Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Florence]

Originally Posted by AlexanderHanff

Yes it would be for non opt in customers only. If customers have given their illphormed consent then there are no issues with the customer with regards the cookies. There are still issues under RIPA, PECR, CMA, FA, CDPA etc. as I mentioned above.

Alexander Hanff

---------- Post added at 13:56 ---------- Previous post was at 13:50 ----------



A law change is not a good idea either. It will alienate the public and privacy groups as well as political representatives/bodies in the EU and UK. It is likely the House of Lords would try to delay the process as long as possible too, and they would need to unratify (if that is even possible?) several EU Regulations/Directives and Conventions or they would most certainly be open to action from the European Commission and the European Court of Human Rights/European Court of Justice.

The timeframe for legislative changes would be significant and BT etc. need to roll this out as soon as possible before someone does come up with a competing "legal" (or less illegal) model and Phorm+Investors+Partners end up with egg on their face and an unsellable product.

Alexander Hanff

I agree Alexander need the link to your paper again please and a link tothe video of the public meeting to post on ISPreview, trying to get more publicity it seems to die quick on there

[AlexanderHanff]

Originally Posted by jelv

I wonder if the opt-in will make sure the user is able to make a fully informed consent? As in:

"I wish to break the law by inciting BT/Phorm to intercept communications between my browser and a website when I visit a website where the owner has explicitly prohibited such interception".

See my previous posts on complicity.

But I agree, it is unlikely that people will be made aware of "why" they have to give informed consent and the possible "consequences" of doing so. If they were then an Opt-In system would only attract a fraction of a percent of users and would die instantly as a product.

Alexander Hanff

---------- Post added at 14:07 ---------- Previous post was at 14:06 ----------

Originally Posted by Florence

I agree Alexander need the link to your paper again please and a link tothe video of the public meeting to post on ISPreview, trying to get more publicity it seems to die quick on there

Hold off on the paper link for now, I finally got some urgent work out of the way today so I have a chance tonight to finish the paper and plan to do so.

The videos are on http://tobymeres.net/

Don't forget BBC "Click" Saturday and Sunday morning this weekend 11:30 on BBC News 24. (Should be available on iPlayer Friday night I believe)

Alexander Hanff

[OF1975]

One thing that does slightly worry me regarding a change of law is that campaigners are already calling for RIPA to be changed with regard to the issue of Local Councils using RIPA to use surveillance in matters such as littering and dog fouling etc etc

Call me cynical but I wouldn't be surprised if in some future revision of RIPA the government were to slip in some Phorm/NebuAd friendly provision or they might just tag on an amendment to some piece of obscure, unrelated legislation that is already going through second reading. They have done it before and I wouldn't be surprised by ANYTHING this government does these days.

---------- Post added at 14:12 ---------- Previous post was at 14:10 ----------

Oh and I am still waiting for any response from my MP, Liberty, Computer Crime Unit of Met Police and the Chartered Institute of Library and Information Professionals.

[BetBlowWhistler]

Originally Posted by AlexanderHanff

Actually it is perfectly feasible for people who want to be involved in the Phorm "system" to have a flag added to their user account details which will allow them to be assigned IPs from specific blocks of IPs which are routed through Phorm. If the flag is not set (it should be disabled by default) then the customer gets assigned an IP from the non Phorm blocks and routed directly to the Internet without going near Phorm's kit.

My brain is so hard-wired that I often overlook software solutions! Thanks for pointing this out.

Originally Posted by AlexanderHanff

Of course it would still not be legal because they are still required under RIPA to get consent from all parties regarding interception, then there is the Fraud Act, PECR, Computer Misuse Act, Copyright, Designs and Patents Act and Torts (Interference with Goods) Act on top of all that which all require consent as well.

So they may be able to fix the legal issues from the perspective of the ISPs customers, but I fail to see any way they can navigate the legal obstacles from the perspective of the rights of content owners.

Which will ultimately be their downfall.

Originally Posted by AlexanderHanff

Oh and

Alexander Hanff

Thanks

Originally Posted by mark777

I you are who I think you might be, we all owe you a considerable debt of gratitude.

Thankyou. I'm trying to keep a low profile these days as I've already lost one job, so everything I post from now on is purely my personal opinion. I doubt Ben is reading these forums, but I'm pretty sure I know a few fellows at BT who will be All that's gone by-the-by now anyway what with BT being found with their hand in over 30,000 cookie jars (sorry that was an awful pun )

[AlexanderHanff]

Originally Posted by OF1975

One thing that does slightly worry me regarding a change of law is that campaigners are already calling for RIPA to be changed with regard to the issue of Local Councils using RIPA to use surveillance in matters such as littering and dog fouling etc etc

Call me cynical but I wouldn't be surprised if in some future revision of RIPA the government were to slip in some Phorm/NebuAd friendly provision or they might just tag on an amendment to some piece of obscure, unrelated legislation that is already going through second reading. They have done it before and I wouldn't be surprised by ANYTHING this government does these days.

---------- Post added at 14:12 ---------- Previous post was at 14:10 ----------

Oh and I am still waiting for any response from my MP, Liberty, Computer Crime Unit of Met Police and the Chartered Institute of Library and Information Professionals.

It is not that easy in this case. The Right to Privacy is an inalienable right afforded to us under multiple European laws/directives and conventions, most of which are currently ratified in the UK. To suddenly change British law in such a way would at least cause problems in official EU circles, or at least that is my belief.

Alexander Hanff

---------- Post added at 14:21 ---------- Previous post was at 14:15 ----------

Originally Posted by BetBlowWhistler

Thankyou. I'm trying to keep a low profile these days as I've already lost one job, so everything I post from now on is purely my personal opinion. I doubt Ben is reading these forums, but I'm pretty sure I know a few fellows at BT who will be All that's gone by-the-by now anyway what with BT being found with their hand in over 30,000 cookie jars (sorry that was an awful pun )

I should just correct you there for a moment, latest reports put the figure at around 128 000 (108 000 in 2006 and 20 000 in 2007), McVitees must love it.

I know where you are coming from regarding the job, I lost a job after appearing on BBC's Newsnight a couple of years back simply for offering my opinion on a judgement in the US Supreme Court (completely unrelated to my work).

However (and without meaning to sound insensitive) some things are so important that the prospect of losing your job over moral and ethical decisions is worth it, and I respect anyone who puts their ethics ahead of their employment prospects.

Alexander Hanff

[OF1975]

Originally Posted by AlexanderHanff

It is not that easy in this case. The Right to Privacy is an inalienable right afforded to us under multiple European laws/directives and conventions, most of which are currently ratified in the UK.

Agreed but that hasn't stopped them in the past. How many times has HMG (particularly the home office) been taken to court and lost? Its got to be double figures. Control Orders and immigration issues being two of the most prominent that I can recall.

Originally Posted by AlexanderHanff

To suddenly change British law in such a way would at least cause problems in official EU circles, or at least that is my belief.

Alexander Hanff

I really hope you are right Alexander. As I said, I wouldn't put anything past this government and the lack of the Police and Home Office acting on the past contraventions of RIPA hardly inspire confidence.

[unicus]

Originally Posted by AlexanderHanff

Of course it would still not be legal because they are still required under RIPA to get consent from all parties regarding interception, then there is the Fraud Act, PECR, Computer Misuse Act, Copyright, Designs and Patents Act and Torts (Interference with Goods) Act on top of all that which all require consent as well.

I have thought about this before and wondered if they would try to pass the responsibility of fully informing the user of the interception and profiling down to the account holder (customer). Not sure if they could get around the laws like this but it would require them to sign people up to the Phorm service [sic] specifically with its own T&C's in which case they'll not get many if any people doing so.

An unusual 'provider, customer, user' relationship is seen when connecting up to some hotspots where you are redirected when you first connect because at that stage you are not a customer of that provider but you are a user.

[OF1975]

BetBlowWhistler, now I realise who you are, may I say a heartfelt thank you for what you have done. It reassures me that there are still people out there who put their principles above profit and take a stand for what is right.

[AlexanderHanff]

Originally Posted by unicus

I have thought about this before and wondered if they would try to pass the responsibility of fully informing the user of the interception and profiling down to the account holder (customer). Not sure if they could get around the laws like this but it would require them to sign people up to the Phorm service [sic] specifically with its own T&C's in which case they'll not get many if any people doing so.

An unusual 'provider, customer, user' relationship is seen when connecting up to some hotspots where you are redirected when you first connect because at that stage you are not a customer of that provider but you are a user.

Naaah they can't do that, because the customer is not making the interception, only inciting BT to do it, BT would still be the party guilty of any interception charges. This is outlined in the response I got from Nicholas Bohm which I will post below for clarification:

A user who knows what is involved in the use of the technology, and who opts in with the knowledge that he uses (for example) webmail which will not be excluded from analysis, can be argued to incite interception, and perhaps conspire to have it done. This is no defence for an ISP, or for Phorm as a fellow inciter. And it seems to me that even if a prosecutor could be persuaded to prosecute BT, which seems an uphill task, there really is not the remotest chance that a user would be prosecuted.

You may say that users should nevertheless not be put at risk of prosecution, even a little theoretically, and I would not disagree. But I would not place this aspect too far up the list of concerns.

In other words, in theory customers who opt-in are likely to be accountable for inciting BT and conspiracy, should they initiate a communication with a web site which denies consent for interception; but in reality it is unlikely a customer would end up being prosecuted and even if they did, it would not remove liability from BT under RIPA.

Alexander Hanff

[BetBlowWhistler]

Originally Posted by OF1975

BetBlowWhistler, now I realise who you are, may I say a heartfelt thank you for what you have done. It reassures me that there are still people out there who put their principles above profit and take a stand for what is right.

Stop already, you're making me blush. And my wife didn't exactly share my principles which caused a few ructions I can tell you!

Come to think of it, I can name a few other people who didn't take too kindly to my high-handed approach either, and it certainly didn't stop them sending a heavy round for my laptop whilst I was off sick (stress related nervous break-down which, thankfully, I'm now recovered from).

I'd actually like to take this opportunity to thank some of the people at BT who supported me and my actions - you know who you are. Not everyone at BT is cozying up to Ken, in fact this whole thing came as a very big surprise to everyone since BT Retail went and did the network design and implementation without bothering to use the BT design team or get any of the recognised security professionals involved (if they're reaction was anything to go by at the time).

Still, better job, better prospects, better pay (worse travel but something's gotta give) so I'm not feeling overly hard done by

[CaptJamieHunter]

Originally Posted by AlexanderHanff

I should just correct you there for a moment, latest reports put the figure at around 128 000 (108 000 in 2006 and 20 000 in 2007), McVitees must love it.

I know where you are coming from regarding the job, I lost a job after appearing on BBC's Newsnight a couple of years back simply for offering my opinion on a judgement in the US Supreme Court (completely unrelated to my work).

However (and without meaning to sound insensitive) some things are so important that the prospect of losing your job over moral and ethical decisions is worth it, and I respect anyone who puts their ethics ahead of their employment prospects.

Alexander Hanff

128000? That's a lot of Jaffa Cakes! I don't think I could imagine 128000 Jaffa Cakes, never mind 128000 jars of Jaffa Cakes! I feel a trip to Waitrose to do some investigative math coming on...

Joking aside, I too respect those who put their principles ahead of job prospects.

[popper]

"BT Retail went and did the network design and implementation without bothering to use the BT design team or get any of the recognised security professionals involved "

which seems to imply they already know what the illlegal stance was as they didnt want to include inhouse employees for legal reasons later perhaps!

[Florence]

Originally Posted by BetBlowWhistler

Stop already, you're making me blush. And my wife didn't exactly share my principles which caused a few ructions I can tell you!

Come to think of it, I can name a few other people who didn't take too kindly to my high-handed approach either, and it certainly didn't stop them sending a heavy round for my laptop whilst I was off sick (stress related nervous break-down which, thankfully, I'm now recovered from).

I'd actually like to take this opportunity to thank some of the people at BT who supported me and my actions - you know who you are. Not everyone at BT is cozying up to Ken, in fact this whole thing came as a very big surprise to everyone since BT Retail went and did the network design and implementation without bothering to use the BT design team or get any of the recognised security professionals involved (if they're reaction was anything to go by at the time).

Still, better job, better prospects, better pay (worse travel but something's gotta give) so I'm not feeling overly hard done by

OMG they did know it was illegal if they didn't use the inhouse team then again they perhaps had their greasy paws lined by a snake in the grass, who wants all the customers UK pc's signed sealed and delivered into his spyware/adware world... MPO ofcourse which if I am right and I am sure Aleaxander will fight in my corner is my legal right to have an opinion.

[popper]

Originally Posted by CaptJamieHunter

128000? That's a lot of Jaffa Cakes! I don't think I could imagine 128000 Jaffa Cakes, never mind 128000 jars of Jaffa Cakes! I feel a trip to Waitrose to do some investigative math coming on...

Joking aside, I too respect those who put their principles ahead of job prospects.

dont forget , its far more jafa cakes that that though...., you need to include potentially every single webpage a conscripted Phorm user opened over the whole timeframes x that 128000 jafa cake packets

[BetBlowWhistler]

Originally Posted by popper

which seems to imply they already know what the illlegal stance was as they didnt want to include inhouse employees for legal reasons later perhaps!

Tempting though it is to agree with you, BT Retail has always been a bit of a law unto iteself regarding design. It's only been in the last year or so that the e2e design team have taken over from all other areas, but there are still little 'in-house' design teams dotted around (although there shouldn't be as this situation has proved).

The original design of the test *could* have pre-dated the carte-blanche approach to designs going through the e2e team. Mind you, if it had then the issues would have been raised in-house and no-one would have gone to the press with their 'fait-accompli'. They [BT Retail] get 10/10 for being underhanded imho.

No, my bigger concern was that the security community seemed a bit taken aback when the news first broke on the register, and a comment was made in The Reg's article about the reaction of the security team. There then immediately followed a posting on the BT Security mailing list about the comment and a very heavy sounding 'anyone found commenting on BT internal stuff will be investigated and stuffed' email.