People using O2 network to browse websites face mobile phone numbers privacy breach
Mobile phone users on O2's network have been inadvertently handing over their phone number to website owners
Website owners could be collecting the phone numbers of visitors which they could then use for marketing without the phone owner’s consent.
People using their mobile phone on O2's mobile networks in the UK to browse websites have been inadvertently handing over their phone number to the website owner.
The privacy breach means that site owners could be collecting the phone numbers of visitors which could then be used for telephone and SMS marketing without the phone owner's consent. That in turn could open up phone users to reverse-charge SMS spams, which could cost them huge amounts in bills if their number is used for scams. O2 has now closed the loophole.
The Information Commissioner's Office said it is considering whether to investigate further, although a spokesman said there was no immediate breach of the Data Protection Act. A mobile phone number on its own is not classed as "personally identifying information" (PII), because it does not identify an individual on its own; but the spokesman said the office would consider whether other personal data was being processed at the same time.
An ICO spokesperson said: "Keeping people's personal information secure is a fundamental principle that sits at the heart of the Data Protection Act and the privacy and electronic communications regulations. When people visit a website via their mobile phone they would not expect their number to be made available to that website. We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed."
It is unclear how long the flaw has existed. O2 said it is investigating what is occurring and why the number is being forwarded, which was confirmed by a number of people who contacted the Guardian and offered links to screenshots of the data.
The phone number is handed over as part of the "header" data sent by the phone to the website, which usually contains information such as which browser the phone has so that the site can serve an appropriately formatted page – mobile phones have smaller screens than desktop or laptop computers.
Headers often contain other information about the device contacting the site – in O2's case it has included the phone number.
Users of BlackBerry phones, however, said their numbers were not handed over – possibly because RIM, which makes the BlackBerry, uses its own encryption and forwarding system to connect to websites.
The discovery was made by Lewis Peckover, a London-based programmer who says he discovered the flaw on Tuesday lunchtime while working on a method of identifying whether users were accessing a site via their mobile.
The number forwarding appears only to happen on O2 and its associated virtual networks such as GiffGaff. Users of other networks confirmed to the Guardian that the number forwarding does not happen on Vodafone, Orange, T-Mobile or 3's network. Peckover created a webpage, Bad O2!, specifically to let people check if their number is forwarded.
O2 is the UK's second-biggest mobile network, with about 22.2 million subscribers, behind the combination of Orange and T-Mobile, which has 27.5m. There are another 2.8 million subscribers on Tesco's network, which uses O2's system, and an unknown number on GiffGaff, its sim-only network where users provide their own mobile devices.
Charles Arthur, technology editor
guardian.co.uk, Wednesday 25 January 2012 12.49 GMT
© 2012 Guardian News and Media Limited or its affiliated companies. All rights reserved.
People using O2's network to browse websites on mobiles face privacy breach | Technology | guardian.co.uk
Mobile phone users on O2's network have been inadvertently handing over their phone number to website owners
Website owners could be collecting the phone numbers of visitors which they could then use for marketing without the phone owner’s consent.
People using their mobile phone on O2's mobile networks in the UK to browse websites have been inadvertently handing over their phone number to the website owner.
The privacy breach means that site owners could be collecting the phone numbers of visitors which could then be used for telephone and SMS marketing without the phone owner's consent. That in turn could open up phone users to reverse-charge SMS spams, which could cost them huge amounts in bills if their number is used for scams. O2 has now closed the loophole.
The Information Commissioner's Office said it is considering whether to investigate further, although a spokesman said there was no immediate breach of the Data Protection Act. A mobile phone number on its own is not classed as "personally identifying information" (PII), because it does not identify an individual on its own; but the spokesman said the office would consider whether other personal data was being processed at the same time.
An ICO spokesperson said: "Keeping people's personal information secure is a fundamental principle that sits at the heart of the Data Protection Act and the privacy and electronic communications regulations. When people visit a website via their mobile phone they would not expect their number to be made available to that website. We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed."
It is unclear how long the flaw has existed. O2 said it is investigating what is occurring and why the number is being forwarded, which was confirmed by a number of people who contacted the Guardian and offered links to screenshots of the data.
The phone number is handed over as part of the "header" data sent by the phone to the website, which usually contains information such as which browser the phone has so that the site can serve an appropriately formatted page – mobile phones have smaller screens than desktop or laptop computers.
Headers often contain other information about the device contacting the site – in O2's case it has included the phone number.
Users of BlackBerry phones, however, said their numbers were not handed over – possibly because RIM, which makes the BlackBerry, uses its own encryption and forwarding system to connect to websites.
The discovery was made by Lewis Peckover, a London-based programmer who says he discovered the flaw on Tuesday lunchtime while working on a method of identifying whether users were accessing a site via their mobile.
The number forwarding appears only to happen on O2 and its associated virtual networks such as GiffGaff. Users of other networks confirmed to the Guardian that the number forwarding does not happen on Vodafone, Orange, T-Mobile or 3's network. Peckover created a webpage, Bad O2!, specifically to let people check if their number is forwarded.
O2 is the UK's second-biggest mobile network, with about 22.2 million subscribers, behind the combination of Orange and T-Mobile, which has 27.5m. There are another 2.8 million subscribers on Tesco's network, which uses O2's system, and an unknown number on GiffGaff, its sim-only network where users provide their own mobile devices.
Charles Arthur, technology editor
guardian.co.uk, Wednesday 25 January 2012 12.49 GMT
© 2012 Guardian News and Media Limited or its affiliated companies. All rights reserved.
People using O2's network to browse websites on mobiles face privacy breach | Technology | guardian.co.uk
