TalkTalk tracking you, phorm?

[Rchivist]

Originally Posted by Maggy J

I nearly forgot.The question of copyright on webspaces..Isn't that open to abuse by everyone visiting a site.Surely the only way to stop it is to watermark images OR put nothing on a website that you do not want to be copied?

<br />
<br />

Yes Maggy you are right. But - at the moment, for some websites dealing with this problem right now, the issue is not really copyright - it is the more fundamental issue that a website has the right to control access to its content - simply through the contractual arrangements laid down in website terms and conditions. For example - TalkTalk Group/Opal, BT Group, and CableForum) include in their Terms of Use clauses such as: (quoting Opal specifically below)

"This page (together with the documents referred to on it) tells you the terms of use on which you may make use of our website. Please read these terms of use carefully before you start to use the site.

By using our site, you indicate that you accept these terms of use and that you agree to abide by them. If you do not agree to these terms of use, please refrain from using our site."

Some sites, on becoming aware of this trial, have notified TalkTalk specifically that they do NOT grant TalkTalk consent to access their content for this sort of monitoring, except on specifically notified conditions, and have done so using very similar terms to those specified by the TalkTalk group themselves on their own site - as quoted above.

TalkTalk seem to be denying specifically that other websites have a right to exercise such a control, despite claiming the identical right for their own website.

There is also the issue of whether the TalkTalk system observes a website robots.txt terms - it does not identify itself with a useragent - and the evidence about whether it observes robots.txt is so far, ambiguous, with different websites seeing different behaviour. With well behaved search bots, robots.txt can be used to limit, or even totally deny access to all bots or some of them selectively, and also to specifiy some directories where a bot MAY crawl and others where it is denied. As for example CableForum does.

If TalkTalk's monitoring system DOES observe robots.txt then it won't be much good for detecting malware - and if it DOESN'T respect robots.txt then webmasters are going to be taking other steps to control it, both through legal action, and technical blocking measures (for example via their .htaccess file or other means).

As far as copyright goes - it's a much more challenging isse - particularly to enforce. But sites such as Ryanair, have in the past, vigorously protected their content from what they have described as "screen scraping" by those who want to make commercial use of their pricing data and flight timetables, but without consent - and there have been other cases too but I don't know the details. A website certainly COULD take civil copyright action against TalkTalk, but it would be an expensive business, and only a site with the resources would be able to tackle it. The issue of trying to get the authorities to pursue a criminal coyright abuse is also difficult - although theoretically available, where copyright material is used for commercial purposes, without consent.

And then of course there are the larger legal issues about whether the TalkTalksystem complies with DPA/PECR/MCA/RIPA - but those are for the enforcement authorities and the criminal law rather than a civil matter between a website and TalkTalk. The ICO has reserved judgement on the DPA/PECR issue so far and an investigation is ongoing.

At some point I imagine some websites may also pursue action against TalkTalk on the basis of restraint of trade or other legal remedies because they object to TalkTalk restricting customer access to their sites.

That should give you a summary of where some websites are coming from on this issue at the moment.

---------- Post added at 07:54 ---------- Previous post was at 07:51 ----------

Originally Posted by bluecar1

which when combined with the fact huawei have systems patented that categorise webpages, and the fact the IP address used intiailly to follow people was the radius servers what more do you want?

and yes ignitionnet i am aware you can have multiple machine share the same IP so long as they do not share the same port id, but in my experience it would be odd to have something like a radius server nat'ed behind a firewall etc

The Huawei patent appliction can be seen here
http://v3.espacenet.com/publicationDetails/originalDocument?CC=EP&NR=2139181A1&KC=A1&FT=D&dat e=20091230&DB=EPODOC&locale=en_GB

Originally Posted by R Jones

<br />
<br />

Yes Maggy you are right. But - at the moment, for some websites dealing with this problem right now, the issue is not really copyright - it is the more fundamental issue that a website has the right to control access to its content - simply through the contractual arrangements laid down in website terms and conditions. For example - TalkTalk Group/Opal, BT Group, and CableForum) include in their Terms of Use clauses such as: (quoting Opal specifically below)



Some sites, on becoming aware of this trial, have notified TalkTalk specifically that they do NOT grant TalkTalk consent to access their content for this sort of monitoring, except on specifically notified conditions, and have done so using very similar terms to those specified by the TalkTalk group themselves on their own site - as quoted above.

TalkTalk seem to be denying specifically that other websites have a right to exercise such a control, despite claiming the identical right for their own website.

There is also the issue of whether the TalkTalk system observes a website robots.txt terms - it does not identify itself with a useragent - and the evidence about whether it observes robots.txt is so far, ambiguous, with different websites seeing different behaviour. With well behaved search bots, robots.txt can be used to limit, or even totally deny access to all bots or some of them selectively, and also to specifiy some directories where a bot MAY crawl and others where it is denied. As for example CableForum does.

If TalkTalk's monitoring system DOES observe robots.txt then it won't be much good for detecting malware - and if it DOESN'T respect robots.txt then webmasters are going to be taking other steps to control it, both through legal action, and technical blocking measures (for example via their .htaccess file or other means).

As far as copyright goes - it's a much more challenging isse - particularly to enforce. But sites such as Ryanair, have in the past, vigorously protected their content from what they have described as "screen scraping" by those who want to make commercial use of their pricing data and flight timetables, but without consent - and there have been other cases too but I don't know the details. A website certainly COULD take civil copyright action against TalkTalk, but it would be an expensive business, and only a site with the resources would be able to tackle it. The issue of trying to get the authorities to pursue a criminal coyright abuse is also difficult - although theoretically available, where copyright material is used for commercial purposes, without consent.

And then of course there are the larger legal issues about whether the TalkTalksystem complies with DPA/PECR/MCA/RIPA - but those are for the enforcement authorities and the criminal law rather than a civil matter between a website and TalkTalk. The ICO has reserved judgement on the DPA/PECR issue so far and an investigation is ongoing.

At some point I imagine some websites may also pursue action against TalkTalk on the basis of restraint of trade or other legal remedies because they object to TalkTalk restricting customer access to their sites.

That should give you a summary of where some websites are coming from on this issue at the moment.

---------- Post added at 07:54 ---------- Previous post was at 07:51 ----------



The Huawei patent appliction can be seen here
http://www.faqs.org/patents/app/20090222919

How many websites are complaining? What sort of websites are complaining?

As for Ryanair's issues well they surely are on shaky ground there, seeing as their pricing system can be obtained in other ways because it as a matter of course has to be out in the public domain...

I can't help feeling that the 'harvesting' of such info that has to be out for public scrutiny wont get anyone very far in any courtroom anywhere..

[Ignitionnet]

Originally Posted by bluecar1

which when combined with the fact huawei have systems patented that categorise webpages, and the fact the IP address used intiailly to follow people was the radius servers what more do you want?

and yes ignitionnet i am aware you can have multiple machine share the same IP so long as they do not share the same port id, but in my experience it would be odd to have something like a radius server nat'ed behind a firewall etc

Done much with load balancers recently? Maybe implemented the odd Virtual IP?

Yes they categorise webpages. Given TalkTalk's announcement they wish to use this stuff to implement parental control and that they have already announced that they are taking reports of the categories of sites visited by this hardware that's not really that surprising either.

If TT's intention is to spy on their userbase they can use their in-line DPI hardware, which is already integrated with their RADIUS for AUP-enforcement purposes.

The Huawei unit is a standalone piece of hardware. TalkTalk's announcement's and Huawei's product range confirm this. TalkTalk don't use Huawei's RADIUS server options which isn't surprising given they're intended for mobile networks.

Occam's Razor remains your friend however it probably isn't too strong a force against pre-conceived notions from over 6 weeks ago. I only mentioned you specifically as being a virtualisation / DC guy you should know better than to think public IP addresses mean anything and probably do, but we all have the tendency to see what we want to see.

Originally Posted by R Jones

Yes Maggy you are right. But - at the moment, for some websites dealing with this problem right now, the issue is not really copyright - it is the more fundamental issue that a website has the right to control access to its content - simply through the contractual arrangements laid down in website terms and conditions. For example - TalkTalk Group/Opal, BT Group, and CableForum) include in their Terms of Use clauses such as: (quoting Opal specifically below)

(Emphasis mine)

That is your assertion. Is there any statute law or case law to demonstrate it?

[Rchivist]

Originally Posted by Maggy J

How many websites are complaining? What sort of websites are complaining?

As for Ryanair's issues well they surely are on shaky ground there, seeing as their pricing system can be obtained in other ways because it as a matter of course has to be out in the public domain...

I can't help feeling that the 'harvesting' of such info that has to be out for public scrutiny wont get anyone very far in any courtroom anywhere..

Originally Posted by Chris

(Emphasis mine)

That is your assertion. Is there any statute law or case law to demonstrate it?

According to TalkTalk/s Mark Schmid, they have had more website queries than customer queries.
http://www.pcpro.co.uk/news/security...trial-to-phorm

Schmid stressed the system looks at websites, not user data, and said the vast majority of the queries TalkTalk has fielded about the system were from website owners wondering why their sites were being scanned, not from the ISP's customers.

With regard to Ryanair - they have actually done quite well in several courtrooms with their screenscraping cases.
Googling on
ryanair screen scraping
should give the details.
http://www.ryanair.com/en/news/tui-u...of-ryanair-com
http://www.ryanair.com/en/news/bravo...ng-ryanair-com
http://www.shoosmiths.co.uk/news/1525.asp (legal discussion of issues around screen scraping and website rights)
http://www.telegraph.co.uk/travel/tr...-scraping.html
http://www.theregister.co.uk/2008/07...aping_victory/ (further legal argument, from outlaw.com)

They also took exception to BT/Phorm (private correspondence).
I do not yet know what their response to TalkTalk monitoring of their content will be but I know that they are aware of it.

This is the latest reference (another legal affairs site - article dated May 25th 2010) that I could find about the Ryanair screenscraping cases:
http://www.internationallawoffice.co...7-ac04fcf4a2da
and the Irish High Court has supported Ryanair in that case - (still under appeal to Irish Supreme Court.) Enjoy!!

Thank you

I will have a proper read of that, however based on the couple of links I read so far (Ryanair's own, plus the Tele), I am wondering how clear a comparison there is between terms and conditions governing a financial transaction (where a contractual relationship has been deliberately and verifiably created in a way recognisable in common law) and terms and conditions that seek to control access to something that is entirely in the public domain without any financial consideration being due.

[Rchivist]

Originally Posted by Chris

Thank you

I will have a proper read of that, however based on the couple of links I read so far (Ryanair's own, plus the Tele), I am wondering how clear a comparison there is between terms and conditions governing a financial transaction (where a contractual relationship has been deliberately and verifiably created in a way recognisable in common law) and terms and conditions that seek to control access to something that is entirely in the public domain without any financial consideration being due.

I think you'll find that quite a few of those cases deal with EACH of those issues separately - certainly the Irish one does. The articles are fairly informative and clear, particularly the Shoosmith and Outlaw.com sites which are presumably non-partisan.

The issues raised in the court cases cited, included - a dispute over court jurisdiction, a dispute over applicability of terms and conditions, a dispute over who was "using" the data (the screen scraper or the purchaser of the tickets), a dispute over copright issues, also reference to trademark issues, "passing off" issues, and a discussion of technical blocking measures - the articles go into all those, expressing various opinions.

The Irish case looked at most of them. (One German case CheapTickets BV eventually went against Ryanair on appeal, but they won a different German case against Vtours GmbH. An English case against TUI UK focussed on website Terms of Use, and was in the High Court - no appeal as far as I am aware) And the legal discussions on the site all then go on to speculate about the applicability of database content rights - which obviously is specific to Ryanair and similar types of commercial site.

Where RyanAir relied on their Terms of Use in their actions, they relied on a clear url link and published Terms online - and that was specifically accepted by the Irish High Court. (Other options include specifically sending Terms to potentially unwelcome visitors, with acceptance conditions included, where subsequent access of a site involves acceptance of the conditions - a clearly created contractual relationship - exactly the sort of conditions contained in Opal Telecoms site and many others, but in these cases, SENT to the visitor, rather than just relaying on a url - Opal even forbid deep linking to their site in their terms of use.)

Given how active Ryanair have been, I think we can say there is case law available in a number of EU jurisdictions so far on a fair variety of issues related to this situation.

Because Phorm "offered" their optout to websites, by compiling their list of websites that didn't want to be part of their scheme, there was little appetite for any legal challenge by websites in that area, and as the Phorm system has never so far been commercially deployed properly, website rights have never really featured because a lack of deployment meant a lack of evidence.

But website rights have always been sitting in the background, and they look as if they are coming to the fore nowadays. The issue that seems to be causing dispute HERE is whether a non-commercial site can notify and then enforce conditions of access on an unwanted site visitor. I can say that absolutely NO legal reason has yet been put forward to justify that claim.

[Ignitionnet]

In other news an FoI request by Hatari / Graham Mills has been rejected due to it being a copy/paste of an earlier rejected FoI request by Peter John / Dephormation and sent after Mr Mills became aware of the original request's rejection for being vexatious.

But remember kids:

Originally Posted by bluecar1 / Peter White, whose FoI request to the ICO on this matter was accepted

it is about a webmasters rights over their own content and how it is accessed

I really must have missed something, these people consulting the Information Commissioner's Office for information on civil violations of copyright and contract. Didn't realise the ICO had branched out into such things.

[Sirius]

Originally Posted by Maggy J

OK if everyone who doesn't want me to visit their sites would just give me the URLS and I promise NEVER to visit them and if I inadvertently do so I'll arrange to have my eyeballs turfed out with rusty spoons...

Now what was the topic?Because to be perfectly honest I lost the plot ages ago.

What exactly is this thread about?..And the explanation had better be in the language stupido or thicko so I can follow it..

I ask this because I notice that there is very little input from anyone else apart from a very few very technically minded and it has occurred to me that this might be because hardly anyone knows what this thread is about.The legalese has certainly baffled the hell out of me..

---------- Post added at 17:39 ---------- Previous post was at 17:35 ----------

Originally Posted by Ignitionnet

The system does not, by any account, profile the browsing habits of users.

If that were TalkTalk's plan their existing DPI equipment, through which 100% of their customer base are routed, would be more than capable. It would also be totally transparent.

And there are those 3 letters again. DPI, I honestly don't trust any company who is involved in the latest development of DPI because Phorm may have gone away for now but there are plenty more companies developing as we speak to try and use our personal information to make them money.

[Ignitionnet]

Originally Posted by Sirius

And there are those 3 letters again. DPI, I honestly don't trust any company who is involved in the latest development of DPI because Phorm may have gone away for now but there are plenty more companies developing as we speak to try and use our personal information to make them money.

Oh the tech has been able to do profiling, etc, for a while. When working for a major ISP the capacity was there, though of course not used as that's illegal without a warrant, to have an individual user's browsing history recorded right down to the packet level which sites they visited and what they did there with the capability to precisely replay their session including any form inputs, etc.

As it is we were just fine knowing which protocols they used and which sites, at domain level, they visited along with which category, social networking, video, file sharing, gaming, etc, those sites went into - this is exactly the same reporting functionality that TalkTalk have mentioned their bot does, the only difference being that they are categorising sites using analysis of the sites while we would need pre-defined lists. Their way is more accurate.

It's nothing really to do with development of the equipment. ISPs have for years refrained from packet level monitoring of users because they have better things to do with their time.

Let's face it, the reason behind a lot of these complaints is that some blokes don't want their wives and girlfriends asking them why there are suddenly a lot of pr0n ads appearing on the sites they visit...

Originally Posted by Chris

Let's face it, the reason behind a lot of these complaints is that some blokes don't want their wives and girlfriends asking them why there are suddenly a lot of pr0n ads appearing on the sites they visit...

You believe.....

[Rchivist]

Originally Posted by Chris

Let's face it, the reason behind a lot of these complaints is that some blokes don't want their wives and girlfriends asking them why there are suddenly a lot of pr0n ads appearing on the sites they visit...

But even if that WERE true, it wouldn't explain the requests about the system received by TT from webmasters (outnumbering those from TT customers according to TT in attributable press statements).

It would if TT were secretly compiling an ultimate online pr0n directory.

[Ignitionnet]

Originally Posted by R Jones

But even if that WERE true, it wouldn't explain the requests about the system received by TT from webmasters (outnumbering those from TT customers according to TT in attributable press statements).

Depends what the 'queries' to use the name given in the statement were - given webmasters would have seen a sudden spike in traffic from a single IP address in a TalkTalk datacentre it's not really surprising they'd receive 'queries' from webmasters.

I would speculate that not every contact they've had has been a cease and desist request, or something along the lines of 'I want to charge you 10 pounds per log entry I think may be your bot.'. Most were probably 'queries' about what the node doing the hits was up to and nothing more.

Any webmaster of a site of any scale would have very much noted this in their stats, and any webmaster of any sense would have queried to ensure it was expected behaviour.

No reason to suspect all or even most of these queries were complaints. If the public thread in TalkTalk's member forum is anything to go by a large number will simply be 'queries' and nothing more.

---------- Post added at 19:10 ---------- Previous post was at 19:06 ----------

Originally Posted by Chris

It would if TT were secretly compiling an ultimate online pr0n directory.

If speculation is to be believed Huawei and in turn the PLA would be getting some hairy palms if that were the case

They could even, again if speculation is to be believed, put recommendations on the sites in the Index. 'Mr Smith of 53 Acacia Avenue, Streatham (Username smith1.nogirlfriend@talktalk.net) recommends this site, he's visited it 300 times in the past month!