Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[none]

Originally Posted by Sirius

Anyone know if BE Unlimited have made any statement about this Spyware ?

http://www.badphorm.co.uk/e107_plugi...ewtopic.php?51

nothing formal so far, but others are apparently looking into it.

[Barkotron]

Originally Posted by SMHarman

So thus far the analagy stands but the difference is the opt in or opt out aspect at a transactional level. Not the fact you are passing transactional data.
Though the supermarket sends you tailored offers and decides shop layout and promotional advertising that will appear in your store based on this data. You could say the store is doing it's best to shove ads in your face as you walk around. Wait until Tesco change their cards from barcode cards to RFID cards that will be read as you walk around the store.

Do Tesco send all their transactional data to a company run by people with a known history of morally repugnant and debatably legal behaviour? Do they use methods which differ from criminal behaviour only in so far as they are sanctioned by the ISP in question without referral to those whose personal data is being mistreated in this way? Do they send it to a company with roots in a country which has a deserved reputation for online crime and fraud, who process it on servers located in a country famous for repression and no privacy legislation at all? Do they take the information whether you want them to or not, and only allow you to "opt-out" of whether you receive the "benefits" of their data mining?

Equating supermarket clubcards with this is very wide of the mark.

This Phorm company is run by a guy who admits with no apparent trace of guilt to have been involved in installing adware and rootkits on users' systems without their knowledge in order to give them unwanted pop-up adverts (google PeopleOnPage for details. Both Symantec and F-Secure have this company listed as "spyware").

The technology is nothing short of an ISP-sanctioned man-in-the-middle attack, which if perpetrated by anyone other than an ISP would be illegal in most European countries, and may well in any case be illegal.

As far as I understand it, exporting personal data to other countries is in any case illegal unless an explicit opt-in (NOT out) has been obtained under the Data Protection Act. Phorm's excuse that they "anonymise" the data appears extremely flimsy according to those who have had a good look at what their system proposes to do.

It appears that the "opt-out" is purely that you will not have targeted adverts - your data will still be processed by these servers whether you have opted out or not.



Even if the above were not the case, there is absolutely no benefit at all to the end user of this technology. It will add lag to your connection, provide "phishing protection" which is already built in to Windows if using Windows and available free from other providers if not - without having adverts shoved in your face. It adds no value at all to their service and sells everything you do online to people who have no business looking at it - is that really what you want?

[Jayceef1]

Originally Posted by Barkotron

Do Tesco send all their transactional data to a company run by people with a known history of morally repugnant and debatably legal behaviour? Do they use methods which differ from criminal behaviour only in so far as they are sanctioned by the ISP in question without referral to those whose personal data is being mistreated in this way? Do they send it to a company with roots in a country which has a deserved reputation for online crime and fraud, who process it on servers located in a country famous for repression and no privacy legislation at all? Do they take the information whether you want them to or not, and only allow you to "opt-out" of whether you receive the "benefits" of their data mining?

Equating supermarket clubcards with this is very wide of the mark.

This Phorm company is run by a guy who admits with no apparent trace of guilt to have been involved in installing adware and rootkits on users' systems without their knowledge in order to give them unwanted pop-up adverts (google PeopleOnPage for details. Both Symantec and F-Secure have this company listed as "spyware").

The technology is nothing short of an ISP-sanctioned man-in-the-middle attack, which if perpetrated by anyone other than an ISP would be illegal in most European countries, and may well in any case be illegal.

As far as I understand it, exporting personal data to other countries is in any case illegal unless an explicit opt-in (NOT out) has been obtained under the Data Protection Act. Phorm's excuse that they "anonymise" the data appears extremely flimsy according to those who have had a good look at what their system proposes to do.

It appears that the "opt-out" is purely that you will not have targeted adverts - your data will still be processed by these servers whether you have opted out or not.



Even if the above were not the case, there is absolutely no benefit at all to the end user of this technology. It will add lag to your connection, provide "phishing protection" which is already built in to Windows if using Windows and available free from other providers if not - without having adverts shoved in your face. It adds no value at all to their service and sells everything you do online to people who have no business looking at it - is that really what you want?

Tescos certainly have much more personal data on ther card holders than Phorm will ever have. Name Address, e-mail, phone, as a minimum and lots more depending on what you have used your card for. This is more than just what websites you have been browsing. And they do targetted ads.

One example springs to mind when a female custoemr rang Tescos to ask why they had sent her money off coupons for condoms. She was very insistent that she and her husband never used them. The customer service rep at the other end then confirmed that according to their records condoms had indeed been purchased and a clubcard used. I guess hubby had some explaining to do.

[Barkotron]

Originally Posted by Jayceef1

Tescos certainly have much more personal data on ther card holders than Phorm will ever have. Name Address, e-mail, phone, as a minimum and lots more depending on what you have used your card for. This is more than just what websites you have been browsing. And they do targetted ads.

One example springs to mind when a female custoemr rang Tescos to ask why they had sent her money off coupons for condoms. She was very insistent that she and her husband never used them. The customer service rep at the other end then confirmed that according to their records condoms had indeed been purchased and a clubcard used. I guess hubby had some explaining to do.

... and way, way over there in the distance is the point...

At every single transaction, Tesco have to ask me whether or not I wish to use a Clubcard (i.e. give them the ability to correlate what I am buying with my Clubcard account), and that's even if I choose to allow them to collate this data in the first place by carrying a Clubcard. Phorm get this information whether or not I wish them to.

Phorm say they "anonymise" email addresses and numbers longer than 3 digits long. My address is, say "94 Road Street, Townville, TV3 8BJ". How many email addresses and strings of digits are in that? How many emails to a web mail account from any web retailer e.g. confirming a delivery addresses will it take for Phorm to have access to this information? How many numeric digits long is your name?

There is no consent sought or given by Phorm, there is no _real_ opt-out, it _should_ be opt-in, they are run by people who I wouldn't trust with my full name, let alone my browsing data, they will be processing _and_ "anonymising" all of the data AFTER it arrives in China (where, incidentally, people care even less about all our Data Protection laws than formerly reputable companies like BT and VM here do), and we apparently have to trust these crooks?

Where exactly is the benefit to us here? What part of the above sounds like a good idea? Targeted adverts on the internet, where I already block all adverts I can and actively avoid giving money to those companies whose ads I can't block? "Phishing protection" which is given away free by reputable companies rather than apparently "reformed" purveyors of scumware?

Well, no. If Virgin continue with this, then I quit. You may be happy being treated like a hole used expressly for the purpose of vomiting money into VM shareholders' pockets, but 95% of people on this forum aren't. They can stuff their poxy ad revenue: the day they start running this scam is the day I cancel every one of their services.

[Florence]

The day they start this I will borrow money to pay BT to put a new line in and go with Aquiss.net. They have already stated they will not use this.. http://forums.aquiss.net/viewtopic.php?f=7&t=3457

[SMHarman]

Originally Posted by lucevans

SMHarman - your argument is valid when made against people who DO have a store loyalty card, but I am a Virgin Media broadband customer who has always chosen NOT to trade my buying habits for a minimal discount - I value my privacy more than £1.50 off my weekly shopping bill. So what argument can you put forward for ME having to endure a total loss of privacy and security on the internet?

I'm not arguing for. I agree with you and I think that this last few postings has highlighted the differences between and opt in and opt out process extremely well.

Which US ISPs are using this software? After all this is a US company you would think they would market to their home territory first!?

[Jayceef1]

Originally Posted by Barkotron

... and way, way over there in the distance is the point...

At every single transaction, Tesco have to ask me whether or not I wish to use a Clubcard (i.e. give them the ability to correlate what I am buying with my Clubcard account), and that's even if I choose to allow them to collate this data in the first place by carrying a Clubcard. Phorm get this information whether or not I wish them to.

Phorm say they "anonymise" email addresses and numbers longer than 3 digits long. My address is, say "94 Road Street, Townville, TV3 8BJ". How many email addresses and strings of digits are in that? How many emails to a web mail account from any web retailer e.g. confirming a delivery addresses will it take for Phorm to have access to this information? How many numeric digits long is your name?



There is no consent sought or given by Phorm, there is no _real_ opt-out, it _should_ be opt-in, they are run by people who I wouldn't trust with my full name, let alone my browsing data, they will be processing _and_ "anonymising" all of the data AFTER it arrives in China (where, incidentally, people care even less about all our Data Protection laws than formerly reputable companies like BT and VM here do), and we apparently have to trust these crooks?

Where exactly is the benefit to us here? What part of the above sounds like a good idea? Targeted adverts on the internet, where I already block all adverts I can and actively avoid giving money to those companies whose ads I can't block? "Phishing protection" which is given away free by reputable companies rather than apparently "reformed" purveyors of scumware?

Well, no. If Virgin continue with this, then I quit. You may be happy being treated like a hole used expressly for the purpose of vomiting money into VM shareholders' pockets, but 95% of people on this forum aren't. They can stuff their poxy ad revenue: the day they start running this scam is the day I cancel every one of their services.

Put your toys back in the pram. I never said I agreed with it. Just pointing out that there are many other things out there that are just as bad if not worse. Sky already sell data on and that does include e-mails & tel nos. Phorm say they do not get e-mails or addresses yet you say they do how do you know better? There has been one (probably premature) press release from Phorm and the world and his wife have set themselves up as experts on the subject spreading wild rumours about what it can or cannot do yet nothing is agreed as yet. Wait for more information and then see. It may be a problem or it may not depending on how it is done. What BT do may be different to what CPW or VM do. Until we know more it is pointless people getting worked up about it.

[Sirius]

Originally Posted by Florence

The day they start this I will borrow money to pay BT to put a new line in and go with Aquiss.net. They have already stated they will not use this.. http://forums.aquiss.net/viewtopic.php?f=7&t=3457

If that ISP is not a LLU ISP then its data will travel through BT's server's and network and will if you think about it be open to abuse. Remember BT have already sold data to Phorm without there users Knowledge or permission so therefor i would not put it past BT to use ANY data being carried on there network and passing through there servers. A LLU ISP will not be subject to this of course as they do NOT use BT's backbone. Think about what i have just said and it is possible for BT to do it.

---------- Post added at 07:37 ---------- Previous post was at 07:33 ----------

Originally Posted by Jayceef1

There has been one (probably premature) press release from Phorm and the world and his wife have set themselves up as experts on the subject spreading wild rumours about what it can or cannot do yet nothing is agreed as yet. Wait for more information and then see. It may be a problem or it may not depending on how it is done. What BT do may be different to what CPW or VM do. Until we know more it is pointless people getting worked up about it.

There is a simple matter over this. The company that they were is a company i NEVER want within a mile of my data never mind computer. Mark my words they WILL work they way up to a full blown spyware package, Its what they are renowned for. ?

[dav]

Originally Posted by Jayceef1

Put your toys back in the pram. I never said I agreed with it. Just pointing out that there are many other things out there that are just as bad if not worse. Sky already sell data on and that does include e-mails & tel nos. Phorm say they do not get e-mails or addresses yet you say they do how do you know better? There has been one (probably premature) press release from Phorm and the world and his wife have set themselves up as experts on the subject spreading wild rumours about what it can or cannot do yet nothing is agreed as yet. Wait for more information and then see. It may be a problem or it may not depending on how it is done. What BT do may be different to what CPW or VM do. Until we know more it is pointless people getting worked up about it.

I think you're missing the point a little.

It isn't about what it can and cannot do, but that it is being done at all and is totally without our consent. Based on the head guys checkered past, there are also serious trust concerns. Personally, I wouldn't trust him with a shopping list written on a scrap of paper.

[none]

Might want to take note of these guys ISPA - http://www.ispa.org.uk/about_us/
The Internet Services Providers' Association (ISPA UK) is the UK's Trade Association for providers of Internet services.

Seems they have a significant swagger in getting Virgin to resolve issues and complaints. See here - http://bbs.adslguide.org.uk/showflat...0&fpart=1&vc=1

Might be worth bookmarking them for future use, especially those caught up halfway through a 12-month contract :S

Their online complaints form can be found here - http://www.ispa.org.uk/cgi-bin/complaints.cgi

[Barkotron]

Originally Posted by Jayceef1

Put your toys back in the pram. I never said I agreed with it. Just pointing out that there are many other things out there that are just as bad if not worse. Sky already sell data on and that does include e-mails & tel nos. Phorm say they do not get e-mails or addresses yet you say they do how do you know better? There has been one (probably premature) press release from Phorm and the world and his wife have set themselves up as experts on the subject spreading wild rumours about what it can or cannot do yet nothing is agreed as yet. Wait for more information and then see. It may be a problem or it may not depending on how it is done. What BT do may be different to what CPW or VM do. Until we know more it is pointless people getting worked up about it.

Not without your explicit consent they don't (you _will_ have had to tick or untick a box somewhere at some point to consent to this). If you ask for it, fine. This is different.

There is good information on how it works available from people who have actually looked at the way the BT experiment was run last year (again without consent).

Phorm have explained exactly what they throw away on their website: "Phorm technology does not view any information on secure (HTTPS) pages, and ignores strings of numbers longer than three digits to ensure that we do not collect credit card numbers, phone numbers, National Insurance or other potentially private information."

How many addresses and names conform to those parameters? Fair enough, that may change, but that's the information we have right now. Does that sound like enough to you?

The company is a "reformed" known spyware/scumware operator who have used rootkit techniques in the past. Would you let Ian Huntley work as a primary school teacher? Would you let Jerome Kerviel run a hedge fund?

It's not just random shouting and toy/pram ejection. I'd say the most sensible option is not to wait and see whatever harvesting these crooks think they can get away with next, but to voice objections loudly right now, before VM/BT etc. get the idea that their customers really are sheep. If you don't let them know, and threaten them the only way it's actually possible to hurt them, by withdrawing your custom, then they will think this is acceptable behaviour and expand it. It is not.

[MovedGoalPosts]

Originally Posted by Barkotron

Phorm have explained exactly what they throw away on their website: "Phorm technology does not view any information on secure (HTTPS) pages, and ignores strings of numbers longer than three digits to ensure that we do not collect credit card numbers, phone numbers, National Insurance or other potentially private information."

How many addresses and names conform to those parameters? Fair enough, that may change, but that's the information we have right now. Does that sound like enough to you?

And how many postcodes have only three numbers meaning your entire address can be captured? Dates of birth can also be captured if a short format dd-mmm-yy style is used. This is blatantly unsafe technology.

[handyman]

Forgive me if I'm wrong as just had a quick scan of the thread.

Can this technology detect and replace ad blocks running on this site. (And others such as mine)?

If so then it has little to do with protecting users from spam and more to do with pure greed. If 70% of UK users get ads served by their isp then I stand to lose a fair amount of money.

Originally Posted by handyman

Forgive me if I'm wrong as just had a quick scan of the thread.

Can this technology detect and replace ad blocks running on this site. (And others such as mine)?

If so then it has little to do with protecting users from spam and more to do with pure greed. If 70% of UK users get ads served by their isp then I stand to lose a fair amount of money.

No you would sign up to this just as you would Google Ads. Its your choice as a web site to use the adverts or not. Still waiting for confirmation whether Cable Forum plan on using the ads once it goes live because if they do then they are as bad ad Virgin and the others.

---------- Post added at 09:55 ---------- Previous post was at 09:50 ----------

Originally Posted by Jayceef1

Put your toys back in the pram. I never said I agreed with it. Just pointing out that there are many other things out there that are just as bad if not worse. Sky already sell data on and that does include e-mails & tel nos. Phorm say they do not get e-mails or addresses yet you say they do how do you know better? There has been one (probably premature) press release from Phorm and the world and his wife have set themselves up as experts on the subject spreading wild rumours about what it can or cannot do yet nothing is agreed as yet. Wait for more information and then see. It may be a problem or it may not depending on how it is done. What BT do may be different to what CPW or VM do. Until we know more it is pointless people getting worked up about it.

This has got to be the most sensible post on here in regards to this topic.

[Stuart]

Originally Posted by Rob

And how many postcodes have only three numbers meaning your entire address can be captured? Dates of birth can also be captured if a short format dd-mmm-yy style is used. This is blatantly unsafe technology.

Postcodes (and for that matter, addresses) are largely text, so would be picked up by Phorm..