Well the latest contact I have been given form BT just answered some questions. I have no explicit agreement to quote, so the gist of it was to avoid profiling
- Use HTTPS
- Use HTTP authentication
- Block Googlebot
- Tell us what your sites are an prove you are the owner.
I have replied as follows and copied my MP in for good measure. My MP has so far seemed quite supportive on the issue, but we'll see how it goes.
Quote:
Hi,
a) I do not see why I should have to pay for the certificates to make my sites SSL encrypted to ensure my rights to privacy.
b) My sites use cookie based authentication (as do many, many sites out there), so this is a non-starter. but at least this is an admission that you will in fact be intercepting data from parts of sites which are password protected.
c) As I have previously stated, I am happy for Google to index my site as it directs visitors to my site - the Phorm system does not. In fact it actually uses the content of my site to direct your customers to other similar sites which may interest them - quite the opposite. I find your use of the Googlebot rules to be crass at the very least - you should have the bottle to use your own separate user-agent string rather than pretending to be Googlebot (computer misuse???)
On your next point I see no reason why I should have to provide you (and any other ISPs who use this type of technology) with my details in order to block access. Doing so would help to give your policies credence which they do not (in my opinion) deserve. You should not profile my site unless I specifically give you (not Google) access.
As the Regulation of Investigatory Powers Act 2000 (Chapter 1 Section 3) states
(1) Conduct by any person consisting in the interception of a communication is authorised by this section if the communication is one which, or which that person has reasonable grounds for believing, is both—
(a) a communication sent by a person who has consented to the interception; and
(b) a communication the intended recipient of which has so consented.
As it stands, but "pretending to be Google" you cannot in good faith have reasonable grounds for believing the person sending the communication (website owner) has consented to the interception. I know I don't consent and I am aware of a number of other site owners who feel the same way.
If necessary I could examine the Copyright, Designs and Patents Act 1988, with reference to you copying my pages, and creating a derivative work, for financial gain in its use for directed advertising.
Aside from the expensive route of HTTPS, I also have no guarantees (other than your word) that you will not profile my site. Nor have you provided, to the best of my knowledge, any way of telling whether or not my site has been profiled, so that I may check that you are doing as you say you will. Given the way in which BT has conducted itself with this matter and Phorm's history as 121Media I am not inclined to take your word for it.
As such could you please provide either the ip address ranges (Alternatively use your own user-agent for robots.txt) or a method by which I will be able to tell whether my traffic has been profiled?
A copy of (my portion) of this reply will be posted to the cable forum thread regarding this issue, and unless advised to the contrary I will assume that as I have access to your reply it is OK for others to read it also and I will post it up.
Regards
Simon
|
If anyone would care to provide anything they think worth mentioning in the next installment, I'm open to suggestions.