Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Bonglet]

It would be better if 80/20 finished the pia and all dealings with phorm then do the working group for the other, or this could be looked upon as another phorm stunt by many people.

[Dephormation]

Originally Posted by Bonglet

It would be better if 80/20 finished the pia and all dealings with phorm then do the working group for the other, or this could be looked upon as another phorm stunt by many people.

I'm one of those people.

You can't take money from people who have a vested interest in the outcome of an EU law, and pretend you're acting independently.

80/20 should NOT be managing that working party. And if they're contributing, they should declare a conflict of interest.

[declanh]

just a thought ....

from 80/20s privacy policy

http://www.8020thinking.com/ethics.html#3

Privacy Policy

80/20 Thinking Ltd believes that individuals have the right to control the use of their personal information, and that your privacy must be respected. We strictly limit the processing of your personal information, and work only with other organizations who do the same.
Personal information that you provide to 80/20 Thinking Ltd will be used only for the service you have requested.
80/20 Thinking Ltd does not sell, rent or lease personal data. We do not purchase such data from other sources.

Any subpoena or attempts by government agencies or private sector organizations to gain access to any information that you give us will be vigorously challenged.

"
Emphasis and colour are mine...
Does this mean that phorm cant profile content provided to 80/20 via say this page
http://www.8020thinking.com/contact.html
which would almost definitely would include private and personal comms.

[Rchivist]

Originally Posted by declanh

just a thought ....

from 80/20s privacy policy

http://www.8020thinking.com/ethics.html#3

Privacy Policy

80/20 Thinking Ltd believes that individuals have the right to control the use of their personal information, and that your privacy must be respected. We strictly limit the processing of your personal information, and work only with other organizations who do the same.
Personal information that you provide to 80/20 Thinking Ltd will be used only for the service you have requested.
80/20 Thinking Ltd does not sell, rent or lease personal data. We do not purchase such data from other sources.

Any subpoena or attempts by government agencies or private sector organizations to gain access to any information that you give us will be vigorously challenged.

"
Emphasis and colour are mine...
Does this mean that phorm cant profile content provided to 80/20 via say this page
http://www.8020thinking.com/contact.html
which would almost definitely would include private and personal comms.

Phorm/Webwise/121Media claim that they don't collect information from forms. BT have also said this about BT Webwise.

[Dephormation]

Originally Posted by R Jones

Phorm/Webwise/121Media claim that they don't collect information from forms. BT have also said this about BT Webwise.

Except search engine forms.

I'm reminded of the marriage scene in Flash Gordon, where Emperor Ming marries Dale.

Zogi, the High Priest: Do you, Ming the Merciless, Ruler of the Universe, take this web user to be your valued customer of the hour?
The Emperor Ming: Of the hour, yes.
Zogi, the High Priest: Do you promise to use her as you will?
The Emperor Ming: Certainly!
Zogi, the High Priest: Not to harvest data from her web forms and search requests?
[Ming glares at Zogi]
Zogi, the High Priest: Uh, until such time as you see commercial value in doing so.
The Emperor Ming: I do.
Trusted Customer: Did I opt in to this?

[Rchivist]

Originally Posted by Dephormation

Except search engine forms.

Quotes from BT Webwise FAQ on Beta forums

I'm interested in this because it was a question I kept pestering BT with and eventually it turned up in the FAQ - if they didn't get info from forms how did they get the info from a google search box?

Here's how it turned out in the published BT Webwise FAQ (version on Beta forums, posted 2/4/08, and wrongly dated as revised 2/4/07)

33. Can the service access private e-mails, webmails and other personal identifying information I enter into web forms?

BT Webwise does not scan webmail pages. Secure pages like banking websites, and web forms such as online registration or sign-up forms are also not scanned. No personal information, often contained in form fields, is therefore ever used by the system.

When analysing in-page keywords, only repeated information is registered. The top-10 most frequent keywords are considered, having first ignored numbers, email addresses, names. Secondly this 'data digest' is only used instantaneously to match against advertiser channels and is then deleted immediately and permanently. Raw data is not stored and therefore cannot be lost. The system only retains the advertiser categories that were matched against a random number, which by definition cannot include your data.

34. If I type a postal address into a form, is that data passed on by BT to Phorm or one of their partners?

No. Not only are online forms ignored completely, the system does not collect any personally- identifiable information, there is nothing to pass on to anybody. All processing analysis is done instantaneously and on BT's controlled equipment

35. snipped

36. If Phorm/Webwise doesn't capture form data, how does it collect search engine queries?

All search keywords become part of the request your browser sends to the search engine. Webwise looks at the http request to understand what search keywords were used.

But I enjoyed the bit about Ming the merciless.

[AlexanderHanff]

Oh so this is not personally identifiable?

http://www.google.co.uk/search?hl=en...e+Search&meta=

My name is not in the url request at all....oh hang on it is...

Furthermore, as was proved with the AOL search data, people can be identified from the things they search for even if they don't enter any personal information in their search terms.

So basically more BT BS

Alexander Hanff

[OldBear]

Originally Posted by AlexanderHanff

<snip>I knew about it some time ago but I was asked to keep it quiet as they wanted to announce it at the launch party on Tuesday.

Interesting comment, Alex. Asked to keep it quiet by who?

<snip>This -includes- Phorm, Google, MS, Yahoo, BT, AOL and every other big player in the industry.

Since when were Phorm a 'big player'?

I agree with the others who say that having both PI and 80/20 Thinking involved in any enquiry/working group suggests a huge conflict of interest.

OB

[icsys]

Originally Posted by OldBear

I agree with the others who say that having both PI and 80/20 Thinking involved in any enquiry/working group suggests a huge conflict of interest.

OB

A huge conflict of interest!
Unfortunately it's business and, it would seem, they are only in it for the money.
PI are non-profit 80/20 are not.

I'm not saying 80/20 aren't doing a good job, but surely they can't be on both sides of the fence.

[AlexanderHanff]

Originally Posted by OldBear

Interesting comment, Alex. Asked to keep it quiet by who?

That is irrelevant. If someone tells me something in confidence it stays between myself and them. There is nothing nefarious about asking someone not to leak information which is due to be publicly announced at an event in the future.

If people felt they couldn't trust me to discuss things "off the record" then I wouldn't have been able to get half of the information I have been given over the past couple of months.

The news about the International Working Group was mentioned during casual conversation not an official email/interview etc. If you were having a conversation with me and said something you wanted to keep between ourselves and I suddenly posted it all over the web, how would you feel?

It is no different to me having advanced notice of the Investors Chronicle article or the upcoming Economist article.

Now I have said this before, I won't respond to attacks against 80/20; my battle is with Phorm and anyone else who wants to use similar technology which contravenes our rights under law, not Simon Davies or anyone else at 80/20 Thinking. So I will say no more on this matter and respectfully request we get back to the matter at hand - Phorm.

Alexander Hanff

[Dephormation]

Originally Posted by R Jones

34. If I type a postal address into a form, is that data passed on by BT to Phorm or one of their partners?

No. Not only are online forms ignored completely, the system does not collect any personally- identifiable information, there is nothing to pass on to anybody. All processing analysis is done instantaneously and on BT's controlled equipment

A more truthful answer would have said;

We gather data from forms which use http get requests, but ignore http posts. The decision is completely arbitrary, but allows us to claim the right to profile your search requests. Typically, this distinction will not be obvious to you (if at all) as a consumer until after you have pressed the submit button on a form. At which point it will be too late to change your mind.

How on earth are these pillocks still in business. Regulators need to pull the plug on this nonsense.

[Rchivist]

Originally Posted by AlexanderHanff

Oh so this is not personally identifiable?

http://www.google.co.uk/search?hl=en...e+Search&meta=

My name is not in the url request at all....oh hang on it is...

Furthermore, as was proved with the AOL search data, people can be identified from the things they search for even if they don't enter any personal information in their search terms.

So basically more BT BS

Alexander Hanff

But Alex - your name is in that search string because you (or anyone else searching for "Hanff Phorm" put it there.) I can't quite see how it leads to an identification of the person making making the search, or the fact that a personal name got put in a search box leads to an argument against Phorm. (Although of course your google profile now includes an interest in Phorm matched against your Google cookie unless you delete the cookie and change your IP address)

Or have I misunderstood what you said?

I completely agree with you that it is a fairly trivial matter for anyone with a website to link the Phorm UID of a Webwise opted-in visitor, with their actual logged in website identity and the personal data that the website already holds on them.

I also agree that the "man in the middle" technology that Phorm are installing stinks and makes possible a whole host of nasty things if Phorm/Webwise are prepared to break the law and lie to us , and just allow mission creep to the extent of their own patent documents - which of course they are,

- but I don't agree that your example above about the google search string is a good way of making the point. Maybe I'm being picky!

I also agree that neither Phorm nor BT have actually come up with a decent answer to the lousy security of the Phorm UID. Dr Clayton has not had an answer to his discussion of the security weaknesses of the model.

I also agree that BT produce a lot of BS - that's why I am always happy to quote their statements, because they so often turn out to be wrong, either through incompetence or dishonesty.

Of course you might now get targeted with adverts for Hanff related merchandise?? (for the book 84 Charing Cross Rd by Helene Hanff, who is still above you on the google hits for "Hanff" - wonder how long she can hold out?)

[icsys]

Originally Posted by R Jones

Not only are online forms ignored completely, the system does not collect any personally- identifiable information, there is nothing to pass on to anybody. All processing analysis is done instantaneously and on BT's controlled equipment

Whilst the processing analysis is done on the channel server within the ISP, I was of the impression that the ISP did not have access to it nor do they have detail on how it works.

How can it be claimed to be BT controlled?

[AlexanderHanff]

Originally Posted by R Jones

But Alex - your name is in that search string because you (or anyone else searching for "Hanff Phorm" put it there.) I can't quite see how it leads to an identification of the person making making the search, or the fact that a personal name got put in a search box leads to an argument against Phorm. (Although of course your google profile now includes an interest in Phorm matched against your Google cookie unless you delete the cookie and change your IP address)

Or have I misunderstood what you said?

I completely agree with you that it is a fairly trivial matter for anyone with a website to link the Phorm UID of a Webwise opted-in visitor, with their actual logged in website identity and the personal data that the website already holds on them.

I also agree that the "man in the middle" technology that Phorm are installing stinks and makes possible a whole host of nasty things if Phorm/Webwise are prepared to break the law and lie to us , and just allow mission creep to the extent of their own patent documents - which of course they are,

- but I don't agree that your example above about the google search string is a good way of making the point. Maybe I'm being picky!

I also agree that neither Phorm nor BT have actually come up with a decent answer to the lousy security of the Phorm UID. Dr Clayton has not had an answer to his discussion of the security weaknesses of the model.

I also agree that BT produce a lot of BS - that's why I am always happy to quote their statements, because they so often turn out to be wrong, either through incompetence or dishonesty.

Of course you might now get targeted with adverts for Hanff related merchandise?? (for the book 84 Charing Cross Rd by Helene Hanff, who is still above you on the google hits for "Hanff" - wonder how long she can hold out?)

OK let me clarify a little. Say for example you are searching on Google for a family member who shares the same surname, or you are searching for information about yourself; those search terms will be profiled based on the BT explanation posted. So clearly stating that no identifiable information is taken from search forms is incorrect. That was my only point, just a simple example of how those search terms can actually contain personal information.

My other point was that even if you never use anything which might be considered as personal information, you can still be identified from your searches as happened with one elderly woman in the US who was identified and tracked to her home address as a result of her anonymised search data being leaked by AOL.

So my post was more about the inaccuracies of BT's FAQ as opposed to anything ground breaking or new.

Alexander Hanff

Originally Posted by AlexanderHanff

This working group is a very good thing, I don't understand why people are getting bent out of shape over it. I knew about it some time ago but I was asked to keep it quiet as they wanted to announce it at the launch party on Tuesday.

What 80/20 Thinking will be doing is working with the entire industry, regulators and information commissioners to build a framework which will allow the industry to make a very big shift from opt-out to opt-in. The result of Article 29 means that this has to be done and Informed Consent is now mandatory across Europe. This -includes- Phorm, Google, MS, Yahoo, BT, AOL and every other big player in the industry.

This is a -good- thing so please lets not ruin it with baseless attacks?

Alexander Hanff

I trust what you're saying on this Alexander but it's difficult to trust companies who are commisioned by Phorm to give appraisals particularly if their findings seemingly don't get to be made public. Particularly when we were told on this forum that it would be a warts and all affair and Phorm were aware of this also and had a publish and be damned attitude...

More than once with 80/20 Thinking I've felt like I've been fed verbal rohipnol

- it sure feels like you've been shafted but you're never quite sure enough to start shouting about it!!