by Dephormation (Post 34588283)

It doesn't have to be that complicated. Simply move to a Phorm free ISP like Aquiss.

I left Virgin shortly after they published details of their partnership with Phorm on their customer zone.

I think anyone else at risk of Phorm should do likewise. So does Tim Berners-Lee. So does Professor Ross Anderson.

"Sir Tim Berners-Lee told BBC News he would change his internet provider if it introduced such a system", BBC News.

"The message has to be this: if you care about your privacy, do not use BT, Virgin or Talk-Talk as your internet provider", Professor Ross Anderson, Cambridge University, UK.

... cut
Pete.