Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Tarquin L-Smythe]

Can't understand it's Sunday and no promise of a trial this week.Losing their touch or the press wiseing up and smelling the BS

[Florence]

While I was with VM I hardly ever changed my IP address infact unless my modem was offline for over 3 hours I had the same IP number looking at the IP list on ISPreview in 8 yrs I had 24 IP numbers. I checked ISPreview as I moderate there and visit it everyday so easiest way to check IPs I have used over 8 yrs.

Wonder hjow many complaints they wil get if Phjorm goes ahead and function creep then starts to grow and Phorm starts to use the whole list on tghe patent for phorm.
http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-559869

[madslug]

Originally Posted by NTLVictim

So sites like genes/friends reunited need to be informed...off you go!

I have recently canceled my friendsreunited membership after looking at the tracking that their new FREE-to-everyone membership offers. They did not appear to be too worried that that was the reason I gave for leaving. They are seeing the $$$$ signs and nothing more.

Just add them to the list of blocked domains in the hosts file. Why? - ads with tracking cookies appear on the login and edit profile pages.

Originally Posted by icsys

I have just received a response from my MP regarding Phorm. My enquiry was forwarded to BERR and the response received was from Shriti Vadera of BERR.

The letter explained that ISP's have announced plans to track internet activity using phorm's Webwise and OIX products. It continued to explain that phorm replaces ads with ones relevant to the customer's web browsing meaning less irrelevant ads. (Standard info - nothing new).

She went on to say...

I´m sorry to say (from my holiday late night bar )that she went onto say absolutely nothing that she has not said in letters to many other people who have written to her. Before I went on holiday she sent EXACTLY the same letter to me too. Completely crap. Sorry, I´ve had many drinks, but to borrow the words of a fellow contributor here: "Makes my blood boil"

Shriti has to be spelt so carefully, especially given how I feel catching up on so much content here after days away and seeing the *****e coming from our Government on the issue. Absolutely unacceptable, this total disregard for the law so far is shocking. I can only hope that they are reading the intelligent debate taking place here and elsewhere (I hope they are skipping over some of the less intelligent debate - no offence intended - I know that we garner support by using different methods, but some of the tack has been less than high level in the last 5 days or so!)

Hank

---------- Post added at 23:51 ---------- Previous post was at 23:48 ----------

Originally Posted by Dephormation

I also had a letter from Patricia Hewitt (BT non exec director and MP) repeating almost verbatim Emma Sanderson's drivvel about extensive legal advice. (I wrote back, telling Ms Hewitt I thought it would be entertaining to read that advice if only BT would publish it, given what I've read of the ICO documentation, and Home Office advice).

Its getting more and more obvious to me with every new revelation the government are desperately trying to white wash this criminal shambles, presumably to protect someone senior in Labour, or a big donor, or some government department from deep embarrassment. The bit I can't work out is why the opposition parties aren't ripping them to shreds over this. Don Foster in particular has been very quiet lately.

July will be a very interesting month I'm sure.

Yes, I agree Pete. What the heck is happening? Don Foster was apparently pro our position - what has changed that?

Hank

---------- Post added at 23:51 ---------- Previous post was at 23:51 ----------

Originally Posted by NTLVictim

I wouldn't worry too much about Shriti Vadera...she's Brown's meat puppet, when he goes, she goes!

Yeah but let´s not wait for that to happen!!

[AlexanderHanff]

http://digg.com/tech_news/Deep_Packe...Privacy_Online

Copy and Paste into URL bar, this one will almost definitely make Digg front page. Last torrentfreak article about me hit about 1600 Diggs, the article has already sent over 200 people to the NoDPI web site in the last hour and over 600 page views.

Alexander Hanff

[madslug]

Originally Posted by icsys

I have just received a response from my MP regarding Phorm. My enquiry was forwarded to BERR and the response received was from Shriti Vadera of BERR.

The letter explained that ISP's have announced plans to track internet activity using phorm's Webwise and OIX products. It continued to explain that phorm replaces ads with ones relevant to the customer's web browsing meaning less irrelevant ads. (Standard info - nothing new).

If you read the HO report, it is confirmed there that where the ISP customer has opted in and the website being intercepted is displaying the javascript which allows the OIX adverts to be displayed, then RIPA does not apply as both sender and receiver are deemed to have agreed to the interception.

I don't think anyone reading this forum has any problem with that analysis. If you don't follow what I am on about - read the questions: they are very specific about what is being considered.

Originally Posted by icsys

She went on to say that she was aware that some ISP customers have voiced concerns about disclosure to third parties about their web browsing and said she understood those concerns. She also stated that the Government is committed to ensuring that peoples privacy is fully protected and that we have legislation in place for this purpose and consequently the ICO has been looking at the proposals to ensure that any use of phorm is compatible with the relevant privacy legislation.

I am so happy that she is aware of how unhappy people are. People are agreeing to having adverts delivered to them and to be warned about phishing sites.
Nowhere is anyone agreeing to having their visits to any other sites which do not display adverts intercepted. Nor are there any scripts on the non-OIX partner sites which can in any way be deemed to indicate that they have consented to the interception.

There is a very finely defined list of who may be intercepted: ISP customers (limited to individual identifiable users on the IP address) who have opted in and partner sites who are hosting the OIX scripts.

Even people who share the same IP address can not be deemed to have consented (so you had better not intercept their traffic looking for an opted in/out cookie). Likewise, all other sites must be excluded (if not there is RIPA [criminal] and Copyright [civil] to protect them).

Phorm need to have a list of opted in sites and users and need to ensure that those and only those communication streams are intercepted, else they fall foul of RIPA and PECR.

However, the ISP customers have not consented to the browser hijack nor the forged cookies that are being placed onto their computers (nor have the sites agreed to the use of the domain in this manner). The various Acts covering the legalities/crimes have already been discussed.

Originally Posted by icsys

She went on to say that the Home Office had advised Phorm on how the use of phorm might be affected by RIPA.

Phorm appear to be unable to understand the advice they have been given - no doubt trusting that their new cookie writing script will be successful in ensuring cookies are stripped and are invisible to all sites that can claim an illegal interception under RIPA.

Originally Posted by icsys

She also stated that both the ICO and herself had discussed details of the upcoming trial with BT and seems satisfied that BT's confirmation that customers' web browsing will only be monitored and ads delivered if they opt-in to the trial.

That is because BT have kept very quiet about the millions of sites they will be intercepting who are not/should not be considered part of the trial.

Originally Posted by icsys

In light of information that is appearing in the online press and the FoI documents, I wonder if she really does understand the concerns and if this Government really is committed to protecting privacy.

Phorm and BT don't understand it - what chance has anyone else of getting close to the truth?

Originally Posted by icsys

With reference to Phorm's document titled 'Phorm informed consent update', a sentence in the document reads: 'Since Phorm technology does not use IP addresses to target advertising there is a strong argument that section 7 of PECR does not apply'.

I can [sort of] agree with Phorm on this: the equipment that needs to be considered for PECR s7 is sitting within the ISP - the ICO should be asking this question of the ISP and not Phorm (although, as Phorm understand the technology, they should be answering on behalf of the ISP and not on behalf of Phorm/OIX). The ISP is using the IP address to deliver the advert back to the customer. Without IP address, the advert can not be delivered. The script delivering the advert will have access to the IP address and the UID (we only have Phorm's assurance that they won't use the display of the adverts to tie in the IP address and the UID).

Originally Posted by icsys

It is easy now to see why Phorm continually state that the Home Office and ICO are comfortable with webwise, they are both quoting different sets of legislation. A bit like madslug's arson versus theft analogy.

And ignoring any discussion about interceptions that fall outside the Webwise remit.

I just hope that the HO and ICO read my letters to them regarding there being no provision within the trial for sites to opt-in. Assuming that all sites are happy to be opted in by default and requiring 165 million sites to contact BT to ensure that they are treated as opted out is not practical under common law let alone any other legal requirement.

Websites are commercial businesses. No one may copy the confidential communications between a business and its customers and then use that information to sell advertising so that the competition can come along and poach the customers. For the government to allow that to happen is to put thousands if not millions of small internet based businesses out of business.

It is not only me saying this. Webmasters around the world are shouting on many forums that their sites may not be intercepted. Are you listening, HO, there is no implied consent to sites' content being copied, profiled, channeled and sold to advertisers. NONE. Commercial businesses do not consent to their customers being tracked around the internet. The relationship between a website and its customers is PI to the business so why should Phorm be allowed to use [sell] it to commercial advantage?

And, why does everyone want to destroy thousands of businesses? - so that thousands of blogs that host on free hosting using free scripts and only take a few hours a day to maintain can be monetised and earn the writers some money for their spammy articles.

Anyway, icsys, I hope the above gives you some ammo to include in your reply to your MP and Shriti Vadera of BERR. They both need educating.

[vicz]

Well said Madslug

[Wildie]

Originally Posted by vicz

Well said Madslug

what they said
you forgot one thing they cannot intercept a minors data, profile it and sell it on for adverts can they.

[Dephormation]

14,966

[madslug]

Originally Posted by Wildie

what they said
you forgot one thing they cannot intercept a minors data, profile it and sell it on for adverts can they.

Yes, they can and are planning to intercept traffic from minors.

If you look on the OIX site (read the source on the contact page for advertisers/publishers) and one of the channel options is 'teens'. It was only after I saw this within the code (found it first on the test site that their web designer was hosting - don't you just love Google's cache?) and that one word probably did more to get me involved in stopping this than anything else that has been discovered about it.

In fact, a minor is responsible for the username I am currently using.

[Wildie]

Originally Posted by madslug

Yes, they can and are planning to intercept traffic from minors.

If you look on the OIX site (read the source on the contact page for advertisers/publishers) and one of the channel options is 'teens'. It was only after I saw this within the code (found it first on the test site that their web designer was hosting - don't you just love Google's cache?) and that one word probably did more to get me involved in stopping this than anything else that has been discovered about it.

well teens is any age from 13 to 19 a minor as I see it is 12 and under.

[warescouse]

Originally Posted by Wildie

well teens is any age from 13 to 19 a minor as I see it is 12 and under.

Lots of minors use the internet connections of the account holder. Hopefully only to use permitted sites by their parents, but that does not allow or consent to their data to be intercepted.

[madslug]

Originally Posted by Paul Delaney

Can somebody please confirm that the following is correct (want to try a different tack with my MP)

DPI can already do all that you do not want it to do. There are 2 parts to traffic: the header and the visible content.

For traffic shaping, only the header data is read. This says what type of data it is. Video and music have different header data from standard text on a web page so it is relatively easy to give each a different contention ratio. That is a valid business purpose to improve the service.
If you don't like your ISP limiting you because they have oversold the capacity of the pipes they use, move to an ISP who has invested in their own pipes and invests again before traffic congestion begins to effect performance experienced by their customers (costs more than £10 a month).

The content data is also available to the DPI system. Processing that too costs a lot of money and CPU power, so there is no financial reason to include that additional data for performance reasons.

However, there is nothing stopping anyone using DPI to copy everything. It 'sits on' the data stream and can view whatever it is programmed to view. If a court order walked in the door, I suspect that any UK ISP already installs all the equipment necessary to stream off 100% of the traffic data for a specific data stream. It just needs the court order to do so.

What Phorm is doing is taking that 100% data stream and running its own software on it. When it arrives at the Phorm supplied software, all the PI data is part of the stream. The IP address (that is usually classed as PI) is a problem for the Phorm system as the ISPs give out random IP addresses each time a person connects their router to the internet, so using IP address as idenifier would not be feasible for Phorm. This is why they give everyone a 'random' UID so that their surfing round the internet can be followed. This is much more personal than an IP address and each browser used on the computer will be given a unique UID. If a building shares an IP address - even it the IP address is static, there could be hundreds of people using the address. By identifying the actual browser being used, there is more chance that the UID identifies the same person for each visit to the internet.

The way the system works, the UID, once set, is available in every data stream sent from the user's browser so the system can immediately add the current data collected to that already stored by the system.

I know that BT/Phorm say that some data like https and blacklisted sites is excluded from being profiled. They do not say that it is not first intercepted so that it can be identified as data that should not be profiled. Phorm do say that they profile URLs and nowhere do they say that they differentiate between http and https URL content - only the content on the https web page is excluded. For this reason, I used 100% in the above text.

---------- Post added at 02:00 ---------- Previous post was at 01:50 ----------

Legally, a minor may not undertake a contract. In the advertising world, teen is about 9+ (you only have to look at who reads 'teen' magazines).

[Wildie]

Well my child has been using computers in school since day one, now has to use one online to access his school work from home, and down loads and uploads what ever work is on the schools system and his a/c, even I have access to their school work to see how they are doing in any subject.
I let they surf the web I even help let em play online games and keep in touch with other family members around the country, yes the pc in the main room where we all sit and no one is ever alone on the pc unlike some in a back room out of sight doing as they please.
this pc has no ads from any web site unless it`s in direct context of what the site offers no 3rd party cookies, no popups and no data saved either not even our login details or anything, as a lot of people who visit us, always use my pc or the wifi with laptops even mobile phones to check their emails and forums via my ip.

just like any other family out there 1 ip many users.

[icsys]

Originally Posted by Wildie

well teens is any age from 13 to 19 a minor as I see it is 12 and under.

In law, the term minor (also infant or infancy) is used to refer to a person who is under the age in which one legally assumes adulthood and is legally granted rights afforded to adults in society. Therefore a minor in the UK is a person under the age of 18.