TalkTalk tracking you, phorm?

[Stuart]

The technology is there. It does not mean it will be used.

[Ignitionnet]

Originally Posted by Stuart

The technology is there. It does not mean it will be used.

The technology has been there for many years. Ever since the 'monitor session' command was added to Cisco's equipment and Ethernet cards had promiscuous modes it's been doable with Ethernet. Thicknet easier still.

[Stuart]

True...

[Ignitionnet]

Originally Posted by bluecar1

thing i even though there is no link to dns or dhcp, there are plenty of system that work now by profiling the browser finger print to identify the user so dns/dhcp are now old technology in this game

Just for completeness I had another thought about this. I missed the obvious here. Browser fingerprinting is initiated server side, it needs the appropriate code on the web server that is being visited, so it's of no use at all to an ISP who may wish to track their customers as it relies on every page being coded appropriately or insertion of the appropriate code into every page which would cause considerable alarm and be quite obvious.

'DNS/DHCP' has some life left after all. The browser fingerprinting is a replacement for tracking cookies and the like as used by ad networks but would be of little use to an ISP.

[Rchivist]

The story continues to run in the mainstream press.

http://www.telegraph.co.uk/technolog...Talk-Talk.html

Information Commissioner reprimands Talk Talk
The Information Commissioner’s Office has criticised internet service provider Talk Talk for failing to disclose details of a malware trial that tracked which websites users had visited

Talk Talk, one of the country’s leading internet service providers, has been rapped by the Information Commissioner’s Office (ICO) for failing to disclose details of a software trial that gathered information about the websites visited by its customers.

The Information Commissioner said that Talk Talk should have informed its customers – and the ICO – about a trial it was carrying out to help protect web users from websites infected with malicious software.

The Telegraph was the paper that started this story off in the mainstream press on 29th July this year.
http://www.telegraph.co.uk/technolog...g-web-use.html

An explanation as to why so many of the journalists are using harsh words from their "discipline" glossary, when the ICO's own words were "disappointed" and "concerned" (a fact which has provoked comment here earlier) may be their awareness that TalkTalk are still under monitoring by the ICO, as a result of an earlier DPA enforcement notice issued by the ICO in Jan 2009
http://www.ico.gov.uk/upload/documen...telecom_en.pdf
http://www.ico.gov.uk/upload/documen...talk_final.pdf

That oversight of TalkTalk by the ICO as a result of the notice, is ongoing, including followup liason meetings. It is during this enforcement oversight period that TalkTalk unfortunately chose to conceal their covert trials from both ICO and customers. I think it is fair to speculate that the ICO have fairly strong feelings about that lack of candour in the circumstances.

According to the ICO, in that 2009 notice, their failure to comply with subject access requirements, their unlawful processing of data, and their failure to take appropriate technical and organisational measures to ensure that there was no unauthorised processing of data, and their processing of inaccurate or out of date data, meant that damage and distress had been caused to individuals and that TalkTalk were required to take various measures to put things right for the future.

The ICO have further indicated that it currently "does hold information" on this matter which is "information relating to an investigation conducted by the ICO" which "may lead to a decision to institute criminal proceedings". (and that statement was made by the ICO on 7th September),

This may explain why journalists, aware of TalkTalk's position vis-a-vis the 2009 enforcement notice have all almost without exception, decided to stiffen up the ICO civil service language a little.

revrob, you keep bringing up the (over) two and half year old ICO enforcement notices (9th January 2008) against TalkTalk, which were for

a) Subject access request - The failure to comply with subject access requests, having clearly received them as cheques were cashed and in certain instances further information was requested when it was not reasonably required.

b) Accuracy and Fairness - The setting up of accounts using incorrect details such as the name address and bank details, which in some instances had been obtained from old contract or purchase data, together with the refusal to amend inaccurate records without the permission of the account holder.
c) Security - The ability of customers to view confidential personal data of other customers when logging on to their online account and in some instances the emailing of such data to other customers.
d) Accuracy – The holding of inaccurate data and its disclosure to credit reference agencies or debt collection agencies and the failure to amend the data unless instructed to do so by the Commissioner.

yet you appear to be conflating these nearly three year old acts with the current issues - is this a case of "throw enough mud and some may stick"? You also state that TalkTalk are still

under monitoring by the ICO, as a result of an earlier DPA enforcement notice issued by the ICO in Jan 2009 (Jan 2008, actually)

Can you evidence this, please, as the letter from the ICO Commissioner about the "malware" trials does not mention any "monitoring".

Also, you state the story continues to run in the mainstream press - there is nothing new in yesterday's Telegraph story that had not been mentioned before, so not really "continues to run", is it?

Do you have a link to the ICO statement made on 7th September, as there is nothing (I can find) on their website.

btw, nice of you to interpret what the press may be thinking, or is it just wishful thinking on your part......

[Rchivist]

https://nodpi.org/wp-content/uploads...y-followup.pdf


You may check its veracity and interpretation direct with the ICO.

Originally Posted by R Jones

https://nodpi.org/wp-content/uploads...y-followup.pdf

You may check its veracity and interpretation direct with the ICO.

Thank you for the link.

There were some other relevant (imho) comments in the ICO reply to a FOI request you provided a link to (not really a "statement", then, as that could be assumed to a press release....)

From your link

Were any penalties imposed on CPW/TalkTalk for noncompliance with that notice?

The ICO does not hold information relevant to this aspect of your request. No penalties have been imposed on Carphone Warehouse or Talk Talk for non-compliance with that notice.

Have any subsequent enforcement notices been issued to the above company or its successors, since 9th January 2008, including to TalkTalk Telecom Ltd, a company registered in England and Wales under number 04633015 and to TalkTalk Telecom Group Plc, a company registered in England and Wales under the number 07105891?

The ICO does not hold information relevant to this aspect of your request. No subsequent enforcement notices have been served on Carphone Warehouse or Talk Talk.

Those answers appear to state that TalkTalk have complied with the ICO's requirements for the original enforcement notice, and have not been subject to ICO enforcement notices for any other "breaches" since then.

btw, in your earlier post, you stated that TalkTalk were

under monitoring by the ICO

when in fact, as evidenced by your link, they (the ICO) were

Monitoring the number of complaints received following service of the notice

which is something quite different.

[Ignitionnet]

Another update on other matters. TalkTalk have repeatedly offered Hatari a meeting to discuss his issues, his responses were somewhat odd and basically consisted of trying to make them concede that they had accepted his terms for the ten pounds per log entry charge to his site. Their response was unsurprisingly to emphasise that they had not done so.

He apparently has no interest in meeting with them in person. A somewhat odd move if the intention is to resolve the issues as, obviously, in person meetings to discuss differences tend to be far more constructive than email exchanges. A few minutes in person or on the telephone is certainly worth many emails in instances like this in my experience.

The email exchange dealing specifically with this was from 19th to 21st August. Much as I'd love to link it it both requires registration and Hatari seems to have something of a penchant for slapping IP bans on people he doesn't want to read his forum, which appears to be anyone of a contrary view to his own.

His prerogative of course.

---------- Post added at 13:32 ---------- Previous post was at 13:30 ----------

Originally Posted by foreverwar

revrob, you keep bringing up the (over) two and half year old ICO enforcement notices (9th January 2008) against TalkTalk, which were for yet you appear to be conflating these nearly three year old acts with the current issues - is this a case of "throw enough mud and some may stick"?

I just had a flashback to the Detica CView discussion

[Rchivist]

Originally Posted by foreverwar

Thank you for the link...

Those answers appear to state that TalkTalk have complied with the ICO's requirements for the original enforcement notice, and have not been subject to ICO enforcement notices for any other "breaches" since then.

btw, in your earlier post, you stated that TalkTalk were Quote:
under monitoring by the ICO
when in fact, as evidenced by your link, they (the ICO) were Quote:
Monitoring the number of complaints received following service of the notice
which is something quite different.

Of course that ICO response doesn't state that they have been subject to any enforcement notices for further breaches. I'm not at all clear where you got that idea from.

But let's also be quite clear about the extent of the ongoing monitoring, remembering that the words came from the ICO on 7th September 2010 - thats 48 hours ago.
I'll do the full quote of that section as you snipped it

On an ongoing basis the ICO is taking, and has taken, steps to investigate compliance with the Enforcement notice including:
• Monitoring the number of complaints received following
service of the notice.
• Correspondence with Carphone Warehouse and Talk Talk.
• Meetings with representatives of Carphone Warehouse and
Talk Talk.
• A consensual data protection audit of Carphone Warehouse
and Talk Talk.

There is, without a shadow of a doubt, without reading between any lines, or trying any clever interpretation games, an "ongoing basis" to this monitoring, as of when that sentence was written and approved for release.

It's while that monitoring process has been ongoing, and during the summer of 2010, that these covert trials have been slipped in under the ICO radar.

Contemporaneously with the writing of that FOI response, we find press articles appearing, in which we discover that the ICO is "disappointed" about TalkTalk concealing the trials from customers and ICO.

I'd hate those clear facts to get lost in a welter of controversial and confrontational interpretations.

Further, the issue of whether TalkTalk has "complied" with the notice - that information was requested as part of the FOI, and it was available to the ICO, but it was witheld, because of the reasons stated, regarding the possibility of criminal proceedings etc. So the issue of TalkTalk's ongoing compliance or otherwise is still open. Officially. According to the ICO. As of 7th September 2010.

Which means equally, that I can't say they HAVEN'T complied with the Jan 2008 notice (and I haven't said that), and no one else unfortunately can say that they HAVE complied. Because the ICO is keeping mum on that topic. The FOI questions were answered but the information was withheld. It's the way FOI works.

(Edited to correct the enforcement notice date. Apologies. Other dates and extracts correct.

***************************************

You refer to an earlier discussion

I just had a flashback to the Detica CView discussion

But according to the link that involved a guy/girl called broadbandings. Shouldn't he/she be here to make their point again?

a) why do you keep saying it's Jan 2009 when it happened in Jan 2008?
b) according to the ICO's own words, they are not monitoring TalkTalk, they are just monitoring the number of complaints following the serving of the notice (not "clever interpretation", just fact).

For instance, if I monitor the number of letters I have delivered by the Royal Mail, I am not monitoring the Royal Mail, just the number of letters delivered to my house; your attempt to inflate a specific into a general weakens your argument, imho (but you do seem to do it a lot, so perhaps it's a tactic?)

Do I think TalkTalk should have told the ICO and their customers this trial was happening? Yes.

Do I think you have made up your mind, and will twist any evidence to match your proposition? Also yes.

[Ignitionnet]

Originally Posted by R Jones

You refer to an earlier discussion

But according to the link that involved a guy/girl called broadbandings. Shouldn't he/she be here to make their point again?

Look to the left of the posts Broadbandings made in that thread. Note the lack of the name 'Broadbandings' and the replacement of it with the name 'Ignitionnet'. The quote info is static so doesn't change sadly.

[Rchivist]

Originally Posted by Ignitionnet

Look to the left of the posts Broadbandings made in that thread. Note the lack of the name 'Broadbandings' and the replacement of it with the name 'Ignitionnet'. The quote info is static so doesn't change sadly.

So how does one do that then?
Doesn't seem to be an option on the Control panel.

[Ignitionnet]

Originally Posted by R Jones

So how does one do that then?
Doesn't seem to be an option on the Control panel.

One asks the moderation team.

[Stuart]

If you wish to have your account name changed (as Ignitionnet did), you need to contact one of the admin team..