Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797] - Page 188

manxminx · 10-04-2008, 01:15

I've also had a reply from 80/20 Thinking re my request for a webcast or podcast of the meeting. The reply I received was privileged and confidential, but what I can say is that so far I am very happy with the response I received. Being ever hopeful, I'll say watch out for some public news about this tomorrow (err, later on today as it's gone 1am and time for bed!)

Ali.

popper · 10-04-2008, 02:49

Quote:

Originally Posted by Alex @ Phorm

Alex @ Phorm here

With regard to PECR, the law is quite clear stating that any system requires valid, informed consent.

We believe the approach that we will take to user notice will not only provide for such consent, but will in fact exceed the level of notice provided by anyone else.

We also believe, as has been the case with the DPA and RIPA, that closer scrutiny will demonstrate that the way in which we obtain consent will substantially exceed any legal requirement.

http://blog.phorm.com/

its usually a good idea to put carrage returns in your text now and then. i did it for you this once.

you didnt answer the question are you a 3rd party PR for Phorm?

and you can confirm, as an agent of Phorm, this is the approach to user notice you instructed BT to use in this newest diagram from BT ?

achived at CF for safe keeping OC.

80/20Thinking · 10-04-2008, 03:43

Dear all,

Following our email responses to some of you, I just wanted to confirm that we are looking to webcast the proceedings of the Phorm public meeting on Tuesday in London. We're hoping the technology at the theatre will allow this, but please do bring along vid cameras if you wish, just to be on the safe side.

Best wishes

Simon Davies
MD, 80/20 Thinking Ltd
www.8020thinking.com

popper · 10-04-2008, 04:21

hi simon, iv asked you this before elsewere, but it might be nice if you gave an official response on this longest Phorm related thread as your posting here.

how come it took you so long to follow the clear and simple official PIA rules as i pointed out here.#1398 18-03-2008

reproduced:
"
and if you can find the time, the rules that need to be followed for that Privacy Impact Assessment (PIA) is here
http://www.ico.gov.uk/upload/documen...l/1-intro.html

did they follow all the provisions ?

i wonder

http://www.ico.gov.uk/upload/documen...preparing.html

"...
2. Undertake a stakeholder analysis

Those who may see themselves as 'having a stake' in the project should be identified at an early stage. This may include:

the organisation conducting the project, and perhaps also various sub-organisations within it;
other organisations directly involved in the project;
organisations and individuals that are intended to benefit from it;
organisations and individuals that may be affected by it, and possibly
organisations that provide technology and services to enable it

It is advisable to document the results of the stakeholder analysis in an appropriate form, most likely a one-page summary.
...
"

---------- Post added at 04:06 ---------- Previous post was at 04:01 ----------

Quote:

Originally Posted by 80/20Thinking

Dear all,

Following our email responses to some of you, I just wanted to confirm that we are looking to webcast the proceedings of the Phorm public meeting on Tuesday in London. We're hoping the technology at the theatre will allow this, but please do bring along vid cameras if you wish, just to be on the safe side.

Best wishes

Simon Davies
MD, 80/20 Thinking Ltd
www.8020thinking.com

thats good to know, a few highspeed wireless connections might be in order for all concerned too, i do hope we dont just get low framerate mobile phone webcam footage.

---------- Post added at 04:21 ---------- Previous post was at 04:06 ----------

a live managed IRC session as pointed out earlyer here might also be a good way to better fulfill your PIA individuals stakeholder analysis

after all, its currently at an estimated 70% plus of the whole UK individuals.

and adaptable web poll, in case some new information comes to light and needs adressing live.

remember its not a marketing exercise, its a PIA to collect the information.

ask a live question, click a vote, mark it's result down, simple and effective.

Portly_Giraffe · 10-04-2008, 08:05

Ref http://cryptome.org/ho-phorm.htm (dated 11 March 2008), I have emailed Simon Watkins to ask him:

(1) On what basis do you think website owners' consent to interception is generally implied (para 15)? What if the web page presented formed part of a private or tailored communication with the user - for example, a commercial quote or a message?

(2) How lawful is it if opted-out users still have their communications intercepted and inspected anyway, just not analysed?

dav · 10-04-2008, 08:24

Quote:

Originally Posted by Portly_Giraffe

Ref http://cryptome.org/ho-phorm.htm (dated 11 March 2008), I have emailed Simon Watkins to ask him:

(1) On what basis do you think website owners' consent to interception is generally implied (para 15)? What if the web page presented formed part of a private or tailored communication with the user - for example, a commercial quote or a message?

(

More to the point, how are Phorm going to identify websites that specifically deny consent to interception? All a website owner has to do is include a line of text stating that they do not consent to that site, or even a particular page on a site, being intercepted and the ISP is breaking the law. I'd be interested to know how the system is going to identify and differentiate between consensual and non-consensual pages without intercepting them to find out, especially as no information has been forthcoming about what site owners should put in their robots.txt file.

jca111 · 10-04-2008, 08:49

Quote:

Originally Posted by mark777

Sorry, but I have to disagree.

It's best that people go as suited professionals, carrying a briefcase etc.

Phorm would love for this to be characterised as an anti-global, dressed up as beagles, nutter fringe.

Outwardly there is no good reason for them to be doing this, so be careful. They have something up their sleeves.

I'm all for getting this wider coverage, but not like this.

I have to agree with you - if you turn up wearing sci-fi masks etc. you will just be portrayed as a bunch of mad geeks in the press.

We want the public to empathise with us - not them to think we are loonies.

Please dont wear masks!!!

manxminx · 10-04-2008, 09:07

Quote:

Originally Posted by dav

More to the point, how are Phorm going to identify websites that specifically deny consent to interception? All a website owner has to do is include a line of text stating that they do not consent to that site, or even a particular page on a site, being intercepted and the ISP is breaking the law. I'd be interested to know how the system is going to identify and differentiate between consensual and non-consensual pages without intercepting them to find out, especially as no information has been forthcoming about what site owners should put in their robots.txt file.

Although I was wrong re the PECR and websites (thanks to Alexander for clarifying that), I still feel that if end users need to give explicit consent, then so do website owners.

Quote:

Originally Posted by Popper

a live managed IRC session as pointed out earlyer here might also be a good way to better fulfill your PIA individuals stakeholder analysis
after all, its currently at an estimated 70% plus of the whole UK individuals.
and adaptable web poll, in case some new information comes to light and needs adressing live.
remember its not a marketing exercise, its a PIA to collect the information.
ask a live question, click a vote, mark it's result down, simple and effective.

I agree. All internet users in the UK will be affected by Phorm, therefore, all internet users should be able to participate in this meeting. A webcast is good, but it's less than ideal.

Ali.

P.s. If it were a protest march, then yes, masks/costumes would be appropriate. However, this is a serious meeting designed to fulfil requirements under the PIA, please respect it as such.

dav · 10-04-2008, 09:36

Quote:

Originally Posted by manxminx

Although I was wrong re the PECR and websites (thanks to Alexander for clarifying that), I still feel that if end users need to give explicit consent, then so do website owners.

I agree. All internet users in the UK will be affected by Phorm, therefore, all internet users should be able to participate in this meeting. A webcast is good, but it's less than ideal.

Ali.

P.s. If it were a protest march, then yes, masks/costumes would be appropriate. However, this is a serious meeting designed to fulfil requirements under the PIA, please respect it as such.

I agree on all points

JosiesGrandpa · 10-04-2008, 09:41

I seem to spend ages getting rid of spyware etc and now they are trying to pretend its good!!!!!

jca111 · 10-04-2008, 10:05

Hi - I think we need to spread the profile of this story outside of Technical News sites (like The Register, BBC Technical section etc).

Today I have emailed Radio 4s Today Programmme, World at One, PM, Click and even Newsnight the following email. Please advise if there are other places we should be sending it.

Quote:

I'm writing to you to see if you would be interested in covering the Privacy storm that is brewing with a UK company called Phorm.

You may or may not be aware of the company, but I will aim to give a brief summary here, so see if you would be interested in compiling an article to raise awareness of this Company

Phorm, previously known as 121Media (a known computer spyware company), had created a system that can be installed at ISP (Internet Service Providers) that can intercept and monitor ALL your web browsing habits with the purpose of serving you related adverts on the internet. According to Phorm the system is completely anonymous, and there is no way of tracing the gathered information back to the user.

Phorm currently claim they are in advanced talks with Virgin Media and Carphone Warehouse, and are (and have) conducting trials with BT. This system could potentially affect over 70% of the UK ISP market.

However, over the last few months a rebellion has started to form on various internet blogs about the interception methods that Phorm use, and some people think that this interception is a breach of privacy etc.

A few issues that have been raised are this:

1. The system as it currently stands is Opt-Out. That means that if you do nothing your browsing habits will be profiled by the system. Indeed if you regularly "clean" your PC with many popular cleaning products then you will be automatically opted back in because the "cookie" (a small file held on your computer by your internet browser) will be removed

2. BT conducted a trail in 2006 and 2007, without informing the users, this is possibly illegal under the Data Protection Act and RIPA (Regulation of Investigatory Powers Act 2000), which makes it illegal to intercept communications without a warrant from the Home Office or consent of both parties (in this case consent would have to be given by the User and the Website Owner)

3. Is Internet Browsing information personal information? for example one may be able to glean information about your Health, Sexuality, Political Preferences etc.

4. Does the system break The Fraud Act 2006? Dr Richard Clayton white paper on how Phorm works states

"The Layer 7 switch will see that the request does not contain a Phorm "cookie" and will direct the request to a machine located within the ISP network that will pretend to be www.cnn.com and will return a "307" response which says, in effect, "you want that page over there". The page that will be directed to is webwise.net/bind/?<parameters>where the parameters record the original URL that was wanted."

The key is "will pretend to be www.cnn.com" (or obviously any other website you are surfing).

Without permission from the host website, it appears that you cannot pretend to be another company/person. Phishing is a prime example of impersonation of a company.

5. Does the system break PECR (Privacy and Electronic Communications Regulations)? Are both parties entitled to a private communication?

6. Other regulations that there are question marks about include:
Human Rights Act 1998
European Convention on Human Rights
Computer Misuse Act 1990
Torts (Interference with Goods) Act 1977
Copyright, Designs and Patents Act 1988
Council of Europe's Convention on Cybercrime

7. Phorm appear to have employed a massive PR team to post on internet blogs positive information about the company. They have also admitted to deleting negative information from their Wikipedia page (http://www.theregister.co.uk/2008/04...ors_wikipedia/).

8. Dr Richard Clayton a Cambridge University security researcher and member of the Open Rights Group and FIPR, attended an on-the-record meeting with Phorm, and has published his account of how their advertising system works, and has declared that he is unhappy with the system (http://www.lightbluetouchpaper.org/2...ebwise-system/) and believes it is illegal under RIPA 200.

I could go on, but the point of the email is to raise awareness of the issue. At the moment there is a "tecchie" groundswell against this system on blogs, and I feel that it needs a higher profile and debate as it could affect the privacy of most UK Internet Users.

An event is happening next week (http://www.8020thinking.com/events) to discuss this system. Could it be worth covering?

I've included some links for your reading if you want to take this story further.

http://www.phorm.com/
http://www.theregister.co.uk/2008/04...phorm_tougher/
http://www.theregister.co.uk/2008/04...orm_interview/
http://news.bbc.co.uk/1/hi/technology/7283333.stm
http://www.cableforum.co.uk/board/12...l#post34524506
http://www.iii.co.uk/investment/deta...scussion&it=le

I hope you decide to cover this story. Should you require any information, please do contact me

CaptJamieHunter · 10-04-2008, 10:24

Quote:

Originally Posted by 80/20Thinking

Dear all,

Following our email responses to some of you, I just wanted to confirm that we are looking to webcast the proceedings of the Phorm public meeting on Tuesday in London. We're hoping the technology at the theatre will allow this, but please do bring along vid cameras if you wish, just to be on the safe side.

Best wishes

Simon Davies
MD, 80/20 Thinking Ltd
www.8020thinking.com

Uh-oh... feels like I got up on the wrong side of the traffic island this morning...

Simon - Thanks for posting and nice to see the points about bringing along video cameras. "Hoping" isn't really a positive action though - surely the venue can confirm whether or not webcasting is possible? If it isn't then will a full audio recording be made and posted online with a full transcript? Spin can only be countered by truth.

As an individual who will be affected by this I certainly want to have input in your PIA document. Getting my crocked body to London may well not be remotely viable, so you can look forward to my e-mail.

As has already been mentioned, the V masks could get people confusing anti Phorm people with Anonymous - read a link off El Reg comments somewhere that says Saturday is another demo day. I spend far too much time reading that site!!!

80/20Thinking · 10-04-2008, 10:55

Quote:

Originally Posted by popper

hi simon, iv asked you this before elsewere, but it might be nice if you gave an official response on this longest Phorm related thread as your posting here.

how come it took you so long to follow the clear and simple official PIA rules as i pointed out here.#1398 18-03-2008

Actually, I can't really fault Phorm on this one. The ICO only launched the PIA initiative last December, and Phorm contacted us in January. Hardly anyone knew such a process existed until then. We started the work as soon as we could clear our diaries. Given those circumstances we had to reconstruct the ICO guidance along a different timeframe.

---------- Post added at 10:55 ---------- Previous post was at 10:38 ----------

Quote:

Originally Posted by CaptJamieHunter

Uh-oh... feels like I got up on the wrong side of the traffic island this morning...

Simon - Thanks for posting and nice to see the points about bringing along video cameras. "Hoping" isn't really a positive action though - surely the venue can confirm whether or not webcasting is possible? If it isn't then will a full audio recording be made and posted online with a full transcript? Spin can only be countered by truth.

Looks like the best we can do is Wireless through BT OpenZone, though I'm not sure what sort of speed we'd be working wit. I'm on the case. One way or the other we'll be able to get the content out, and probably also take questions via email.

Icoms07 · 10-04-2008, 11:31

You should see what Virgin Media Staff think about this on out intranet site! Were all really angry about this too. The powers that be need to look at peoples opinions! (JUST LIKE THE PREMIUM RATE TECH SUPPORT NUMBER!!!)

lucevans · 10-04-2008, 11:46

Quote:

Originally Posted by Icoms07

You should see what Virgin Media Staff think about this on out intranet site! Were all really angry about this too. The powers that be need to look at peoples opinions! (JUST LIKE THE PREMIUM RATE TECH SUPPORT NUMBER!!!)

Thanks for the info, Icoms07 - Would you be able to drop any anonymous quotes here for us?

We now have pretty clear statements of intent from both BT and TalkTalk, but still nothing from VM.
Hello? Virgin Media? Is anybody home? Your customers demand to know what you plan to do with their accounts. We're waiting...and this isn't going to go away, no matter how long you stay silent...