Phorm fires privacy row for ISPs

hamba

Inactive User
Joined
May 24, 2005
Messages
8,704
Reaction score
1,345
Location
Down Here
Phorm fires privacy row for ISPs

Web users are up in arms over what they see as an invasion of privacy by a company that will track surfing patterns to serve targeted ads


Marc Burgess has the sound of a man trying to keep a pack at bay. "Our privacy claims have been audited by Ernst & Young; they have been through our system and seen that it does what we say it does," he says. "Privacy International have done a privacy impact assessment, and they will be doing spot checks. We have spoken to the Information Commissioner's Office. All of the privacy groups in the US, UK and Europe have been impressed by our approach."


The problem for the senior vice-president of technology at Phorm, an Aim-listed company which recently tied up a deal with the UK's three biggest internet service providers - BT, Virgin Media and TalkTalk, who between them have more than 10 million customers - is that it's not the privacy groups who he really needs to convince. It's the millions of people whose services will be affected by Phorm's scheme, because some are up in arms over what they see as an invasion of their privacy through Phorm's intention to categorise all of their web-surfing habits in order to target online ads at them.


Refined cookies

The essence of the Phorm scheme is straightforward. It will have equipment at ISPs that will track your activities on port 80 (used for the web) - though not to secure websites. With each site you visit it will capture the URL (and, for a search engine, the search terms too) plus enough of the header data from the page to "categorise" it into one of a number of areas. Anything longer than a three-digit number is thrown away. Your IP address is not captured, but a cookie with a unique number is set on your browser when you start using it, which persists into the future.


The data about what websites you tend to visit is then categorised to generate a profile. When you then visit a page whose adverts are sourced from the Open internet Exchange (oix.net) - set up by Phorm - your browser will see adverts targeted to your profile. (Adult, gambling, political, drugs and smoking-related adverts are not allowed.) Your browsing history is not retained; instead the profile for the cookie is refined as it "sees" more of your browsing. Sites that join OIX are told they will get a better per-click payment than with other services. (Disclosure: The Guardian is one of a number of media websites that are signed up to OIX.)


Users get one benefit: if they try to access a phishing site that is listed on a database available to Phorm, a warning will appear on the browser - though phishing sites not on the database won't trigger any warning.


News of the deal has leaked out ahead of the service's launch. BT says it will begin trialling soon with "a few thousand" customers, though the Guardian has learnt that BT and Phorm tested the service in secret last summer; at least one customer noticed (tinyurl.com/25jwn6) and began worrying that his machine had been infected by a Trojan. BT's support centre had not been told, but later said there was "an issue" affecting "a small number of users". BT denied any involvement with Phorm at the time. The lack of candour has now aroused the ire of many who have learnt about it, who see this as a matter of trust - and are not convinced that ISPs are earning that trust.


Part of the anger derives from Phorm's long and chequered history. In a previous incarnation, as 121Media, it distributed a program called PeopleOnPage, which was classified as spyware by F-Secure (tinyurl.com/yu7pae). Burgess insists it was adware: "Spyware is downloaded without you knowing. Our adware client you had to deliberately download and agree to an end-user licence agreement." (121Media became Phorm last May.)


But there'll be no EULA with this scheme. "The issue is that these ISPs have signed deals to allow a third party unfettered access to ALL of your web browsing," wrote clanger9 on the Guardian's Technology blog.


"Not just the URLs, but the content as well. The fact that they use this data to provide 'targeted advertising' and claim to discard it afterwards is irrelevant. All your browser content, webmail, forum postings, everything is being analysed by servers owned and controlled by a third party."


For many, the concept of someone seeing where you're going has uncomfortable echoes of AOL's disastrous leak in August 2006, when it mistakenly made available 2GB of data encompassing 20m search keywords for more than 650,000 users collected over a three-month period. Using just the clues from the searches, which used a unique ID for each searcher, journalists and bloggers were able to identify a number of them - demonstrating that even just your search habits (as Google only notes what you search for and what page you then go to) can profile you to a third party.


Phorm's challenge is that it is simultaneously trying to persuade the two sides of the argument - the would-be advertisers and the users - of two slightly different points.


Advertisers are told that it will be able to profile the surfers, based on where they have visited, and target them through that uniquely numbered cookie. But users are told they will not be identifiable. It's the apparent contradiction in those statements that has infuriated so many.


Millions needed

For that reason, those who have heard about it are demanding that the scheme should be opt-in - requiring you to choose to allow it - rather than opt-out. BT and Virgin Media told the Guardian this week that they had not yet decided on either. But it's clear that with millions of customers, the benefits would only accrue if millions take part - which will never happen in an opt-in scheme.


BT, which calls the scheme "Webwise" (webwise.bt.com), notes that you can turn off the monitoring by permanently blocking the cookie from oix.net, though of course you won't then get Phorm's warning about phishing sites. (Many browsers do have installable anti-phishing toolbars, however.) It also implies that the system will be opt-out, with one question saying: "I didn't switch on this service. Why do I have to switch it off?"


To which the given answer is: "We believe BT Webwise is an important improvement to your online experience - giving you better protection against online fraud and giving you more relevant advertising."


But it's potentially an improvement for the ISPs, too - by garnering them more money. For years they have had to sit by and watch while companies like Google, DoubleClick (now being bought by Google), Yahoo and Microsoft have analysed where people go online, and in the case of DoubleClick notice which adverts they are served and which they click on. (Your browser almost certainly has a cookie from doubleclick.net.) They've missed out on the billions of pounds of targeted advertising those companies, and the cookies they have placed (from which the AOL-Google data was drawn) have made.


And with budgets getting squeezed all the time, every ISP is eager to find new revenue sources. Phorm is understood to have contacted scores of ISPs around the world, making presentations about the potential benefits of its scheme.


Phorm's approach, in trying to create a network from the ground up that involves ISPs, advertisers and publishers, is certainly audacious. But one former employee told the Guardian that this typifies its approach: "I'm used to the culture of smart people, long hours and overall complexity but this was exponentially more true of Phorm. It was a 'get a Ferrari and lose your sanity' kind of deal."


Adding that Phorm was "very serious" about anonymising data, the former employee noted that the company has been in talks with the Home Office about whether its system would fall under the Regulation of Investigatory Powers Act (RIPA), which is used for surveillance and crime prevention.


But there was also one unexplored possibility about the technology, the ex-employee noted: "The [Phorm] platform clearly has some edge-of-network technologies involved. It would be entirely feasible for an ISP to allow customers to opt out - and subsequently throttle their service."


Targeting the grail

That would be a worrying development; but it is the simple idea that a third party will be monitoring, even anonymously, where you go online that has spooked people. On the Virgin forums at cableforum.co.uk, 95% of those who answered a poll said they would opt out of the deal.

But they, of course, are only a tiny proportion of those whose data might be channeled through Phorm's servers. "This is the holy grail for advertisers," insists Burgess. "Privacy-friendly but targeted." But in their quest to grab that grail, might ISPs and Phorm have found the point at which users rebel?







Charles Arthur
Wednesday March 5 2008
guardian.co.uk
© Guardian News and Media Limited 2008
 
And they said Orson Wells was full of crap....... feckin communism by proxy !!!

Is there nothing sacred ?
 
cows are apparently - but not in wales lol
 
There aint much sacred in Wales chum.... only place I know where the nickname for a sheep is "leisure centre" lol
 
Back
Top