Quote:
Originally Posted by AlexanderHanff
OK let me just clarify something here. The page that you request from the server is mirrored irrespective of whether or not you are opted in opted out or shaking it all about. Kent made this clear at the PIA meeting as does Dr. Richard Clayton's analysis if I remember correctly. The only difference is if you have an opt-out cookie or you have the domain blocked for cookies that data is not passed to the channel server, it still goes through the profiler.
|
All accessible web traffic was originally going to be mirrored, although not passed right through the profiler.
Phorm launches data pimping fight back
So if I'm opted out, data passes straight between me and the website I'm visiting? It doesn't enter Phorm's systems at all?
Marc Burgess: What happens is that the data is still mirrored to the profiler but the data digest is never made and the rest of the chain never occurs.
However, this soon changed. The change has been restated a number of times, but I think the following quote represents the first time.
Phorm’s Answers (part3)
phail: Virgin and BT are both currently operating an OPT-OUT solution, which would mean all users are opted in by default, and even if they are opted out OUR data is mirrored on phorm servers, regardless of whether the data is used, you ARE collecting it.
KentErtugrul: When a user opts out, the system is OFF. There is no data collection at all
The 18 May amendment to Richard Clayton’s analysis does include this, as one of the updates provided by Phorm.
The Phorm “Webwise†System
Phorm also say that “in many ISP implementations (all of the UK ones for instance)†the mirroring system described in paragraph 2 above, can be set to only mirror the traffic of users who have a valid UID. Thus the traffic of those who have the “OPTED OUT†cookie (or are cookie-disabled) is not mirrored and does not reach the out-of-band machine.
Even without any Phorm-provided equipment, ISPs already rummage through your HTTP headers. They need to record the host names in all the URLs you access, to comply with the Home Office Voluntary Code of Practice on Data Retention.