Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[SimonHickling]

This received today from BT.


Simon,

Please accept my apologies for the further delay in responding to your questions.

In your email, you referred to The Regulation of Investigatory Powers Act (RIPA) and how Webwise fits within this context. We believe that, in general, we can rely upon website owners' implied consent where websites have not taken steps to make their sites inaccessible generally, for example by excluding major search engines such as Google via robots.txt.

Over and above this, we are also taking reasonable steps to exclude specific websites from profiling upon specific request from the website owner. As per my previous email, if you provide me with the domain name for your website (and confirmation of ownership) then we will ensure that it is excluded from profiling within Webwise. I can assure you that we have taken advice and believe our approach is both entirely reasonable and complies with relevant legislation. I am not able to share that advice with you in detail and, and as noted in my previous email, I am not able to provide you with BT's IP address ranges.

I am afraid that if you do not provide us with the domain name of your website then we will be unable to act on your request to specifically exclude your website from profiling if an opted-in end-user visits your site.


You also referred to copyright implications arising from the implementation of Webwise. Again, having taken advice, it is our position that the planned trial of the BT Webwise system will not involve infringement of the copyright of any website owner.

Regards,

I'm pondering my response

[warescouse]

Originally Posted by Tarquin L-Smythe

WOT NO ANORAKS!
How about a box of rich tea to throw at the BT share holders ,or would this be deemed illegal cookie distribution

The shareholding (body count) majority if carefully informed (i.e. not misinPhormed) could be on our side . After all, if and when Phorm hits the rocks after the legal system rule against them, it probably would not be a good time for BT shares.

Theoretically those longer term shareholders who are not aware of what's currently going on (and there must be quite a few) could take an active interest in any developments, if properly put to them, that could affect their investment.

[phormwatch]

Originally Posted by bluecar1

bt beta forums offline for maint?

or is it to clean and lock threads and start a new one to hide info again

have we been raising to many awkward questions again?

peter

Perhaps it's time to mirror the thread?

[warescouse]

Originally Posted by SimonHickling

This received today from BT.



I'm pondering my response

As someone has mentioned in another post previously. It is not the website owners job to make the Phorm/BT/Webwise system legal. The onus is on BT.

[phormwatch]

>Over and above this, we are also taking reasonable steps to exclude specific websites from profiling upon specific request from the website owner. As per my previous email, if you provide me with the domain name for your website (and confirmation of ownership) then we will ensure that it is excluded from profiling within Webwise. I can assure you that we have taken advice and believe our approach is both entirely reasonable and complies with relevant legislation. I am not able to share that advice with you in detail and, and as noted in my previous email, I am not able to provide you with BT's IP address ranges.

Once/if Webwise spyware is ever implemented, requests for web pages from BT 'customers' will come from the Phorm proxy. This will reveal the IP range of the proxy machines making the requests. We should then be able to block BT IP ranges.

---------- Post added at 00:26 ---------- Previous post was at 00:25 ----------

Speaking of which, is there any other way we could get this information? (IP range assignment)

[popper]

"we can rely upon website owners' implied consent where websites have not taken steps to make their sites inaccessible generally"

you really,really have to include something like "if you rely on that defence with all websites having auto (C) not to mention explicit, 'not for commercial use' and 'interception by Phorm/webwise strictly forbidden' type notices, will get you upto 10 years in prison plus fines per offence committed...

we have taken advice about bringing court cases against commercial piracy for profit infringers and believe our approach is both entirely reasonable and complies with relevant legislation.

[mark777]

Originally Posted by phormwatch

>Over and above this, we are also taking reasonable steps to exclude specific websites from profiling upon specific request from the website owner. As per my previous email, if you provide me with the domain name for your website (and confirmation of ownership) then we will ensure that it is excluded from profiling within Webwise. I can assure you that we have taken advice and believe our approach is both entirely reasonable and complies with relevant legislation. I am not able to share that advice with you in detail and, and as noted in my previous email, I am not able to provide you with BT's IP address ranges.

Once/if Webwise spyware is ever implemented, requests for web pages from BT 'customers' will come from the Phorm proxy. This will reveal the IP range of the proxy machines making the requests. We should then be able to block BT IP ranges.

---------- Post added at 00:26 ---------- Previous post was at 00:25 ----------

Speaking of which, is there any other way we could get this information? (IP range assignment)

I wonder if any US website owners have written to BT HQ in the US over similar issues e.g. Interception and copyright, under US law? Especially given the attitude in Congress. UK users will visit their sites.

BT are trying to force the issue as an opt-out. The ICO should act. So should Google.

Regarding IP ranges, I think some work was done on this on BadPhorm.

EDIT : Found it.

http://www.badphorm.co.uk/e107_plugi...topic.php?4326

[Florence]

Originally Posted by Dephormation

Time to check your cookies for cookie fiddling perhaps Rob?

I can't login on the beta forums says use my BT details which i do but it still will not allow me in I reset password and still fails I can login and check my bill but cannot login on the forums..

[madslug]

Originally Posted by SimonHickling

This received today from BT.

I'm pondering my response

I have asked both ICO and HO for their opinion on this as I got tired of reading the same response from BT. Unfortunately, if the ICO go by their standard response time of 28 days, I won't have an acknowledgment of my question until after the AGM.

I see no point in complying with a request for PI on what domains and URLs are under my control when I have no idea who the data controller is nor confirmation that the data will be destroyed after the trial - the final system has to be opt-in and they do not need this data for that. Even less as some domains or portions of domains are part of the 'invisible web' and I have no intention of making that public.

As BT are refusing to confirm the IP address ranges during the trial, the only option open to me is to block all BT IP addresses and offer them only a page explaining why they are not able to access the site.

My hope is that a court order will require BT to reveal the IP addresses of the 2006 and 2007 trials so that all webmasters can go through their logs and put in claims for Copyright and RIPA infringement during those trials too.

Maybe the ICO or HO will make the request to BT so that they can prove that they complied with the legal requirement to request permission before intercepting the traffic which is not part of the ad delivery network.

That's a thought, refer BT to the HO opinion and point out that only opted in customers and sites delivering ads can be assumed to have agreed to the interception:
"17. The provision of a targeted online advertising service, contracted by an ISP as part of the service to the ISP's users, can probably be regarded as being carried out "on behalf of" the ISP for the purpose of section 3(3)(a)."

The ISP has no contract with my sites to provide targeted advertising and is, therefore, not doing anything 'on behalf of' the ISP for any section under RIPA. Any interception is, therefore, protected by RIPA and is a criminal act.

---------- Post added at 01:31 ---------- Previous post was at 01:12 ----------

Originally Posted by thebarron

Both IE7 & Opera warned me about this site so what is your point?

I think that the point he is trying to make is that Webwise will also warn you before you visit a phishing site, as long as it uses a valid http URL.

Sorry HW, I have a honeypot for phishing emails and I rarely see an http URL - they are ALL https.

This is the real description of the phishing protection offered:

Sorry Webwise users, Webwise is unable to warn you about 99.9% of phishing urls included in emails as they point to https URLs which we do not intercept. The few http URLs are pointing to invalid subdomains of sites which are not connected to phishing, [as they are invalid, Webwise will also not have them on the warning list] and the Webwise system is unable to detect the XSS script included in the URL.

Isn't it sad to see technical ignorance being taken advantage of?

Webwise is dangerous for the ignorant. It offers no protection and gives a false sense of security.

[sorry to drag up a thread that had started to go quiet - I did not notice anyone else make this point about the primary weakness of the 'protection' offered.]

[popper]

its always good to bring up and re-focus the lense now and then Madslug, and you make a very good point not considered here before about the https phishing URLs, well done.

[3x2]

We believe that, in general, we can rely upon website owners' implied consent where websites have not taken steps to make their sites inaccessible generally, for example by excluding major search engines such as Google via robots.txt.

Again they just don't seem to get it.

If I visit an AIDS clinic it is a private matter. The clinic may be in the phone book, have an open door policy and it may well advertise it's services in a host of other ways. Once I interact with the clinic in any way both ends of the interaction become private and confidential. The fact that everyone knows where it is and what it does is completely irrelevant to the issue of confidentiality.

Why do they believe issues of confidentiality are any different because it is a website?

[tdadyslexia]

Originally Posted by AlexanderHanff

You are welcome to email them on my behalf

In fact anyone is welcome to email any press/media companies with news of the event, it will be one less email for me to send

Alexander Hanff

Alex do you have a standard press release that I can send to the local media?

[edit]

Just want to do my bit!

Originally Posted by 3x2

Why do they believe issues of confidentiality are any different because it is a website?

I think that they are confused by and frightened of the technology involved. Worse still they are afraid to admit their lack of understanding and are trying to be seen as forward thinking in order to avoid being accused of holding the advance of technology back.

They are incapable of discussing the technology and so they nod their heads and stroke their chins whilst being terrified of putting up the hand and asking the simple questions like "why?".

They have completely missed the single most basic point of the whole debate. Why should any delivery company be allowed to open and read the content of any communication regardless of the nature of that content or the method of delivery?

Once you remove the technological aspects of the internet it all boils down to system for delivering that is no different in any aspect from that undertaken by the Royal Mail. There is no difference in value between the content of a website and the content of my subscribed magazines. Both are delivered to my home at my request and I do not expect the Royal Mail to open the packet and read the magazine before they deliver it. In fact, if they did so they would be breaking the law.

The subject or content of the magazine is irrelevent and it would not be a defence for the Royal Mail to claim that the magazine didn't contain any personal details that identify me nor would it be a defence if the magazine was "free" copy or was otherwise available in the public domain.

When I read the information on a website I send a request to the website and the website agrees to send me the information. They are fulfilling an order and the ISPs only involvment is in their contractual obligation to deliver that order.

Take the technology smoke-screen away and even an MP should be able to see why this form of spying must not be allowed in a civilised country without the specific intervention of court and only then with the the most compelling reason to justify such action.

[AlexanderHanff]

Originally Posted by Peter N

I think that they are confused by and frightened of the technology involved. Worse still they are afraid to admit their lack of understanding and are trying to be seen as forward thinking in order to avoid being accused of holding the advance of technology back.

They are incapable of discussing the technology and so they nod their heads and stroke their chins whilst being terrified of putting up the hand and asking the simple questions like "why?".

They have completely missed the single most basic point of the whole debate. Why should any delivery company be allowed to open and read the content of any communication regardless of the nature of that content or the method of delivery?

Once you remove the technological aspects of the internet it all boils down to system for delivering that is no different in any aspect from that undertaken by the Royal Mail. There is no difference in value between the content of a website and the content of my subscribed magazines. Both are delivered to my home at my request and I do not expect the Royal Mail to open the packet and read the magazine before they deliver it. In fact, if they did so they would be breaking the law.

The subject or content of the magazine is irrelevent and it would not be a defence for the Royal Mail to claim that the magazine didn't contain any personal details that identify me nor would it be a defence if the magazine was "free" copy or was otherwise available in the public domain.

When I read the information on a website I send a request to the website and the website agrees to send me the information. They are fulfilling an order and the ISPs only involvment is in their contractual obligation to deliver that order.

Take the technology smoke-screen away and even an MP should be able to see why this form of spying must not be allowed in a civilised country without the specific intervention of court and only then with the the most compelling reason to justify such action.

Peter, that was a very comprehensive post I enjoyed reading it and you hit the nail right on the head.

Alexander Hanff

Thank you.

If you'll forgive me for quoting from a Star Trek film...

"Let us redefine progress to mean that just because we CAN do a thing doesn't mean that we MUST do that thing"