Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Matari]

Hi

Thanks for these addresses. Meanwhile I have written to Viviane Reding at the EC, OFCOM and am about to write to my MP

Also, thanks to Alex and yourself for your hard work in keeping people up to date. I know it must seem like a thankless task, but this is how protests get started - ordinary people fed up to the back teeth of big corporations constantly showing disrespect to their customers. So thank you.

Originally Posted by Dephormation

Three names to offer you

Sir Michael Rake (Chairman)
Ian Livingston
Gavin Patterson
Emma Sanderson (director of value-added services at BT Retail)

BT Group plc,
BT Centre,
81 Newgate Street,
London
EC1A 7AJ

You probably will not get a reply.

You might also write to the ICO to explain, "BT are not engaging with their customers..." (use that phrase verbatim, its a direct contradiction of a phrase in an ICO press releases). You could also write to OFCOM. And you should write to your MP too (see www.writetothem.com).

Make it clear to BT, this is something you do not want anywhere near your internet connection, full stop.

[Dephormation]

Originally Posted by HaveToBeAnon

5. Bt have said that they will add websites to an exclusion list, provided the webmaster contacts BT and says so, providing proof that he is in fact the webmaster. What about foreign language websites. Anyone know a website owner in, say Hungary. Get them to write to Emma, *in hungarian*, asking to not be profiled. Would be interesting to see what happens! Repeat for as many bizarre languages as possible.

Thanks for keeping us posted.

On the question of webmasters begging BT not to profile their web sites, I take exception to what they're asking. Its up to BT to obtain consent (ie, a copyright licence and consent for interception) before processing private unencrypted communication traffic for any purpose other than onward transmission. Anything else is illegal.

Webmasters should not have to beg ISPs around the globe not to steal their content, or profile their customers/users. Its simply wrong, in the same sense that stealing MP3 files is wrong or bugging your nextdoor neighbour is wrong.

Originally Posted by HaveToBeAnon

Oh, just another thought while I'm here.

BT have, as you would expect, a whole team of security experts who's job it is the keep the backbone infrastructure secure and reliable, and it has to be said do a pretty good job. What you would not expect is that they weren't even consulted, and discovered about phorm at the same time as the rest of us, ie February, and their head man, I won't mention names so lets call him JR, went absolutely ape-s..t on hearing about it.

Thats an indication of just how secret this has been within BT, keeping it from people who would instantly recognise it for what it was.

I'm sure they did go ape. The security people would also face difficult questions themselves. Why did no alarm bells ring when someone installed this garbage in the network? Why did no one in BT security spot the interference with traffic? What security measures were in place to stop someone gaining access to this equipment, and how were they so easily circumvented?

So to summarise what we now know; the trials in 2006/7 were secret, conducted without Home Office knowledge, without ICO knowledge, without BT Security being informed or discovering, using 'closed source' kit supplied by Russians, with alleged history of rootkits/spyware, during a period of critical/severe national security alert, and profiling tens if not hundreds of thousands of customer's traffic (including judges, lawyers, military, civil servants, medics, police, politicians), not once but twice.

And not one MP in Parliament has yet found it appropriate to ask the Government for an explanation. Perhaps I need to write to my MP again?

Keep in touch

Pete.

[phormwatch]

Might be worth asking Bruce Schneier if he was consulted about the matter.

[AlexanderHanff]

Originally Posted by phormwatch

Might be worth asking Bruce Schneier if he was consulted about the matter.

He isn't replying to communications.

Alexander Hanff

[warescouse]

Originally Posted by phormwatch

Might be worth asking Bruce Schneier if he was consulted about the matter.

He doesn't seem to reply to emails about Phorm/Webwise .

Bruce Schneier -- Chief Security Technology Officer, BT, and an internationally-renowned author and founder of Counterpane Internet Security; also designer of the popular Blowfish and Twofish encryption algorithms.

Anybody else had replies to correspondence?


Incidental, I have read quite a few papers, articles, quotes and comments from this guy lately and unless his views have changed considerably over the last few months, my opinion is that this Phorm/WebWise relationship with BT may not be sitting comfortably with his beliefs.

[phormwatch]

>Incidental, I have read quiet a few papers, articles, quotes and comments from this guy lately and unless his views have changed considerably over the last few months, my opinion is that this Phorm/WebWise relationship with BT may not be sitting comfortably with his beliefs.

Indeed! That is why I strongly suspect that he has been given orders by BT to keep his mouth shut if he wants to keep his job.

[AlexanderHanff]

Just an update on the PIA for everyone.

I had an interesting 2 hour discussion with Simon Davies on the telephone yesterday (he left the country again this morning for the second part of his UN work and was only back in the UK for 3 days).

I explained to him that I had seen the final PIA via Baroness Miller on Wednesday and he was actually quite taken aback. He explained to me that while there have been some recent drafts they were still waiting for confirmation that it is factually accurate and as such have not officially released a final version to Phorm (although he did state that the final version may not be any different to the current draft).

So it would seem Phorm are pushing a draft document to politicians and claiming it is the final complete version of the document. I will allow you all to draw your own conclusions.

Just a follow up too regarding Baroness Miller, in my discussions with her on Wednesday, as you all know she made it clear that Kent has been basically bad mouthing me to every politician he comes across. Baroness Miller said to me on Wednesday (and this is not a verbatim quote just general context, I didn't record the conversation):

Baroness: "It seems to me all you are asking is that the system be made opt-in as required under the law?"

Me: "Yes exactly, but that needs to be extended to content providers too as under RIPA all parties must give their consent."

Baroness: "Well I don't understand why Phorm think you are being unreasonable, it seems perfectly reasonable to me that you would demand the system be opt-in because that is what is required under law. I don't understand why they don't simply do that."

I then when on to explain that my belief as to their reasoning is that if they use Opt-In it destroys their business plan because in order to reach the revenues they need they need an Opt-Out model to guarantee numbers.

Alexander Hanff

[icsys]

Originally Posted by AlexanderHanff

So it would seem Phorm are pushing a draft document to politicians and claiming it is the final complete version of the document. I will allow you all to draw your own conclusions.

Alexander Hanff

Presumably then, the PIA is favourable to Phorm or they wouldn't be pushing it?
Or are they only pushing the favourable bits.... claiming the fact that it is only a draft?

[AlexanderHanff]

Originally Posted by icsys

Presumably then, the PIA is favourable to Phorm or they wouldn't be pushing it?
Or are they only pushing the favourable bits.... claiming the fact that it is only a draft?

Simon didn't give me any details as to the content and I didn't have the time to read it at the protest (nor was it the correct environment) so I don't know if it is favourable to Phorm or not. I would presume that it is very similar to the original interim PIA (I wouldn't expect it to change a lot) and therefore will mention the anonymising systems as doing more to protect privacy (and I should perhaps change this to Personal Data as opposed to privacy as the two are completely different; but instead I will just add this explanation in the interests of transparency) than current models (such as Google) and their belief that the current model doesn't violate DPA (not the trials, 80/20 Thinking have had no involvement in assessing the covert trials of 2006/2007).

If you recall my discussion with the Earl of Northesk you will remember that in that discussion, the Earl (on the advisory board of 80/20 Thinking) stated he believed the final PIA would have some positive comments in it and some negative and I tend to agree with his feedback on this. I expect that the PIA will make it clear that this system has to be Opt-In to comply with UK and EU law.

Alexander Hanff

[phormwatch]

Latest entity-relationship diagram:

http://img87.imageshack.us/img87/6748/phormumliv8.jpg

Notice the addition of 'Janet Blake' - head of Corporate Social Responsibility. Haven't heard a word from her at all. Anyone else?

[AlexanderHanff]

One thing we all have to remember is the PIA is an ICO recommendation and will likely only cover DPA (and possibly PECR) so I am not expecting to see references to Fraud Act, RIPA, Computer Misuse Act etc. in the PIA.

DPA protects personally identifiable data, not privacy. People who attended the PIA "Town Hall Meeting" will recall that Dr. Richard Clayton made a clear comparison of the two and I believe it may even be in the video of his presentation at that meeting. I say believe because I can't recall if it was in the main presentation he did or in the Q&A panel at the end (which wasn't recorded).

Alexander Hanff

[madslug]

Originally Posted by HaveToBeAnon

5. Bt have said that they will add websites to an exclusion list, provided the webmaster contacts BT and says so, providing proof that he is in fact the webmaster. What about foreign language websites. Anyone know a website owner in, say Hungary. Get them to write to Emma, *in hungarian*, asking to not be profiled. Would be interesting to see what happens! Repeat for as many bizarre languages as possible.

To which, I would like to add: what is meant by exclusion? Will no information about anything to do with the website, not even the URL, go anywhere near any part of the Layer 7 system. What are the technical details of the exclusion? How do new sites get added to the exclusions list? Will this exclusion list availability be made public before the trial. Is there a format for providing the exclusion list? What proof is required - ownership of domains is a matter of public record and the owner and webmaster are not necessarily the same person. What effort has BT made to contact international sites so that they can be included on the omission list?

And, most important, how can websites audit whether or not their content has been used as part of the profile data source?

[AlexanderHanff]

Originally Posted by phormwatch

Latest entity-relationship diagram:

http://img87.imageshack.us/img87/6748/phormumliv8.jpg

Notice the addition of 'Janet Blake' - head of Corporate Social Responsibility. Haven't heard a word from her at all. Anyone else?

I have a big issue with that diagram. Simon Davies has made it very clear to the public and to Phorm that Privacy International is -nothing- to do with this issue. I would appreciate it if you changed the references from PI to 80/20 Thinking. If you have issues with 80/20 Thinking that is fine and you are completely entitled to those opinions (whether I agree with them is irrelevant), however, dragging PI into this is wholly inappropriate in my opinion.

Alexander Hanff

[phormwatch]

Alex-

The existence of an entity or relationship doesn't necessarily imply any wrongdoing. In any case, I've change the diagram so Simon Davies points to 80/20 Thinking. However, Simon Davies still has the attribute of being Director of Privacy International.

Do you think - and do other people agree - that this is fair enough?

http://img232.imageshack.us/img232/107/phormumlqw2.jpg

Privacy International shouldn't need to dragged into this - they should be making a statement to make their position in the matter clear. I am appalled that they have avoided the entire subject and I think it is disgusting that Simon Davies has undertaken a contract with Phorm for financial gain.

I appreciate his comments posted elsewhere that he makes no money from PI but if that's a problem then he should stand down and then he can sell his talents to whomever he choses but until that time he has let everyone down who looked to him for and PI to support freedom and privacy.