Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[davews]

Originally Posted by hOrZa

Is anyone else seeing display problems with this forum? I'm using the latest Opera and the page formating is massive

tia

hOrZa

All fine here, Opera 9.27 and 9.50B2

[Portly_Giraffe]

For anyone with an interest, I've put up a report of last Tuesday's 10th Anniversary Public Meeting of the FIPR at http://www.inphormationdesk.org/FIPR10.pdf

It includes Richard Clayton's withering attack on behavioural advertising and some interesting comments from the Earl of Northesk, plus discussion of several other key issues.

---------- Post added at 20:53 ---------- Previous post was at 20:43 ----------

Also, I had the opportunity to have about two minutes' one-to-one chat with the Home Secretary this evening. She wasn't aware of what has been happening with the BT Trials and Phorm, and to be fair to her she has some weighty challenges on other issues. Nevertheless, she is now aware that something is going on, and that it is something to do with BT, privacy, the law and the integrity of the Internet.

I think that senior politicians will only start to take serious notice when it reaches the front pages of the papers. I have an idea about this, but it'll take several weeks to bring it to fruition - maybe in time for the BT AGM, who knows?

[popper]

Originally Posted by R Jones

Phorm claim (in advertiser oriented promotions) that they know what you were doing 3 days ago (looking at ads for a certain Canon camera model)

---------- Post added at 15:04 ---------- Previous post was at 15:00 ----------

Reply from Don Foster MP (signatory to Early Day Motion in Commons)

I've had a reply from my MP Annette Brook (LD) one of the EDM signatories, with Don Foster's response to my concerns (Don Foster MP is the intiator of the EDM). It does not make for happy reading.

He has met Phorm, and appears to have been given their standard talk, and believed it.

the points where he appears to have been effectively misled are:

1 - non https email. "There is no suggestion that Phorm would be able to scan individual emails for content because the system does not monitor `https' URLs which are used for secure access websites". This is sufficient for Don Foster to then go on and say "Ths should mean that it is unable to collect any personally idenfiable data". Again - serious lack of understanding of the system evident here.

This ignores the issue of the many non-https mail sites, security issues relating to the cookies, data handling by BT Webwise sites, and the issue of interception of Phorm UID by 3rd party websites.

2 - He appears not to be familiar with Dr Clayton's analysis as he says, "I am confident that currently and in the future, Phorm poses no risk to individuals' privacy and security".

3 - He makes absolutely no reference to webmasters intellectual property rights and the lack of webmaster explicit informed consent.

He has concerns about the previous tests and seems to confine his concerrn to the potential illegality of BT's 2006 and 2007 trials.

He states that - "the tests put the trust between BT and their customers at risk". You bet it does.

He states that he has met with BT and urged them to consult their customers before any further tests take place and to use an opt-in system. Presumably the closed Q&A thread on the BT beta forums represents this consultation - unfortunately the answers stopped coming as soon as the questions got difficult. He been "assured that this will be the case (opt-in) for any future tests or use of the service". Good, but even the ICO was saying that - just that BT have never confirmed up to now that they would abide by that. So - some progress.

He states that "there is no way of knowing whose data traffic was processed in these trials" (2006/2007). That will be news to those who already KNOW that they were included. He urges such people to "contact BT to discuss their experience." I would recommend those people who have evidence of being affected by the BT secret trials to contact Don Foster MP and relate what responses BT have given them, and what response they have had from the ICO. Don Foster has made his feelings (on the secret trials) "very clear to BT and hope that they will offer a full apology to all customers affected."

He has been informed by the ICO that "the ICO has ruled that the tests were technically legal". So presumably he does not agree with Nicholas Bohm of FIPR.

With regard to the website blacklist - he is informed by Phorm that "they have over 1000 known webmail websites on their blacklist." So that leaves one heck of a lot of the internet still to give or withold their explicit informed consent. No mention of all the other websites whose intellectual property is going to be copied, exploited and profiled. He has said he believes that "for the sake of transparency and accountability, Phorm should make public this blacklist. They have so far refused to do so, but I shall continue to pressure them on this."

He has no problems with the company Phorm, or what they do but does have problems with the way the product has been tested. He has had assurances from BT, Virgin Media and TalkTalk that the system will be opt-IN across the board, along with demonstrations to support that. Great - all they need to do now is communicate with their customers?

He concludes:
"I am convinced the technology is safe to use, and believe that there are sufficient systems in place to notify customers of Phorm and for customers to choose not to use this system."

I'm very dis-satisfied with that reply but note:

BT, Virgin Media and TalkTalk have committed to opt-in. Presumably BT can now confirm that to their customers? US?

Hope this sparks some further debate.

you know, it would be so much easyer if we could get the make and model of the DPI kit they are using, alongside the full PDF spec documents, so we could then give him the real deal on what this DPI kit CAN DO with a mear "set <intercept option> ON" at the remote CLI/shell.

failing that exact Phorm gifted model/model...,has anyone got links to the spec tech PDF's of the most common off the shelf Deep Packet Inspection kit in use today, that can help support the general eduction of what they CAN be made to do.

it also seems wise to keep a copy of that new FLV video for any county court small claim anyone might make later.

as happened with the so called bankcharges rush on the county courts, any largescale "small claim" ISP/Phorm/Webwise rush might also eventually have the lower courts move the cases into the higher courts.

and so get a meaningful ruling in case law on this interception/wiretapping for profit matter, without paying lots of high court costs, even if it takes time it might be werth considering at least.

[davethejag]

Hi, New BT trial!

http://www.webuser.co.uk/news/255941.html

Dave

[NTLVictim]

Originally Posted by Portly_Giraffe

EDIT
Also, I had the opportunity to have about two minutes' one-to-one chat with the Home Secretary this evening. She wasn't aware of what has been happening with the BT Trials and Phorm,

Whacky Jacqui unaware?

No **** Sherlock, half the planet knows that.

[bluecar1]

Originally Posted by jelv

How many ISP's are preparing to participate in the Webwise "trial".

If I go to http://www.webwise.com/privacy/can-choose-NA.html from the office I get a page that says:



If I go to the same page from my home connection I get:



My ISP is NOT BT, Talk Talk or VM.

i get that it is not enable even it i click the button and i am on bt??

[mouqeet]

Originally Posted by davethejag

Hi, New BT trial!

http://www.webuser.co.uk/news/255941.html

Dave

How many days is it

[Kursk]

Deleted (I bored myself ).

[mark777]

Originally Posted by Portly_Giraffe

For anyone with an interest, I've put up a report of last Tuesday's 10th Anniversary Public Meeting of the FIPR at http://www.inphormationdesk.org/FIPR10.pdf

It includes Richard Clayton's withering attack on behavioural advertising and some interesting comments from the Earl of Northesk, plus discussion of several other key issues.

Thank you for this. One quote below I find interesting, somewhat worrying and I suspect very sound advice

"The Earl of Northesk observed that Freedom of Information requests were more effective than Parliamentary Questions."

---------- Post added at 21:58 ---------- Previous post was at 21:50 ----------

Originally Posted by Portly_Giraffe

Also, I had the opportunity to have about two minutes' one-to-one chat with the Home Secretary this evening. She wasn't aware of what has been happening with the BT Trials and Phorm, and to be fair to her she has some weighty challenges on other issues. Nevertheless, she is now aware that something is going on, and that it is something to do with BT, privacy, the law and the integrity of the Internet.

Hopefully, she might start to ask some questions.

I think that senior politicians will only start to take serious notice when it reaches the front pages of the papers. I have an idea about this, but it'll take several weeks to bring it to fruition - maybe in time for the BT AGM, who knows?

Perhaps it needs to make those front pages as a Home Office issue, just to jog her memory!

[Portly_Giraffe]

Originally Posted by Kursk

Deleted (I bored myself ).

Yes, but before you deleted you made a good point. Most of the public, unless faced with simple facts and appropriate analogies to real life let their eyes glaze over when anything about computers is mentioned (I did detect a bit of that with Jacqui this evening). All they want to do is to use the Internet to do what they want to do. They don't want to - and shouldn't have to - know how it works. They should be able to trust companies like BT to do that for them.

Getting our message over to the public is our challenge. We're right, but Phorm and their ISPs are relying on it being too difficult or too technical for most normal users to understand or get concerned about the issues.

My aim with inphormationdesk has always been to provide a place where non-technical people can come to learn about what is going on. In that spirit I offer a page I'm working on and would be very grateful if people here could provide feedback. Are these the right points? Are they expressed in the right way? Have I missed any arguments or are any superfluous? Have I been too technical? (probably - I'll be working on this as well) and so on.


1. Webwise/Phorm is Illegal

To carry out the kinds of communications interceptions needed by Phorm, either a warrant has to be obtained or the parties at both ends have to give their permission. This is covered by the Regulation of Investigatory Powers Act 2000. In addition the data has to be kept private and not misused. The Data Protection Act 1998 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 provide safeguards against this.

In the BT Trials in 2006 and 2007, consent was neither sought from nor granted by any of the tens of thousands of users affected. The trials flagrantly breached the Regulation of Investigatory Powers Act, and also the Privacy and Electronic Communications Regulations.

The basic principles of Phorm have not changed since then. It involves snooping. Even with user opt-in, website owners will not have given consent for the pages they serve to be intercepted and read. And whether their data is really private or secure is questionable.


2. Webwise/Phorm intrudes on Privacy

Most of us have nothing to hide. But we wouldn’t want a little man following us around all day, watching where we went and what we bought in shops, following us while we played sports or went to the gym, sitting in the corner of the pub listening to us, inspecting our post as it came through the front door, making a note of what clothes we were putting on, reading our books and newspapers over our shoulders and recording where we were going on holiday.

And that’s just what Phorm say they do. They’ll also read all your web-based email unless it’s on one of their recognised webmail services. There will be little they don’t know. The may bundle it all up and assign you to a demographic segment. But that cookie on your PC discloses your likes and dislikes, and it could be used to work out who you are.


3. Webwise/Phorm makes the Internet less secure

Webwise/Phorm operates by adding four message redirects to the way your data is handled by your Internet Service Provider. Webwise/Phorm also forges cookies on your PC which look as though they have come from the websites you have accessed.

This presents opportunities for abuse from within Internet Service Providers and Phorm itself, and more alarmingly from external hackers and fraudsters. Internet Service Providers using Phorm will be much more vulnerable to cyber-terrorist attacks. Ideas on how to compromise Phorm-based systems are already appearing on the Web.

For this reason, if Webwise/Phorm goes ahead many technically-aware people are considering moving to Internet Service Providers which have committed to not intercepting web traffic in this way.



4. Webwise/Phorm may compromise the Internet’s integrity

In the BT Trials of Webwise/Phorm in 2007, messages from users to websites were actually altered by the Phorm system. Phorm offers the opportunity not just for tailoring the advertisements you see, but also what you see on the web.

While Phorm will only be used initially for tailoring advertisements, it opens up many opportunities for interference with the operation of the Internet. How will you know who you are communicating with when your message can be modified by your Internet Service Provider? How will you know that what you are reading on a website is what the website owner wants you to see, or what your ISP and Phorm want you to see?

An Internet which has integrity is essential to our freedom and essential to our economy. Webwise/Phorm puts this at risk.


5. Webwise/Phorm is being marketed dishonestly

Webwise is being presented primarily as providing greater protection from online fraud, with tailoring of advertising a secondary feature. Yet its primary purpose is to make advertising from participating websites more relevant.

Nowhere does BT state that equivalent protection from online fraud is standard with the latest free browsing software which more then 90% of UK users already have. Nor do they state that Webwise works by intercepting, reading and processing nearly everything users do on the Web.

If Webwise is such a good offer for users, why doesn’t BT focus on Webwise’s core purpose and loss of user privacy needed to achieve it?


6. Webwise/Phorm’s business model will be valueless within months

The UK’s Information Commissioner has stated that users must have expressly to opt in to Webwise/Phorm. If they are properly informed that everything they do will be read, it is likely that only a small proportion will opt in.

Even then, the Web’s big operators such as Google, Yahoo, Microsoft, Amazon and eBay will not let Phorm get a foothold. Within months, it is likely that much useful web traffic will be encrypted and so of no value to Phorm.

[mark777]

Originally Posted by davethejag

Hi, New BT trial!

http://www.webuser.co.uk/news/255941.html

Dave

On the subject of speed, a potential dirty trick. If BT trial on a single exchange, should users look out for better performance on that exchange during the trial?

If they can selectively ramp that up (by increasing bandwidth on that exchange?) they are likely to be complemented on the performance! One for the techies to keep an eye on?

[mouqeet]

A trial version is definetly rubbish because the trial will be slow but the actual thing will be good

[Rchivist]

Originally Posted by Portly_Giraffe

Yes, but before you deleted you made a good point. Most of the public, unless faced with simple facts and appropriate analogies to real life let their eyes glaze over when anything about computers is mentioned (I did detect a bit of that with Jacqui this evening). All they want to do is to use the Internet to do what they want to do. They don't want to - and shouldn't have to - know how it works. They should be able to trust companies like BT to do that for them.

Getting our message over to the public is our challenge. We're right, but Phorm and their ISPs are relying on it being too difficult or too technical for most normal users to understand or get concerned about the issues.

snip

I like that a lot. Very good communication aimed at the non-technical. I understood it!
The killer comment though is "But the ICO say it's legal, so what you say must be rubbish" - and that is when the answers have to get technical and we see that glazed look coming over their eyes.

[mark777]

Originally Posted by Portly_Giraffe

{snip}
1. Webwise/Phorm is Illegal

To carry out the kinds of communications interceptions needed by Phorm, either a warrant has to be obtained or the parties at both ends have to give their permission.

This is covered by the Regulation of Investigatory Powers Act 2000. This is our phone tapping law and it strictly forbids other people from listening to or reading our communications unless under these very specific circumstances.


In addition the data has to be kept private and not misused. The Data Protection Act 1998 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 provide safeguards against this.

Suppose Stephen Gerrard buys a new fridge in Currys. Because of DPA/PECR, Liverpool FC can't sell Currys a list of all their season ticket holders phone numbers so that Currys can ring them up to try to sell them a fridge like Stephen Gerrard's.

In the BT Trials in 2006 and 2007, consent was neither sought from nor granted by any of the tens of thousands of users affected. The trials flagrantly breached the Regulation of Investigatory Powers Act, and also the Privacy and Electronic Communications Regulations.

The basic principles of Phorm have not changed since then. It involves snooping. Even with user opt-in, website owners will not have given consent for the pages they serve to be intercepted and read. And whether their data is really private or secure is questionable.
{snip}

Some suggestions of mine in bold which I am sure could be better phrased! The aim being to bring home just what these laws mean in normal life.

[Digbert]

Originally Posted by popper

you know, it would be so much easyer if we could get the make and model of the DPI kit they are using, alongside the full PDF spec documents, so we could then give him the real deal on what this DPI kit CAN DO with a mear "set <intercept option> ON" at the remote CLI/shell.

failing that exact Phorm gifted model/model...,has anyone got links to the spec tech PDF's of the most common off the shelf Deep Packet Inspection kit in use today, that can help support the general eduction of what they CAN be made to do.

An interesting article on arstechnica from June 2007 about DPI kit and what can be done with it, contains this quote.

"The rise of "lawful intercept" (CALEA) requirements and the growth of online video (both P2P and over HTTP) are making monitoring and shaping increasingly important to ISPs. Because of the firestorm surrounding network neutrality in the US, ISPs here tend to take a cautious approach to using this equipment, but it's far more common overseas.

BT, for instance, recent became Ellacoya's single largest customer, using its gear to support more than 3 million broadband subscribers. According to BT, deep packet inspection enables them to better monitor their network, but it also allows them to apply QoS to two important services. VoIP, to be useful, needs to move quickly, so BT gives it priority on the network. BT also runs its own IPTV system, with the data apparently flowing over the same network as user data. To prevent distortion in the TV signal whenever half the country decides to download an episode of Little Britain using P2P, BT uses QoS to make sure a fixed amount of bandwidth is always available to IPTV."

http://arstechnica.com/articles/cult...eutrality.ars/

http://www.arbornetworks.com/en/ella...echnology.html