Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[amateria]

Originally Posted by lucevans

Sorry I'm a bit late back to the party, Portly-Giraffe, but I've also been doing some thinking...here's what I wrote:



Is any of it any use to you? I realise it's rather simplistic, but I was aiming for the same writing style as the FAQs on Phorm's Webwise site (or at least, the way they were written the last time I visited before blocking the entire domain!)

Looks good to me. I would add that Phorm is not just reading the websites you visit, but all the data you send to websites is read - which could include sending emails, posting in forums and details of orders sent as part of shopping online. Phorm say thy don't keep this data, but your ISP reads it, to decide whether to strip out sensitive information. We have no way of knowing how safe this stripping out is.

Also, I'm not sure I would call Phorm a new element of the internet. That is exactly how Phorm would like us to see it, but it is not part of the internet, but a wart on the side, a parasite. Perhaps it is "a new surveillance technology, aimed at ordinary people". That is an accurate description which puts a different complexion on what Phorm would like to do.

[lucevans]

Originally Posted by amateria

I'm not sure I would call Phorm a new element of the internet. That is exactly how Phorm would like us to see it, but it is not part of the internet, but a wart on the side, a parasite. Perhaps it is "a new surveillance technology, aimed at ordinary people". That is an accurate description which puts a different complexion on what Phorm would like to do.

I take your point, but I wanted to convey to non-technical users that this technology is a major change rather than just a small "tweak" to their use of the internet (I'm sure Phorm would like us all to believe that their system is just like installing a really cool anti-phishing filter on our home PCs but without the hassle or inconvenience of having to make sure it's updated constantly)

It certainly wasn't my intention to elevate Phorm's system to being the next generation of www !!

Of course, Portly-Giraffe is free to edit and change what I've written for the greater good...

[amateria]

Originally Posted by lucevans

Thanks for that very accessible explanation of copyright.

If I read it correctly, would the advent of systems such as Phorm on the www warrant the writing of a new class of generic copyright notice that allows reproduction for the purposes of relay and profit for the holder, but at the same time expressly denying it's reproduction for profit by any intermediary? This notice would then be available to all website owners to include in their pages if they wish to deny Phorm their use for profit. (I'm thinking of similar generic copyright notices that are in common use by, for example, photographers on sites like Flickr)

It would be a good idea, as it could remove ambiguity and leave Phorm and its ISP partners even more exposed.

[AlexanderHanff]

I am actually so motivated by this entire issue that I am considering converting my article to use for my dissertation. I have been working on my dissertation for some time now which is based on the impact of a Microsoft Centric Public Sector but I have had difficulty in getting replies from local/central government with regards to the economic impact (how much does the government spend on MS licences each year etc.)

I actually believe this Phorm issue is more important and more inline with my other work on Privacy, Biometrics etc. so I am having a rethink on my dissertation. The article might prove useful for my application for my LL.M too, so that is another good reason for changing my dissertation.

Waffling again, I know...

/me gets his coat.

Alexander Hanff

---------- Post added at 17:05 ---------- Previous post was at 16:46 ----------

Y'all need to chat more cos I have to stay awake until gone 10pm now and if I don't find something to keep me occupied I am gonna fall asleep. I feel a bit lost now that I can't continue my article until I hear back from Pinsent Masons or manage to find Trespass to Chattels case law somewhere.

[amateria]

"Hi and thanks for the post. I actually know a great deal about copyright law (which is understandable if you google my full name hehehe) and yes there is an argument via copyright and case law to back it up (google and archive.org are just 2 organisations which have fallen foul of copyright judgements as a result of caching) however there is precious little case law in the UK on this front."

Yes, I see! Don’t forget, though, that English copyright law is different from in the US. There isn’t a lot of case law because the CDPA is fairly clear and does not need a lot of interpretation.

"If you have explicit terms on your web site denying consent then obviously copyright becomes a much stronger argument. I have to say I don't actually agree with some comments I have seen from people claiming that their web activities are copyrighted as they are not actually "works" they are interactions/actions so I am not convinced the customer has any argument regards copyright. It could be argued that someone editing their blog, or creating other types of content (over a non-encrypted link) falls under copyright but Phorm are arguing that they don't profile POST data."

Phorm might not profile it, but as I understand it, the ISP is reproducing POST data in order to decide whether to send any of it to Phorm or not. If the reproduction of a copyright work is unlicensed, then it is an infringing act. If, say, the reproduction for this purpose is happening at the ISP on different kit and as part of a separate process from the straightforward direction of traffic, then it would be relatively easy to separate this potentially infringing reproduction from the lawful (impliedly licensed) reproduction on the ISP's normal, production servers.

"provide the hardware and source code for inspection to prove that they are not processing POST data but this would be very expensive and the Judge might refuse the request on the grounds of "Trade Secrets"."

In England and Wales (Scotland has a different legal system) instead of discovery, there is disclosure. As part of the parties’ legal duty to the court, the onus is on each party to volunteer any documents to the other side that may harm its own case. A judge would not refuse a disclosure request on trades secrets grounds: the most he might do is limit the ability to read the information to lawyers and expert witnesses.

"I am steering clear of the copyright aspects at the moment, I may include something at a later date though."

Copyright is such a well-understood area of the law, I would be inclined to put it in. I would anticipate that your paper might be shown to lawyers, and a copyright argument will be seen as mainstream and therefore be more accessible than the newer, less well-understood things like RIPA.

"Incidentally are you a law student/graduate? I ask because that was one of the best explanations of copyright I have seen on a non legal forum, so if you are not qualified or studying law then I take my hat off to you for taking the time to research it so thoroughly."

Thanks very much! I do work in a relevant area.

"Another point though is this, if we are assuming no implied consent from web sites (or explicit terms denying consent) then I think RIPA is the stronger legislation to use in court simple because it is criminal. Whereas Copyright Infringement can be criminal if it occurs for commercial gain or profit it is more often than not a civil matter. The injunction is a good idea and one I already expressed last week, although I was looking at a High Court injunction under RIPA based on the consent angle as opposed to an Injunction under Copyright Law (which would also be using the consent argument)."

Copyright infringement is criminal, whatever the motive. The judges in the Chancery division understand copyright very well, and deal with injunctions in that respect quite often. RIPA is new, and judges might have to think about it a bit longer. But rIPA also covers the parts of the transaction that are not likely to be subject to copyright. So the two approaches look as though they might be complementary.

"It is an interesting debate though. With Intellectual Property being the litigant's favourite target at the moment and with harsher penalties being lobbied for (even an attempt to change infringement from civil to criminal offences) it could be that copyright law might be seen as a more serious issue than RIPA in the eyes of the Judge (which is actually really a scary thought because I can't think of anything more serious than unlawful interception in my mind)."

More familiar, at any rate, to High Court judges.

I wonder if I sense a reluctance to get into copyright because of your previous brush with it, which is understandable - but maybe think of it as a neutral (ish) tool that you can now use for a virtuous end?

"Anyway I am probably waffling because I have been up all night and all day so forgive me if I am, and again thanks for the post "

It all makes perfect sense to me. And thanks for what you are doing.

[BeckyD]

Originally Posted by Portly_Giraffe

So, let's get http://www.inphormationdesk.org viral!

Stumbled and Twittered. Passed along to friends.

[AlexanderHanff]

I won't hit "quote" this time as the posts are getting bit a long but this post is directed at amateria.

With regards to processing POST data, this is an area I have been umming and arring on too. There is an argument appearing from some academics/experts that are questioning the legitimacy of ICO's claims that this is not a privacy issue. Based on the fact that intercepting and copying the communication/data; scanning; and anonymising the data is defined as processing. I actually agree with this and have been considering adding the DPA to the article to cover this topic.

I agree Copyright is relevant as well and I think in order to make the article comprehensive it would certainly be advisable to include it. You are probably right regarding my aversion to copyright law due to my past experiences; the entire situation took a lot out of me at the time so it is something I try to steer clear of now. So I will be adding Copyright and hope to have something written on the subject sometime tomorrow.

It is also interesting to see the Fraud Act 2006 mentioned on the UKCrypto mailing list so I will be adding some information on that topic as well.

Thanks again for your input.

Alexander Hanff

---------- Post added at 17:44 ---------- Previous post was at 17:40 ----------

This issue seems to have taken over my life. I research, write, research, write, drink coffee, research, eventually sleep, wake up and start the process all over again. I actually sat here for a whole hour this morning puzzled that I was not seeing any action on the stock markets before I realised it was Saturday.

Mind you idle hands and all that so I suppose it is a good thing to keep me busy

[lucevans]

So to recap: Quite apart from the obvious moral issue at stake, on the legal front we now have:

1. Breach of the Data Protection Act
2. Breach of the Regulation of Investigatory Powers Act
3. Breach of Copyright
4. Fraud

And all these are criminal offences, right?

Wow. That legal advice Mr. Ertugrul sought must have been really convincing.

I forgot...there's Also the Human Rights Act.

[AlexanderHanff]

Originally Posted by lucevans

So to recap: Quite apart from the obvious moral issue at stake, on the legal front we now have:

1. Breach of the Data Protection Act
2. Breach of the Regulation of Investigatory Powers Act
3. Breach of Copyright
4. Fraud

And all these are criminal offences, right?

Wow. That legal advice Mr. Ertugrul sought must have been really convincing.

I forgot...there's Also the Human Rights Act.

And...

• Computer Misuse Act 1990
• Privacy and Electronic Communications (EC Directive) Regulations 2003

Not to mention...

• Torts (Interference with Goods) Act 1997 (trespass to chattels/trespass to goods)

It is getting to be a long list eh?

Alexander Hanff

[amateria]

And the European Convention on Human Rights

[AlexanderHanff]

Hey peeps, get your teeth into this little gem

The Council of Europe's Convention on Cybercrime

Alexander Hanff

[amateria]

That's food for thought - is it what was behind RIPA?

Have you ever heard of The Interception of Communications Commissioner, whose remit includes:

the adequacy of arrangements made by the Secretary of State for the protection of communications data and encryption keys for intercepted material.

(http://www.ipt-uk.com/default.asp?sectionID=8&chapter=2)

[AlexanderHanff]

"Internet Trespass :

If a person, without permission, interferes with another persons possessions this may amount to trespass to goods. Traditionally trespass cases have dealt with interference with physical goods but a number of US cases have suggested that accessing a computer hard drive can amount to trespass. The barrier preventing the use of trespass as a means of legal complaint about Adware, Spyware or DRM in the US has been the need to prove that the complainant has suffered actual damage. However, last month a Californian District Court ruled that allegations that Adware had damaged existing software and reduced the efficiency of the complainants computer were sufficient to amount to damage for the purposes of trespass. This was not a final ruling in this case but it is the second Adware trespass case known to the author to get past the first hurdle in US court procedure no doubt other cases are pending or will soon be launched.

In the UK it is not necessary to prove that the trespass has caused damage but a complainant must show that the interference with his property has gone beyond generally acceptable standards of conduct. The surreptitious downloading of software which impairs the function of the users computer and is only of benefit to the commercial entity causing it to be installed is likely to fall foul of this UK test and amount to trespass.

In the US cases the litigation has been brought not only against the seller of the software but against the agencies and advertisers who employ such software. If advertisers in the UK do not think through their use of Adware and DRM technology there is a real risk that they could be subject to trespass claims."

(emphasis added)(source: http://www.legalday.com/commentaries...ss-050306.html )

The above is with regards to Trespass to Chattels and I am happy to say it basically re-iterates my comments from earlier today

Pay particular attention to the part I formatted in italics. It would seem that the Javascript which was inserted in the 2006/2007 trials satisfies this definition pretty much verbatim (especially since Webwise was not part of the trials).

Alexander Hanff

[bonzoe]

[QUOTE
http://petitions.pm.gov.uk/ispphorm/
A[/QUOTE]

Hi, I've signed the petition, BUT why have the closing date March 2009?? - it won't be looked at until then, by that time Phorm may already be intercepting our data.

[AlexanderHanff]

Originally Posted by amateria

That's food for thought - is it what was behind RIPA?

Have you ever heard of The Interception of Communications Commissioner, whose remit includes:

the adequacy of arrangements made by the Secretary of State for the protection of communications data and encryption keys for intercepted material.

(http://www.ipt-uk.com/default.asp?sectionID=8&chapter=2)

It would seem like it is the convention behind RIPA but I don't think it is. If I remember correctly, Jack Straw started work on RIPA back in 1998/99 and that convention is from the end of 2001. RIPA was passed in 2000.

As regards Interception of Communications Commissioner, looks like another useful person to add to the list of those we write to.

Alexander Hanff