Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[kt88man]

Originally Posted by JohnHorb

Picked up by the beeb

http://newsvote.bbc.co.uk/1/hi/technology/7331493.stm

Such a nice lead paragraph...

Technical analysis of the Phorm online advertising system has reinforced an expert's view that it is "illegal".

[mark777]

Originally Posted by Alex @ Phorm

Hi. It's Alex @ Phorm

The ICO has posted its latest statement on Phorm, which includes the following:

"They assure us that their system does not allow the retention of individual profiles of sites visited and adverts presented, and that they hold no personally identifiable information on web users. Indeed, Phorm assert that their system has been designed specifically to allow the appropriate targeting of adverts whilst rigorously protecting the privacy of web users."

The full statement is here: http://www.ico.gov.uk/about_us/news_..._releases.aspx

Very dissapointing, they have appeared to accept Phorm at face value, and not considered phase II and III etc. Phorm says it's ok so it is!

"We have spoken to BT about this trial and they have made clear that unless customers positively opt in to the trial their web browsing will not be monitored in order to deliver adverts."

BT weasel words - it might not be monitored to deliver adverts, but will still be monitored, just no adverts.

How does this sit with Richard Clayton's earlier release? Looks like this will have to be tested in the courts, which won't be a bad thing.

Complaints about the Information Commissioner to your MP please.

--- added ----

“We will continue to maintain close contact with Phorm and BT throughout the trial. Clearly the trial should reveal whether this is a service that web users want, whether it is privacy friendly and that users are comfortable with the privacy safeguards put in place by Phorm.”

They are waiting to see how many people complain, not doing their job. They know most people will not even give a thought as to what is happening given the way it is intended to be deployed.

[Raistlin]

Originally Posted by mark777

[...]Phorm says it's ok so it is![...]

They didn't even go that far, all they said was "Phorm says it's ok.....".

What next? 'Mr Bin Laden says there's no problem, so we're withdrawing all the troops.....'

[Barkotron]

Originally Posted by mart44

This is a huge thread that I've only just come in on. A search and a quick scan by me hasn't brought up reference to this interview in The Register. Apologies if it has already been highlighted. Perhaps worth a read to see what is said in defence of Phorm.

Unfortunately he doesn't get very far in that interview without being very economical with the truth. In fact if I wasn't feeling charitable I'd say his very first answer was an outright lie.

The previous product was malware, plain and simple. Trying to call it "adware" rather than the more correct "spyware" is fairly desperate spin. It was software which installed itself surreptitiously, hid itself from users and the operating system, took extreme measures to prevent its own removal and required extraordinary effort to finally get rid of. Of course, it also delivered your browsing habits to advertising servers: remind me why they claim this isn't spyware again? Look up Apropos rootkit for info, here's one to get you started.

I'd suggest you have a good read of the comments thread on that Register interview by the way. If you manage to wade through some of the more excitable members of the readership, there's still a very clear thread of reasoned argument against this company.

Moving to the FIPR write-up, it looks a lot like Phorm don't (or didn't when the meeting took place) actually understand the law as it applies to their system.

Originally Posted by "Light Blue Touchpaper

Phorm assumes that their system “anonymises” and therefore cannot possibly do anyone any harm; they assume that their processing is generic and so it cannot be interception; they assume that their business processes gives them the right to impersonate trusted websites and add tracking cookies under an assumed name; and they assume that if only people understood all the technical details they’d be happy.

Well now’s your chance to see all these technical details for yourself — I have, and I’m still not happy at all.

Let's go through this statement:

"they assume that their processing is generic and so it cannot be interception" - in which case, I'd suggest they need to hire better lawyers. The process is indisputably an interception under RIPA - their only get-out from this act is consent, which they empatically do not have on most people's reading of the law.

"they assume that their business processes gives them the right to impersonate trusted websites and add tracking cookies under an assumed name" - they'd better be _very_ sure of the Fraud Act 2006 and/or the Computer Misuse Act 1990, as mentioned.

So some very technically and legally aware people have looked at this in great detail, speaking to the company involved, and they are _still_ convinced that this is illegal, very possibly under more than one statute. Please tell me how this opinion is based on emotion and mistrust.

[CaptJamieHunter]

Originally Posted by Alex @ Phorm

Hi. It's Alex @ Phorm

The ICO has posted its latest statement on Phorm, which includes the following:

"They assure us that their system does not allow the retention of individual profiles of sites visited and adverts presented, and that they hold no personally identifiable information on web users. Indeed, Phorm assert that their system has been designed specifically to allow the appropriate targeting of adverts whilst rigorously protecting the privacy of web users."

The full statement is here: http://www.ico.gov.uk/about_us/news_..._releases.aspx

It's the same old Phorm led song and we still haven't had clear, honest answers to prove beyond doubt that the supposedly anonymised data cannot ever be turned into identifiable data.

It's what isn't said that glares out at me. The complete lack of addressing the two IMO illegal secret trials that BT undertook. The ICO is in a position to launch an investigation with its own experts yet fails to do so.

I'm on the verge of quoting Bill Hicks again so I'd better go for another cup of tea...

[Florence]

Originally Posted by PhormUKPRteam

Hi everyone
Hope you are all looking forward to the weekend - looks like a bit of rain.

Just rain thought you and phorm management plus shareholders were in the middle of hurricain phorm.

Originally Posted by PhormUKPRteam

Our ISP partners have not sold and will never sell your data. No data leaves the ISP network and no PII data is stored by Phorm's technology. We do not tie into the ISP's authentication server or any other information the ISP holds on their subscribers.

I have to disagree with you my clicks are my property you are going to pay my ISP money for this information.. by definition then my ISP has sold my private details to you for money.

Originally Posted by PhormUKPRteam

For the record, once again, we do not store personal data or any information on which sites a user has visited. Nor do we store any personally identifiable information such as IP addresses etc (unlike Mi-Info) and we do not pass on any information (unlike Mi-Info).

You say that now but looking at the patent for phorm it has the ability to collect IPs plus much more next question do I trust the Phorm managment to not amend what this program does at a later date... Well with his past history would you.

Originally Posted by PhormUKPRteam

Unlike Mi-Info, Webwise users are anonymous to the system – the technology observes anonymous behaviours and draws a conclusion about the advertising category that's most relevant. All the data leading to that conclusion is then deleted by the time each page is loaded.

We only have the word of phorm management about this, trust is small word now do we trust phorm management enough knowing this system has the ability to identify us later on.

Originally Posted by PhormUKPRteam

Webwise is far more secure simply because it does not store any data and therefore it cannot be lost. As always for more information, especially on the new levels of privacy and security that Webwise sets,

I look after my own online security never had a problem I will always look after my own online security. Hence no need for phorm.

Originally Posted by Incognitas

And go to BT who already have done the dirty...Sky which I would never do 'cos I hate Murdoch and all he stands for.Not a lot of choice left I'm afraid which I think they may be banking on.

I move monday to Aquiss.net small company with no plans to jump into bed with phorm. One month contracts so can always move if needed but seems many of their customers have been there for years.

[mark777]

Originally Posted by Raistlin

They didn't even go that far, all they said was "Phorm says it's ok.....".

What next? 'Mr Bin Laden says there's no problem, so we're withdrawing all the troops.....'

Well it strikes me that they are just waiting to see which way the wind blows, rather than raising the wind themselves. I thought they were there to provide the lead.

Time to double efforts with MP's etc, HMG and it's various arms will be as useful as a chocolate teapot.

---------- Post added at 20:16 ---------- Previous post was at 20:09 ----------

Originally Posted by CaptJamieHunter

It's the same old Phorm led song and we still haven't had clear, honest answers to prove beyond doubt that the supposedly anonymised data cannot ever be turned into identifiable data.

With respect, it's not. It's the ICO saying it.

[popper]

No.29
No.30



and OC to the many other new voters above

i find this most interesting from a tech POV , not twice redirected as thought ,but 3 times...

so your datastream is going from a zero redirect, to 3 times redirected, nice and slow then..., is this a new form of STM LOL.
http://www.lightbluetouchpaper.org/2...ebwise-system/
"
Much of the information was already known, albeit perhaps not all minutiae. However, there were a number of new things that were disclosed.

Phorm explained the process by which an initial web request is redirected three times (using HTTP 307 responses) within their system

so that they can inspect cookies to determine if the user has opted out of their system, so that they can set a unique identifier for the user (or collect it if it already exists), and finally to add a cookie that they forge to appear to come from someone else’s website.

A number of very well-informed people on the UKCrypto mailing list have suggested that the last of these actions may be illegal under the Fraud Act 2006 and/or the Computer Misuse Act 1990.

[CaptJamieHunter]

Originally Posted by mark777

With respect, it's not. It's the ICO saying it.

I said Phorm led song. The words may be coming from the ICO's mouth but it looks very much like Phorm's lyrics to me. I'm growing less and less impressed with this supposed guardian of privacy rights. Hence the letters.

I could sing (actually, better not) I Should Be So Lucky and although it's my voice, the lyrics are still by Pete Waterman's Hit Factory (did you know Pete Waterman is hugely into trains?).

Just my perception.

[Sirius]

Originally Posted by Florence

I move monday to Aquiss.net small company with no plans to jump into bed with phorm. One month contracts so can always move if needed but seems many of their customers have been there for years.

Can you just imagine how many are going to do the same when VM issue that letter that says "sod you we are going to sell your data to a spyware company and what are you going to do about it ?"

I tell you what i will do about it i will move just like everyone else will do.

[mart44]

Originally Posted by Anonymouse

Richard Clayton's FIPR report states explicitly that the Webwise system uses DPI. Which means, beyond any possible debate, it is interception and therefore it is illegal. Is there any part of that which the I-don't-mind brigade don't get? How the hell can that be compared to WGA? The purpose of the profiling and the "anonymising" of the data are irrelevant - it's a freakin' crime. End of!

Thanks for the opinions everyone ..except this one. I came for debate/views on opposition's standpoint in order to help form my own opinions. Someone just had to get ill-tempered I suppose.

[popper]

mark44, did you vote before you formed your opinion, you do know you cant recast your vote once you become fully informed.

[OF1975]

Originally Posted by mart44

Thanks for the opinions everyone ..except this one. I came for debate/views on opposition's standpoint in order to help form my own opinions. Someone just had to get ill-tempered I suppose.

Some of us care about civil liberties, privacy rights and the fact that big business shouldnt be above the laws of the land. If you dont that is of course your right but many here do. Thats why people are "ill-tempered"

[mart44]

No, I haven't voted either way.

[Junglist2k5]

I reckon the government want phorm type powers over the internet and therefore are allowing the system to be deployed so that they can abuse it too, probably just another big brother system for them to add to the list.

personally think the whole concept is flawed , because for many home users one login on a pc is normal for the whole family, hence the targeting just wont work anyway, and from the privacy standpoint (having used similar systems in my role at the largest internet security company)it will be easy for the developers to rake in personal info with very little effort.

maybe European laws can help? doubt it though, a friend who works for VM told me its defiantly gonna be deployed.