Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Rchivist]

Originally Posted by serial

I'm sorry if I'm being overly cynical, but I'm looking at my choice of hats and have selected the tinfoil one.

8020 Advisory group contains: Ray Stanton, Global Head of Business Continuity, Security & Governance, BT plc

So, Phorm, pioneered by BT plc have paid an auditing company to green light its system when that company also has a high level BT plc employee as an advisor.

Anyone else see a major problem here?

An advisory group is exactly that - advisory - and hence has a variety of people on it, with a variety of views, and backgrounds. So I would expect to see privacy focussed people, and even people from the marketing industry - 80/20 should be seeking advice from "opponents" as well as "friends".

It worries me far more that the Phorm team of executives includes people like CTO Stratis Scleparis, who was CTO at BT at a critical time in the development of this BT/Phorm relationship. CTO's don't advise, they make decisions - but who for? Their current employers or their future employers or their past employers?

[Florence]

With the change in the Terms and conditions VM have implemented would mean the information that they hadn't agreed or signed to use Phorm were incorrect.

taken from http://www.ispreview.co.uk/news/EkpAZEVFkuzmMedgDI.html

Virgin Media has signed a preliminary agreement with Phorm to understand in more detail how this technology works but we have not yet decided if it will be introduced. Webwise is a technically complex application which could be implemented in a number of different ways and it will be some months before we can confirm if the service will be made available to our customers and if so, how and when it would be deployed. Customer concerns around privacy and data protection are (and will remain) an important element of this preliminary evaluation and we will not roll out Webwise unless we are completely satisfied that in our view it complies with applicable data protection and privacy regulations.

It may be that, as part of the evaluation process, we want to test the technology among some of our customers but we are not currently doing so and we will not conduct any such tests without individual customers' prior consent. Moreover, should Virgin Media eventually decide to roll out Webwise, customers will not be forced to use the system.

Now we start to think about trust again if our ISP is giving out information like that to the news media then quietly changing Terms and Conditions..........

[Rchivist]

Originally Posted by pseudonym

I think a bigger problem is websites will be able to read your webwise tracking cookie by embedding some https content on their page. Phorm can't strip the cookie from encrypted streams, so the website will get to see your unique user id. If the website doesn't want to pay for a certificate to read your UID, it should also work if they use a port other than 80.

Maybe during the Webwise trials there will be those webmasters who are able to demonstrate the various security problems associated with the Phorm cookies, by intercepting Webwise cookies, associating them with visitor IP addresses, and linking them to a smattering of information that the
website already holds on the visitor, and diverting the visitor to a page that explains what they have been able to do and encourages the visitor to approach their ISP and complain. Something like (with exaggeration just for humour you understand..)

"Welcome. You appear to be using Webwise. I've got a note of your IP address and your Phorm UID and I note that you are interested in **** and *** on my site. It seems you are also a forum member here and from your IP address I think you are Fred Bloggs - how is your sister Mabel? - are her ****'s improving? - keep inserting the cream with the applicator. I could now sell all this information for £*** but I'm a nice guy and I won't. In fact I've already deleted it. But it really is this easy to hack the Webwise system and I think you should tell your ISP. And switch off Webwise. The next person to do this to you might live abroad somewhere like **** or **** and they could well be less honest than me."

Of course I couldn't condone such action...but I expect to see a variety of reports about successful hacking of the system once the trials start, if they ever do.

If a website does this - I wonder if Phorm would claim that the webmaster was acting illegally?

From the tools I've already got from Dephormation, I could probably do something like this with a little work and advice, if I felt like paying for an https certificate. As a charity site I don't think I can justify it, but I hope some anti-Phorm campaigners can come up with something similar before the BT Webwise trials start. After all - trials are for experimenting!

Originally Posted by R Jones

Maybe during the Webwise trials there will be those webmasters who are able to demonstrate the various security problems associated with the Phorm cookies, by intercepting Webwise cookies, associating them with visitor IP addresses, and linking them to a smattering of information that the
website already holds on the visitor, and diverting the visitor to a page that explains what they have been able to do and encourages the visitor to approach their ISP and complain.

CF, for example? (...and I'm not convinced you would need an SSL certificate)

[AlexanderHanff]

If the terms and conditions have changed then of course you all now have a chance to cancel your contract without penalty because you don't agree with the new terms. Nothing says "We don't want this!" more clearly than mass migration.

Alexander Hanff

[Florence]

Originally Posted by Bonglet

I see virgin media has already changed there T&C's to suit phorm

G Your details and how we look after them

2. By having the services we provide installed in your home and/or by using them you are giving us your consent to use your personal information together with other information for the purposes of providing you with our services, service information and updates, administration, credit scoring, customer services, training, tracking use of our services (including processing call, usage, billing, viewing and interactive data), profiling your usage and purchasing preferences for so long as you are a customer and for as long as is necessary for these specified purposes after you terminate your services. We may occasionally use third parties to process your personal information in the ways outlined above. These third parties are permitted to use the data only in accordance with our instructions.

Pity vm dosent say what there instructions are and if they ever leave the country .
All this data to share with phorm yay (not) starting to get really peed off with events and people.

To answer this in laymans terms making it easier for some to understand what they are agreeing with.

1. They say Phorm will stop the phishing by protecting you. Your browsers already have this technology to protect you and do without profiling you. Well Phorm will do this by first Phishing your connection..

When you get an email pretending to be your bank they have a websit that looks just like your banks website but you are on someone elses server be warned this is exactly what Phorm will do to every page you visit pretend to be that website to place a false cookie on your computer...

2. The get scripts are very easily changed and one simple line addition can make phorm harvest your IP and add this to your Phorm number, or the name your computer uses even the name, address that is stored on your computer.

Would you really like to entrust this power to a company already well known for its activities as a rootkit/spyware/adware company.

[AlexanderHanff]

Maybe we should start http://www.leavevirginnow.com and explain what the new terms mean and how it effects people's rights. Also a history of 121Phormedia all the articles about Phorm, the technical analysis by Dr Clayton etc etc etc.

Alexander Hanff

[James_Firth]

Originally Posted by AlexanderHanff

If the terms and conditions have changed then of course you all now have a chance to cancel your contract without penalty because you don't agree with the new terms. Nothing says "We don't want this!" more clearly than mass migration.

Alexander Hanff

And don't be bullied by misinformation from customer support teams who often unfair clauses in the Ts & Cs that seem to give you no choice.

Typical clauses are "if you do not agree to this change you have x days to respond". No you don't. No court would see your lack of action to be taken as implicit consent. You may want time to seek legal advice. The communication may not have reached you (BT seem to email me via an account they chose to set up that I never read, despite me saying my email address was x@y.com).

Other arguments the ISP may make is that the changes don't significantly alter your arrangement and you as a signatory will not suffer penalty from the new changes. This could be harder to argue about, but I doubt in the current climate of data loss and identity theft that you couldn't successfully argue your case.

Don't be bullied. IANAL.

[Portly_Giraffe]

Originally Posted by AlexanderHanff

Also a history of 121Phormedia all the articles about Phorm, the technical analysis by Dr Clayton etc etc etc.

There is a list of relevant source links at http://www.inphormationdesk.org/attributions.htm

[flowrebmit]

How many customers would have to leave VM for a mass exodus to be noticed?

From my perspective, it doesn't seem to me that VM are very interested in its current customer base, the VM business seems to be hell bent on acquiring new customers at any cost e.g. half-price packages for 12 months.

Changing subject, a couple of points about the BBC Click interview:-

Viewing this without the benefit of this forum, I would have wondered why you were asked to shake hands and why the presenter thought it had been a contentious interview, the way the BBC Click edited the stream it seemed very bland.

I think that using a commercial sites, e.g. Amazon, could confuse the message that Phorm is bad, because commerical sites already tend to profile their customers and suggestions from Amazon can be pretty good - so if I wasn't aware of Phorm but knew about Amazon, I'd probably think more profiling could be a good thing.

[AlexanderHanff]

Originally Posted by Portly_Giraffe

There is a list of relevant source links at http://www.inphormationdesk.org/attributions.htm

Yeah I was thinking maybe using your site as a template would be a good idea, but obviously VM specific.

Alexander Hanff

---------- Post added at 14:33 ---------- Previous post was at 14:12 ----------

Originally Posted by James_Firth

And don't be bullied by misinformation from customer support teams who often unfair clauses in the Ts & Cs that seem to give you no choice.

Typical clauses are "if you do not agree to this change you have x days to respond". No you don't. No court would see your lack of action to be taken as implicit consent. You may want time to seek legal advice. The communication may not have reached you (BT seem to email me via an account they chose to set up that I never read, despite me saying my email address was x@y.com).

Other arguments the ISP may make is that the changes don't significantly alter your arrangement and you as a signatory will not suffer penalty from the new changes. This could be harder to argue about, but I doubt in the current climate of data loss and identity theft that you couldn't successfully argue your case.

Don't be bullied. IANAL.

I think it is safe to say that a change which effects your fundamental human rights and also asks you to wave your rights under criminal law would be classed as a material change in the contract terms and be valid cause to terminate without penalty. And believe me, the last thing VM will want to do is force this issue into court as the resulting media coverage would just alert more people to the change in terms and cause yet another scandal for VM; so they are likely to release you from your contract with limited umming and arring.

Alexander Hanff

[80/20Thinking]

Originally Posted by serial

I'm sorry if I'm being overly cynical, but I'm looking at my choice of hats and have selected the tinfoil one.

8020 Advisory group contains: Ray Stanton, Global Head of Business Continuity, Security & Governance, BT plc

So, Phorm, pioneered by BT plc have paid an auditing company to green light its system when that company also has a high level BT plc employee as an advisor.

Anyone else see a major problem here?

This point has been raised before, so I'll clarify the situation.

In my Privacy International capacity, I have for some years known and worked with each member of the 80/20 advisory board, and I have a high regard for every one of them.

I knew Ray well before his BT incarnation and even before his UNISYS days, and regard him as a man of enormous energy and intellect who always believed in following an ethical compass.

The vast majority of the advisory board, including Ray, joined 80/20 weeks before I had even heard of Phorm.

I wouldn't accuse you of being a tinfoil hat brigade member, but please do understand that in our view the privacy world is bigger than Phorm, bigger than online targeted advertising and broader than the Web. We certainly don't choose our AB members to suit a small contract involving a tiny part of the global privacy spectrum.

Simon

[socnsum1]

Earlier on this week I emailed Virgin Media Customer Services and asked if PC Guard software that they supply would detect spyware such as Phorm, Webwise and OIX. This is the reply that I got from one of their agents on Friday 2 May 2008.

Hi
**** EMAIL REF: ******

Thanks for getting in touch with the Virgin Media Support team.

Virgin Media has signed a preliminary agreement with Phorm to understand
in more detail how this technology works but we have not yet decided if
it will be introduced. Webwise is a technically complex application
which could be implemented in a number of different ways and it will be
some months before we can confirm if the service will be made available
to our customers and if so, how and when it would be deployed. Customer
concerns around privacy and data protection are (and will remain) an
important element of this preliminary evalaution and we will not roll
out Webwise unless we are completely satisifed that in our view it
complies with applicable data protection and privacy regulations.

It may be that, as part of the evaluation process, we want to test the
technology among some of our customers but we are not currently doing so
and we will not conduct any such tests without individual customers'
prior consent. Moreover, should Virgin Media eventually decide to roll
out Webwise, customers will not be forced to use the system.

In the meantime, we'll continue to communicate our intentions openly and
transparently. If we go ahead with deployment, we will let all our
customers know before rolling out the Webwise solution and will clearly
explain how the system works and what it means for them.

If there's anything else we can help with, please let us know.

Kind regards,
***** ********
Econtact Support Team
Virgin Media
**** EMAIL REF:******

[Florence]

Originally Posted by 80/20Thinking

This point has been raised before, so I'll clarify the situation.

In my Privacy International capacity, I have for some years known and worked with each member of the 80/20 advisory board, and I have a high regard for every one of them.

I knew Ray well before his BT incarnation and even before his UNISYS days, and regard him as a man of enormous energy and intellect who always believed in following an ethical compass.

The vast majority of the advisory board, including Ray, joined 80/20 weeks before I had even heard of Phorm.

I wouldn't accuse you of being a tinfoil hat brigade member, but please do understand that in our view the privacy world is bigger than Phorm, bigger than online targeted advertising and broader than the Web. We certainly don't choose our AB members to suit a small contract involving a tiny part of the global privacy spectrum.

Simon

We do seem to be at the mercy of 80/20 since we already know from previous posts that Phorm will use selective extracts to make the system look good. It only takes one bad apple to ruin the load and in this case the bad apple is at the head. The main problem is this bad apple is very good at sales talk and those who only look for £££ do not see the undelying ajenda.

I think the local elections might have been a warning shot to the government and until there is a court case I would say Phorm shouldn't be deployed as any ISP that does could then leave themselves open to prosocution..

The management of Phorm are much wiser than the managment of the ISPs since phorm only incite the crime the ISP actually commits it.

[Frank Rizzo]

Originally Posted by 80/20Thinking

The vast majority of the advisory board, including Ray, joined 80/20 weeks before I had even heard of Phorm.

Did Ray know of Phorm before he joined 80/20?