Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Rchivist]

Originally Posted by Peter N

I just had a thought.

Does anyone know for certain what the business relationship is between Phorm and BT? Specifically, do BT employ Phorm to make use of their data or do Phorm employ BT to provide the data for their system?

Phorm's statements regarding the "agreements" or "contracts" with the ISPs seems to suggest that it is Phorm who are running the business and that the ISPs are simply providing them with the data.

The reason I am querying this is that BT (and the other ISPs) term and conditions allow for personal information to be shared with "third-parties" and I'm curious as to whether this relationship actually does apply to Phorm.

Exactly (and hi to Minky - lovely picture Minky!)

BT have been using Phorm to handle the BT Webwise site, and to answer BT Webwise questions just like they use people like custhelp.com etc. to handle the Webwise contact page now (since we embarrassed them by discovering Phorm were doing it so they had to stop/disguise it).

It looks like a lose/lose whatever answer they give.
If Phorm ARE a partner with BT then BT can give them my PII as a partner according to the T&C's, but then that makes a nonsense of the promises that they never pass any PII to Phorm. Because they will already have given Phorm loads of PII via the BT Webwise site and the contact form (which we know they have in fact already done) - and then Phorm have PII, IP data, AND the UID data - the sort of data that enables them to destroy any semblance of protecting my privacy.

If Phorm are NOT a partner with BT in that sense, then they are barred from sharing my PII with Phorm, unless I have consented. Unfortunately they have already done this by letting Phorm walk all over the BT Webwise pages and handle BT Webwise contact page enquiries, so we have them by the short and curlies for doing it.

That is the point of my current DPA request. Hopefully it will cause the odd drop of sweat or swearword at the BT end.

[bluecar1]

Originally Posted by R Jones

That's one of the significant unanswered questions. So far BT have avoided that one by simply refusing to take any responsibility for it. Their take so far is that they have one account, and whatever happens with that account or any of the sub accounts, is the responsibility of the account holder. They have NOT answered any questions about the enforceability of a change in T&C's triggered by a minor or any other user of the account/subaccounts, who opts in to Webwise.

When they don't answer a question it means they haven't got an answer. If they had a legal watertight answer, they would give it - anthing to help propr up the share price!!! And then there is usually a further delay in the trial date. So - "keep asking them difficult questions" is my method!

yep still waiting for my reply, time to give another prod me thinks,

and then leave it a while beore the next question so it adds further delays

peter

[Rchivist]

Originally Posted by bluecar1

only problem with that is BT Retail use dynamic IP's

peter

which might change once they roll out Phorm as a way of differentiating the two types of customer? One lot could get lumped in (or added on to the edge of) with the static IP ranges given to BT Business customers, the others could remain on dynamic BT Residential Broadband IP ranges.

Of course all this would require co-operation with BT Wholesale contrary to regulator rules.

[rryles]

Originally Posted by isf

Only so long as we can know the exact mechanism they're using, I was just giving an example If they add a "secret" key prior to hashing it's more difficult still. I think Phorms "privacy enhancing" feature of leaking the UID over the entire web is the bigger issue for them to solve -- along with all the other show stoppers.

There are several big issues for Phorm to solve and no easy solutions. I don't see the point in debating which is the biggest.

The ironic thing is that in trying to design a system that mitigates the problem of UIDs leaking, you give yourself the problem of handling more PII (The IP address).

Originally Posted by isf

I don't think that matters, it's the uid number that links you to your profile and they'd simply set a valid cookie over the stale one. I'm only giving examples, they could use the hostname of the site so long as we don't know the mechanism (security by obscurity).

I think it does matter. How do you lock the uid to an IP address then allow the IP address to be dynamic?

When you reference 'security by obscurity' I hope you understand how bad a reputation this approach has!?

[Rchivist]

Originally Posted by Florence

Very true they seem to have sliped with their due diligence mind they were blinded with greed and dollar signs.

Which raises the interesting question that I can't quite make my mind up on - are the people at BT really evil or are they just plain stupid?
I know from years as a customer that they are incompetent.
I know from years as a customer that they regard customers as irrelevant except as a source of income, and treat us with contempt - that is the default position, and many of the staff find that very difficult.
I know that they want to make money, but aren't very good at doing it.
I know that they have a lousy company structure and corporate culture, and that the management are very very poor at managing.
I know that they are devious and if they can possibly avoid it, they won't tell anyone anything - like they don't talk to their staff, they don't talk to their customers, and they only talk to the press when they want to sell something.


But I am not yet convinced that they really do want to break the law. I don't think they intend to be criminal. They are just too stupid to know that virtually 99% of this basic Webwise plan is illegal. In so many ways.

Hence the delays. As again and again, they discover (from us usually) the next bit they forgot to check, and that sadly the ICO or the police couldn't be bothered to enforce.

Of course I could be wrong. Maybe they are corrupt, law breaking criminal deceivers. Maybe. But personally - I think they are just stupid. Anyone from any reputable company who signed any sort of commercial agreement with a company with Phorm's background and reputation, MUST be stupid.

I suppose it's up to them to help us make up our minds. That is quite easy. Even a BT manager could work it out.

a) full disclosure of what they have been up to
b) apologise for mistakes and compensate for losses
c) dump Ertugrul completely as a bad mistake. Lesson learned. Don't do that again.
d) sack anyone who needs sacking - like the head of BT Retail at the time all this got started - oh yes - that was Ian Livingstone wasn't it? Arrange the employment tribunal and then if you have to, pay him his millions of CEO compensation and give him his P45. You can always sue him for it later when all this has been through the courts and the actions of the people responsible have been weighed in the balance and found wanting.

[bluecar1]

rob, why not say it like it is, and don't mince your words next time :P

there is one on here that could poss tell you the answer, but he is trying to keep out of BT's head lights at the mo

peter

[HamsterWheel]

I see there are calls here for BTs Heads to roll.
not sure why you think this is called for.
What they are doing with phorm is designed to make BT a substantial amount of money and increase it's share of the broadband market as other, non-Phorm, ISPs become unable to compete on price.
BT's shareholders will be very happy with this.

[Deko]

wrong avatar image..

[img]Download Failed (1)[/img]

[bluecar1]

Originally Posted by Deko

wrong avatar image..

nah, hammy got the right pic, if you look the person is headless

he he

headless chicken in a hamster wheel, yep , bout right

either that or the hamster should have a jacket on (like greyhounds with a number) but have the NODPI.ORG logo on it

peter

[Florence]

Suppose really BT need to confirm on if they knew 121media was under investigatioin when they allowed them lose on the network with customers details.

Suppose 121media now phorm should be investigated for the lrevious crimes since they dodged them then tried to come out all ligit.. Begining to sound like Kent is snakecharming BT into giving thjem respectability something phorm, 121media or any other reincarnation of them should ever be given.

Has anyone contacted those persuing 121media asking if they ever did locate them and did thye know they are now using the name of Phorm?

[isf]

Originally Posted by rryles

There are several big issues for Phorm to solve and no easy solutions. I don't see the point in debating which is the biggest.

A debate wasn't my intention, I was simply putting it in perspective -- exactly as you did with your opening sentence.

The ironic thing is that in trying to design a system that mitigates the problem of UIDs leaking, you give yourself the problem of handling more PII (The IP address).

I'm not trying to design their system for them, far from it. However if they insist on going ahead with this farce the least they can do is attempt to avoid leaking the uid.

I think it does matter. How do you lock the uid to an IP address then allow the IP address to be dynamic?

The uid is a key to a database containing profile data, we're only talking about leakage due to phorged cookies under 3rd party domains. If a cookie is invalid, they simply overwrite it by spoofing a valid one.

When you reference 'security by obscurity' I hope you understand how bad a reputation this approach has!?

Err yeah -- even although that's exactly what strong passphrases etc... are

[Florence]

Yet again BT beta forums go off for maintenance should we be worried are they about to cull webwise from the forums in a genicide attack...

Thank you for visiting.


Due to essential maintenance work this section of the site is not currently available.

We apologise for any inconvenience this may have caused you. Please contact either your sales or service team with any further questions.

The numbers below may be of assistance while this section of the site is down.UK Directory Enquiries 118 500
International Directory Enquiries 118 505


Please note the remainder of the site is still available.

[rossco555]

Just read an article on Computer Weekly about talk of the goverment tapping into phone and internet traffic.....makes Phorm look tame!

Apologies if this link has already been posted.

http://www.computerweekly.com/Articl...d-internet.htm


Rossco

[bluecar1]

Originally Posted by Florence

Has anyone contacted those persuing 121media asking if they ever did locate them and did thye know they are now using the name of Phorm?

not forgetting they have a nice shiney office in london and a registered address in states

he he

[Deko]

CW could learn to use a spellchecker.

"interent traffic data"