Great work being done here.

All comments from previous Phorm stories in this place also?

A search for Phorm or Webwise on the Privacy International website shows 0 hits so what exactly are they supposed to have endorsed?

While the use made of the information for advertising may (or may not) be as Phorm describes, what prevents them from doing anything else with it? What ongoing oversight is there? (none?).

If these companies are so sure that the data is being anonymised, perhaps we should put it to the test.

Suggest prior to setting the ball rolling with Phorm, they should run a competition, open to anyone, to see whether someone can piece together details from what they intend to send to Phorm and play pin the tail on the customer.

If it's completely safe then there'll be no problem. They could offer the equivalent of an entire years worth of profit from their deal with Phorm, safe in the knowledge that nobody will win the prize.

With these developments, I know that I will personally be tunneling all my browsing over SSH from now on. Find yourself a server and do the same!

I just had a look at http://www.badphorm.co.uk. It seems the Phorm software was developed by the russian Lebedev Institute which has links to the russian security services. Combine that with OIX servers in china and you have the makings of a tense modern day techno-thriller involving the KGB (yes I know they've changed their name) and the PRC security services.

If anyone had written such a book/script last year, it would have been laughed at for being too far fetched. There could be an interesting twist of a back story where the UK government had decided it was no good at this modern internet data thingy and decided to subcontract the job of surveillance to people who knew what they were doing.

As I said earlier, it's too far fetched to be true.

..Mine's the one with the RFID tags hidden in the lining.

So does that mean if i browse p0rn all night, I will get p0rn banners!!!!!!!!!!

Having said that, thankfully none of the ISPs I deal with are involved so I can't do that myself...

There is one good thing to come out of this - I've just setup a TOR server on my colo box as part of my complaint (I've also chucked a message on the forum for my ISP), so there's no another 3TB/month available to TOR directly as a result of this debacle.

Seriously, police should march them out of board rooms and off golf courses in handcuffs come Monday morning.

They can waffle on about reviews and anonymisers all they want, the very fact that your browsing history is routed to a computer called the "Profiler" located in CHINA is reason alone to sound major alarm bells here.

So will the profiler look at my bank details to see if i can afford a shiny new car or HD telly and so give me an ad for one?

Serious questions need to be answered here. Fuckers.

One thing occured to me on the way home - using TOR isn't necessarily going to help.

With the collection being cross-ISP, the vulnerability is NOT the one that TOR was designed to protect against. Indeed, the ability of the "exit points" to monitor your traffic is one of the stated limitations of TOR - it means that if anyone runs a server at the end of a line provided by one of the compromised ISPs then sessions could be "nobbled".

I wonder whether China's looking at this and thinking "Why didn't we do that?"

A reply from virginmedia customer support( edited to reduce tedium)

I am sorry that the information that we are going to start using phorm

has worried you, here is some information to help give you a better

understading in regards to what this is.

A safer experience

Webwise will help customers avoid scams, such as 'phishing' - this is

where someone pretends to be a well known brand, like a bank, but is

looking to steal confidential information. [SNIP..]...identity theft. In this way Webwise helps to secure our customers' privacy.

A more relevant browsing experience

Another great thing about Webwise is that it can help reduce irrelevant

advertising. As customers browse web pages, Webwise looks at things like

search terms, and learns what topics might be of interest. This is done

without collecting any personal information, so once again their privacy

is protected. These topics are then used to help filter out adverts that

might be irrelevant - instead they'll simply see an advert that will

match a topic they're are more interested in.

Don't worry, they won't see any more adverts than they currently do,

they'll just be more relevant. [SNIP...]

Protecting customers' privacy

Webwise has been designed from the ground up to protect our customers'

privacy and anonymity. As the system only learns about topics of

interest, it does this anonymously, ensuring their privacy is completely

protected.

Neither the web addresses, nor search terms they use are stored. They

are purely matched to an advertising topic and then discarded.

Webwise doesn't store their internet (IP) address or keep track of their

browsing. The system or advertisers won't know who you are or the

websites they've visited.

No personally identifiable information such as email addresses,

surnames, street addresses, or phone numbers are ever gathered.

No sensitive or personal financial information, such as credit card

numbers, login IDs, passwords or bank account numbers are ever gathered.

We found that this system met our high standards for simplicity and

privacy - so customers' privacy is assured. These privacy standards were

also verified independently by Ernst & Young who conducted a detailed

audit of the whole process and Webwise solution.

Customers won't be forced to take up Webwise, so they'll be able to keep

their internet experience as it is now...

[END...]

That last phrase leaves it deliberately ambiguous as to whether or not users will be required to Opt In or Opt Out -I wrote back to Virgin Media to request clarification on this point.

...that is on the BT and Phorm sites. Of course the point is that whatever Phorm SAY they are doing now or whatever they showed E&Y IN THE PAST there is no ongoing supervision to ensure that they don't just change their minds or just pass the information on to their spyware purveying friends. BT and VM actually have no idea what else will happen to our data, no way of checking and no possible way of changing what is being done should they not like it. At the moment they are just happy to take their 30 pieces of silver and run. It is utterly despicable but why do I suspect that once Brown and his goons wake up this their first reaction will be 'hmm how can we get a copy too'....

"So will the profiler look at my bank details to see if i can afford a shiny new car or HD telly and so give me an ad for one?"

It's far more likely that a Phorm employee will set up a direct deduction from your bank account to a bank in China, Joe.

I'd give up online banking immediately, if I were a customer of one of these three subsidiaries of the Red Chinese Army.

Will it be possible for users to identify Phorm-selected ads?

If so, could an Adblock filter be written to *highlight* those ads?

And if that came together, how long would it take to devalue Phorm if [a large number] of VM/BT/TT users clicked on every Phorm-served ad whenever they were fortunate enough to see one?

Every ad. Every time.

Just wondering, like.

Here it is, should anyone be interested:

http://www.facebook.com/groups/edit.php?info&gid=9216870661

Yes, I realise the irony of starting a group on facebook, a site which is notoriously shady in terms of privacy issues etc., but it is a powerful social tool after all. I just hope facebook members glance up from their lame Vampire/Werewolf fight applications long enough to notice something important going on.

Just what the f**k makes them think we want any part of their cr*pware ? Enhanced user experience ! My Boney Arse !

Phorm will not like have title of SPYCOMS, i don't care sue me!

Spying with communications in anyway then that is SPYCOMS.

Well done Phorm you have honer of being first business in the world to have title of SPYCOMS.

Just read this and this is powerful comment, totally on the money.

...and they don't store IP addresses, how do they know who to target the ads to?

It would be like a postman trying to deliver a letter that has no name and address on it, wouldn't it?

To use your analogy... There's a story (I believe it is true, but don't guarantee it) that a letter was delivered "to the girls sitting on the back of the 6:30 bus from 'A' to 'B'". The postman never knew who the girls were, but got the message to them... In the same way that phorm won't know who you are, they will know that you're interested in hairy german bottoms - and therefore send you appropriate messages.

EVERY comment from one of the companies talks about what is stored, not what passes through - quite apart from the security of my data from Phorm, how about my security from someone hacking phorm's network(s) and/or devices?

95% of unencrypted web traffic is now going to be going through some very well defined pinch points that are all running the same software... Perfect for MI6 (if you want to stay within the law) and/or ID fraudsters (if you want to include the not so happy people) and a complete and utter "no NO NO!" to all security advice around. All anyone has to do is see a single email in your gmail/hotmail/a.n.other folder, and the anonymity is all gone.

I've picked the helicopter because I hope, REALLY HOPE, that I'm being paranoid.

so will this mean they will be changing there terms & condition (contract) which will allow me end my contract soon? i really want to change my ISP BT.

We currently run their top whack option with BT Vision but recently the quality and reliability of our broadband (and supplied equipment) has fallen well short of the mark but this is just plain wrong, I wonder what that other Bastien of privacy and advertising thinks about this, has any one heard from google? surely their ads being swapped out isn't going to make them very happy is it?

Where the hell is the Information Commissioner in all this?

As usual toothless and doing NOTHING, probably because not enough people are complaining.

I think one's browsing habits count as personal information and shold NOT be sold without express written permission. The IC should also ensure that such permission is NOT included in ISP Terms and Conditions as this would clearly be an UNFAIR CONTRACT TERM.

I encourage everyone to make a complaint to the IC office at this address:

http://www.ico.gov.uk/complaints.aspx

I don't mind having targeted ads as I ignore all online ads anyway, just a fact of life, like the ad breaks on TV, just ignore them. It is the fact it is happening without me being asked and stored and that ALL my inline activiity is being logged, not just then but for later use.

A cookie is one thing, taking that and storing it is another. And storing it overseas is even worse.

And this might happen using MY BANDWIDTH for the privileage is even worse than that, me paying for them to get more money. Then sending me emails to warn me of a limit I might be exceeding...

This must be a breach of contract.

You want to COMPLAIN to some Government (no)Body who's probably on the payroll / a shareholder of one of these corps?

Seriously, that's why they're getting away with it; everybody's whinging to some ineffectual dullard instead of canning the direct debit on the spot, and pointing out how they're breaching UK and EU privacy law, and their own T's&C's, when they sue for breach of contract.

The EFF exists for this exact reason.

Aside from complaining to the ISP's, the ICO and OFCOM, lets fill Phorms system with Spam. In the process of writing a script that will be run by Cron to access various sites at regular intervals. Simple case of using wget as I imagine won't know the difference. The only thing to change regularly would be what you 'are' viewing.

Im guessing that all the collected information will be used to create profiles for the most likely target audiences within those not being analysed by Phorm. I.e. those who have ISPs with scruples.

If enough people fill the system with utter rubbish (one min I'm viewing a car site, then I'm viewing a clothes site, then looking at holidays, then credit cards, then back to cars and so on...) then the system won't be profitable to Phorm. Even better, set up a spider and create your own search database ;-) that'll flood their system quite well.

Paris cos, well, do I need a reason??

After at first denying any partnership with Phorm, TalkTalk have replied to my complaint, stating:

"I can advise as previously stated PHORM are unable to access any

personal information without your permission. The service they are

offering is called Webwise, although they are able to view your browsing

history, they are unable to recognise who you are through this

information."

Can anybody help with a suitable rebuttal of this nonsense? It's like doublespeak. Surely anybody could be easily identified from their browsing history? What makes Phorm "unable" to the same?

Hope like the rest of us that the media and/or regulators will get the ISPs to clime down?

I totally share your frustration but it seems almost pointless to try and argue what is quite a complex point (but nevertheless important - with wide-ranging implications) with support representatives who aren't that technically/legally trained .

I'm encouraged by the number or people commenting on these stories, write to the Information Commissioners Office, sign the petition http://petitions.pm.gov.uk/ispphorm/, write to the RIPA Commissioner and your MP, write to press and news agencies...

Get the facts into the public domain and hopefully these issues will be tackled by the people who have the power to fix things, not the overworked customer support representatives...

Of course Google and all other search engines profile you, but that is in my mind the right side of the line. You chose to use Google, a free but valuable service, knowing that in return they will serve you adverts and take some interest in your personal data.

In mitigation, you know a.) you can delete your cookie every day or every visit and the link will be lost, b.) Google have a well stated policy not to give your information to anyone else and c.) they only have access to a small portion on information of your web-based activities, namely search.

Contrast this with your ISP, who you most likely pay for a service, who are in a trusted position with access to your entire (non-encrypted) web-based activities and have a legal obligation in most cases not to share personal information and now intend to a.) not only profile you but share this information with a third party and b.) in the process of doing so, potentially interrupt the service you pay for by intercepting private packets in transit between 2 parties without and consent, and injecting additional inforamtion (cookies) without consent into such transmissions. The interception element from a protocols issue is beyond belief, that's why I'm so truly upset about this whole debacle...

A few people have commented on the various Phorm stories relating to when the news may break in the mainstream press and how this publicity will affect the ISPs involved.

I've spoken to a few very well placed friends in the media whove alerted me to their concerns.

Firstly, the issues are too complicated to spin simply to the punters. They can't just say "all your browsing history for sale" without the guys from Phorm and ISPs coming back with a glossy right-of-reply which will knock down the claims and lead the correspondant into detailed technical arguments that will lose the majority of readers.

They're basically waiting for someone to act before they report, e.g. a regulator, a legal challenge from a consumer group etc. Without clear allegations from a sufficiently respectable body there just isn't a story.. apparently.

Secondly, it appears according to this article that many national newspapers are involved in OIX-type advertising:

http://www.newswireless.net/index.cfm/article/3779

Phorm could be hear to stay.

Peter, I just asked PlusNet Customer Services the same thing, and they said

"Unfortunately we have no information regarding this. We will let our customers know when we're aware."

That's slightly different from what they told you....

you never know. It might work.

Petition to HM Government.

http://petitions.pm.gov.uk/ispphorm/

Power to the people! Or somerthing like that.

One minute it's top of Tech-news with a link on the front page, the next it's nowhere to bee seen? Have the legal brigade been dispatched? For those who don't know it was printed on front page of Technology Guardian supplement this morning (Thursday), so a bit like horse and door and stable and bolted...

Gruaniad assure me honest rearrangement - story's been moved to Digital Media and a link's been put back to moved story on Techno page. Phew!

http://news.bbc.co.uk/1/hi/technology/7280791.stm

Top tech story at the Beeb. Shame that they don't really seem to appreciate just what BT et al and Phorm are proposing. And no mention of Phorms shady past either. Oh and no way of commenting on the article itself.

Lookslike they feel they have to report but aren't looking to start any kind of real debate on the issue.

Paris - because I can't imagine her having much thought for the consequences either. Or much thoughts at all for that matter.