Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[OF1975]

Damn I wish had seen those links before I posted my letter to the Computer Crime Unit. I could have included them in the letter. If anyone is gonna send letters to them too please make sure to include the link to the open letter from FIPR to jacqui smith and also the full legal analysis paper too.

[CaptJamieHunter]

Might just let the Shadow Home Secretary know too.

[mark777]

Originally Posted by CaptJamieHunter

Might just let the Shadow Home Secretary know too.

Yep - another data/privacy issue HMG makes a mess of. And a particularly error prone part of HMG at that!

[Tezcatlipoca]

Originally Posted by OldBear

For those who want to check if their MP has signed Don Foster's EDM, they can check the list of signatories here: http://edmi.parliament.uk/EDMi/EDMDe...52&SESSION=891.

I'm pleased to report that my MP's name is on there.

OB

Just checked.

My MP (David Howarth, Lib Dem) isn't on there, so I've just emailed him via www.writetothem.com.

Hopefully he'll sign it, especially as the sponsor is a fellow LD & various big name LDs have signed it. Plus he signed the last EDM I asked him to do.

[jelv]

I've just been reading Richard Clayton's analysis and found:

36. To avoid processing non-web traffic, the Phorm system has a "whitelist" of "User-Agent" identification strings, the type and version text that browsers place into their requests. If an HTTP request does not appear to have been generated by a "well-known" browser, then the request will be ignored.

Does this mean that if in Firefox we used Modify Headers 0.6.4 we could defeat the system? Pretending to be Safari would be a good first step!

[Cobbydaler]

Originally Posted by jelv

I've just been reading Richard Clayton's analysis and found:



Does this mean that if in Firefox we used Modify Headers 0.6.4 we could defeat the system? Pretending to be Safari would be a good first step!

A bit simpler is User Agent Switcher

List of user agent strings (including Safari) here...

[AlexanderHanff]

OK, this is an email I just sent to Mr Bohm with regards to his analysis (which I have now read and thoroughly enjoyed):

Dear Mr Bohm,

It is with great honour that I send you this email and that honour exists due to your diligence in your work relating to the protection of privacy in particular in your function as legal counsel for FIPR and your recent work on the Phorm scandal.

I have just completed the reading of both your letter to the Home Secretary and your legal analysis complimentary to Dr Richard Clayton's technical analysis of the same issues last month. I have the greatest of respect for the effort you have made with these activities and hope that they enable the relevant authorities to finally provide justice to the victims of the illegal BT trials of Phorm in 2006/2007; justice which is long over due. I also feel that you have made a clear analysis regarding the current working model of Phorm's product to the 3 ISPs who have expressed an interest in deploying said technologies and hope that in light of such comprehensive analysis, the relevant authorities can take the necessary steps to ensure that the currently proposed model cannot be deployed without violation of criminal, civil and common law.

Your analysis also gave me a degree of pride in that as a student of Applied Social Science at the University of Cumbria (award granted by Lancaster University) I have for the last 2 months been writing my final year dissertation for my undergraduate degree, focusing on the covert trials carried out by BT in 2006/2007 and attempting to the best of my ability, to analyse the very same legal points your recently published document covers. As a student who has concentrated his undergraduate studies on issues relating to Privacy, Technology, Human Rights and Ethics (specifically regarding consent); I have become increasingly aware and troubled by the path our society is travelling with regards to these very same issues. Therefore, I humbly request that you read the almost completed draft of my dissertation which I have attached to this email and would value any comments or insight you may be able to offer. I have recently decided to continue my studies after graduating this spring to a Master's qualification in Law, where I intend to focus on privacy, technology and related human rights. This is a significant change in my original academic plans where I intended to focus on the broader area of the effects of technology on society from a sociological perspective because I now feel that I can achieve more from working within the system as a legal expert than I can by analysing the situation from the outside in as a sociologist. My decision is grounded in my appreciation for work carried out by yourself and your colleagues as well as respected privacy advocates such as Simon Davies and Privacy International.

One issue does continue to concern me though; the issue of complicity. It worries me that the ISPs and Phorm may be in a position to argue that the customer is complicit with regards to any breaches of relevant laws and statutes should they initiate a web based communication after explicitly opting in to Phorm's services, and that in initiating a communication with a web site, they may be regarded as inciting BT to commit the offences you outline in your analysis. I would sincerely appreciate any feedback you have with regards to this matter as it is my belief that a system which could potentially criminalise 70% of the UK's broadband users (the number of people reported to use the 3 ISPs in question) is a very serious and grave societal issue which needs to be addressed and prevented.

I thank you for your time on these matters and look forward to hearing from you in the near future. In the event that your email service may remove the attached dissertation draft, you can access the document on the web at: http://www.paladine.org.uk/phorm_paper.pdf (please note this is a draft and may have formatting, grammar and spelling errors).

Sincerely,

Alexander Hanff
University of Cumbria

(emphasis added).

I am hoping Nicholas will be able to provide some insight with regards my concerns which I have highlighted in bold in the above copy of the email. I will keep you all posted.

Alexander Hanff

[CaptJamieHunter]

Originally Posted by CaptJamieHunter

Might just let the Shadow Home Secretary know too.

E-mail sent.

[SimonHickling]

The name at the bottom of the BT PR sheet got back to me and was not in a position to answer technical questions, and so asked me to e-mail any queries. Below is the (redacted) e-mail I sent. If BT allow, I shall post the responses.

Hi [redact],

Thanks for your time earlier, and the opportunity to send these questions through.

There are a number of things which concern me and which I'd like a bit of further information on please.

As I said, I contacted the Home Office and copied my MP ([redact]) regarding my concerns and was sent by the MP a copy of "BT Public Affairs Briefing Note: BT and Phorm"

This seems to be (and please correct me if I'm wrong) a standard hand-out to Parliament (based on the picture, top-right).

1. It mentions that Simon Davies from 80/20 Thinking has carried out a Privacy Impact Assessment on Webwise, and I was wondering if documentation of that assessment is available to the public and if it details the process taken and the stakeholders consulted?

2. Whilst the document talks about data protection, it does not mention the method of data gathering. I have read many articles and opinions regarding the technology provided by Phorm (including the report by Richard Clayton) and these suggest that Deep Packet Inspection is involved. Could you clarify the technologies used for data collection please?

3. You state that "Webwise does not scan webmail pages". I have a mail server at home which runs a webmail service to allow me to check my mails when I am away from home. If was to check my webmail from the home of a friend who had not opted out of the Webwise service, how would you ensure that my mail was not scanned? To take this a step further, as I have not agreed to *MY* communications being intercepted by Webwise, how would you ensure that *MY* browsing from my friends computer was not scanned?

4. From the diagram on the Webwise information site, it seems that you must intercept the traffic in order to establish the existence (or otherwise) of a Webwise related cookie (opt-in, opt-out or blocked). Does this initial interception not constitute an illegal interception if the customer has not consented to interception?

5. I am responsible for a number of web sites (1 commercial, 2 login based content sites), and would like to know how Webwise ensures that the password protected areas or private messages between members are not scanned when accessed by a user? Is it possible for me to block Webwise from scanning any of my sites? If so, how? If not, how can you claim to have consent from the sender of the information?

6. During the stated times of your previous trials my late father was a customer of BT Broadband services and used one of the aforementioned sites to keep our family and friends up to date as to the progress of his illness and treatments. I would like to know if this very personal information was scanned by Webwise during the trials.

I shall be posting a copy of this e-mail (with your details redacted) to the cableforum.co.uk thread regarding Webwise and Phorm. Although this is a thread predominantly focusing on the potential for Virgin Media to adopt Phorm technologies, it is read and contributed to by users of many other ISPs, including BT, and by posting these questions you may end up not being asked several times by different members of the forum. If you would not like your reply to be posted to the forum also, please let me know in your reply.

I look forward to your response

[AlexanderHanff]

Just a quick update on Click. I got an email from Dan Simmons part of which I quote below:

The interview will be
broadcast in the UK on 3rd and 4th May - at 1130 both days on BBC News
Channel.

That's BBC News24.

Alexander Hanff

[mark777]

I think the 80/20 video of the London meeting is now pie in the sky.

Regardless of feelings about 80/20, would it be a good idea for people to post key points of their recollections of the parts of the meeting that are missing from the good Captains own record?

Not so many days ago members were agreeing to 'wait for the pro video' regarding these areas, but I don't think it's going to happen. Phorm legal threats perhaps?

[AlexanderHanff]

Phorm don't have any grounds for legal threats as the meeting was open to the public and therefore the video can legitimately be released to the public domain. Furthermore they were fully aware that the meeting was being recorded officially and that members of the public had been invited to bring video recording equipment with them. There was even a footnote on the Event announcement on 80/20T's web site reiterating that there would be video recording equipment present at the meeting.

I trust Simon to be good for his word with regards the official video, so I will continue to wait for it's release.

Alexander Hanff

[Kursk]

Originally Posted by AlexanderHanff

Phorm don't have any grounds for legal threats as the meeting was open to the public and therefore the video can legitimately be released to the public domain.

I trust Simon to be good for his word with regards the official video, so I will continue to wait for it's release.

Alexander Hanff

At the risk of being throttled (again), any idea why we've not heard from Simon of late? Contrary to opinion, I rather enjoyed his frank contributions to this thread.

[Portly_Giraffe]

Originally Posted by Hank
(quoted from Attorney General Office's email response) "The Attorney General is principal legal advisor to government and as such is unable to offer legal aid or assistance to individuals, this office does not perform a investigatory function and in regards to your request we are unable to assist."

I have heard from Nicholas Bohm who tells me that formal responsibility for RIPA lies with the DPP who therefore might be a better port of call.

I will have a look at this tomorrow, but in the mean time here's their contact link - http://www.cps.gov.uk/contact/index.html

[AlexanderHanff]

Originally Posted by Kursk

At the risk of being throttled (again), any idea why we've not heard from Simon of late? Contrary to opinion, I rather enjoyed his frank contributions to this thread.

All I know is what I picked up last Tuesday after the meeting. Gus mentioned they were off to Italy the following day but he didn't indicate how long for. I can only assume that they are still out of the country on business.

Let's not forget post production takes time. Even the BBC won't be airing the Click show recorded yesterday until 4th May which is 11 days away and isn't anything like as much video footage shot at the public meeting. It has only been 8 days since the public meeting and it is fair to assume that the post production work required is significant especially when you consider that the venue was not designed to be used as a film studio.

Alexander Hanff