Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[bluecar1]

Originally Posted by davethejag

Hi All, Just seen this. -

http://www.security.itproportal.com/...stomers-usage/

Regards to all, davethejag

that is just standard data retention, basically where you looked and when. dns logs which when combined with DHCP logs allow law enforcment to confirm if you looked at a particular site and when, but a warrant is required before the ISP hands over the info. same as the phone side so they can check (with a warrant) who you called and when

standard stuff as covered under ripa 2000, just been made more formal under EU law

[Dephormation]

Originally Posted by Anonymouse

The Information Commissioner does not have responsibility for advising on or enforcing the Regulation of Investigatory Powers Act 2000 (RIPA). I should also make clear that the Information Commissioners Office does not have responsibility for advising on or enforcing the Computer Misuse Act 1990.

If they don't have responsibility for RIPA or the CMA, who the hell does?

The ICO should be enforcing PECR (which should guarantee that your privacy is protected by explicit opt in)... Try asking them why they haven't assigned a case worker, and highlight PECR.

Regards RIPA, it seems the Home Office may have responsibility for enforcement, but they consider they have 'no investigatory role'. You should also be able to report to your local Police, Scotland Yard/SOCA investigated the News of the World case for the Royal Family... but they can't be bothered to investigate for 100,000+ ordinary people.

Regards Computer Misuse, I understand again it should be your local Police. But if your experience turns out anything like mine, they won't investigate, claiming its a Home Office responsibility or implying that someone 'higher up' is investigating, or demanding absolute proof (which you can't have unless you have a search warrant for an ISP). Essentially, they will say anything to avoid investigating.

So its a pretty depressing story really.

DON'T LET THAT STOP YOU REPORTING IT.

Its really important these complaints keep adding up. I know of around half a dozen to a dozen complaints to various Police forces (including Avon, Metropolitan) that have so far gone uninvestigated, despite the flagrant admission by Emma Sanderson on TV. I know of only one instances of the ICO assigning 'a case worker' (for what that's worth).


Incidentally, I was in IKEA at the weekend looking for a solution to the perpetual problem of 'wasted space'. The thought ocurred to me that the ICO could be replaced by a more useful Billy bookcase unit.


.

[AlexanderHanff]

Hot Tip

There'll be a piece on Phorm in the Economist's quarterly tech supplement in the 6 June edition.



Alexander Hanff

[popper]

its interesting that Phorm or inter-ISP DPI interception for commercial profit doesnt get a mention in this latest "state of Information Security in UK" report http://www.security.itproportal.com/...n-security-uk/

but when you take the official No.s of Uk business Dependence on IT web connections and introduce this unlawful interception,data collection and processing for profit, plus using this interception to make those "unauthorised derivative work's" it seems they have a lot of extra work to do and need to expend a LOT MORE CASH at protecting their copyrights and company secrets from other commercial entitys etc...
against the likes of Phorm and the intercepting ISPs they are using today.

http://www.pwc.co.uk/pdf/BERR_ISBS_2008(sml).pdf
"

Attitudes to information security
The UK business community continues to grasp the opportunities
provided by new technology. UK companies have now fully embraced
the broadband revolution, with 97% having a broadband connection (up from 85% two years ago). Broadband penetration is fairly evenly distributed across the country, varying from 93% in East Anglia to 100% in Northern Ireland.

Dependence on IT systems remains high, at similar levels to those seen two years ago - only one in six small companies would be able to
continue their businesses without IT. On average, companies in East
Anglia are least dependent on their IT, and those in Greater London and Scotland most dependent.

As in previous surveys, the financial services, health and education
sectors, particularly those based in London and the South-West, are
likeliest to hold highly confidential data. Retail and leisure companies are least likely, but even here three-fifths keep sensitive information in
electronic form. The continued push towards electronic submission of

PAYE data is a big driver here.
...
"

[SMHarman]

Originally Posted by popper

http://www.theregister.co.uk/2008/05...maden_privacy/
Privacy? Forget it. Sell your brain and desires to the highest bidder

Web $9.95

Page: 1 2 3 Next >
By Ashlee Vance in Santa Clara → More by this author
Rate this story
Published Sunday 18th May 2008 21:14 GMT

---------- Post added at 22:55 ---------- Previous post was at 22:50 ----------

http://www.lightbluetouchpaper.org/2...ges-all-alike/
"
Twisty little passages, all alike

May 18th, 2008 at 19:29 UTC by Richard Clayton
Last month, on the 4th April, I published a document describing how the Phorm system worked and blogged about what I thought of the scheme.

The document had been run past Phorm’s technical people to ensure it was correct, but — it turns out — there were still a handful of errors in it.

A number of helpful people pointed out that I’d misdescribed third-party cookies (which didn’t matter much because Phorm specifically uses first-party cookies), and I’d managed to reference RFC2695 rather than RFC2965 !
....
The Phorm system does some of its tracking magic by redirecting browser requests using HTTP 307 responses.

When this was first explained to me at the meeting with Phorm there were two redirections (a scan of my notes is here), but having thought about this for a while, I asked for it to be explained to me again later on, and it turned out that I had previously been misled, and that there were in fact three redirections (here’s my notes of this part of the meeting).

It now turns out, following my further emails with Phorm, that there are in fact FOUR redirections occurring! This is not because my notes are rubbish — but because Phorm have managed to recall more of the detail of their own system!
...
"
"

So these ISPs are now installing switches and black boxes on their networks that not only they don't have fully documented details of the code on the box but the developer company does not or cannot explain how it works either. Priceless.

[Julian Smart]

I'm still wondering why 80/20 are still working with Phorm given that this clause of their ethics policy has presumably been violated (no videos of the Phorm meeting):

"Any instance of deception or dishonesty by an 80/20 client during the course of our work will result in the termination of that relationship."

Maybe if Phorm puts the videos up in 2015, it still counts? Or maybe the ethical code is a wee bit flexible?

On another note, I'll be fascinated to hear what the chairman of a notorious PR company has to say about privacy at 80/20's launch party tomorrow, not to mention a BT manager. Plus a representative from that bastion of online privacy, AOL... I wonder if Kent will be there too! All power to the Earl of Northesk contending with that lot.

[Rchivist]

Originally Posted by bluecar1

getting further

just in from BT

****************

Dear Mr XXXXXXXX,

Thank you for your e-mail.

No problems whatsoever, I understand your situation and will gladly assist you in anyway possible.

If you stay on what you are on then your data stream will be on a none intercepted path like it is now. BT cannot and will not do anything to disrupt the flow without your consent on taking up the option of webwise/phorm.

This is still in trial period mode at the moment and more details will be available if this option is launched officially.

The charge if you cease your broadband service will be as one lump sum and if you decide that moving is the way forward for you then I will be able to supply you a MAC Code.

I look forward to your next correspondence.

Thank you for contacting BT.

Yours sincerely,

Jamie XXXXXX
eContact Customer Service

************

"This is still in trial period mode at the moment " ????, does this mean the trial is running??

"If you stay on what you are on then your data stream will be on a none intercepted path like it is now", this seems to be a network address based system so things can be routed

peter

That contradicts everything BT have said to me so far privately, that is attributable, and also what they have said on the Webwise FAQ.

They have committed to giving 24 hours notice for the trials. No such notice has been given. If they start trials without notice (again) then they really would be in deep PR doodoo - so I don't believe they are currently trialling - they are trying hard to get the trials started, and may well be trialling internally but I don't see how the trial can have started.

They have always said so far - no information in advance on the final rollout.
Secondly that they were working on a cookie free "not opting in" method, and thirdly - no comment on the actual methodology to be used in the trials until they were ready to start.

Knowing BT - the most likely reason for any confusion is poor internal communication.

You can check the current Webwise FAQ here

On the official Webwise site (sets a session cookie, and is not hosted by BT - the IPs resolve to Fasthosts)
http://webwise.bt.com/webwise/index.html

or on the main BT site (may not be identical - BT are v poor at synchronising different sets of pages)
http://www.productsandservices.bt.co...=CON-WEBWISE-I

[icsys]

Originally Posted by icsys

Having just read Richard Clayton's re-revised Phorm explanatory document 18 May 2008, I was concerned about certain paragraphs.
Forgive me if I have misunderstood them but the document was a lengthy read.

Paragraph 72. In the meeting itself, Phorm said that the reason for not centralising the Channel Server function was that they were concerned about EU regulations concerning moving personal data outside of Europe.

Paragraph 73. I then pointed out that it was Phorm's contention that the {channel/UID/timestamp} information was completely anonymised and hence there would be no movement of data that could fall foul of the regulations - to which they responded that they wished to ensure that they were not being perceived to break the rules, even though they did not believe they would do so.

So, Phorm don't collect any personal data, but just to ensure they don't fall foul of the regulations, should any personal data be collected, it will not leave Europe.

Paragraph 77. It is Phorm's belief that it is not possible for the Channel Server (the part of the system operated by them) to make a link back to any particular individual.

It would be nice to have a bit more assurances than a belief that it isn't possible. I would suggest that it probably IS possible but they want to cover their backsides if it ever comes to light.

It would seem that the more that Phorm is pressed, the more unfavourable information emerges.

Further thinking about the above, I am sure Phorm would much rather have a central Channel Server - everything that is farmed and profiled would be sent to one location, and that could be anywhere!
So, to say the only reason not to is because 'they wished to ensure that they were not being perceived to break the rules' seems a little far-fetched. Or am I being over paranoid?

[Wildie]

doh my bad was reading wrong page like :P

Originally Posted by Julian Smart

I'm still wondering why 80/20 are still working with Phorm given that this clause of their ethics policy has presumably been violated (no videos of the Phorm meeting):

"Any instance of deception or dishonesty by an 80/20 client during the course of our work will result in the termination of that relationship.".

Yeah... We're all still wondering the same thing Julian (even Alexander is probably shaking his head but like he says, someone needs to try and work with these 3rd party plonkers like K*nt or we'll not know what's going on until it is too late)

Originally Posted by Julian Smart

All power to the Earl of Northesk contending with that lot.

Another good point. Although going by the current speed of the GOvernment's answers, it will be Christmas before he gets any answers to new questions.

From here: http://www.publications.parliament.u...d/ldordpap.htm

Questions asked: 24 April
Due for answer: 8 May

HL3267 Earl of Northesk [HO]
HL3268 Earl of Northesk [HO]

Come on Home Office... The Earl is waiting for answers, my MP is waiting for answers, I'm waiting... BT are probably waiting. In fact I bet the ICO, Police, Kent and his concerned investors are even waiting ...We're all bleedin' waiting!!

Hank

[JackSon]

Speaking of waiting. Apologies if I missed it happening, but am I right in thinking the PIA is still MIA?

[popper]

hmm , while researching for the latest Docsis and cable news i came across this old news now as referenced below.

are we looking at a US,UK or even world cable wide DPI interception tied into this cable "Project Canoe" advertising tracking software project?

http://www.lightreading.com/document...54112&site=cdn
"The Cable Show: A Five Item PreviewMAY 17, 2008

...
Advanced advertising
This show will offer as good a time as any for "Project Canoe" to drop the veil and at least acknowledge a few more things, since plenty of details about the effort has leaked out already. (See Cable's 'Canoe' RFI Paddles Toward Deadline and Who's Rowing 'Project Canoe'? and Verklin to Helm Cable Ad Initiative?.)
"
http://www.lightreading.com/document...34343&site=cdn

Cable's 'Canoe' RFI Paddles Toward Deadline
SEPTEMBER 19, 2007Discuss >
As many as 60 vendors could reply to a request for information (RFI) from CableLabs that will form the basis of a common, industry-wide back-office and architecture for advanced advertising applications and services.

The project, multiple sources have confirmed, carries the internal code-name of "Canoe," with the idea that it will ensure that all cable MSOs paddle in the same technical direction, and give advertisers the ability to "buy cable" across the board with ease, and without the headaches of supporting disparate ad systems and technologies.


It's a big deal," a source says of the CableLabs-led project, which is carrying regular and high-level participation from the top MSOs. Adding interactive elements to the mix could also help to jumpstart a sluggish cable local ad sales market. At Comcast Corp. (Nasdaq: CMCSA, CMCSK), for example, ad sales make up about 6 percent of its overall revenue.

"The cable industry is definitely interested in building a next-generation interactive advertising platform," says another person familiar with Canoe.


..
Although little technical detail is known about Canoe, it's expected to define common interfaces and systems for a set of advanced advertising services, including targeted ads, addressable spots, and "telescoping" VOD ads,...."

cable "Project Canoe"
http://search.virginmedia.com/result...ct+Canoe%22&cr=

[Rchivist]

Originally Posted by JackSon

Speaking of waiting. Apologies if I missed it happening, but am I right in thinking the PIA is still MIA?

Last email I had from 80/20 (last week) said the information they had been waiting on was now in, and the project was "nearing completion".

[davethejag]

Hi All, just seen this (nothing new)!

http://news.zdnet.co.uk/internet/0,1...9419839,00.htm

Regards to all, davethejag

[popper]

Originally Posted by R Jones

Last email I had from 80/20 (last week) said the information they had been waiting on was now in, and the project was "nearing completion".

its a pitty we didnt know about this
Mobile Livecasting service during the PIA meeting this would have been better than nothing for a public record of the Q&A

http://www.dailywireless.org/2008/05/19/7771/


Now anyone can stream live video from a mobile phone. DailyWireless.org is
even equipping a van for Live Casting. Consider PocketCaster from ComVu. ComVu’s PocketCaster streams video from your phone to your video blog or homepage.