Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Ravenheart]

if it's the same one that visited my blog, he's also a member of the illustrious phormcomsteam

Phorm PR, like bailing out a sinking ship with a thimble.

[manxminx]

Ok, after reading PECR, as far as I can tell (I'm no expert) conse3nt has to be sought from both the end user and the website they are communicating with.

I say this because reg 7, pt 3 says:

(3) Traffic data relating to a subscriber or user may be processed and stored by a provider of a public electronic communications service if -

(a) such processing and storage are for the purpose of marketing electronic communications services, or for the provision of value added services to that subscriber or user; and

(b) the subscriber or user to whom the traffic data relate has given his consent to such processing or storage; and (my highlight)

(c) such processing and storage are undertaken only for the duration necessary for the purposes specified in subparagraph (a).

The PECR defines 'subscriber' as " a person who is a party to a contract with a provider of public electronic communications services for the supply of such services"

Ok, I subscribe to a hosting service (a provider of public electronic communications) that provides me with space to host my website and forums.

Sorry, please correct me if I am wrong, but me, as a website owner is also a subscriber, therefore under 7.3b I also have to give consent for my (the website) data to be processed.

This is V important, because if I've interpreted this correctly, Phorm will have to ask permission of all websites as well as end users, which is almost impossible, and immediately makes Phorm a dead duck.

Ali.

[AlexanderHanff]

Don't forget section 27 of PECR:

"To the extent that any term in a contract between a subscriber to and the provider of a public electronic communications service or such a provider and the provider of an electronic communications network would be inconsistent with a requirement of these Regulations, that term shall be void."

Which would indicate explicit consent should be obtained as opposed to a change in terms and conditions.

Alexander Hanff

[Alex @ Phorm]

Alex @ Phorm here

With regard to PECR, the law is quite clear stating that any system requires valid, informed consent. We believe the approach that we will take to user notice will not only provide for such consent, but will in fact exceed the level of notice provided by anyone else. We also believe, as has been the case with the DPA and RIPA, that closer scrutiny will demonstrate that the way in which we obtain consent will substantially exceed any legal requirement.

http://blog.phorm.com/

[manxminx]

Alex, will you also be seeking the valid, informed consent of website owners whose sites will be profiled?
If not, why not?

[Julian Smart]

Originally Posted by Alex @ Phorm

Alex @ Phorm here

With regard to PECR, the law is quite clear stating that any system requires valid, informed consent. We believe the approach that we will take to user notice will not only provide for such consent, but will in fact exceed the level of notice provided by anyone else. We also believe, as has been the case with the DPA and RIPA, that closer scrutiny will demonstrate that the way in which we obtain consent will substantially exceed any legal requirement.

http://blog.phorm.com/

What consent will you have got that enables to you to legally hijack the web session in order to display that form purely for your/the ISP's commercial gain?

[Florence]

Alex

Will you also have consent to have your servers pretend to be the url I asked for?

What is in place to stop you redirecting small businesses and viewing all their details?

I also find this an important issue noone has picked up on but if you intercept a child or young adults online search then being targeted with adverts. Many do search online to help with their education this can be misinterprited by phorm so question below.
Children and young adults doing online search to help with their education?

One close to my feelings if a customer opts out this should be before phorm system and not be redirected in any shape or phorm, should not be mirrored, redirected, intercepted, cookied or even scanned by phorm What can you do to comply with that request?

[Bonglet]

@ alex@phorm But we dont want to consent to anything we DONT want it, good luck in your future job btw.

[AlexanderHanff]

Originally Posted by Alex @ Phorm

Alex @ Phorm here

With regard to PECR, the law is quite clear stating that any system requires valid, informed consent. We believe the approach that we will take to user notice will not only provide for such consent, but will in fact exceed the level of notice provided by anyone else. We also believe, as has been the case with the DPA and RIPA, that closer scrutiny will demonstrate that the way in which we obtain consent will substantially exceed any legal requirement.

http://blog.phorm.com/

Alex @ Phorm

I disagree with you completely. In light of the technical analysis published by Dr Richard Clayton (which Phorm reviewed as accurate) it is clear that in order to detect whether or not someone has either opted-in or opted-out that the Layer 7 technology must perform DPI on the traffic data. That in and of itself requires interception -and- processing of the traffic data; which means the current model fails to meet the requirements of the Directive.

Section 27 of the Directive (see my previous comment) also indicates that a change in terms and conditions by the ISP will not satisfy the consent requirements of the Directive.

Phorm have repeatedly been asked to comment on the legality of the trials of 2006/2007. It is very clear to me (and many others) that the trials of 2006/2007, which could not possibly have obtained consent as they were secret trials; were in fact in breach of the following laws and statutes in the UK (and Europe):

Regulation of Investigatory Powers Act 2000
Privacy and Electronic Communications (EC Directive) Regulations 2003
Human Rights Act 1998
European Convention on Human Rights
Computer Misuse Act 1990
Fraud Act 2006
Torts (Interference with Goods) Act 1977
Data Protection Act 1998
Copyright, Designs and Patents Act 1988
Council of Europe's Convention on Cybercrime

Why do Phorm repeatedly avoid replying to questions on these points?

Furthermore, it is all well and good saying you feel Phorm believes they have exceeded the requirements of the law, but where is your evidence and sources supporting this statement?

I believe that my 2yr Old son is more intelligent than Einstein was but without some evidence and references to support that claim, it means absolutely nothing in the real world.

I would seriously consider looking for a new job "tout de suite" if I was you Alex, because I fail to see how Phorm will not be involved in the criminal prosecution of BT (complicity) for the illegal trials of 2006/2007.

Alexander Hanff

[mark777]

Originally Posted by Alex @ Phorm

Alex @ Phorm here

With regard to PECR, the law is quite clear stating that any system requires valid, informed consent. We believe the approach that we will take to user notice will not only provide for such consent, but will in fact exceed the level of notice provided by anyone else. We also believe, as has been the case with the DPA and RIPA, that closer scrutiny will demonstrate that the way in which we obtain consent will substantially exceed any legal requirement.

http://blog.phorm.com/

"Click here if you want less random ads and to be protected from visiting fake websites"

I'm sure the wording will be an art of spin. It will be interesting to see your interpretation of 'informed'.

But, it's an opt-in and your share price will continue to reflect that.

[jca111]

Alex @ Phorm

What about the potential Fraud that may be occurring by your system pretending to be a web site that it is not?

From Dr Richard Clayton white paper on how Phorm works:

"The Layer 7 switch will see that the request does not contain a Phorm "cookie" and will direct the request to a machine located within the ISP network that will pretend to be www.cnn.com and will return a "307" response which says, in effect, "you want that page over there". The page that will be directed to is webwise.net/bind/?<parameters>where the parameters record the original URL that was wanted."

The key is "will pretend to be www.cnn.com" (or obviously any other website you are surfing.

Is this not a Fraud against Fraud Act 2006, and exactly the same type of Fraud as Phishing, by impersonating a website that you are not?

[AlexanderHanff]

This made me laugh:

"We’ve had an informed and productive dialogue with ICO and look forward to
working with them and other stakeholders to ensure that UK internet users
enjoy unparalleled choice, privacy protection and transparency online." (Phorm's Blog)

By transparency online I presume they mean "All your browsing are belong to us!" and will be transparent due to the fact that DPI can see through our traffic data.

Alexander Hanff

[Bonglet]

All you pr guys and workers at phorm could opt in but i dont think you'd make much revenue off 5 people, glad to see with this whole debate that people are sick of just rolling over and getting shafted in this country when anyone feels like it if more people keep these kind of attitudes i still have hope for this country and sticking up for what they know is right.

@jca111 i agree completely what phorm are intending is exclusive phishing rights nothing more nothing less they offer the phishing service too as they dont want any competition on the phorm phish .

[AlexanderHanff]

Come on Alex @ Phorm, it was you who posted to my DenyPhorm blog inviting me to engage in telephone meeting with Kent, so why are you now so unwilling to address my questions? I am merely an undergraduate with limited experience in Law, you are supposed to be the expert on this, so why not engage or attempt to disprove my analysis? Surely you are not scared of an undergraduate who lives in a 2 bedroom terrace and drives an 11 year old car?

Alexander Hanff

[TheBruce1]

Originally Posted by Alex @ Phorm

With regard to PECR, the law is quite clear stating that any system requires valid, informed consent. We believe the approach that we will take to user notice will not only provide for such consent, but will in fact exceed the level of notice provided by anyone else. We also believe, as has been the case with the DPA and RIPA, that closer scrutiny will demonstrate that the way in which we obtain consent will substantially exceed any legal requirement.

You are talking utter phish, please tell us if we choose to opt-out how exactly this will done without the PR BS. Will the OIX.net cookie still be present on my system, if not, how will Phorm/VM know that i have opted-out.

As for the Anti-Phishing, which company/database are you going to use.