Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Moh Kohn]

Originally Posted by weesteev

Hey Alex

Im confused as to the legal ramifications towards communications providers when they clearly state in their terms and conditions of service that this type of action they can justify.

For example....

Virgin Media T&C's

Section B, Category 3, Sub Section ii

"We reserve the right to monitor and control data volume and/or types of traffic transmitted via the interactive services on your Virgin TV and/or Internet access."

...

Thoughts?

Hi Alex,

I was going through these last night and my reading of that section was that data volumes and/or data types could be examined - but not the data itself... This is implicitly linked with the traffic management section although, I suspect, it is therefore not limited to it, and so the inference i'm getting is that this is to enable to do packet type profiling and say "oh - you've received 823MB of x-binary data today" rather than examine the packet contents.

It does not seem to me to be allowing examination, storage or manipulation of the data sent between me and another party... however IANAL

Any knowledgable insight into the Ts & Cs would be well received by all here I suspect.

Cheers
Tim

[AlexanderHanff]

To be honest it doesn't really matter, any terms which effect your statutory rights are unlawful (Unfair Terms in Consumer Contracts Regulations) and since this is a clear violation of RIPA and Privacy and Electronic Communications Regulations 2003 they would be void.

I am not a lawyer either, but the bods at FIPR are lawyers and furthermore government policy advisers. I share the same interpretation (the logical one) of the law as they do on this issue and I am reasonably confident that they know what they are talking about.

Furthermore if BT thought their terms and conditions covered them already then why did the Home Office advice mention new terms and conditions and why have BT stated they intend to try to circumvent this law by changing their current terms?

Let us also not forget that the ISP need the consent of the web site/content owners as well as the consent of their customers. The Home Office statement claimed that implied consent (having a publicly accessible web site) -might- give the ISP an escape route but also stated it was not a definitive legal article and that it would be up to the courts to decide. FIPR (and myself) believe that implied consent is -not- valid and that consent must be given explicitly (informed consent) under RIPA. Given that it also falls under Human Rights law it is fair to assume that explicit consent is required.

However, even if (and it is a big if) a Judge allows the implied consent angle, there are -many- very popular websites which have explicit terms already in place which deny consent for such activity, so they cannot be seen to be giving implied consent. Furthermore, many webpages are -not- publicly accessible (not linked to from anywhere in the public domain) but do not use HTTPS either. As they are not published in the public domain they are not relevant under the implied consent argument either.

Alexander Hanff

[Barkotron]

I'd say they're on dodgy ground if they try to use that: "data volume and/or types of traffic transmitted" does not equate to reading the full content of every single webpage viewed by a user.

To me, the most telling thing is that BT (and, I think, Virgin, although I can't find the statement right now) have already said that they would have to change their T&C in order to comply with the law. If they have to change this, then that says to me that their current ones are not enough. As far as I can see, BT have committed a clear criminal breach of RIPA, and have not provided any clear reasons why they believe this not to be the case. Just stating "we don't think it's illegal" over and over is not good enough - they need to point out exactly where in the provisions of the RIPA they think covers their actions.


Just to recap the RIPA thing as far as I see it:

There are a few things which are clear, taking into account all of the advice we've seen from the Home Office, FIPR and others:

1. The Phorm system does legally constitute an interception under RIPA. There are no dissenting legal opinions to this that I've seen.
2. This interception is not necessary to provide the contracted service of providing an internet connection, so the ISPs cannot claim immunity under RIPA due to necessity. I haven't seen anyone arguing against this either.
3. That being the case, in order for the ISPs to legally implement this system, they require "explicit consent" from both the customers and the website owners. Even the Home Office advice makes the point that consent from both parties is absolutely required under the act.


As far as I see it, the above 3 points are not in dispute (although if anyone thinks otherwise, please reply pointing out where I've gone wrong). The only argument is around what exactly constitutes "explicit consent". I can see that a properly worded set of Terms and Conditions would provide this on behalf of the customer (although note that in my opinion, and inferring from their actions, also BT's opinion, their current Terms and Conditions do not give sufficient consent under the law). So the question remains whether this concept of "implied consent" for webpages is worth anything or not. Personally, I don't think the Act allows you to assume consent - BT/Phorm obviously feel differently.

Even if you can assume a general consent, I think BT/Phorm would have a very hard time in court when coming up against some of the Terms of Service for many websites (Amazon and the BBC site have been mentioned), which would appear to explicity deny the right for third parties to use their content for commercial exploitation without further agreement: I can't see that they can argue that an assumed implied consent can trump an explicit statement denying that consent on the part of website owners.

I'd be very interested to hear a detailed explanation of how they expect to be able to comply with the RIPA given all of the above. Unfortunately we don't hear any detail, just blanket statements of "we disagree". I think they need to do a lot better than this in public statements, as all the PR is doing is winding people up, and they definitely would need to do a lot better than this in court.

[theciscokid]

Originally Posted by Ravenheart

Interesting comment from Virgin that Batchain posted a link to in the 3 strikes thread..

http://www.computeractive.co.uk/comp...s-itself-three



Raised privacy and legal issues... hmmm now that sounds familiar for some reason..

Hi

Thanks for the info Ravenheart. Very interesting reading.

I hope VM realise what raised privacy and legal issues means.........hmmm indeed!

---------- Post added at 10:24 ---------- Previous post was at 10:10 ----------

Originally Posted by Winston Smith

Just read an article on the BBC news website about the proposed threes strikes on p2p, under the 'See Also' was this http://news.bbc.co.uk/1/hi/technology/7246403.stm. What was interesting was the following quote:

"A spokesman for the Internet Service Providers Association (ISPA) said the 2002 E-Commerce Regulations defined net firms as "mere conduits" and not responsible for the contents of the traffic flowing across their networks.

He added that other laws on surveillance explicitly prohibited ISPs from inspecting the contents of data packets unless forced to do so by a warrant."

The obvious question then is what has changed since the 15th February to make this now legal?

Really good article. Thanks for posting it Winston. Cheers

It really strikes me that Phorm must be very ignorant to peoples concerns and according to the above quote are in blatant breach of the law.

They clearly don't give a monkeys about anyone's privacy or rights. Now where is that petition???

[lucevans]

Originally Posted by AlexanderHanff

Just to make it clear, if they were only using the system to provide extra security features to prevent Phishing (inspecting the packets to look for blacklisted destinations) then it would be a harder argument (although would still need to adhere to the consent aspects as it is not an essential procedure for providing broadband). But the second they use that data for anything else (ie profiling for advertising purposes) then it violates the law.

That worries me, Alexander. Phorm think they've covered themselves by offering an "opt-out" which, if chosen, (allegedly) means that they "won't use that data for anything else."
We suspect that our data will still pass through the profiler even if we've opted-out, but they promise not to record that profile information anywhere, transmit it to anyone, or use or for anything (remember people, this is an ex-spyware company...) so they haven't breached the law as you've outlined it above.

I think we need to concentrate on the consent aspect, as this is necessary before they can even pass any data through the profiler. I personally don't want any data of mine to go anywhere near a profiler, whether I'm opted in or out.

---------- Post added at 11:01 ---------- Previous post was at 10:56 ----------

Originally Posted by theciscokid

It really strikes me that Phorm must be very ignorant to peoples concerns and according to the above quote are in blatant breach of the law.

They clearly don't give a monkeys about anyone's privacy or rights. Now where is that petition???

I'm afraid I'm rather more cyncial about Phorm than you, ciscokid. I don't think they're ignorant to our concerns; I believe they know exactly why we're worried, and they're utterly indifferent. As far as they're concerned we're just units to be utilized in the generation of profit. The only thing that will make them care is if the "units" look like they're going to "malfunction" and cause a drop in revenue (i.e. mass opt-out).

[Barkotron]

Originally Posted by lucevans

That worries me, Alexander. Phorm think they've covered themselves by offering an "opt-out" which, if chosen, (allegedly) means that they "won't use that data for anything else."
We suspect that our data will still pass through the profiler even if we've opted-out, but they promise not to record that profile information anywhere, transmit it to anyone, or use or for anything (remember people, this is an ex-spyware company...) so they haven't breached the law as you've outlined it above.

I think you may be confusing RIPA and DPA here: DPA has the provisos about using the data. Under RIPA the simple act of interception without warrant or explicit consent is illegal. We could be sending a random stream of 1s and 0s, as soon as they send this to the profiler, even if they instantly discard everything from memory, without consent, constitutes an illegal interception - the use they are putting this data to (unless is is required to operate the communications system, which is not the case) is irrelevant.

Under DPA they may have a get-out under "no personally identifiable material" is recorded, transmitted or used. However one of the lawyers on the Channel 4 piece yesterday pointed out that the very act of "anonymising" the datastream was processing personal information. You can't remove personal information from a stream without looking at it and ignoring it, which can be (and will be) argued as processing.

It's important to keep the distinctions between the DPA and the RIPA in mind. As far as I can see, Phorm is illegal under RIPA, and only arguably legal under DPA.

[kt88man]

Good Morning to the PhormUKPRteam.

What news have you for us today, or are you simply browsing?

[lucevans]

Originally Posted by Barkotron

I think you may be confusing RIPA and DPA here: DPA has the provisos about using the data. Under RIPA the simple act of interception without warrant or explicit consent is illegal. We could be sending a random stream of 1s and 0s, as soon as they send this to the profiler, even if they instantly discard everything from memory, without consent, constitutes an illegal interception - the use they are putting this data to (unless is is required to operate the communications system, which is not the case) is irrelevant.

Under DPA they may have a get-out under "no personally identifiable material" is recorded, transmitted or used. However one of the lawyers on the Channel 4 piece yesterday pointed out that the very act of "anonymising" the datastream was processing personal information. You can't remove personal information from a stream without looking at it and ignoring it, which can be (and will be) argued as processing.

It's important to keep the distinctions between the DPA and the RIPA in mind. As far as I can see, Phorm is illegal under RIPA, and only arguably legal under DPA.

Thanks for the clarification Barkotron.

[OF1975]

Welcome back to the forums PhormUKPRTeam

While you are here care to answer a question I asked you about over a week ago? What precisely is stored in the "research and debug logs" that are stored for 14 days? As I said last time I asked this question, it is the word "research" which has me most concerned. What data will be stored in these logs and precisely what type of "research" will be done with that data? This is important because you often claim that no data is stored.

Care to answer the question?

[bigbadcol]

Hi PhormUKPRteam,

Could you pleas comment on the news yesterday about BT and the secret trial of your bosses illegal interception of data.

What has been done with the data?

what was the criteria of the trials?

can you publish an assessment of the outcome?

I am also a little worried about your lack of posting around the web. Is the stress making you ill.

thank you and looking forward to your next cut and paste non-reply

[3x2]

"A spokesman for the Internet Service Providers Association (ISPA) said the 2002 E-Commerce Regulations defined net firms as "mere conduits" and not responsible for the contents of the traffic flowing across their networks.

Just as an aside to the Phorm debate this may come back to bite ISP's on both sides of the Atlantic. By testing and deploying Phorm ISP's are proving that given sufficient incentive they can indeed monitor and control the content of traffic on their networks. Something they had previously said couldn't be done. They can't possibly claim that they are "mere conduits" on the one hand then routinely intercept, profile and classify users on the other.

I imagine those who seek to remove "objectionable" content from the networks will not have missed the implications of universal profiling.

[weesteev]

Originally Posted by AlexanderHanff

No definitely not. RIPA has provisions in it covering the principle of those terms which is specifically with regards to them being essential procedures for providing the service (ie your broadband). Note how the terms explicitly state data volume and type of traffic as opposed to the actual contents of the traffic/data. This is acceptable as it falls under reasonable network management, but to actually look at the data itself or intercept that data for the purpose of an advertising business is not covered.

They have no grounds for the interception with regards to their existing terms and conditions.

Furthermore, Privacy and Electronic Communications Regulations 2003 (section 8 I think) states that Terms and Conditions which do not adhere to the regulations (as in must have customer consent first, which implies this must be explicit (informed) consent as opposed to implied consent (not objecting to the terms)) are void under the regulations. So even if they had Terms and Conditions giving themselves permission to intercept, those terms would be invalid and void.

Furthermore, even if they managed to get a "sympathetic" judge, the activity still contravenes the European Convention on Human Rights and the Human Rights Act 1998 and as such the judge would have to rule that the case is incompatible with the Convention.

Hopefully it will all become clear when people read my interpretation of the law in the article I am currently working on.

Alexander Hanff

Nice one Alex, I look forward to the read!

[OF1975]

Phorm PR arent showing as viewing the thread anymore. Did we frighten them off?

[gnilddif]

Hi all. I just joined. I'm a BT customer. My first post on this forum is a technical question:

Over on the BT forums they've issued a new FAQ.
http://www.beta.bt.com/bta/forums/ann.jspa?annID=64
No 57 reads:
"Does Webwise runs its own Javascript software on the users' machines? (relates to a Phorm patent where it claims it can do this)
No, Webwise operates at the network level and will not download, install or run any software on users' machine."

However, at http://www.experts-exchange.com/Prog..._22012205.html
we see
"On a website I look after (http://www.bluesnights.co.uk/) I've noticed a strange piece of javascript that has embedded itself on the site after the closing html tags.
Eg: </html>
<script type="text/javascript">var PSpc="I.287303.1",PSsize="none";</script><script type="text/javascript" src="http://ntp.sysip.net/tag/2.js"></script>
How it got there, I've no idea. Can only think I've been "infected" via my Firefox browser when visiting Google and the like (who all seem to have the same script on their web pages when I viewed page "Source"!) and then inadvertently uploaded via my FTP when making site changes.
This doesn't show up on my computer as a virus/malware, etc.
Google reference to "sysip" is very sparse (seems to be a proxy) and I can only assume that the script is some sort of "spyware" or harvester?
Does anybody know what this is? And what does it do?
And how do I get rid of it - permanently!
Is their a counter script I can add to my web pages to stop these scripts "attaching" themselves incognito?
Can anybody help? Many thanks,
Richard"

If it was not on the user's machine, then where was it?
What do you think BT means by "at the network level"?

Another horror story with more examples of the Phorm/Webwise software injection HTML or javascript is at:
http://www.spikelab.org/blog/btProxyHorror.html

gnilddif

[gaz1]

thankyou for all those people that have posted alot of information on this site its been an interesting read

i have also been in touch with a few forums about this phorm business myself and brought it to light with them about secureing there website against phorm

and past it around the joe public around the parents and schools but i can tell you now the schools system was shocked about this system and was doing enquires within there system and was thanked for the mention

has anybody found that channel 4 update yet where phorm was grilled alot more at the night news as i missed that myself

its looking more like phorm pr are unwilling to answer our ? anymore as they are seen viewing the site but are unwilling to answer the ? that have been put to them only giveing the usual drivel that is copy and pasted form site to site