Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Portly_Giraffe]

Originally Posted by mark777

I'm sure many of the laws regarding the postal system were originated in the 1800's, but we still use them to lock up postal workers who open our letters.

Could you add this as a comment to the Guardian Blog at http://blogs.guardian.co.uk/technolo...nto_phorm.html

or let me know if you'd like me to add it? Thanks.

[Ravenheart]

Don't remember seeing this previously, but there's an interesting piece over at the Electronic Frontier Foundation (EFF) http://www.eff.org/deeplinks/2008/03...ng-isps-honest

It mentions a number of software applications to monitor ISP behaviour that may be involved in profiling

This might be of use too http://www.eff.org/wp/detecting-packet-injection

Seems we have EFF Europe too: http://www.eff.org/issues/eff-europe

[mark777]

Originally Posted by Portly_Giraffe

Could you add this as a comment to the Guardian Blog at http://blogs.guardian.co.uk/technolo...nto_phorm.html

or let me know if you'd like me to add it? Thanks.

Done.

[Portly_Giraffe]

Originally Posted by amateria

Looks good to me. I would add that Phorm is not just reading the websites you visit, but all the data you send to websites is read - which could include sending emails, posting in forums and details of orders sent as part of shopping online. Phorm say thy don't keep this data, but your ISP reads it, to decide whether to strip out sensitive information. We have no way of knowing how safe this stripping out is.

Also, I'm not sure I would call Phorm a new element of the internet. That is exactly how Phorm would like us to see it, but it is not part of the internet, but a wart on the side, a parasite. Perhaps it is "a new surveillance technology, aimed at ordinary people". That is an accurate description which puts a different complexion on what Phorm would like to do.

Thanks to Lucevans and Amateria. I have used your suggestions to enhance http://www.inphormationdesk.org by updating "What is Phorm?" and "What does it do?"

I've also reworded "Has It started yet?" to make it clearer, and revised unanswered question 7 on opt out.

If you have a moment, please review these changes.

Later this evening, I'll include acknowledgments and a site icon (thanks ManxMinx). Also I want to add a page giving ISP postal addresses to write to. For Virgin I have the complaints address and Sir Richard Branson's address. Can people suggest an operational postal address and an appropriate executive postal address for the other two ISPs?

[popper]

Originally Posted by ceedee

While I agree it's important to stop intrusive and insecure trawling of our browsing data, if Hitwise operates as described on Wikipedia then I'd guess that it's not in the same league as Phorm.

Mind you, some of the blurb on their website reads very similar to the Phorm BS to me!

At Hitwise, our DNA is based on three values: Integrity, Innovation and Exceptional Client Service. These values form the basis of everything we do – including how we interact with our clients - and are detailed in the Hitwise Client Commitment statement:
1. Integrity
* Clients will experience the highest levels of integrity, ethics and respect at all times from all Hitwise employees.
* Hitwise will always respect client privacy.
* Any sensitive information clients share with Hitwise is treated with strict confidentiality.
* We do what we say we will do.

it must have slipped right by you there ceedee, right there on the top wiki, they give the game away.

"Hitwise is an internet monitor which collects data directly from ISP networks. Hitwise bands the aggregate usage information into commercial verticals (travel, finance, retail, etc).

The Hitwise product is a commercial platform whereby customers pay Hitwise a premium to access data reports for their vertical."

you always need to keep in mind all the CRA's customers/Clients are the other companies, NOT you or i as end users, we are just the sheeple that bug them with our DPA requests etc.

its no wonder they are not really interested in the ad space as their primary goal.

theres far more money in collecting the end users data directly from the ISP's and they know it, be sure they have learned from the surlyBonds thread i pointed to and they will be trying to fool you at every step, dont fall for it my friend.

[Ravenheart]

Hi Portly,

I've just done some digging and have found this info on Charles Dunstone of TalkTalk

Charles Dunstone
Cheif Executive
1 portal Way
London
W3 6RS

Sources: http://www.the-scream.co.uk/forums/t21030.html
http://forums.moneysavingexpert.com/...html?p=1589638

Hope this helps

EDIT: Richard Clayton has also updated his blog entry on the positive spin Phorm have put on his review of the system
http://www.lightbluetouchpaper.org/2...ebwise-system/

[lucevans]

Originally Posted by Portly_Giraffe

Thanks to Lucevans and Amateria. I have used your suggestions to enhance http://www.inphormationdesk.org by updating "What is Phorm?" and "What does it do?"

I've also reworded "Has It started yet?" to make it clearer, and revised unanswered question 7 on opt out.

If you have a moment, please review these changes.

Later this evening, I'll include acknowledgments and a site icon (thanks ManxMinx). Also I want to add a page giving ISP postal addresses to write to. For Virgin I have the complaints address and Sir Richard Branson's address. Can people suggest an operational postal address and an appropriate executive postal address for the other two ISPs?

Even Better

Just one point about the update on question 7: "will all my web traffic still be intercepted by Phorm...." the language needs to be tightened up, because I've already heard Kent Erturgul deflect this particular point by saying that Phorm don't do the intercepting; your ISP does it, then passes the results on to Phorm. (He's the King of carefully-worded evasion!)
Maybe change it to: "Will all my web traffic still be intercepted by this technology...." ?


Have you read some of the names on the petition? (Sorry - bored- waiting for the kettle to boil). Apparently we have the support or Fox Mulder and Tony Blair, amongst others

[AlexanderHanff]

By the way, if anyone who reads my article works for a group like Privacy International, ORG etc. or are really wealthy; I would be happy to consider offers of funding for my LL.M

[Edit]
The above does not extend to Phorm or other such organisations

[re-edit]
Actually all joking aside, it turns out that the LL.M I want to do might not be running in 2009/2010 due to lack of applicants, which is a shame. There is another LL.M at the same University which has a similar scope (although leans more on International Relations than European Law) so if all else fails I can do that, but now I have to seriously consider whether or not to try and get accepted for 2008/2009 in order to do the LL.M I was initially interested in. I honestly can't see how I could do that since the last couple of years have seriously depleted our household funds but I will see if it is possible.

Alexander Hanff

---------- Post added at 21:32 ---------- Previous post was at 20:41 ----------

Oooo maybe I could sell myself on eBay? Now there's an idea!

[Florence]

Originally Posted by AlexanderHanff

By the way, if anyone who reads my article works for a group like Privacy International, ORG etc. or are really wealthy; I would be happy to consider offers of funding for my LL.M

[Edit]
The above does not extend to Phorm or other such organisations

[re-edit]
Actually all joking aside, it turns out that the LL.M I want to do might not be running in 2009/2010 due to lack of applicants, which is a shame. There is another LL.M at the same University which has a similar scope (although leans more on International Relations than European Law) so if all else fails I can do that, but now I have to seriously consider whether or not to try and get accepted for 2008/2009 in order to do the LL.M I was initially interested in. I honestly can't see how I could do that since the last couple of years have seriously depleted our household funds but I will see if it is possible.

Alexander Hanff

After all the help you have given us freely I wish there was someway to help you, do companies sponsor people to go through their higher education to ease the finacial burden. Anyone who has a company using Alexanders information to help with phorm can you get tax relief on helping someone further their education, is there a loop whole there to help.

Originally Posted by ceedee

I wonder if something similar could be used to setup a webpage that could detect if a browser request was being hijacked by an ISP's Phorm server?
(I mean, Phorm repeatedly redirecting the request and forging cookies rather than it's ad server substituting adverts onto target webpages.)

Over in the VM newsgroups, the author of dephormation has posted about something similar to the above that he has developed.

[popper]

he has a good point....

http://business.timesonline.co.uk/to...cle3688387.ece?
"
As Intercepting communications is illegal the bigger question is why is the ICS allowing BT to do yet another trial.

By letting BT test the system, the ICO are aiding and abeting a criminal act.

colin stone, manchester"

[amateria]

I've been thinking about the contractual angle:

1. the Virgin terms and conditions don't cover the planned disclosure of information to Phorm
2. Virgin would have to change those terms and conditions to allow for Phorm
3. at that point, even people who are locked into 12 month contracts could leave without penalty, and go to, say Tiscali (£20 for up to 8MB, phone rental and unlimited national and international calls - and Freeview is free)
4. Refusing to provide an internet service that is free from surveillance might be an unfair contract term in accordance with the Unfair Contract Terms Act (UCTA). Particularly if no other ISP is available, or if the only other available ISPs also conduct surveillance. Furthermore, my credit card conditions of service forbid me to disclose my password to anyone. Virgin will have access to my password, whatever they say they are going to do with it. (I think I will write to my credit card and ask them for their views about these risks. I am also thinking of asking an insurance company to quote me for the cost of cover against the risk that someone at Virgin or Phorm uses my credit card details. The answers to the questions would be relevant to the court's consideration of the UCTA issues. Come to that, I should ask my bank if it is still safe to do internet banking.)

I am continuing to mull this over!

(The contract interpretation argument:

See clause G, "Your details and how we look after them". A lot of people think this allows Virgin to sell data to Phorm: I don't think so. You need to bear in mind the principles of contract interpretation used by the courts. Some of the main ones:

1. the contra preferentum rule. This means that the court will construe an ambiguous contract term against the party that wants to rely on it.
2. Words are to be given their normal and natural meaning
3. Any given contract clause is to be construed in the context of the contract as a whole.

If you look at clause G:

"We [not Phorm's customers, third party advertisers who have nothing to do with Virgin] may also, *subject to your consent*, use your personal information [there isn't a contractual definition of "personal information". The definition is not necessarily limited to the DPA meaning. The court will give the words their ordinary and natural meaning. Information about me, what I read, but etc., is "personal" within the normal meaning of the word.] to contact you with information about special offers and rewards. We and other Virgin companies (e.g. Virgin Atlantic) may also, *subject to your consent*, use your personal information to contact you with information about their products [i.e. the products of other Virgin companies, not those of Phorm's customers] and services including special offers from them, and we may disclose your personal information to other Virgin companies and sub-contractors and agents *for these purposes* [i.e. for the purposes of giving us information about the products and services of other Virgin comanies]. But don't worry, [condescending!] we won't share your details with companies outside the Virgin group for marketing purposes *without your consent*.[So disclosure to the subcontractors and agents must be with our consent. NB: Phorm is not a subcontractor or agent of Virgin - Phorm is a Virgin customer - it buys marketing data from Virgin. As the planned disclosure of our information is not to enable the provision of information about Virgin products and services, then disclosure to Phorm, with or without consent, it is not covered by this clause. Which brings us to consent: the repeated use of the word "consent" can only mean separate, express consent independent of the passive agreement to these terms and conditions. If consent meant - by signing these terms and conditions, you have consented - then why would this clause keep referring to consent? Consent clearly means something else - separate consent.]

If you have given us the consent referred to in paragraph G3 above, then from time to time, we *and other Virgin companies* [NB: not Phorm's customers] may contact you by mail, telephone, email, other electronic messaging services (such as text, voice, sound or image messages including using automated calling systems) or fax with information about Virgin products and services (including discounts and special offers). [NB: but not via advertisements from Phorm's customers on their (or perhaps their customers') websites.])

---------- Post added at 23:27 ---------- Previous post was at 23:23 ----------

Originally Posted by popper

he has a good point....

http://business.timesonline.co.uk/to...cle3688387.ece?
"
As Intercepting communications is illegal the bigger question is why is the ICS allowing BT to do yet another trial.

By letting BT test the system, the ICO are aiding and abeting a criminal act.

colin stone, manchester"

I wonder if they really understand the interception angle: have they been distracted by the complexities of the personal data processing (although admittedly they go that equally wrong).

[popper]

Quote:
sandinista

Comment No. 1024974
April 2 11:43
Re
Stratis Scleparis.
Not only did he move to Phorm after conducting the BT trial he also (this is from Phorms own site)
"held senior technology management roles with leading firms Orange UK plc (formerly Freeserve/Wanadoo), AOL Europe and the BBC."
That probably explains why the BBC have mostly just used Phorms publicity statements instead of carrying out real journalism.

Originally Posted by Cobbydaler

Interesting point in the comments there:

Conspiracy theories, doncha just love 'em...

while i dont put that Conspiracy label on any of this,not even jokingly as it belittles the real seriousness of the subject matter.

it does yet again, come back to my view that 'people are the Company'
a person sits down and choses to instigate this practice or idea.

and he does seem to like this interception cashcow idea doesnt he, after all it gets installed in some form or other were ever he goes.

did anyone look at AOL for any of this type of interception?.....
are they still operating on the exC&W/exTW/exNTL/VM cable with that re-badged cable modem, and if so, will they also be effected by any Phorm DPI interception kit?.

lets not forget the mobile phorm story in all this ,here...
http://www.theregister.co.uk/2008/03/12/mobile_phom/

"
Qualcomm buys into Phorm-alike firm

Data gathering on the hoof

By Bill Ray → More by this author
Published Wednesday 12th March 2008 13:14 GMT

The ad-fatigued may groan at the news that Qualcomm has splashed out $32m on data-gathering outfit Xiam. The Irish company specialises in analysing the habits of mobile phone users in order to target advertising at them, and has customers including Orange UK.

Targeted advertising is all the rage these days, but the ways in which the necessary data is gathered is still the subject of hot debate. Xiam makes great play of its ability to profile users just by watching what they do without requiring configuration, and Orange UK apparently "supplies Xiam with data including billing information, mobile browsing logs and purchase history".

Orange assured us that the "browsing logs" only refers to on-portal usage (within Orange World), and "billing information" relates to purchases made from the operator.

However, Portal Relevance Manager Jim Small is quoted as saying that 2008 will be the year when the service is "rolled out fully into all download content areas and beyond into browsing content in third-party off portal services".
We asked Orange if it was serious about this, but met with silence. ...."

[Florence]

This quote below comes from the forums I moderate i thought it relevante to copy over here.

Originally Posted by Mel

I've read lightbluetouchpaper's analysis and came away beleiving the design of the whole Phorm system is as flawed as the opt-out was.

It would seem what they've done using a fair amount of slight of hand and redirection is create a global tracking cookie that anyone can exploit. Sure they've made a school boy effort to strip their UID so that webservers on port 80 don't see it directly, but just by using a web bug on a port other than 80, or by using a client side javascript, or https, it will be possible for any webserver to read the Phorm UID that has been stored in the websites own domain.

The post can be seen here

[AlexanderHanff]

Meh there is going to be a slight delay on getting the next section of the article finished because I did a stupid earlier tonight. Rule #1 never try and refill your radiator reservoir in the dark, now I have to drain my power steering fluid reservoir tomorrow :/

Alexander Hanff