Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[ilago]

My first post. You are all doing such a good job with this. I haven't posted because I'm not a resident in the UK. I'm an Australian who has been following the Phorm story since February when I found that OIX resolves to our Telstra. Telstra is Australia's own privatised BT, except that Telstra have an almost monopoly control over many Telecommunications function.

I'm an experienced malware remover and I was very familiar with the removal procedures used for ContextPlus, PeopleonPage and the Apropos rootkit.

I cannot conceive of anything worse than using Deep Packet Inspection for the sole purpose of serving advertising, advertising, for Pete's Sake. This is the stuff of nightmares for malware removers and security people. You can do nothing to protect yourself.

I have read every post here and BadPhorm and every other place I can find anything. I've posted extensively about Phorm and deep packet inspection interception methods on dslreports.com in their Security and Privacy forum. Some of the comments are interesting, but in the USA they don't have the same attitude to advertising.

http://www.dslreports.com/forum/r200...al-Advertising
http://www.dslreports.com/forum/r203...h-ISP-Fiddling
http://www.dslreports.com/forum/r203...with-Web-Pages

I'm not in the UK, but my concern isn't any less. If the UK ends up with this, it is almost certain that Australia and New Zealand will. Our markets are smaller, but we have far weaker Privacy protection and almost no Data Privacy regulation of any kind.

I tend to disagree, BestBuy is a huge "brand" in the US and it is in their best interests not to taint that brand (the same as it is for VM).

Phorm and NebuAd wouldn't worry Bestbuy. They will be asking to talk to them I would think, if they haven't already. They are not known for any principled stand on consumer rights in their current business operations. If you're feeling brave you could go through Slashdot for some technical opinions of BestBuy. They are the Walmart of retail computer sales and repairs.

ISP customers should not be regarded as a product to be sold to the highest bidder.

Keep up the good work, specially Alexander. Well done on the paper and well done in the interview.

[AlexanderHanff]

Originally Posted by oblonsky

It can't, but there are two issues embroiled in my original post.

For RIPA there is an "implied" consent argument, as raised by Simon Watkins of the Home Office in his email (par 15):
http://cryptome.org/ho-phorm.htm

However Fipr argue that this consent can not be assumed, and provide several layers to their argument, starting with the premise that consent to read (through publication) does not imply consent to intercept - a legally questionable view that I have heard counterargument from several lawyers, hence my post, and ending with less contestable arguments that consent cannot be assumed when:
- reading private email
- a page is not linked from any other page, therefore remains unpublished
- where access controls are in place on the website

Now as far as robots.txt I agree this has no bearing on RIPA but it does on copyright control. Any person publishing a web page and is happy to have their page read and classified by an automated process e.g. Google is unlikely to win damages from Phorm. My view, and I qualify that by saying only for "published" content, i.e. non of the Fipr specific cases apply (password protected etc).

No need to shoot me for having an unpopular view on this. I think the best way to fight Phorm is on the fact that they cannot distinguish with certainty between private content (e.g. password protected) and published content, nor can they accurately and reliably ignore all web email services.

Again this is simply not true, there is existing case law for exactly this situation (which I have cited earlier in this thread). In fact the copyright point is so strong it is one Nicholas Bohm will be referring to himself at the ISPA Legal Forum in London next month.

And again Simon Watkins' comments are not and have been explicitly stated that they should not be read as a legal opinion by the Home Office (and he never posted to crypto either, it was pasted there by a crytpo member). Even the Home Office statement (which frankly isn't worth the paper it is written on anyway which they admit themselves in the very same statement) makes it very clear that even in their opinion implied consent -might- be applicable (again not an official legal analysis as stated directly in the statement) in the absence of any explicit terms. Phorm have stated they will not be paying any attention to explicit terms and will simply assume the right to garnish other people's original works if Google is present in the robots.txt file.

There is absolutely no doubt in my mind or any of the very influential people I have discussed it with including the Earl of Northesk, Nicholas Bohm and many others, that implied consent cannot every be assumed with regards to Privacy and -must- be explicit (informed) consent. the fact that Privacy is a Human Rights in both EU and UK Law makes it inalienable, let me just define that word for anyone who might not know what it means:

not alienable; not transferable to another or capable of being repudiated: inalienable rights.

No-one can assume within the EU or the UK that you have waived an inalienable right (by definition) they must be given up explicitly not impliedly and any judgement in a court of law on such matters -must- be compatible with the ECHR. The implied consent fairytale is nothing but hogwash.

Alexander Hanff
(No I never managed to get to bed yet)

---------- Post added at 15:06 ---------- Previous post was at 15:00 ----------

Originally Posted by haydnwalker

After reading Mick's News Post... I have a question... Do we as consumers have the right to cancel our contract due to the T&C Changes (as we haven't been informed of them) and also the website doesn't give the date of the T&Cs change...

Yes you definitely have the right to cancel without penalty, this is a material change in the contract and is covered under UK contract Law (specifically Unfair Terms in Consumer Contracts Regulations).

The new terms don't even appear to be legal, DPA requires (again) explicit informed consent before any personal data can be exported from the UK. So burying it in Terms and Conditions doesn't satisfy the requirements of DPA.

Alexander Hanff

[Dephormation]

Originally Posted by oblonsky

I think the best way to fight Phorm is on the fact that they cannot distinguish with certainty between private content (e.g. password protected) and published content, nor can they accurately and reliably ignore all web email services.

TIMTOWTDI

- Copyright is certainly one way; unpriced content certainly does not imply copyright free for unlimited commercial exploitation
- Permission to intercept cannot be implied
- Phorm cannot discriminate private private communications (commercial and personal) from 'broadcasts' even if copyright consent and intercept consent can be assumed.

... plus about 3000 other reasons why Phorm should never be tolerated.

Pete.

[Rchivist]

Originally Posted by oblonsky

Now as far as robots.txt I agree this has no bearing on RIPA but it does on copyright control. Any person publishing a web page and is happy to have their page read and classified by an automated process e.g. Google is unlikely to win damages from Phorm. My view, and I qualify that by saying only for "published" content, i.e. non of the Fipr specific cases apply (password protected etc).

There is more at stake when Phorm profile the unique personal exchange of website content between a webmaster and the website visitor for profit, without the informed consent of the webmaster. The arguments about content are not confined to the issue of intellectual property and civil actions from webmasters against Phorm - although publishing something on the web does not give someone else the right to profit by profiling it. As the webmaster of a couple of charity sites, I feel particularly strongly about that.

When I have asked questions from a webmaster perspective I always couch them in terms of "the unique personal exchange of website content between a webmaster and the website visitor for profit, without the informed consent of the webmaster" - as far as that exchange is concerned, and from the perspective of the webmaster, there remain a number of legal issues that are being questioned by Nicholas Bohm and to which I have not yet seen a detailed rebuttal from Phorm/Webwise ISP's. And I want to see their rebuttal so I can make an informed choice about Webwise.

I think it is significant that although I have managed to get a fair number of responses from BT about Phorm/Webwise, they have not picked up a single one of the webmaster issues except to keep insisting that they can presume consent to monitor that private exchange, between webmasters and website visitors, without bothering to ask for it. (except they never talk about any unique private exchange of data - just "websites")

They have not yet explained how they read body text Webwise exclusions on site pages. They refuse to give details on robots.txt. They have not yet explained how they will find the non-listed http webmail pages unless those webmail site owners tell them.

On an issue like this we all have our various hobby horses and varying focus - and personally I think that is a strength of a diverse community. Best to communicate what is going on, and let people pursue their particular interest (in consultation) rather than say that a particular avenue of complaint is not important - unless there is an absolutely clear mistake being made.

I have benefited from that here, when sharing things I thought would be a good idea to do - and the comments of others have helped me see that a particular idea would NOT be helpful - or needed particular care. But once we start the ad-hominem stuff we're finished.

[Chroma]

ilago
Its good to see people down under getting involved

So re: useragent.

Am i correct to assume that not only does the phorm equipment impersonate the site initialy, but that the vice versa is also true?

So in effect the equipment impersonates you so the site only sees your own useragent?

Isnt there some kind of legal framework in place to prevent someone impersonating you in order to gain a profit?

This is sounding more than a little fraudulent to me and i can see that as breaking yet another regulation. I dont presume to be a lawyer in any sense of the word but most laws are based on common sense and it strikes me that this practice would be illegal.

[AlexanderHanff]

Originally Posted by Chroma

:
So re: useragent.

Am i correct to assume that not only does the phorm equipment impersonate the site initialy, but that the vice versa is also true?

So in effect the equipment impersonates you so the site only sees your own useragent?

Isnt there some kind of legal framework in place to prevent someone impersonating you in order to gain a profit?

This is sounding more than a little fraudulent to me and i can see that as breaking yet another regulation. I dont presume to be a lawyer in any sense of the word but most laws are based on common sense and it strikes me that this practice would be illegal.

Yes, Fraud Act 2006, as stated in Nicholas Bohm's legal analysis.

Alexander Hanff

[Rchivist]

Life can be so ironic! Just had this email from BT

Dear BT Forum user,
BT is conducting a survey to help us improve the usefulness of our Support Forums.
We'd be grateful if you could spend two minutes of your time to complete our 10 question survey on your experience with our Support Forums.
To complete the survey, please follow the link below:
http://www.surveymonkey.com/etc *****
Please be advised that this is an official BT survey conducted in line with the BT.com privacy policy. Your responses will be treated as strictly confidential. For more information on the BT privacy policy, please click here:
http://www2.bt.com/btPortal/applicat...privacy_policy
Thank you for your time,
BT Forum Research Team

I really enjoyed completing that one, especially the freeform comment box at the bottom.

[oblonsky]

Originally Posted by AlexanderHanff

Again this is simply not true...

In your opinion...

Originally Posted by AlexanderHanff

There is absolutely no doubt in my mind or any of the very influential people I have discussed it with including the Earl of Northesk, Nicholas Bohm and many others, that implied consent cannot every be assumed with regards to Privacy and -must- be explicit (informed) consent.

Privacy? If you'd actually read what I originally wrote you would see that I was talking only about published content. I don't agree with Nicholas Bohm's opinion in only one respect - implied consent for published content. In fact I wouldn't even go so far as to say I don't agree, just that, after speaking to legal experts I don't see any value of using this weak argument when stronger arguments exist.

I know privacy still applies to published content, the knowledge of what I read is personal and private. However the content of such magazines/books/newspapers is not private.

But, and here is the crux of the argument, if the police want to sequester my subscriptions at my local newsagents, which section of RIPA do you think would apply? I very much doubt it would be section 2.

RIPA section 2 relates to intercept. In my opinion the minute you start trying to pursuade a court or a politician that it applies to "ordinary" published web consent is the minute they switch off.

I know you can argue the letter of the law but what actually matters is the prevailing argument and ultimately the support of parliament, who have it in their power to amend laws, either way.

Someone very close to the issue at an ISP told me the reason they thought no action would ever come of this [the trials] was because of a confusion amongst everyone [implying the campaigners] over exactly what laws were being breached.

To my mind stick with the clearest example rather than inventing increasingly complex and verying reasons why you don't want Phorm.

Phorm is illegal because the IP stream carries a variety of types of communications including but not limited to published content, private messages, broadcast content (possibly not port 80) and it is impossible to identify and ignore private messages separate from other content.

[SMHarman]

Originally Posted by oblonsky

Every time this has happened in the past has preceded either an exclusive in El Reg or an announcement from the Regulators.

Although I noticed on iii that for the first time last year's results were charted, so I wonder whether this has spooked a few of the imbecile home investors who's idea of research is to look at the graphs.

Chartism is a valid way of looking at short term investing.

[NTLVictim]

Originally Posted by lucevans

With Phorm's stock croaking on AIM, the small investors are trying to talk it back up....

Quote from Carol & Son over on iii:

"Small volumes speak rather loudly to people dealing in even smaller volumes and this share isn't being traded enough to get an accurate picture of the real market value. There's more to this than the UK market - and enough cash and equivalents to keep it ticking over. Worry though is the Charles Stanley "research" showing forecast of revenues from Germany and Italy. In my view they need to look to Eastern markets where perceived privacy is less of an issue. Also US looks favourable. The board always said UK was a market tester, but Germany is even more privacy focussed, with scars of the Cold War hanging over the East and so it appears a very privacy-focussed legal framework."

It sounds as if the message that the UK won't take this lying down is starting to get through to Phorm's investors. They're beginning to talk about other countries - a tacit admission that the "pilot study" in the UK is failing even before it's got off the ground? I'd like to think so

I always find it fascinating that otherwise decent, rational people check their conscience at the door when they go shopping for shares. It never ceases to amaze me that people living in a democracy feel no shame openly talking about infringing individuals' human right to privacy for commercial gain; "Hey, if it won't fly in the UK, let's do it somewhere else instead. Who's got a reputation for trampling their citizens' rights? Eastern Europe. Yeah, let's do it to them instead..."

Anyone got friends in phorms new target markets that they can give an early "heads up" to?

Perhaps contacts in the national press of those countries?

[AlexanderHanff]

Again, I have to disagree, in a case of this magnitude it is important to fight it with the strongest laws available. RIPA is Criminal Law and therefore is a very good starting point. Fraud Act, Computer Misuse Act etc are also criminal law so again they are suitable. Torts are not particularly useful (Copyright is a tort for example) because they require significant financial support to be carried through the courts, a requirement many web site owners could simply never meet when facing teams of lawyers and barristers from BT. Joe Public doesn't need any money to bring action under Criminal Law as the CPS does it for them.

If we rely on Copyright law and other torts then that means only big companies (like Amazon, Google, eBay etc.) would ever have their rights upheld (because BT would settle out of court rather than go to court and cause significant damage to their public trust and likely lose), but it leaves hobbiests and non profit organisation little chance of having their rights upheld as they would not be able to finance a civil case.

Yes CDPA is a well know and heavily used piece of legislation and should certainly be included in the arsenal where applicable, but I would never class a tort as more suitable than relevant criminal law in any circumstances.

I appreciate you don't like Phorm either and I appreciate you have your own opinion, but I do not agree with it in the slightest.

Alexander Hanff

[oblonsky]

Originally Posted by AlexanderHanff

Again, I have to disagree, in a case of this magnitude it is important to fight it with the strongest laws available. RIPA is Criminal Law and therefore is a very good starting point. Fraud Act, Computer Misuse Act etc are also criminal law so again they are suitable. Torts are not particularly useful (Copyright is a tort for example) because they require significant financial support to be carried through the courts, a requirement many of BTs customers could simply never meet when facing teams of lawyers and barristers from BT. Joe Public doesn't need any money to bring action under Criminal Law as the CPS does it for them.

If we rely on Copyright law and other torts then that means only big companies (like Amazon, Google, eBay etc.) would ever have their rights upheld (because BT would settle out of court rather than go to court and cause significant damage to their public trust and likely lose), but it leaves hobbiests and non profit organisation little chance of having their rights upheld as they would not be able to finance a civil case.

Yes CDPA is a well know and heavily used piece of legislation and should certainly be included in the arsenal where applicable, but I would never class a tort as more suitable than relevant criminal law in any circumstances.

I appreciate you don't like Phorm either and I appreciate you have your own opinion, but I do not agree with it in the slightest.

Alexander Hanff

ALEX IF YOU'D READ what I wrote I WAS SAYING WE SHOULD USE RIPA, BUT STICK ONLY TO THE ISSUE OF PRIVATE WEB CONTENT.

In fact my original post, which you really should refer to, was spurred on by discussions over CDPA, to which I responded by saying it was almost pointless pursuing the copyright argument.

[AlexanderHanff]

We are going round in circles here, as I said, RIPA applies to all parties in a communication which includes webmasters. RIPA basically extends ECHR Article 8 into UK criminal law; which -is- the right to privacy of communications, it is not the content that is important, it is the communication that is important and it is that communication which is protected and inalienable for all parties which is why implied consent cannot work and cannot be legal.

But for the sake of stopping the thread turning into a 2 player argument I am not going to repeat it again, I suggest perhaps it would be wise if we just agree to disagree and leave it at that.

Alexander Hanff

[Edit]
Incidentally the Newsagent analogy you used is wholly inappropriate with regards to RIPA. If they were opening your mail to see what magazines you buy, that would be applicable to RIPA; if they take the bag off the paper boy to find out, that would probably also fall under RIPA; going to the shop and asking the shop owner what you buy would fall under DPA not RIPA as there is no interception but they would be asking for personal data which is covered under DPA and would require a court order to force the shop owner to comply. Without the court order the shop owner can and should tell Mr Plod to get back on his bicycle and return from whence he came.

[windowcleaner]

Originally Posted by oblonsky

Phorm is illegal because the IP stream carries a variety of types of communications including but not limited to published content, private messages, broadcast content (possibly not port 80) and it is impossible to identify and ignore private messages separate from other content.

hmm, isn't this phorms argument - It doesn't matter that we intercept everything - because we take steps to ignore everything private then it's legal.

Not in my book!

[Edit]
The argument is a red herring - Interception is illegal period.
RIPA

[Russ]

Guys please do not shout, you know the forum rules. I'm just itching to dish out infraction points today, stay within our T&Cs to ensure I don't get my way....