TalkTalk tracking you, phorm?

[Rchivist]

You have got all the information you need already. You'll have to work it all out for yourselves on the basis of what is already publicly available. I'm sure you will enjoy speculating about it, amongst yourselves. Although I still don't seem to be seeing any response to the more on topic issue I keep referring to and which everyone seems to be stedfastly ignoring.

*****************************
http://www.official-documents.gov.uk.../7586/7586.pdf and http://www.lse.ac.uk/collections/inf...P_Briefing.pdf Especially: (from the gov.uk pdf)
"traffic data may identify a server or domain name (web site) but not a web page"
and giving an example of "traffic data"
"web browsing information to the extent that only a host machine, server or domain is disclosed;"
**********************************
or there are the responses from ICO to recent FOI requests about this issue. That seems a more appropriate area to concentrate on than speculation about a 2 party contractual relationship about which you know virtually nothing.

Thank you, once again, for not answering our questions......

[Mr Angry]

Originally Posted by R Jones

... a 2 party contractual relationship about which you know virtually nothing.

Bob old chap,

Are you now telling us that TalkTalk have entered into a "contractual relationship" with you in relation to certain "agreed conditions"?

[Rchivist]

I'm sure you can work it all out from what is already available out there. I can.

Now - back to the ICO's responses and those government definitions...

[Ignitionnet]

Originally Posted by foreverwar

Thank you, once again, for not answering our questions......

Seems to be an ongoing theme sadly.

Originally Posted by tdadyslexia

I am not going to reply to you any more.

Originally Posted by Hatari

I will not be bothering to reply again.

Originally Posted by R Jones

I've nothing more to add.

---------- Post added at 13:42 ---------- Previous post was at 13:40 ----------

Originally Posted by R Jones

I'm sure you can work it all out from what is already available out there. I can.

Now - back to the ICO's responses and those government definitions...

Originally Posted by R Jones

This dispute between webmasters and TalkTalk is not about privacy. It is about enforcing the terms and conditions for access to web sites.
Their are privacy and interception issues that relate to TalkTalk's programme, sure - and those are matters for the enforcement authorities (ICO, police, CPS).

But don't get confused between privacy and contracts.

So let's not discuss privacy and leave that to the enforcement authorities, let's discuss these contracts shall we?

Don't worry about it ... the general approach from some of the more fervent contributors to this thread seems to be: 'you don't understand the problem. If you did understand it, you would agree with me'. There's not much true debate here, just the same old slightly hysterical ranting and batty schemes from the usual suspects.

[Ignitionnet]

Interesting - a bit of testing shows that this thing does indeed look at robots.txt and then behaves itself with it.

It doesn't spider the entire site, it just replays a previous request after having a mooch at robots.txt if it's the first time it's visited the domain. Beyond reading robots and calling up the original page, scripts included, it doesn't do anything else from the web server perspective.

It has considerable contextual and heuristic awareness built into it as it can be used for parental control - it can analyse and profile content and rate it unsuitable or not for children. Probably experience gained deploying the Great Firewall.

It produces reports categorising websites into various levels such as social networking, music, download. Websites are put into categories and listed by domain name.

The replaying 'appears' to be an attempt to ensure anonymity - original requesting agent data isn't stored anywhere.

Being involved in the data collection side of the service doesn't sound like it'll be optional, having content filtered by it will be.

No HTTPS is included for obvious reasons.

Attempts to ensure personalised URLs aren't replayed are ongoing. Any information in URLs after the ? (Query string) is not passed to the processing unit in order to attempt to prevent personalised URL replay.

Quite amusing they didn't test this stuff elsewhere before bringing it here though, or at very least on a small subset of customers. Would have saved a lot of headaches with malfunctions.

Once they get this properly resolved it shouldn't be particularly noticeable and certainly as designed, and if functioning as intended, there's no privacy issues. Actually getting the thing functioning as intended on the other hand....

EDIT: Ah yes for those concerned about Huawei:

TT bought the system from Huawei. TT have ownership and on-site control. The working of and definition of what the system should do is TT's. However, as this is new hardware, Huawei engineers on-site are helping to configure the hardware and software at the moment (if that makes sense).

It should be noted TT's network runs on Huawei kit, as do various bits of BT's and other ISPs. If Huawei want to pwnz0r your data they can do it with any of the routers, MSANs or other network kit they pimp to ISPs worldwide.

EDIT: Also for the bored how's this for an FoI request - rejected for being vexatious, maybe due to the discussion of espionage, etc, or perhaps due to that making FoI requests is a hobby of this chap's:http://www.whatdotheyknow.com/reques...surveillance_o

Originally Posted by R Jones

I'm sure you can work it all out from what is already available out there. I can.

Now - back to the ICO's responses and those government definitions...

Why not summarise it then, for those of us unable to work it out.

[bluecar1]

Originally Posted by Ignitionnet

Interesting - a bit of testing shows that this thing does indeed look at robots.txt and then behaves itself with it.

It doesn't spider the entire site, it just replays a previous request after having a mooch at robots.txt if it's the first time it's visited the domain. Beyond reading robots and calling up the original page, scripts included, it doesn't do anything else from the web server perspective.

It has considerable contextual and heuristic awareness built into it as it can be used for parental control - it can analyse and profile content and rate it unsuitable or not for children. Probably experience gained deploying the Great Firewall.

It produces reports categorising websites into various levels such as social networking, music, download. Websites are put into categories and listed by domain name.

The replaying 'appears' to be an attempt to ensure anonymity - original requesting agent data isn't stored anywhere.

Being involved in the data collection side of the service doesn't sound like it'll be optional, having content filtered by it will be.

No HTTPS is included for obvious reasons.

Attempts to ensure personalised URLs aren't replayed are ongoing. Any information in URLs after the ? (Query string) is not passed to the processing unit in order to attempt to prevent personalised URL replay.

Quite amusing they didn't test this stuff elsewhere before bringing it here though, or at very least on a small subset of customers. Would have saved a lot of headaches with malfunctions.

Once they get this properly resolved it shouldn't be particularly noticeable and certainly as designed, and if functioning as intended, there's no privacy issues. Actually getting the thing functioning as intended on the other hand....

EDIT: Ah yes for those concerned about Huawei:



It should be noted TT's network runs on Huawei kit, as do various bits of BT's and other ISPs. If Huawei want to pwnz0r your data they can do it with any of the routers, MSANs or other network kit they pimp to ISPs worldwide.

i note with interest you are confirming a number of things and you have verified the interaction with robots.txt,

i am getting permission from a third party before posting some information about that they recieved from TT but i don't think you need it now

It produces reports categorising websites into various levels such as social networking, music, download. Websites are put into categories and listed by domain name.

i note that comment with interest, as i knew it could categorise but the patent did not elaborate i believe

the next question is what will that categorisation information be used for?

that i think will be the driver behind the project, not the malware / parental control benefits as they do not provide income for the kit etc

Originally Posted by bluecar1

i note with interest you are confirming a number of things and you have verified the interaction with robots.txt,

i am getting permission from a third party before posting some information about that they recieved from TT but i don't think you need it now


i note that comment with interest, as i knew it could categorise but the patent did not elaborate i believe

the next question is what will that categorisation information be used for?

that i think will be the driver behind the project, not the malware / parental control benefits as they do not provide income for the kit etc

As R Jones posted two days ago in this thread

Never assume that you know what someone else is doing.

But feel free to speculate away (preferably in private) - but it doesn't make for a very profitable discussion here does it?

[Ignitionnet]

Originally Posted by bluecar1

i note that comment with interest, as i knew it could categorise but the patent did not elaborate i believe

the next question is what will that categorisation information be used for?

Talk Talk themselves gave this information openly, nothing in the patent.

ISPs like to know how their networks are being used - amongst other things it's useful to assess what to pimp to their customers via other means. If a large proportion of your customer base are obsessed with something you may have the opportunity to upsell value adds.

Some DPI kit can already give this information with the appropriate configuration and has been able to for some time

Originally Posted by bluecar1

that i think will be the driver behind the project, not the malware / parental control benefits as they do not provide income for the kit etc

Depends. For many parents, and remember the average TalkTalk customer isn't a geek who knows their own ways to implement such things, parental control is a big benefit.

---------- Post added at 15:27 ---------- Previous post was at 15:23 ----------

Originally Posted by bluecar1

i note with interest you are confirming a number of things and you have verified the interaction with robots.txt

I like checking things for myself where possible

[Rchivist]

Originally Posted by Ignitionnet

It doesn't spider the entire site, it just replays a previous request after having a mooch at robots.txt if it's the first time it's visited the domain. Beyond reading robots and calling up the original page, scripts included, it doesn't do anything else from the web server perspective.

A request for the specific page? That would seem to be going beyond "traffic data" and into something else. Potentially problematic?

http://www.official-documents.gov.uk.../7586/7586.pdf
"traffic data may identify a server or domain name (web site) but not a web page"
and giving an example of "traffic data"
"web browsing information to the extent that only a host machine, server or domain is disclosed"

(further information here:
http://www.lse.ac.uk/collections/inf...P_Briefing.pdf )

Different websites appear to have had very different experiences during the trial, in terms of how the requests arrive from TalkTalk, whether TalkTalk customers have been "followed" to their sites, and whether they respect the terms of robots.txt. Whether this represents "problems" during the trial, or just that the situation may have been more complex than any one website can verify, and perhaps too, more complex than TT have been prepared to publicly acknowlege, only time will tell.

All the requests I have seen on my logs have been for specific pages rather than just the domain. Because I do not have login sections on my site, and I do not nowadays, set cookies or run a forum, I have not seen session id's etc in the urls requested during the trial, but other websites do seem to have seen this and it looks like TT are acknowledging that at least to the ICO if not on the TT blog.

You referred to Huawei "equipment" - the discussion that I have seen has indicated that Huawei IP addresses were involved in this following process - although I don't see that in my own logs for the May-July period. That is something that AFAICS TalkTalk have not addressed at all in their responses.

Even in what TT say they are "proposing" to do in the full rollout (the flow chart they sent to the ICO), there are some unresolved issues as far as DPA/PECR are concerned, and the ICO seems, as yet, unprepared to give them the green light from that point of view.

It is also fairly important to include dates -
1 - the trial in the "pre-Register/Telegraph article" period,
2 - the time from around 26th July onwards (when the main trial appeared from log evidence, to have stopped - Register published 26 July, the Telegraph on 29th July), and then
3 - what any individual site experienced after making direct contact with TalkTalk about the matter - although they may be unable to discuss that publicly because of legal implications.

The various IP ranges from which the trial seems to have originated are all given on the TT members forum discussions, including both TalkTalk and Huawei ranges.

What period do your observations relate to please?
And what IP ranges were you seeing?
I saw 62.4.***.*** log entries for the period prior to the publicity.

[Peter_]

So some people have websites that are online but for reasons only known to themselves they do not want people searching the net to find them or for major search engines to keep records of their sites to enable said people to find their sites as that may be a breach of their sites terms and conditions if their site were to be found by means of them looking for it using a major search engine which in turn prevents the people being able to find their website so that keeps their website private away from potential prying eyes actually looking at their website with the intent of reading it.

If the above made any sense then you must be wearing one of these.

Spoiler: 

[Rchivist]

Actually yes - there ARE a lot of websites who do not want to be found or feature on search engines. I'm amazed you didn't know that. They want to be online but they don't want to be public. It's quite common and quite normal. And it makes perfect sense. So they would be particularly annoyed at their visitors being "followed" to the site by their ISP.

Mine isn't one of those sites, but there are a lot out there.

But to bring this back to our topic - one of the issues that comes up with this sort of monitoring is the reluctance of those who do it to behave like the well known search bots - giving themselves a recognised user agent and just joining in crawling the web and identifying themselves and using the directives in robots.txt.
Instead of following their customers around - and from the evidence so far available, impersonating them by using their request urls for specific pages.

I know when googlebot or Bing/msnbot or Slurp! visit my site, and they are very easy to monitor AND restrict so that my site benefits, but also retains control - as are the other major search engines. But TalkTalk seem to want to be covert. In fact to judge from their useragent strings, they seem to want to be thought of as a human visitor using IE8 and Windows XP Service Pack 2 with NET framework.

That's what doesn't make sense to me.

[Ignitionnet]

Originally Posted by R Jones

A request for the specific page? That would seem to be going beyond "traffic data" and into something else. Potentially problematic?

I'll leave that to armchair lawyers thank you

Originally Posted by R Jones

Different websites appear to have had very different experiences during the trial, in terms of how the requests arrive from TalkTalk, whether TalkTalk customers have been "followed" to their sites, and whether they respect the terms of robots.txt. Whether this represents "problems" during the trial, or just that the situation may have been more complex than any one website can verify, and perhaps too, more complex than TT have been prepared to publicly acknowlege, only time will tell.

I can only comment on my own experiences and the (few) documented examples I've seen.

Originally Posted by R Jones

All the requests I have seen on my logs have been for specific pages rather than just the domain. Because I do not have login sections on my site, and I do not nowadays, set cookies or run a forum, I have not seen session id's etc in the urls requested during the trial, but other websites do seem to have seen this and it looks like TT are acknowledging that at least to the ICO if not on the TT blog.

I believe it's been openly acknowledged by TT that they have been working on this issue. I believe we have already noted this.

http://www.cableforum.co.uk/board/35078115-post21.html

Indeed one can see them noting they have seen issues in their own forum and asked for customer feedback to assist with fixing them.

Originally Posted by R Jones

You referred to Huawei "equipment" - the discussion that I have seen has indicated that Huawei IP addresses were involved in this following process - although I don't see that in my own logs for the May-July period. That is something that AFAICS TalkTalk have not addressed at all in their responses.

Depends where you look to be honest. It's not hard to find.

http://62.24.139.3/forums/showpost.p...&postcount=333

TT bought the system from Huawei. TT have ownership and on-site control. The working of and definition of what the system should do is TT's. However, as this is new hardware, Huawei engineers on-site are helping to configure the hardware and software at the moment (if that makes sense).

Originally Posted by R Jones

Even in what TT say they are "proposing" to do in the full rollout (the flow chart they sent to the ICO), there are some unresolved issues as far as DPA/PECR are concerned, and the ICO seems, as yet, unprepared to give them the green light from that point of view.

Yes, well, I've seen you getting a tad over-excited picking holes in which tense they wrote sections of said ICO submission, and perhaps a tad enthusiastic looking for something, anything to criticise it on.

I'm not a lawyer, either by profession or in an armchair, and will refrain from giving anything more than my previous uneducated opinion.

Originally Posted by R Jones

It is also fairly important to include dates -
1 - the trial in the "pre-Register/Telegraph article" period,
2 - the time from around 26th July onwards (when the main trial appeared from log evidence, to have stopped - Register published 26 July, the Telegraph on 29th July), and then
3 - what any individual site experienced after making direct contact with TalkTalk about the matter - although they may be unable to discuss that publicly because of legal implications.

No idea - the only IP addresses I've seen noted anywhere have been Opal owned. Even the very first post in that thread, from 13th July, notes Opal IP addresses which appears to suggest dates are irrelevant.

The occasionally poor communication with Opal I regard as irrelevant. I'd prefer to not use incorrect statements as ammunition in a witchhunt. If we went down that route neither side would get anywhere and nothing would get done.

Originally Posted by R Jones

The various IP ranges from which the trial seems to have originated are all given on the TT members forum discussions, including both TalkTalk and Huawei ranges.

I've seen nothing mentioning Huawei IP addresses anywhere.

Originally Posted by R Jones

What period do your observations relate to please?
And what IP ranges were you seeing?
I saw 62.4.***.*** log entries for the period prior to the publicity.

Bit confused why you're censoring the rest of that IP, not that it really matters. None of that subnet belongs to Huawei.

Are you thinking of 62.24 / 16 - part of which is indeed owned by Opal and is the subnet which, by all known accounts, accesses have been seen?

My period of personal observations are today, the data I have seen from others dates back to mid-July, well within the pre-Register/Telegraph period.

If you could show me the Huawei IP addresses that you saw it would be good to see - this is quite relevant to this discussion especially given the previous implication by Pete John that this system is involved in espionage along with the implications for data processing.

If you could show connections coming from Huawei's own address space this would be very interesting indeed.