Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Ravenheart]

Originally Posted by the_baby_jebus

the new advice from the IC still doesn't say anything about our data not being mirrored..

it could be taken to mean that we will have to opt-in to the data rape but our data will still go past the profiler even if it does have it's eyes shut by the default opt-out cookie

I would have thought that unless you opt in, then any form of profiling without your consent would be illegal, but I know nothing of the way the law would interpret this.

[AlexanderHanff]

Originally Posted by Ravenheart

I would have thought that unless you opt in, then any form of profiling without your consent would be illegal, but I know nothing of the way the law would interpret this.

The section of the Directive ICO are referring to is with regards to interception, so they should not be permitted to intercept the traffic in any way unless a user is opted in.

This would mean that their current model would not satisfy the requirements as they need to intercept to verify whether a user has opted in or not (using DPI to look for the cookie).

This also means we need complete disclosure from BT with regards to how their upcoming trials are going to work. If they are going to use the same methods as described in the technical analysis by Dr Richard Clayton, they would be in breach of PECR as they will be using DPI (which requires interception) to detect the opt in cookie in the traffic data. This means we need to ask questions about how the upcoming trials can circumvent the requirements of PECR.

Alexander Hanff

[Ravenheart]

Chris Williams of The Register has posted his latest article, with the ICO U-turn

http://www.theregister.co.uk/2008/04...phorm_tougher/

[AlexanderHanff]

Yup another very good article.

Alexander Hanff

[the_baby_jebus]

Originally Posted by AlexanderHanff

The section of the Directive ICO are referring to is with regards to interception, so they should not be permitted to intercept the traffic in any way unless a user is opted in.

This would mean that their current model would not satisfy the requirements as they need to intercept to verify whether a user has opted in or not (using DPI to look for the cookie).

Alexander Hanff

http://www.opsi.gov.uk/si/si2003/20032426.htm

7. - (1) Subject to paragraphs (2) and (3), traffic data relating to subscribers or users which are processed and stored by a public communications provider shall, when no longer required for the purpose of the transmission of a communication, be -

(a) erased;

(b) in the case of an individual, modified so that they cease to constitute personal data of that subscriber or user; or

(c) in the case of a corporate subscriber, modified so that they cease to be data that would be personal data if that subscriber was an individual.

(2) Traffic data held by a public communications provider for purposes connected with the payment of charges by a subscriber or in respect of interconnection payments may be processed and stored by that provider until the time specified in paragraph (5).

(3) Traffic data relating to a subscriber or user may be processed and stored by a provider of a public electronic communications service if -

(a) such processing and storage are for the purpose of marketing electronic communications services, or for the provision of value added services to that subscriber or user; and

(b) the subscriber or user to whom the traffic data relate has given his consent to such processing or storage; and

(c) such processing and storage are undertaken only for the duration necessary for the purposes specified in subparagraph (a).

7.1.a The data is erased
7.1.b. the data is modified to remove person data
7.1.c. not applicable only happens to home users
7.2. n/a nothing to do with billing
7.3.a it is (supposedly) value added as they've added a phishy filter.. at least that's their get out
7.3.b. user has been informed and opted-in.. or even not opted-out.. doesn't make the distinction
7.3.c. i.e. forever if they're still serving you adverts

also according to Richard Clayton http://www.cl.cam.ac.uk/~rnc1/080404phorm.pdf

16. The Layer 7 switch will again direct the request to a special machine (within the ISP's
network for performance reasons if nothing else). This special machine, which is now acting
as webwise.net, will inspect any existing cookie to establish the current UID associated
with the user. If there is no cookie then a new UID will be issued instead.

28. If the user has set a cookie within the webwise.net domain indicating that they do not
wish to be tracked, then this preference is passed to the Layer 7 switch during the process in
paragraph 16 above. The details on how this is done were not explained by Phorm. . . but
it is presumably related to the mechanism described in the previous paragraph.

so the switch redirects to a "fake" webwise domain to inspect a cookie which then decides to proceed or not.. which isn't Deep Packet Inspection

have they covered all the bases and we're dangling by the short an curlies??

(obviously this only goes for any furthur implementations.. the 2 previous trials by BT sholdn't be covered as they were under the radar so not covered by 7.3.b)

edited : 15.29 with some extra detail from richard clayton

[deek72]

ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZzzzzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzz

[jca111]

http://technology.timesonline.co.uk/...cle3714098.ece

Looks like Kent is spinning this to a positive story!!!!!

[kt88man]

Originally Posted by deek72

ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZzzzzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzz

I once had a dodgy keyboardddddddddddddddddddddddddddddd

[TheBruce1]

It seems this is also occurring in the US:

"We simply place the equipment at the ISPs network," said NebuAd CEO Bob Dykes. "Their role is completely passive. We sell the advertising." (Read an interview with NebuAd's Bob Dykes.)

NebuAd's appliances can track the Internet usage of between 10,000 and 30,000 Internet subscribers, and the firm claims to have contracts with "multiple tens" of ISPs covering millions of subscribers. The company is based in the U.S., but also has a presence in Canada and will launch soon in the U.K.

http://www.dslreports.com/forum/r202...ained~start=20

Originally Posted by LadyMinion

n a new twist, the most influential voice in the identity space has now spoken out on the topic: Microsoft's identity guru Kim Cameron agrees that 'opt-out' implementations of Webwise are in breach of the Laws of Identity. This is important - Kim is shaping the principles that will drive future privacy-protecting identity systems, and if Phorm is an inappropriate third-party in the online identity relationship then they have a real problem on their hands.
It's very likely that attention will shift to BT and VirginMedia, who have both been very quiet indeed about their 'opt-out' approach to Phorm (TalkTalk are off the hook because they have taken a more privacy-friendly 'opt-in' approach). The real test will be whether those providers start to lose business over this, particularly in Croydon and Ealing, where further trials of OIX and Webwise are due soon.
Full article:
http://www.computerweekly.com/blogs/...-independ.html

I wonder if this has anything to do with that statement:

It's such a tremendously bad idea that it's almost bound to succeed. Microsoft has filed another patent, this one for an "advertising framework" that uses "context data" from your hard drive to show you advertisements and "apportion and credit advertising revenue" to ad suppliers in real time. Yes, Redmond wants to own the patent on the mother of all adware.

The application, filed in 2006, describes a multi-faceted, robust ad-delivering system that lives on a "user computer, whether it's part of the OS, an application or integrated within applications."
http://arstechnica.com/news.ars/post...e-systems.html

It seems that they are all at it.

[dav]

It looks as if the bandwidth needed to serve all these ads is soon going to overtake that used by P2P traffic.

It's very sad that something as useful as the web is going to be largely reduced to the role of pushing space filled with ads for stuff nobody wants nor cares about.

[snazzy]

Maybe we should get reduced rate for putting up with all this crap we are about to see.

[AlexanderHanff]

www.openrightsgroup.org

80/20 Thinking are organising an open meeting for Tuesday 15th April 2008 at:

The Lecture Theatre, Brunei Gallery, School of Oriental & African Studies, London.

18:30-20:30.

Anyone in the London area, please attend the meeting. My paper will be complete in time for the meeting so there will be plenty of questions you can ask. I am the other end of the country so I can't attend due to disability and costs.

It is an open meeting but attendees are requested to email info@8020thinking.com in advance.

Alexander Hanff

[manxminx]

I haver one question regarding consent requirements under PECR (Privacy and Electronic Communications (EC Directive) Regulations 2003)

Does active consent have to be gained from both ends of the data stream? In other words, both the traffic data to and from the user AS WELL AS the traffic data to and from the website that the user is communicating with?

Ali.

P.s. I'm reading through the PECR now (http://www.opsi.gov.uk/si/si2003/20032426.htm). Can someone point me to the relevant paragraphs please?

[mertle]

Originally Posted by dav

It looks as if the bandwidth needed to serve all these ads is soon going to overtake that used by P2P traffic.

It's very sad that something as useful as the web is going to be largely reduced to the role of pushing space filled with ads for stuff nobody wants nor cares about.

very good point what will happen is they try push prices up by forcing you onto higher speeds just to get the service you had before.

Maybe this is vm masterplan to get us to move to 50megs which with all this impending traffic slowdown will act like 10 megs service as all the traffic gets queued into phorms rubbish while our computers patiently waits for packets.

I would not be suprised one minute if we get an overload which just completely crashes the whole vm broadband or turns it to 56k modem.

I still dont trust the bunch of criminals to honour people who opt out. I bet the find a way to track us anyway with a rootkit embeded in opt out users machines.

---------- Post added at 16:42 ---------- Previous post was at 16:40 ----------

Originally Posted by manxminx

I haver one question regarding consent requirements under PECR (Privacy and Electronic Communications (EC Directive) Regulations 2003)

Does active consent have to be gained from both ends of the data stream? In other words, both the traffic data to and from the user AS WELL AS the traffic data to and from the website that the user is communicating with?

Ali.

P.s. I'm reading through the PECR now (http://www.opsi.gov.uk/si/si2003/20032426.htm). Can someone point me to the relevant paragraphs please?

very good point is what happens if the website your are connected has given consent but you have refused to consent.

[kt88man]

Good Afternoon to "Alex @ Phorm"

I don't recall you telling us if you were part of the PR team or not. Come on, don't be shy...