Bad Phorm

Net eavesdropping firm NebuAd and its partner ISPs violated hacking and wiretapping laws when they tested advertising technology that spied on ISP customers web searches and surfing, according to a lawsuit filed in federal court.

The lawsuit seeks damages on behalf of thousands of subscribers to the six ISPs that are known to have worked with NebuAd. If successful, the suit could be the final blow to the company, which abandoned its eavesdropping plans this summer after powerful lawmakers began asking if the companies and ISPs violated federal privacy law by monitoring customers to deliver targeted ads.

NebuAd paid ISPs to let it install internet monitoring machines inside their network. Those boxes eavesdropped on users' online habits -- and altered the traffic going to users in order to track them. That data was then used to profile users in order to deliver targeted ads on other websites.

The suit alleges the ISPs and NebuAd both violated anti-wiretapping statutes by capturing users' online communications without giving adequate notice or getting consent.

Neither WideOpenWest nor Embarq, the two largest ISPs being sued, responded to requests for comment. Knology told Congress in August it had used NebuAd in Georgia, Florida, Tennessee and Alabama, but stopped in July after Congress started asking questions. The other named ISP defendants are Bresnan Communications, Cable One, CenturyTel, all of which admitted testing NebuAd's technology.

The suit seeks damages as well as an injunction against any similar behavior in the future.

BT has banned all future discussion of Phorm and its WebWise targeted advertising product on its customer forums, and deleted all past threads about the controversy dating back to February.

Subscribers to BT's broadband packages had used the BT Beta forums to criticise its relationship with Phorm and raise concerns about the technical implications of ISPs wiretapping their customers.

However, BT decided it had had enough and deleted the threads. A first thread on WebWise extended to almost 200 pages, before being closed in late September when BT's third trial of the system began. It was still available to read however and a new thread was started by BT Beta moderators, which continued until yesterday. All record of either has now been removed.

Phorm expects to launch its targeted ad service in the first half of next year after a successful trial with BT.

Phorm is behind technology that analyses web users' behaviour in a bid to serve up more relevant advertising. The company has been criticised because of fears that its technology will allow internet companies to spy on users.

However, it has taken great pains to explain that privacy is one of its major concerns and that because of the way its targeting works, no identifying information is retained on web users.

Phorm said that the BT trial, which began on 30 September, achieved its primary objective of testing all the elements necessary for a larger deployment, including the serving of small volumes of targeted advertising. BT has said it expects to move towards deployment of the Phorm platform.

Phorm chief executive Kent Ertugrul said: We have met with most of the main players in the advertising sector and they welcome the potential commercial value of the service. We have not set a date for a full launch, as this depends on several factors such as the ISPs, but we are looking at a launch in the near term. This is a first half of 2009 initiative.

News articles based on a survey indicating public opposition to Phorm's web snooping and advertising system have been withdrawn after the firm made legal threats to their publishers.

The independent consumer watchdog Which? sent a press release to newspapers earlier this week entitled Internet users say: Don't sell my surfing habits. It detailed survey findings that UK internet users are opposed to plans by BT, TalkTalk and Virgin Media to monitor and profile their browsing in collaboration with Phorm.

The findings contradicted market research repeatedly cited, but not published, by Phorm that the majority of people want the more relevant web experience it claims its Webwise-branded technology will provide.

The Which? survey was covered by the Press Association, Channel 4 News, The Telegraph, and The Daily Mail. The press release, however, was swiftly followed by a retraction of the press release.

The Press Association, Channel 4 News and Telegraph stories have all been removed whilst the Daily Mail has edited its story to online to remove all references to the negative survey findings.

A Phorm spokesman said that the survey had been based on inaccurate information and that the press release itself contained inaccuracies. It repeatedly stated the Webwise system collects and sells on data which is misleading. We also wouldn't allow the creation of advertising channels on sensitive subjects such as for medical products.

BT must be stopped from deploying technology that uses people's personal internet communications to make money from advertisers, the government was told this week.

Baroness Miller of Chilthorne Domer, Liberal Democrat home affairs spokeswoman, asked in the Lords for the government to delay the rollout of interception-based online advertising until its legality had been established under the Regulation of Investigatory Powers Act 2000.

She told Computer Weekly that Ofcom, the Information Commissioner, the Home Office and the Department for Business Enterprise and Regulatory Reform (BERR) were all passing the buck. Phorm could normalise a level of snooping not even attempted by the Home Office's stalled Interception Modernisation Programme.

Online retailer Amazon has confirmed that it is opting out of the controversial internet advertising service, Phorm.

The company has said that it will not allow Phorm to scan its web pages in order to serve customers with targeted adverts based on their browsing habits.

The Phorm technology, known as Webwise, has been at the centre of controversy in recent months. Last year, BT allowed a trial of Webwise to go ahead without the explicit consent of users. It has now started a new trial of the technology on an opt-in basis only.

Although Phorm has been cleared by the Information Commissioner’s Office of any concerns regarding data or privacy, the European Commission has announced that it is starting legal action against the UK government for the way its data protection laws operate in relation to Phorm.

The EU telecoms commissioner, Viviane Reding, said: I call on the UK authorities to change their national laws and ensure that national authorities are duly empowered and have proper sanctions at their disposal to enforce EU legislation.

The Commission has branded the technology as an interception of user data, and believes there is a legal need for more explicit seeking of consent from users before such services can be rolled out.

And privacy lobby the Open Rights Group has also called on a number of websites, including Microsoft, Google and AOL to opt out of Phorm’s scheme. The group said it expected more companies to follow Amazon’s lead and opt out of the Phorm service.

Phorm introduce their Stop Phoul Play website:

Over the last year Phorm has been the subject of a smear campaign orchestrated by a small but dedicated band of online "privacy pirates" who appear very determined to harm our company. Their energetic blogging and letter-writing campaigns, targeted at journalists, MPs, EU officials and regulators, distort the truth and misrepresent Phorm's technology. We have decided to expose the smears and set out the true story, so that you can judge the facts for yourself.

Shares in Phorm, the controversial online advertising group that tracks consumer behaviour, plunged more than 40% after BT said it has no immediate plans to use the company's technology.

We continue to believe the interest-based advertising category offers major benefits for consumers and publishers alike, said BT: However, given our public commitment to developing next-generation broadband and television services in the UK, we have decided to weigh up the balance of resources devoted to other opportunities.

Phorm's software has been dogged by controversy following news that BT ran two trials using it without seeking its customers' permission in 2006 and 2007. Tim Berners-Lee, the British founder of the internet, has also spoken out against Phorm.

Phorm said that it is now focused on its overseas business and has made strong progress in South Korea: We are engaged in more than 15 markets worldwide, including advanced negotiations with several major internet service providers (ISPs).

The likes of Virgin Media and Carphone Warehouse are believed to be considering working with the group. However, Virgin Media released a statement suggesting that no deal was imminent. The company believes that interest-based advertising has some important benefits for consumers as well as website owners and ISPs but said it was a fast-changing market and had extended its review of potential opportunities.

Americans do not want to be given tailored advertising based on monitoring of their online behaviour, according to what its authors call the first independent, academically rigorous survey of consumers' views.

Research conducted by the University of Pennsylvania and the Berkeley Centre for Law and Technology has found that 66% of adult US citizens do not want advertising to be tailored to what advertisers think are their interests.

Publishers keen to increase advertising revenue and advertisers have claimed that tracking that does not identify users by name is acceptable to most people, because of the benefits that accrue from being shown more relevant ads. To marketers, it is self-evident that consumers want customized commercial messages, the academics' report says. The survey's data appear to refute that argument.

Contrary to what many marketers claim, most adult Americans (66%) do not want marketers to tailor advertisements to their interests, said the study. We conducted this survey to determine which view Americans hold. In high%ages, they stand on the side of privacy advocates. That is the case even among young adults whom advertisers often portray as caring little about information privacy, it said. Our survey did find that younger American adults are less likely to say no to tailored advertising than are older ones.

This survey's findings support the proposition that consumers should have a substantive right to reject behavioural targeting and its underlying practices, said the report.

Ministers face an embarrassing showdown in court after the European Commission accused Britain of failing to protect its citizens from secret surveillance on the internet.

The legal action is being brought over the use of controversial behavioural advertising services which were tested on BT's internet customers without their consent to gather commercial information about their web-shopping habits.

Under the programme, the UK-listed company Phorm has developed technology that allows internet service providers (ISPs) to track what their users are doing online. ISPs can then sell that information to media companies and advertisers, who can use it to place more relevant advertisements on websites the user subsequently visits. The EU has accused Britain of turning a blind eye to the growth in this kind of internet marketing.

Ministers were warned by the EU in April that if the Government failed to combat internet data snooping it would face charges before the European Court of Justice. The European Commission made it clear this week that it is unhappy with the Government's response and began further legal action to force ministers to address the problem. Commissioners are disappointed that there is still no independent national authority to supervise interception of communications.

Europe's information commissioner Viviane Reding said that the aim of the Commission was to bring about a change in UK law. People's privacy and the integrity of their personal data in the digital world is not only an important matter: it is a fundamental right, protected by European law, she said. I therefore call on the UK authorities to change their national laws to ensure that British citizens fully benefit from the safeguards set out in EU law concerning confidentiality of electronic communications.

The Commission said the UK had failed to comply with both the European e-Privacy Directive and the Data Protection Directive.

Google is now personalizing results even when users have not logged into its web-dominating search site.

Personalization is a euphemism for a Google-controlled practice that involves tweaking your search results according to your past web history. Mountain View was already doing this with users who had signed in to a Google account so they could use non-search services like Gmail and Google Calendar. But now it's targeting results for all users - whether they're logged in or not.

Google has always hoarded the search history of everyone visiting the site - whether they were logged in or not. But this is the first time Google has massaged results for users who haven't signed in. This is just one of the many reasons Google likes cookies.

The company's new cookie-based personalization is based on 9 months of stored data. And it's completely separate from account-based personalization.

Google does let you turn off personalization off. But it's on by default - and we all know that most people will leave it on.

The Crown Prosecution Service has revealed that it is working with a top barrister on a potential criminal case against BT over its secret trials of Phorm's targeted advertising system.

BT had covertly intercepted and profiled the web browsing habits of tens of thousands of its customers, the CPS told campaigners this week that it is still investigating the affair.

The Crown Prosecution Service is working hard to review the evidence in this legally and factually complex matter, a spokeswoman said.

Campaigners gave prosecutors a file of evidence, including a copy of BT's detailed internal report on a trial of Phorm's technology in 2006, obtained by The Register. The experiment monitored 18,000 broadband lines without customers' knowledge or consent.

This week the CPS said: We are currently awaiting advice from a senior barrister which we will review before coming to a conclusion. We are giving the matter meticulous attention and will reach a proper and considered decision as soon as it is possible for us to do so.

The main law BT is alleged to have broken is the Regulation of Investigatory Powers Act (RIPA). It restricts the interception of communications.

ISP TalkTalk has been reprimanded by the Information Commissioner's Office (ICO) for failing to disclose enough about a trial requiring the collection of the urls of websites visited by customers.

The ICO said the ISP should have told both it and customers about the trial.

In August the ICO received a Freedom of Information request, asking whether it had investigated the system.

It revealed that it had and in correspondence with TalkTalk, Information Commissioner Christopher Graham said: I am concerned that the trial was undertaken without first informing those affected that it was taking place. He also revealed that TalkTalk had not told the ICO about the trials: In the light of the public reaction to BT's trial of the proposed Webwise service I am disappointed to note that this particular trial was not mentioned to my officials during the latest of our liasion meetings.

BT's Webwise system, devised by ad firm Phorm to track user behaviour in order to serve them more relevant advertisements, proved highly controversial.

TalkTalk defended its trial and the technology. We were simply looking at the urls accessed from our network, we weren't looking at customer behaviour so we didn't feel we were obliged to inform customers, said Mark Schmid, TalkTalk's director of communication. It didn't cross our minds that it would be compared to Phorm, said Schmid.

Schmid explained that the system scans websites and would provide customers with a blacklist of sites that contained malware or viruses. In its tests, some 75,000 websites were found to contain malware. TalkTalk plans to introduce the system at the end of this year.

The European Commission is suing the UK government over authorities' failure to take any action in response to BT's secret trials of Phorm's behavioural advertising technology.

The Commission alleges the UK is failing to meet its obligations under the Data Protection Directive and the ePrivacy Directive.

The action follows 18 months of letters back and forth between Whitehall and Brussels. The Commssion demanded changes to UK law that have not been made, so it has now referred the case to the European Court of Justice in Luxembourg.

Specifically, European officials firstly charge that contrary to the ePrivacy Directive there is no UK authority to regulate interception of communications by private companies.

Secondly, the European Commission says the Regulation of Investigatory Powers Act (RIPA), which sanctions commercial interception when a company has reasonable grounds for believing consent has been given, does not offer strong enough protection to the public. The City of London police dropped their investigation of the Phorm trial, claiming BT had reasonable grounds to believe it had customers' consent.

European law says consent for interception must be freely given, specific and informed indication of a person's wishes. BT did not obtain, or attempt to obtain, such consent to include customers' internet traffic in its testing.

Finally, the Commission says the provisions of RIPA that outlaw only intentional interception are also inadequate. EU law requires Members States to prohibit and to ensure sanctions against any unlawful interception regardless of whether committed intentionally or not, it said.

If the government loses the case, it faces fines of millions of pounds per day until it brings UK law in line with European law.

Facebook might be inadvertently outing its gay users to advertisers, according to a new study.

Researchers have discovered that different targeted advertising is being sent to users' accounts if they have described themselves as gay or straight.

The discovery could mean that people who wish to keep their sexuality private may be sharing it with advertisers without their knowledge.

A team from Microsoft and Germany's Max Planck Institute created six fake profiles: two straight men, two straight women, a gay man and a lesbian. They wanted to see if Facebook targeted ads based on sexuality, and so the profiles were left otherwise completely the same.

The team then monitored what ads each virtual user was sent over a period of a week. They found that the ads displayed on the gay man's profile differed substantially from those on the straight one. Many of these adverts were not obviously adverts for services that only gay men would require, and half of them did not mention the word gay in the text.

The researchers write in the paper: The danger with such ads, unlike the gay bar ad where the target demographic is blatantly obvious, is that the user reading the ad text would have no idea that by clicking it he would reveal to the advertiser both his sexual-preference and a unique identifier (cookie, IP address, or email address if he signs up on the advertiser's site).

The loophole means that any advertisers who collect data such as Facebook IDs could match a person's sexual preference with their unique ID and their name.

Last week it emerged that vast amounts of data – including the names of individual members and their online friends – were passed to internet advertising firms, with tens of millions of people thought to have been affected. The leaks were possible even when members had deliberately set their privacy options to the maximum secrecy levels.

Security experts warned that the details could be used – when combined with other publicly available information – to build up a detailed picture of an individual's interests, friendship circle and lifestyle.

Around 25 different advertising and data firms were receiving the information, an investigation by the Wall Street Journal found. It was passed to them by firms whose apps – games and other features – operate on Facebook and not by the social networking site itself.

The Home Office is scrambling to close loopholes in wiretapping law, revealed by the Phorm affair, ahead of a potentially costly court case against the European Commission.

It is proposing new powers that would punish even unintentional illegal interception by communications providers.

Officials in Brussels are suing the government following public complaints about BT's secret trials of Phorm's web interception and profiling technology, and about the failure of British authorities to take any action against either firm.

The government has now issued a consultation document proposing changes to the Regulation of Investigatory Powers Act (RIPA) that will mean customer consent for interception of their communications must be freely given, specific and informed, in line with European law. RIPA currently allows interception where there is only reasonable grounds for believing consent is given.

The Home Office consultation document has been published with an unusually short period for public response closing 7 December.

Google's GMail service has announced that it will be trawling people's email to try and extract signals that it can use to more selectively target ads.

Google wrote:

Coming soon: Better Ads in Gmail

• Fewer irrelevant ads
• Gmail's importance ranking applied to ads
• Offers and coupons for your local area

Bad ads tend to annoy people. We're trying to cut down on these ads, and make the ones you do see much more useful.

With features like Priority Inbox, we've been working hard to help sort out the unimportant messages that get in your way. Soon we're going to try a similar approach to ads: using some of the same signals that help predict which messages are likely to be important to you, Gmail will better predict which ads may be useful to you. For example, if you've recently received a lot of messages about photography or cameras, a deal from a local camera store might be interesting. On the other hand if you've reported these messages as spam, you probably don't want to see that deal.

As always, ads in Gmail are fully automated-no humans read your messages- and no messages or personally identifiable information about you is shared with advertisers.

BT will not be prosecuted for snooping on the web browsing habits of its customers.

The Crown Prosecution Service (CPS) has dropped a request to bring charges against BT and Phorm - the firm that supplied the monitoring system. The Webwise software used cookies to track people online and then tailored adverts to the sites they visited.

Trials were carried out in 2006 and involved more than 16,000 BT customers. When the covert trials became public they led to calls for prosecution because BT and partner Phorm did not get the consent of customers beforehand. Snooping is an offence under the Regulation of Investigatory Powers Act which outlaws unlawful interception.

At present, the available evidence is insufficient to provide a realistic prospect of conviction, said the CPS in a statement: We would only take such a decision if we were satisfied that the broad extent of the criminality had been determined and that we could make a fully informed assessment of the public interest. It added that there was no evidence to suggest that anyone who unwittingly took part in the trial suffered any harm or loss.

Facebook is facing a European crackdown on how it exploits vast amounts of its users' most personal information to create bespoke advertising.

The European Commission is planning to stop the way the website eavesdrops on its users to gather information about their political opinions, sexuality, religious beliefs, and even their whereabouts.

Using sophisticated software, the firm harvests information from people's activities on the social networking site, whatever their individual privacy settings, and make it available to advertisers.

However, following concerns over the privacy implications of the practice, a new EC Directive, to be introduced in January, will ban such targeted advertising unless users specifically allow it.

Even though Facebook is US based, if it fails to comply with the new legislation it could face European legal action or a massive fine.

Viviane Reding, the vice president of European Commission, said the Directive would amend current European data protection laws in the light of technological advances and ensure consistency in how offending firms are dealt with across the EU. She said:

I call on service providers -- especially social media sites -- to be more transparent about how they operate. Users must know what data is collected and further processed (and) for what purposes.

Consumers in Europe should see their data strongly protected, regardless of the EU country they live in and regardless of the country in which companies which process their personal data are established.

US also pick up on Facebook's privacy deficiency

See article from mashable.com

Facebook has agreed to a settlement with the US Federal Trade Commission (FTC) over charges that the social network had deceived its users about privacy.

The FTC had accused Facebook in an eight-count complaint of not living up to its own promises. Among them: sharing users' personal information with third parties without their knowledge or consent, changing privacy practices without informing users, and claiming to have a program to verify the security of apps when it didn't.

The terms of the settlement bar Facebook from making any further deceptive privacy claims. Facebook also agrees to obtain users' permission before making any changes to the way the service shares their information. And in a condition similar to the FTC settlement with Google over Google Buzz, Facebook also must submit to regular assessments from privacy auditors for a no less than 20 years.

The FTC complaints about Facebook are:

• In December 2009, Facebook changed its website so certain information that users may have designated as private --- such as their Friends List --- was made public. They didn't warn users that this change was coming, or get their approval in advance.

• Facebook represented that third-party apps that users' installed would have access only to user information that they needed to operate. In fact, the apps could access nearly all of users' personal data --- data the apps didn't need

• Facebook told users they could restrict sharing of data to limited audiences --- for example with Friends Only. In fact, selecting Friends Only did not prevent their information from being shared with third-party applications their friends used.

• Facebook had a Verified Apps program & claimed it certified the security of participating apps. It didn't.

• Facebook promised users that it would not share their personal information with advertisers. It did.

• Facebook claimed that when users deactivated or deleted their accounts, their photos and videos would be inaccessible. But Facebook allowed access to the content, even after users had deactivated or deleted their accounts.

• Facebook claimed that it complied with the U.S.- EU Safe Harbor Framework that governs data transfer between the U.S. and the European Union. It didn't.

Google has announced that it was placing 60 of its Web services under a unified privacy policy that would allow the company to share data between any of those services. (Google Books, Google Wallet and Google Chrome are excluded due to different regulatory and technical issues.)

Any user with a Google account --- used to sign in to services such as Gmail, YouTube and personalized search --- must agree to the policy. Users who don't want to have their data shared have the option to close their accounts with Google.

The changes will apply from March 1st.

Data-protection agencies in Ireland and France said they would assess the implications of the push. At least one consumer-advocacy group fretted that the policy -- which makes it easier for Google to target advertisements to specific groups -- might tie users' hands and make it harder for them to limit what the company can do with their information.

This announcement is pretty frustrating and potentially frightening from a kids and family and teenager standpoint and an overall consumer privacy standpoint, said James Steyer, chief executive officer of San Francisco-based Common Sense Media.

...Read the full article

A small group of British MPs have signed up to an Early Day Motion voicing concern that Google are set to plunder user data for advert serving purposes.

The primary sponsor is Robert Halfon and the motion reads:

That this House

• is concerned at reports in the Wall Street Journal that Google may now be combining nearly all the information it has on its users, which could make it harder for them to remain anonymous;

• notes that Google's new policy is planned to take effect on 1 March 2012, but that this has not been widely advertised or highlighted to Google's users and customers, who now number more than 800 million people;

• and therefore concludes that Google should make efforts to consult on these changes and that the firm should be extremely careful in the months ahead not to risk the same kind of mass privacy violations that took place under its StreetView programme, which the Australian Minister for Communications called the largest privacy breach in history across western democracies.

The motion has been signed by

• Campbell, Gregory: Democratic Unionist Party Londonderry East
• Campbell, Ronnie: Labour Party Blyth Valley
• Caton, Martin: Labour Party Gower
• Clark, Katy: Labour Party North Ayrshire and Arran
• Connarty, Michael: Labour Party Linlithgow and East Falkirk
• Corbyn, Jeremy; Labour Party Islington North
• Halfon, Robert; Conservative Party Harlow
• Hopkins, Kelvin; Labour Party Luton North
• McCrea, Dr William; Democratic Unionist Party South Antrim
• Meale, Alan; Labour Party Mansfield
• Morris, David; Conservative Party Morecambe and Lunesdale
• Osborne, Sandra; Labour Party Ayr Carrick and Cumnock
• Rogerson, Dan; Liberal Democrats North Cornwall
• Vickers, Martin; Conservative Party Cleethorpes
• Williams, Stephen; Liberal Democrats Bristol West

When new rules governing the way companies collect and use data about our movements online come into force, a little i symbol will appear on screen to reveal adverts generated by cookies. Many internet users find these digital devices, which are used by websites to create personal profiles based on use of the Internet, intrusive.

The data is used for Online Behavioural Advertising, allowing companies to direct their display adverts at individuals who, through the websites they have visited, have indicated an interest in certain goods or services.

The warning system, to be introduced by the European Advertising Standards Alliance and the Internet Advertising Bureau of Europe, will allow users to opt out of all Online Behavioural Advertising.

Similar measures introduced in the US had shown that users were often reassured about the use of cookies and chose to redefine their advertising profiles so they more accurately reflected their interests. Some web names, like Yahoo!, have already begun using the triangle icon on a voluntary basis in Britain but from June all ad networks will be required to display the symbol or face sanctions.

Changes made by Google to its privacy policy are in breach of European law, the EU's justice commissioner has said.

Viviane Reding told the BBC that authorities found that transparency rules have not been applied.

The policy change, implemented on 1st March, means private data collected by one Google service can be shared with its other platforms including YouTube, Gmail and Blogger.

Google said it believed the new policy complied with EU law. It went ahead with the changes despite warnings from the EU earlier this week.

Offsite Comment: Thoughts on Google's Privacy Policy changes

2nd March 2012. See article from privacyinternational.org

Google wants to be able to provide an ID card equivalent for the Internet.

...Read the full article