Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Bonglet]

Must be one of the rebels , i think someone in labour has been secretly keeping this hush hush it will all come out in the end i can see , might be some big phorm story this week too for some reason.

[Florence]

I have had a reply from Amozon.

Dear Customer

Thank you for writing to Amazon.co.uk with your enquiry.

At this time, all graphics on our site are proprietary, and we ask
that you do not make use of any information from our website unless
Amazon.co.uk grants you official permission to make use of them.

We therefore require you to forward the details listed below so that
our legal team may consider your request:

* if request is from a company, the registered company name, full
address and contact details (in the case of an individual we require
the full address and occupation)

* a printed copy or mock-up demonstrating use of the proposed reproduction

I would say Phorm are not in a position to use this data from Amazon..

[Portly_Giraffe]

Florence and I have now completed our exchange with Simon Watkin and Andrew Knight at the Home Office and this is what we have concluded from that. Please note that we have focussed solely on the application of The Regulation of Investigatory Powers Act (RIPA) to targeted online advertising.

Overall, what is, and always has been, the primary issue is for ISPs and their partners to assure themselves that they are complying with relevant legislation in providing and offering a targeted online advertising service and to be clear to the users what is being offered, the basis of the offer and how the service operates.

1. RIPA provides a statutory framework for regulating the conduct of public authorities which may interfere with individuals’ right to respect for their private and family life under Article 8 of the European Convention of Human Rights.

2. RIPA provides for an offence of unlawful interception which any person, absolutely anyone, is able to commit. It also provides for lawful interception of communications.

3. The Home Office (outside of its immigration functions) is not an investigatory body. It is the role of the police to investigate allegations of unlawful interception. The Home Office cannot make the police investigate people’s allegations.

4. It is the unlawful interception of data which is the offence under RIPA (unless that interception has lawful authority), not how the interceptor uses or intends to use that data.

5. To the extent that deep packet inspection amounts to interception of communications (as defined in RIPA), deep packet inspection can be lawful by virtue of section 3(3) of RIPA, for example to identify and give priority to packets of voice data, or to packets of streaming media and other legitimate traffic management issues.

6. For a prosecution against BT over the 2006 and 2007 trails to have a chance of success, then at least all of the following would have to be proved:
(a) That there had been conduct which amounted to interception of communications as defined in RIPA.
(b) That the data intercepted was not simply traffic data whose interception would be lawful by virtue of section 2(5) of RIPA.
(c) That there was no lawful authority to intercept the data as defined in section 3(3) of RIPA or any other lawful authority.

7. The Home Office’s note dated January 2008 considered the application of targeted online advertising services in relation only to open browsing, not to anything using HTTPS or requiring authentication.

8. Even where an ISP’s end user has opted-in to an advertising service, depending on how that service is offered a question may also arise as to whether the ISP and the targeted online advertising provider has reasonable grounds for believing the host or publisher of a web page consents to the interception for the purposes of section 3(1)(a) or 3(1)(b). It may be argued that section 3(1)(a) or 3(1) (b) is satisfied in such a case because the host or publisher who makes a web page readily available for download (that is, not using SSL or https) from a server impliedly consents to those pages being downloaded.

9. Targeted online advertising undertaken with the highest regard to the respect for the privacy of ISPs’ users and the protection of their personal data, and with the ISPs’ users consent, expressed appropriately, is a legitimate business activity.

10. An individual cannot consent to something they don’t know about and haven’t been told about or had the opportunity to know about.

[Kursk]

Originally Posted by dav

Easy, Kursk. Turn it down a bit.
I'll try to explain what was being proposed and why....

It wasn't to exclude anyone from the general discussion, but was to provide a PhormPR-free way of presenting member's concerns to the Earl of Northesk through Alexander. As he, no doubt, would need clarification and discussion with others the suggestion was to try and find some way of doing this with others who wanted to participate and get involved with this process.
I tell you what...forget it. The next time I'm in a position to take a penalty kick, I'll just tell the goalie where I'm going to put it.

Apologies for the knee-jerk but I had only limited time. I suppose we'd have to hope the goalie doesn't still save the penalty.

Look, I'm all for a more organised approach (it saves chasing down the wrong road for weeks) but let's not pin too many hopes on any single event and keep our options open eh?

[Portly_Giraffe]

Here is my commentary based on my further entirely personal interpretation of the exchange with the Home Office. Before I start I should say I found Simon and Andrew very helpful and responsive, and keen to say as much as they reasonably could given the situation. In my view they have said all they can and need to say on these points, and we should now move the campaign on from them.

The commentary below sets out my initial thoughts. They are entirely my opinions, and others involved in the exchange may have differing views.

Points 1 and 2 confirm that RIPA applies to anyone, which could include ISPs and their suppliers.

Point 3 says that we should not be chasing the Home Office for enforcement of RIPA following the BT Trials in 2006 and 2007. I think it is the Attorney General we should be focusing on. We might want to write polite letters to her to ask why, when there is a widespread conviction that the law has been broken, no action appears to have been taken.

Lady Scotland of Asthal
20 Victoria Street
London SW1H 0NF

Point 4 undermines BT’s “it was only a technical trial” argument. It doesn’t matter what you do or intend to do with the data, it is the interception itself which is the offence under RIPA.

Point 5 was intended to cover the position of opted-out users of a Phorm ISP. Under RIPA it is not certain either way whether intercepting traffic to determine whether there is consent to intercept it is illegal. BT could argue that it is lawful because the interception is part of a traffic management process (determining whether or not to divert the traffic for Phorm processing). We could argue that operating a Phorm/Webwise service is a commercial decision of theirs and that without it the need for such traffic management would not arise. Any thoughts on this from Alexander would be useful. If Phorm goes ahead I expect this will be argued in Court sooner or later.

In my view, Point 6 says that the CPS has the basis for a case against BT under RIPA, but there will be other aspects of the situation which apply and will have to be argued.

Point 7 confirms that the Home Office has said nothing about the interception of secure browsing in their comments on RIPA. I do not think we need to take this further right now as I do not think there would be any question that the interception of secure browsing is illegal under several laws.

Point 8 says that it is not certain either way under RIPA whether website owners’ consent to interception of open web traffic can be taken as implied. The key phrase here is “it may be argued”. Another interesting point is that law distinguishes the inbound message from the outbound message (RIPA 3(1)(b) as opposed to 3(1)(a)). And other laws may also make the use of the intercepted data illegal. Again, any thoughts on this from Alexander would be useful. And again, if Phorm goes ahead I expect this will be argued in Court sooner or later.

Point 9 reaffirms that if there are adequate safeguards in place (informed opt-in, privacy) then targeted online advertising is a legitimate activity for an ISP under RIPA. We can argue this case on many levels: from a legal perspective is opt-in really informed and are privacy safeguards sufficient? And which other laws may apply? From a practical perspective is the equipment used safe from criminals? From a political perspective, should ISPs be allowed to operate this kind of service at all?

Point 10 emphasises that the decision to opt in must be informed. We should keep track of the trial and any other proposed Phorm activity: if the fact that the service involves the interception, reading and processing of almost all the user’s web traffic is not made as clear as the purported benefits, then in my opinion there would be a case that any subsequent interceptions would be illegal under RIPA.

[roadrunner69]

Originally Posted by Portly_Giraffe

Point 8 says that it is not certain either way under RIPA whether website owners’ consent to interception of open web traffic can be taken as implied. The key phrase here is “it may be argued�. Another interesting point is that law distinguishes the inbound message from the outbound message (RIPA 3(1)(b) as opposed to 3(1)(a)). And other laws may also make the use of the intercepted data illegal. Again, any thoughts on this from Alexander would be useful. And again, if Phorm goes ahead I expect this will be argued in Court sooner or later.

"5. Licence for website access

Amazon.co.uk grants you a limited licence to access and make personal use of this website, but not to download (other than page caching) or modify it, or any portion of it, except with express written consent of Amazon.co.uk. This licence does not include any resale or commercial use of this website or its contents; any collection and use of any product listings, descriptions, or prices; any derivative use of this website or its contents; any downloading or copying of account information for the benefit of another merchant; or any use of data mining, robots, or similar data gathering and extraction tools.

This website or any portion of this website may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without our express written consent."



I don't think that “it may be argued� that amazon give any consent for interception.
Taken across the whole WWW this would seem to be a major stumbling block for phorm.

[CWH]

Would it be at all possible to monitor in any way, the Layer 7 interception?
I was wondering if,when the BT trials start, whether it would be beneficial for a few technically knowledgeable participants to be able to log just what happens and how. It could help confirm just what BT & Phorm will be doing.

Colin

As a new forum member, I have no concerns with some of the more informed members communicating between themselves regarding Phorm and the responses.

[Portly_Giraffe]

Originally Posted by roadrunner69

"This website or any portion of this website may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without our express written consent."

I don't think that “it may be argued” that amazon give any consent for interception.

Agreed, but the main issue here may not be the interception but the use of the data. I actually used the Amazon quote above in my correspondence with the Home Office. I personally think Amazon would have a case to take legal action under RIPA, but they might not choose a criminal prosecution under RIPA as their first option as they will have so many other avenues.

[JackSon]

Originally Posted by roadrunner69

"5. Licence for website access

Amazon.co.uk grants you a limited licence to access and make personal use of this website, but not to download (other than page caching) or modify it, or any portion of it, except with express written consent of Amazon.co.uk. This licence does not include any resale or commercial use of this website or its contents; any collection and use of any product listings, descriptions, or prices; any derivative use of this website or its contents; any downloading or copying of account information for the benefit of another merchant; or any use of data mining, robots, or similar data gathering and extraction tools.

This website or any portion of this website may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without our express written consent."



I don't think that “it may be argued” that amazon give any consent for interception.
Taken across the whole WWW this would seem to be a major stumbling block for phorm.

I think Amazon definitely have the Phorm system covered in ther T&C's, I've emboldened the part of the statement which I feel is the real ball buster for Webwise.

---------- Post added at 18:28 ---------- Previous post was at 18:26 ----------

Am I allowed to plagarise that part of Amazon's T&C's for that of my own website?

[Florence]

Originally Posted by roadrunner69

"5. Licence for website access

Amazon.co.uk grants you a limited licence to access and make personal use of this website, but not to download (other than page caching) or modify it, or any portion of it, except with express written consent of Amazon.co.uk. This licence does not include any resale or commercial use of this website or its contents; any collection and use of any product listings, descriptions, or prices; any derivative use of this website or its contents; any downloading or copying of account information for the benefit of another merchant; or any use of data mining, robots, or similar data gathering and extraction tools.

This website or any portion of this website may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without our express written consent."



I don't think that “it may be argued” that amazon give any consent for interception.
Taken across the whole WWW this would seem to be a major stumbling block for phorm.

Already email Amazon to get them into the battle for our right to not be phormed....

[OldBear]

Originally Posted by roadrunner69

"5. Licence for website access

Amazon.co.uk grants you a limited licence to access and make personal use of this website, but not to download (other than page caching) or modify it, or any portion of it, except with express written consent of Amazon.co.uk. This licence does not include any resale or commercial use of this website or its contents; any collection and use of any product listings, descriptions, or prices; any derivative use of this website or its contents; any downloading or copying of account information for the benefit of another merchant; or any use of data mining, robots, or similar data gathering and extraction tools.

This website or any portion of this website may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without our express written consent."



I don't think that “it may be argued� that amazon give any consent for interception.
Taken across the whole WWW this would seem to be a major stumbling block for phorm.

I build websites, (mainly for charitable organisations and others involved in working with disabled persons), and when I'm asked about T&Cs I point all my clients to Amazon's site to use as a guide. Simple reason: because they have been written by a qualified lawyer/solicitor and are utterly brilliant.

I applaud Florence for using Amazon's site as a perfect example with respect to how to tell Phorm/Webwise to keep off.

"This website or any portion of this website may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without our express written consent."

roadrunner69: You've picked out exactly the one part of Amazon's T&Cs I advise all my clients to include, good call.

OB

[Deko]

Also the www.bbc.co.uk

4. All copyright, trade marks, design rights, patents and other intellectual property rights (registered and unregistered) in and on bbc.co.uk and all content (including all applications) located on the site shall remain vested in the BBC or its licensors (which includes other users). You may not copy, reproduce, republish, disassemble, decompile, reverse engineer, download, post, broadcast, transmit, make available to the public, or otherwise use bbc.co.uk content in any way except for your own personal, non-commercial use. You also agree not to adapt, alter or create a derivative work from any bbc.co.uk content except for your own personal, non-commercial use. Any other use of bbc.co.uk content requires the prior written permission of the BBC.

---------- Post added at 18:42 ---------- Previous post was at 18:40 ----------

Also www.sky.com

4. Intellectual Property
4.1 All copyright, trade marks and all other intellectual property rights in all material or content supplied as part of the Sky Site shall remain at all times vested in Us or Our licensors. You are permitted to use this material or content only as expressly authorised in writing by Us or Our licensors. You will not, and You will not assist or facilitate any third party to, copy, reproduce, transmit, distribute, frame, commercially exploit or create derivative works of such material or content.



how big can this list get. are we barking up a tree with no CAT ????

[Florence]

So on a legal side if a customer of VM was phormed (with or without informed consent) visited those sites and Phorm categorised the page logged and profiled the customer. This is where Pandora’s Box comes in as the person with or without Knowledge has just broken the rule on Amazon and now opened themselves up for possible prosecution.

I think I am becoming more legal minded in my thinking I need help..

Maybe Alexander could tell me if I am right or wrong the person that would be prosecuted would be the customer not the Phorm management in the case like Amazon?

[rogerdraig]

any one got a copy of Blackstone's police manuals out there was reading last years and on one of the questions to do with RIPA offences

the answer of when the offence was committed by a person who was intending to access information covered by this law was that he committed the offence as soon as he switched on the computer that would enable him to do so

was wondering if this years was the same and if it could be of help in the reporting of this to the police whom the Home office say are suposed to be the ones to investigate such matters

[ceedee]

Great work, Portly_Giraffe and Florence!
Many thanks for your time and effort.