Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[flowrebmit]

Anyone else wondered why the allegedly random Webwise UID is so LARGE?

According to Richard Clayton's technical notes point 31, Phorm say that the Webwise UID numbers that will be stored in our browser's cookies is a 16 byte random number. A 16 byte number can range from 0 to 4.3 x 10^38 (or to express it another way that is 43 followed by 37 zeros). It is a mind-boggling large number, so why is the random number so big?

It seems (to me) too much of a coincidence that the replacement IPv6 addressing scheme is 16 bytes long...

For info, an IPv4 address, ones that you may be familar with (e.g. 87.106.129.133) is just a 4 byte number written in a form that is slightly easier for humans to understand.

[Portly_Giraffe]

Originally Posted by manxminx

Hia Portly, excellent website. In your footer where you say "Write to your MP - Write to your MEP" you could make it a clickable link to http://www.writetothem.com

have added it

Originally Posted by manxminx

Your site could also benifit from a favicon.ico such as: you can download the .ico from http://www.favicon.cc/?action=icon&file_id=7437

Tell me about favicons? (I'm not really a web developer as such)

Originally Posted by lucevans

You're very welcome. I've sent the URL to all my family and friends. Keep up the good work!

Thanks, lucevans. I've now loaded the site to:
http://www.inphormationdesk.org/
which will be the "official" address now. Thanks for the name, Ravenheart. The old address will of course still work.

So, let's get http://www.inphormationdesk.org viral!

[lucevans]

Originally Posted by flowrebmit

Anyone else wondered why the allegedly random Webwise UID is so LARGE?

According to Richard Clayton's technical notes point 31, Phorm say that the Webwise UID numbers that will be stored in our browser's cookies is a 16 byte random number. A 16 byte number can range from 0 to 4.3 x 10^38 (or to express it another way that is 43 followed by 37 zeros). It is a mind-boggling large number, so why is the random number so big?

It seems (to me) too much of a coincidence that the replacement IPv6 addressing scheme is 16 bytes long...

For info, an IPv4 address, ones that you may be familar with (e.g. 87.106.129.133) is just a 4 byte number written in a form that is slightly easier for humans to understand.

I don't think it could be a user's IPv4 address (unless that is a dynamic address?) since every time the user at a particular IP address deletes their Phorm UID cookie, the replacement one they are issued with is different to the previous one.

Perhaps it's because they anticipate a lot of people blocking the permanent cookie, and thus requiring a new unique number for every page they visit? At least with that many to choose from, we might actually avoid being given a recycled one that was previously assigned to someone else (and may well be associated with that person's "habits")

One thing that struck me about Richard's technical description was the fact that the UID number will also be incorporated into the site cookie of each website you visit that uses the OIX advertising platform. If that's true, then won't each site be able to associate the user's IP address with their Phorm UID number (and, if you've entered your real name, address, credit card number, etc. on their site, also to all of these "real world" details)? That potentially means that each website that uses OIX adverts will be able to link your real identity, personal details and financial details with your web activity profile. Hmmm. Tell me again Phorm, how is this better than Google?

[Altern8]

I found this article, not sure is it's been posted before. It does mention phorm and its evil ways.

http://www.washingtonpost.com/wp-dyn...040304052.html

[Ravenheart]

The posts on this site seem to state that the US is already infested with Phorm like advertising.

http://blog.clickz.com/archives/topics/advertising.html

[flowrebmit]

Originally Posted by lucevans

Perhaps it's because they anticipate a lot of people blocking the permanent cookie, and thus requiring a new unique number for every page they visit? At least with that many to choose from, we might actually avoid being given a recycled one that was previously assigned to someone else (and may well be associated with that person's "habits")

One thing that struck me about Richard's technical description was the fact that the UID number will also be incorporated into the site cookie of each website you visit that uses the OIX advertising platform. If that's true, then won't each site be able to associate the user's IP address with their Phorm UID number (and, if you've entered your real name, address, credit card number, etc. on their site, also to all of these "real world" details)? That potentially means that each website that uses OIX adverts will be able to link your real identity, personal details and financial details with your web activity profile. Hmmm. Tell me again Phorm, how is this better than Google?

That depends on whether your computer is ever connected to the internet on non-Phorm infected ISP. If you always use VM, and they had Phorm kit then the nasty Webwise UID would be stripped by the DPI kit as the cookie passes through i.e. See Richard Clayton's point 22:

22. The specious cookie (from the point of view of www.cnn.com) will be removed as the request passes through the Layer 7 switch.

I feel deeply uneasy about the this manipulation of data and redirecting and faking web-sites. It just smacks of Rootkit type thinking.

[lucevans]

Originally Posted by flowrebmit

That depends on whether your computer is ever connected to the internet on non-Phorm infected ISP. If you always use VM, and they had Phorm kit then the nasty Webwise UID would be stripped by the DPI kit as the cookie passes through i.e. See Richard Clayton's point 22:

22. The specious cookie (from the point of view of www.cnn.com) will be removed as the request passes through the Layer 7 switch.

I feel deeply uneasy about the this manipulation of data and redirecting and faking web-sites. It just smacks of Rootkit type thinking.

Thanks for the clarification (Not good for anyone who uses their laptop at home and on wifi hotspots, then.)

I agree - adding things and stripping things out of my web traffic is not something I want anyone to do, especially a spyware company.

[info4u]

http://news.bbc.co.uk/1/hi/technology/7331493.stm

Virgin Media might have to drop the use of PHORM as the legality of it is being questioned, breach of privacy.

Specially in the states there shhh**** hot on that

[kt88man]

Please, someone tell me I'm wrong:

So much for the anonymous UID.

On a website that hosts the Phorm/OIX adverts when the advert is fetched by the browser from the use of either an IMG tag or an Iframe, then the (Phorm/OIX) 'adserver' has the UID from the cookie (to know which advert to serve) and the users IP address from the request header (or we won't get the advert back)...

So Phorm now have your (so called anonymous) UID tied to your IP address...

[lucevans]

Originally Posted by kt88man

Please, someone tell me I'm wrong:

So much for the anonymous UID.

On a website that hosts the Phorm/OIX adverts when the advert is fetched by the browser from the use of either an IMG tag or an Iframe, then the (Phorm/OIX) 'adserver' has the UID from the cookie (to know which advert to serve) and the users IP address from the request header (or we won't get the advert back)...

So Phorm now have your (so called anonymous) UID tied to your IP address...

According to Richard Clayton's analysis of the system, the unique identifier portion of the cookie is stripped-out by the Phorm hardware in your ISP before it gets to the website, so the website doesn't actually get to see your UID. The decision of what ad to serve you from their website is made by Phorm based on your UID and the ad is then passed to the website by Phorm's hardware for them to serve to you. However, there is an additional, apparently redundant piece of kit in the middle between the Layer 7 intercept hardware and the Phorm-owned ad channel server kit which does not relay your IP address to the Phorm kit. It seems that the only reason for introducing this extra machine into the pathway is to prevent your IP address "going outside the ISP's network" - almost as if they anticipated the legal attacks on their spyware system...

[thebarron]

Hi there just gone throught the 10,000 mark and we will soon be in the top 10!

http://petitions.pm.gov.uk/ispphorm/

Also the USA is beginning to wake up too!

http://www.washingtonpost.com/wp-dyn..._Comments.html

[kt88man]

Originally Posted by lucevans

According to Richard Clayton's analysis of the system, the unique identifier portion of the cookie is stripped-out by the Phorm hardware in your ISP before it gets to the website, so the website doesn't actually get to see your UID. The decision of what ad to serve you from their website is made by Phorm based on your UID and the ad is then passed to the website by Phorm's hardware for them to serve to you. However, there is an additional, apparently redundant piece of kit in the middle between the Layer 7 intercept hardware and the Phorm-owned ad channel server kit which does not relay your IP address to the Phorm kit. It seems that the only reason for introducing this extra machine into the pathway is to prevent your IP address "going outside the ISP's network" - almost as if they anticipated the legal attacks on their spyware system...

Thanks. Must pay more attention and not read late at night...

Section E 65-66 of the analysis explains it.

Still very unhappy with it though. ('Trust me, I'm anonymising everything...')

[amateria]

Originally Posted by AlexanderHanff

OK I have updated the article again, you can find it here: http://www.paladine.org.uk/phorm_paper.pdf

I have now completed the first draft of the sections pertaining to RIPA, Privacy and Electronic Communications (European Directive) Regulations 2003 and Computer Misuse Act 1990 (Scotland).

I will be looking at Trespass to Chattels later today and then covering other aspects of the issue.

As always, feedback welcomed. I think I fixed the words with Americanised "ise" (ize) but let me know if you find any I missed (other than in quotes obviously).

Alexander Hanff

Alexander,

Can I suggest adding copyright infringement to the list (if you haven't already). A good overview of statute law is at

http://www.jisclegal.ac.uk/ipr/IntellectualProperty.htm

but this does not really explain the relationship of copyright to electronic media. Your library may have Laddie, Prescott & Vittoria, or Copinger and Skone James, which are the main practitioners legal textbooks on copyright.

I hope the following is also useful:

Computer programs are "literary works" in the terms of the Copyright, Designs and Patents Acts 1988 (CDPA) and computer screens, such as those displayed on websites, are liable to be "artistic works" in accordance with the CDPA.

Literary and artistic works are protected by copyright if they have sufficient originality and complexity. (In practice, most things that have had more than a few minutes work put into them will be protected by copyright.)

There is no need to register copyright: it arises automatically as soon as a non-trivial, original work has been created. The author of the work can license others to reproduce the work in an unlimited way, can forbid all reproduction or can specify limited circumstances in which reproduction is be permitted. The author may transfer his interest in the rights to another. The new owner of the rights can then specify the terms on which reproduction will be allowed.

Any unlicensed reproduction of a copyright work is a criminal offence, punishable by imprisonment, and potentially gives rise to entitlement on the part of the owner of the rights to apply in the High Court for an injunction to prevent any further infringement and can sue for damages and/or an "account of profits" (payment to the victim of the profit that the infringer has made from the infringing act).

In the case of copyright works in electronic form, reproduction occurs when (among other things) the work or a significant part of it is copied into transient computer memory, stored on disk in virtual memory or stored more permanently on disk or any similar medium. This point is the basis of all software licensing: even to execute a program, it is necessary to have a licence in order to avoid civil and criminal liability for the reproduction of the program code transiently in computer memory.

The ISP effects a reproduction when it directs streams of data through its computer systems as a necessary part of its service. In order to do this lawfully, the ISP must have a licence to reproduce any copyright works. Is this reproduction lawful? If it is licensed, then it is. If unlicensed, the reproduction is unlawful. The licence may be express or implied.

The concept of implied licences makes not much sense in RIPA terms, but perfect sense in the context of copyright. If you publish a website, open to the world, then in the absence of any express terms there is an implied licence for end users and ISPs to reproduce the copyright material - as it a necessary part of the process of access and delivery. If the user has to register, accept terms and conditions and use a password (perhaps even pay) to access parts of the website, then reproduction of those parts of the website without complying with the registration etc. requirements is almost certainly an infringing act - unless you are the ISP, who has an implied licence to direct and transmit data streams to the duly registered user.

Many websites have express licences in the published terms and conditions: these specify the terms and scope of the copyright licence to reproduce the materials that comprise the website.

Is the further reproduction by the ISP for the purposes of Phorm's analysis lawful? It's difficult for me to see an argument that by publishing a website, an implied licence is given to Phorm or its partners to reproduce in order extract commercial value from the copyright material: this does not arise by necessary implication as a part of the directing of traffic. And, as many posters have pointed out, there are express licence terms on many large, commercial websites, which would not permit the reproduction envisaged by Phorm and its ISP partners.

It seems to me that a website publisher would be able to apply to the court for an injunction to prevent Phorm from infringing the website owner's copyright. After the event, I do not see why in principle a copyright owner should not seek to obtain damages or an account of profits from the ISP and/or Phorm that they have made as a result of their infringing acts.

All that's stopping rights owners is the cost - which would of course be very substantial. This is the problem with rights: they are expensive to enforce.


Keep up the good work,

[lucevans]

Originally Posted by amateria

Alexander,

Can I suggest adding copyright infringement to the list (if you haven't already). A good overview of statute law is at

http://www.jisclegal.ac.uk/ipr/IntellectualProperty.htm

but this does not really explain the relationship of copyright to electronic media. Your library may have Laddie, Prescott & Vittoria, or Copinger and Skone James, which are the main practitioners legal textbooks on copyright.

I hope the following is also useful:

Computer programs are "literary works" in the terms of the Copyright, Designs and Patents Acts 1988 (CDPA) and computer screens, such as those displayed on websites, are liable to be "artistic works" in accordance with the CDPA.

Literary and artistic works are protected by copyright if they have sufficient originality and complexity. (In practice, most things that have had more than a few minutes work put into them will be protected by copyright.)

There is no need to register copyright: it arises automatically as soon as a non-trivial, original work has been created. The author of the work can license others to reproduce the work in an unlimited way, can forbid all reproduction or can specify limited circumstances in which reproduction is be permitted. The author may transfer his interest in the rights to another. The new owner of the rights can then specify the terms on which reproduction will be allowed.

Any unlicensed reproduction of a copyright work is a criminal offence, punishable by imprisonment, and potentially gives rise to entitlement on the part of the owner of the rights to apply in the High Court for an injunction to prevent any further infringement and can sue for damages and/or an "account of profits" (payment to the victim of the profit that the infringer has made from the infringing act).

In the case of copyright works in electronic form, reproduction occurs when (among other things) the work or a significant part of it is copied into transient computer memory, stored on disk in virtual memory or stored more permanently on disk or any similar medium. This point is the basis of all software licensing: even to execute a program, it is necessary to have a licence in order to avoid civil and criminal liability for the reproduction of the program code transiently in computer memory.

The ISP effects a reproduction when it directs streams of data through its computer systems as a necessary part of its service. In order to do this lawfully, the ISP must have a licence to reproduce any copyright works. Is this reproduction lawful? If it is licensed, then it is. If unlicensed, the reproduction is unlawful. The licence may be express or implied.

The concept of implied licences makes not much sense in RIPA terms, but perfect sense in the context of copyright. If you publish a website, open to the world, then in the absence of any express terms there is an implied licence for end users and ISPs to reproduce the copyright material - as it a necessary part of the process of access and delivery. If the user has to register, accept terms and conditions and use a password (perhaps even pay) to access parts of the website, then reproduction of those parts of the website without complying with the registration etc. requirements is almost certainly an infringing act - unless you are the ISP, who has an implied licence to direct and transmit data streams to the duly registered user.

Many websites have express licences in the published terms and conditions: these specify the terms and scope of the copyright licence to reproduce the materials that comprise the website.

Is the further reproduction by the ISP for the purposes of Phorm's analysis lawful? It's difficult for me to see an argument that by publishing a website, an implied licence is given to Phorm or its partners to reproduce in order extract commercial value from the copyright material: this does not arise by necessary implication as a part of the directing of traffic. And, as many posters have pointed out, there are express licence terms on many large, commercial websites, which would not permit the reproduction envisaged by Phorm and its ISP partners.

It seems to me that a website publisher would be able to apply to the court for an injunction to prevent Phorm from infringing the website owner's copyright. After the event, I do not see why in principle a copyright owner should not seek to obtain damages or an account of profits from the ISP and/or Phorm that they have made as a result of their infringing acts.

All that's stopping rights owners is the cost - which would of course be very substantial. This is the problem with rights: they are expensive to enforce.


Keep up the good work,

Thanks for that very accessible explanation of copyright.

If I read it correctly, would the advent of systems such as Phorm on the www warrant the writing of a new class of generic copyright notice that allows reproduction for the purposes of relay and profit for the holder, but at the same time expressly denying it's reproduction for profit by any intermediary? This notice would then be available to all website owners to include in their pages if they wish to deny Phorm their use for profit. (I'm thinking of similar generic copyright notices that are in common use by, for example, photographers on sites like Flickr)

[AlexanderHanff]

Originally Posted by amateria

Alexander,

Can I suggest adding copyright infringement to the list (if you haven't already). A good overview of statute law is at

http://www.jisclegal.ac.uk/ipr/IntellectualProperty.htm

but this does not really explain the relationship of copyright to electronic media. Your library may have Laddie, Prescott & Vittoria, or Copinger and Skone James, which are the main practitioners legal textbooks on copyright.

I hope the following is also useful:

Computer programs are "literary works" in the terms of the Copyright, Designs and Patents Acts 1988 (CDPA) and computer screens, such as those displayed on websites, are liable to be "artistic works" in accordance with the CDPA.

Literary and artistic works are protected by copyright if they have sufficient originality and complexity. (In practice, most things that have had more than a few minutes work put into them will be protected by copyright.)

There is no need to register copyright: it arises automatically as soon as a non-trivial, original work has been created. The author of the work can license others to reproduce the work in an unlimited way, can forbid all reproduction or can specify limited circumstances in which reproduction is be permitted. The author may transfer his interest in the rights to another. The new owner of the rights can then specify the terms on which reproduction will be allowed.

Any unlicensed reproduction of a copyright work is a criminal offence, punishable by imprisonment, and potentially gives rise to entitlement on the part of the owner of the rights to apply in the High Court for an injunction to prevent any further infringement and can sue for damages and/or an "account of profits" (payment to the victim of the profit that the infringer has made from the infringing act).

In the case of copyright works in electronic form, reproduction occurs when (among other things) the work or a significant part of it is copied into transient computer memory, stored on disk in virtual memory or stored more permanently on disk or any similar medium. This point is the basis of all software licensing: even to execute a program, it is necessary to have a licence in order to avoid civil and criminal liability for the reproduction of the program code transiently in computer memory.

The ISP effects a reproduction when it directs streams of data through its computer systems as a necessary part of its service. In order to do this lawfully, the ISP must have a licence to reproduce any copyright works. Is this reproduction lawful? If it is licensed, then it is. If unlicensed, the reproduction is unlawful. The licence may be express or implied.

The concept of implied licences makes not much sense in RIPA terms, but perfect sense in the context of copyright. If you publish a website, open to the world, then in the absence of any express terms there is an implied licence for end users and ISPs to reproduce the copyright material - as it a necessary part of the process of access and delivery. If the user has to register, accept terms and conditions and use a password (perhaps even pay) to access parts of the website, then reproduction of those parts of the website without complying with the registration etc. requirements is almost certainly an infringing act - unless you are the ISP, who has an implied licence to direct and transmit data streams to the duly registered user.

Many websites have express licences in the published terms and conditions: these specify the terms and scope of the copyright licence to reproduce the materials that comprise the website.

Is the further reproduction by the ISP for the purposes of Phorm's analysis lawful? It's difficult for me to see an argument that by publishing a website, an implied licence is given to Phorm or its partners to reproduce in order extract commercial value from the copyright material: this does not arise by necessary implication as a part of the directing of traffic. And, as many posters have pointed out, there are express licence terms on many large, commercial websites, which would not permit the reproduction envisaged by Phorm and its ISP partners.

It seems to me that a website publisher would be able to apply to the court for an injunction to prevent Phorm from infringing the website owner's copyright. After the event, I do not see why in principle a copyright owner should not seek to obtain damages or an account of profits from the ISP and/or Phorm that they have made as a result of their infringing acts.

All that's stopping rights owners is the cost - which would of course be very substantial. This is the problem with rights: they are expensive to enforce.


Keep up the good work,

Hi and thanks for the post. I actually know a great deal about copyright law (which is understandable if you google my full name hehehe) and yes there is an argument via copyright and case law to back it up (google and archive.org are just 2 organisations which have fallen foul of copyright judgements as a result of caching) however there is precious little case law in the UK on this front.

If you have explicit terms on your web site denying consent then obviously copyright becomes a much stronger argument. I have to say I don't actually agree with some comments I have seen from people claiming that their web activities are copyrighted as they are not actually "works" they are interactions/actions so I am not convinced the customer has any argument regards copyright. It could be argued that someone editing their blog, or creating other types of content (over a non-encrypted link) falls under copyright but Phorm are arguing that they don't profile POST data.

Of course during discovery you could ask the court to force Phorm to provide the hardware and source code for inspection to prove that they are not processing POST data but this would be very expensive and the Judge might refuse the request on the grounds of "Trade Secrets".

I am steering clear of the copyright aspects at the moment, I may include something at a later date though.

Incidentally are you a law student/graduate? I ask because that was one of the best explanations of copyright I have seen on a non legal forum, so if you are not qualified or studying law then I take my hat off to you for taking the time to research it so thoroughly.

Another point though is this, if we are assuming no implied consent from web sites (or explicit terms denying consent) then I think RIPA is the stronger legislation to use in court simple because it is criminal. Whereas Copyright Infringement can be criminal if it occurs for commercial gain or profit it is more often than not a civil matter. The injunction is a good idea and one I already expressed last week, although I was looking at a High Court injunction under RIPA based on the consent angle as opposed to an Injunction under Copyright Law (which would also be using the consent argument).

It is an interesting debate though. With Intellectual Property being the litigant's favourite target at the moment and with harsher penalties being lobbied for (even an attempt to change infringement from civil to criminal offences) it could be that copyright law might be seen as a more serious issue than RIPA in the eyes of the Judge (which is actually really a scary thought because I can't think of anything more serious than unlawful interception in my mind).

Anyway I am probably waffling because I have been up all night and all day so forgive me if I am, and again thanks for the post

Alexander Hanff