Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[ilago]

Originally Posted by madslug

Hi Dean - a few weeks back I made a post which related to the history of one of the tracking scripts. Even though I linked to a google cache, when people visited the page they had malware download warnings.

The big problem is that for the last 4/5 years, adverts relying on javascripts, etc have been associated with the downloading of malware and rootkits. DPI is seen in the same light as that malware and rootkits.

The risks are the origins of the adblockers, cookie removal/blocking and hosts file restrictions far more than the adverts themselves.

My personal view is that the advertising industry needs to clean up its act and start to use methods which do not expose anyone viewing ads to such risks, not look for methods to increase those risks. And DPI is a method too far. Ad delivery needs to go back to what it was doing before the malware and rootkits got added by the hackers.

Give us adverts backed by a secure system. For current technology that means that a lot of the current ads are not acceptable: no gifs, no flash, no javascript. Spend the development money on a secure delivery system, needs to be developed from scratch.

Malware is developed professionally with the intent to make money. Earlier forms of malware up until around 2005 were principally designed to be installed on a user's computer as a forced advertising or forced search model. There was a change in the installation methods after the first rootkit, hackerdefender, was stealth installed. From around 2004 malware has mostly used rootkit techniques as part of the installation. The Apropos rootkit (one of many different kinds of malware) was stealth installed, forced advertising with the advertising being provided by ContextPlus. Things have progressed since then to identity theft, credit card fraud, keylogging, extortion and the incorporation of users' machines into botnets. The malware industry is highly competitive and very profitable.

The larger companies that had been involved were being investigated in the USA and several changed their business model. Gator became Claria where several of NebuAd's staff come from and 121Media became Phorm. There's others. Bob Dykes of NebuAd is from Juniper Networks.

[SimonHickling]

Originally Posted by Dephormation

The enthusiasm of Simon Davis (wearing his Privacy International hat), to berate Google (hurrah!) is laudible.

So why have Privacy International got nothing at all to say about Phorm? Literally not one single word. Click here to search their web site.

You can search news.google.com for Google and Privacy International. 61 results. But do the same for Phorm and Privacy International and you get zilch.

So, PI simply stinks to me.

And when you compare your chances of actually being caught by a Google camera to your chances of being profiled by Phorm it becomes even more laughable.

[Rchivist]

Originally Posted by Dephormation

The enthusiasm of Simon Davis (wearing his Privacy International hat), to berate Google (hurrah!) is laudible.

So why have Privacy International got nothing at all to say about Phorm? Literally not one single word. Click here to search their web site.

You can search news.google.com for Google and Privacy International. 61 results. But do the same for Phorm and Privacy International and you get zilch.

So, PI simply stinks to me.

There are however, some links on Webwise and OIX
http://www.privacyinternational.org/...D=x-347-560974

There is also the statement:
"Opting Out
The whole opt-in and opt-out debate is only the beggining of the story. Most of the advertising schemes out there require that you opt-out if you do not wish to be behaviourally profiled and tracked. We fundamentally oppose these techniques and demand opt-in regimes. In the meantime, however, we are listing the opt-out opportunities that you have. One major problem here is that if you delete your cookies, you will have to opt-out again from all of these services."

As far as I am concerned we have to treat Privacy International's refusal to even discuss the subject in the same way that we treat the government's and the police's. It stinks of corruption especially as senior figures at Privacy International have taken money from Phorm for services rendered.

It's time to stop making excuses for them and I couldn't give a damn about who is friends with Simon Davies or what a nice chap he is in private. In terms of this issue Privacy International is doing harm to our side of the debate by their silence. They are effectively saying that there is no threat to privacy - if there was they'd be involved.

Privacy International is registered in the UK as a non-profit private limited company no. 4354366. If they are now selling their approval to companies like Phorm then that status should be questioned.

[OldBear]

Originally Posted by Peter N

Feesch has a very nicely written blog but it is irrelevent to this discussion.

We are discussing whether or not it is acceptable and legal for any company or organisation to intercept our web-traffic and process that data in order to profile us for any reason without a warrant being issued based on a specific requirement pertaining to the individual.

The fact that one potential use for such systems is to deliver targetted advertising is only relevent because that is Phorm's stated purpose but the financial benefit to ISPs, advertising companies and High St brands is neither here nor there especially since the ISPs - the only group that we are contractually involved with - have not made any claims or statements regarding the use of any income derived from this system.

Feesch's case boils down to a single statement - DPI should be used because it can make a lot of money for a few people involved in sales.

Don't let these people draw attention away from the core issue - our right as law-abiding citizens to chose who has access to our personal information regardless of why they want it or how they plan to use it.

Thank you, Peter. Totally agree.

It's time to stop making excuses for them and I couldn't give a damn about who is friends with Simon Davies or what a nice chap he is in private. In terms of this issue Privacy International is doing harm to our side of the debate by their silence. They are effectively saying that there is no threat to privacy - if there was they'd be involved.

Again, totally agree.

OB

[Rchivist]

I see we have 50 guests on line at present, so welcome to you, and if you want to begin to find out more try this post here.

If you are lurking here on behalf of Phorm, then you have our condolences with regard to the regulatory interest in Canada and the agressive Congressional interest in the USA, and the growing interest and information available to our own parliamentarians, and of course the continuing 5 month and counting, delay in the BT trials. If you want to help your cause, then in the interests of transparency, publish the 80/20 Final PIA immediately, and maybe ask BT to publish "Premium Browsing:Research Findings".

If you are here as a legislator, then great to know you are interested. If you are a UK legislator, please can we have a more robust attitude?

If you are a member of the government, - hey this is a great opportunity to make a lot of voters very very happy - just take action to stop this DPI based scheme and remove that interception kit from BT's network. Forget Milliband, just go public that you are going to stop Phorm. Those 15,981 signatures on the epetition are an indicator of the public interest.

[oblonsky]

PHP/Apache site owners may be interested in this post, which starts the ball rolling if you are considering sending a custom robots.txt to Phorm which is different to the robots.txt you want to send to Google, MSN, Yahoo etc...

http://www.badphorm.co.uk/e107_plugi...topic.php?7852

As I said on Badphorm, apologies I haven't had the time to fill in the gaps on this and release a script package. I'm sure others who know more about PHP than me will fill in the gaps if anyone needs a hand.

O.

[isf]

Originally Posted by oblonsky

PHP/Apache site owners may be interested in this post, which starts the ball rolling if you are considering sending a custom robots.txt to Phorm which is different to the robots.txt you want to send to Google, MSN, Yahoo etc...

I could do this if there's sufficient interest although I don't consider robots.txt to be a suitable exclusion method. Phorm isn't a spider and is not indexing publicly linked content. They intercept pages swerved during authenticated user logon sessions. At the very least Phorm should append themselves to the UA string when they strip the phorged domain cookie from the request headers.

[oblonsky]

Originally Posted by isf

I could do this if there's sufficient interest although I don't consider robots.txt to be a suitable exclusion method. Phorm isn't a spider and is not indexing publicly linked content. They intercept pages swerved during authenticated user logon sessions. At the very least Phorm should append themselves to the UA string when they strip the phorged domain cookie from the request headers.

I agree that there are a lot of things Phorm should do, but in the event they don't then there are many steps webmasters can take to hamper the ISPs attempt to make money off the back of people's private data and other people's content.

I trust that the ISPs will ensure that Phorm complies with robots.txt. Their argument for implied consent is weak already but disappears entirely if webmasters are serving them a DENY ALL robots.txt.

In the unlikely event that Phorm does get rolled out, and is allowed by the regulators, it would be suicide if an ISP was found to be breaching other people's copyright by ignoring the robots.txt.

Other steps webmasters will be taking will be to detect Phormed connections so that they can educate visitors what their ISP is doing with their data.

Without the online community behind this, Phorm and the ISPs simply cannot win. They have chosen to confront this head on, with PR agencies and hardcore lobbying of parliament, dismissing the anti-Phorm campaign as ill conceived noise.

This will be Phorm and BTs undoing, chosing to fight the very people whose support they most need. Chosing to run trials in secret and attempting an equally quiet and secretive roll-out.

Without this campaign, the ICO would not even have gone so far as to rule that Phorm must be opt-in, and that consent muts be clear and unambiguous. THis was a major victory for us, let's not forget that.

Originally Posted by feesch

Waking up to find I have ruffled a few more feathers this morning...

Good, that was my intention. hello peoples. This is Dean Donaldson. Note I deliberately did not state my personal aspect on all this, I was merely posing a viewpoint to the counter-measure .

Advertsing works. Cookies are a part of the web - and you leave footprints. Whether we like it, agree with it or not - it is now here. 10% of ALL company revenue is spent on advertisng, and has been for last 90 years - whether on posters, TV ads, or sales men - because it works. Anyone think thet are immune to advertising must live on another planet, (and a quick check through your cupboards and wardrobes and garage will prove it!) but if you don't realise that you are being 'persuaded' then all credit to the 'persuaders', because that is their job.

How did you find my blog? Some "automated" system that enabled you to find content - that did not exist a few years ago. So you obviously appreciate technology advances to have your voice. So are we to herald all technology as inherently evil? Is it the medium or the message? Questions that have long been posed around - or you going to say 'rock music is evil, TV is evil' and go live in a Hamish community?

So my point is that advertsing and technology ARE part of the debate - and how both are combined and used is a given. You are not going to win this one by saying advertsing doesn't work and we don't want progress - there has to be a smarter and more navigatable solution.

Just to re-emphasise what others have said, this campaign is not about advertising per se. Most of us 'techies' are perfectly capable of blocking adverts if we want to. It is about the unauthorised interception of ALL our (unencrypted) web traffic, including interception of web pages where the web site has explicitly denied permission to intercept for commercial purposes. This is no different to the post office reading our mail and sending us targetted junk mail based on the content. Some people have indicated that intercepting web traffic is more like reading postcards than opening and reading sealed letters, but I'd be pretty upset if the Post Office were routinely reading post cards for commercial purposes, and would look at some way of sealing letters so they could only be opened by the recipient (equivalent to encrypting web communications).

[Tarquin L-Smythe]

Possible sighting of Phorm Exec leaving the UK
http://t-loombreaker-smythe.kicks-as...%201/plane.gif

Originally Posted by Tarquin L-Smythe

Possible sighting of Phorm Exec leaving the UK
http://t-loombreaker-smythe.kicks-as...%201/plane.gif

Link not working here.

[Tarquin L-Smythe]

ok now

Originally Posted by Tarquin L-Smythe

ok now

Love it

[Dephormation]

Originally Posted by oblonsky

In the unlikely event that Phorm does get rolled out, and is allowed by the regulators, it would be suicide if an ISP was found to be breaching other people's copyright by ignoring the robots.txt.

Robots.txt and copyright. There is no link.
Copyright is a mechanism of inclusion (and requires explicit licence to copy).
Robots.txt is a mechanism of exclusion (and requires denial of licence to index).
Put a different way, BT would dearly like to push the idea that web sites owners have no copyright by default.
That's legally and morally wrong, and you should not co-operate with them to make it so. Wait for them to switch Phorm on, then sue for copyright infringement.

Originally Posted by oblonsky

This will be Phorm and BTs undoing, chosing to fight the very people whose support they most need. Chosing to run trials in secret and attempting an equally quiet and secretive roll-out.

I work in IT for my sins... One key step when you create a new system is a stage called 'stakeholder analysis'. In that step you identify the people impacted by your new system, and consider the effect that your IT system might have.
Phorm ignoring web sites was probably intentional. Asking web site owners if they wanted their communications intercepted, and their copyright works stolen, would probably have elicited a firm refusal.

Originally Posted by oblonsky

Without this campaign, the ICO would not even have gone so far as to rule that Phorm must be opt-in, and that consent muts be clear and unambiguous. THis was a major victory for us, let's not forget that.

It was a battle won, but its not enough.
If we don't prevent Phorm intercepting web traffic without the consent of both parties to the communication the internet is going to change dramatically. Expect to see widespread encryption, denial of content to Phorming ISPs customers, and web site countermeasures.
And if Government won't protect the privacy of web data communications, expect phones, SMS, voip, emails to be the next battlefield.
Phorm must be stopped.