UK.gov misses deadline on EU Phorm probe The government has failed to meet a deadline to respond to European Commission questions over the UK's handling of BT's allegedly illegal secret trials of Phorm's ISP-level adware and its planned rollout of the system to millions of subscribers, The Register has learned. The Commission wrote to the UK government to quiz …
Many thanks Chris and El Reg for keeping us up to date with this story.
I would expect the real reasons that UK Gov has not responded to this letter from the EU Gov is that, as partly indicated by BT they:
A) Are too stupid to fully understand the technology.
B) Are too stupid to fully understand the content of the letter from the EU.
C) Might have to do some work.
D) Will have crosses against their names for rocking the pork trough boat that is Labour and corporate business.
Sod the lot of you.
Hopefully the EU will force our government to get a clue in this instance and realise that they *must* enforce the provisions that they themselves signed into law. There's no point having any laws if nobody is responsible for investigating alleged breaches.
What happens if the EU parliament decides that the UK effectively has not implemented the statutory requirements since it has not included an investigatory body?
Q1. What are the United Kingdom laws and other legal acts which govern activities falling within the scope of Articles 5(1) and 6 of Directive 2002/58/EC on privacy and electronic communications and Articles 6, 7 and 17(1) of Directive 95/46/EC?
A1. Data protection act probably.
Q2. Which United Kingdom authority(-ies) is (are) competent (i) to investigate whether there have been any breaches of the national law transposing each of the above-mentioned provisions of Community law arising from the past trials of Phorm technology carried out by BT and (ii) to impose any penalties for infringement of those provisions where appropriate?
A2. None.
Q3. Have there been any investigations about the past trials of Phorm technology by BT and what were their results and the conclusions of the competent authority(-ies)? Are there ongoing investigations about possible similar activities by other ISPs?
A3. Unlikely.
Q4. What remedies, liability and sanctions are provided for by United Kingdom law in accordance with Article 15(2) of the Directive on privacy and electronic communications, which may be sought by users affected by the past trials of the Phorm technology and may be imposed by the competent United Kingdom authority(-ies) including the courts?
A4. Maybe a little fine which can be recouped by upping customers charges.
Q5. According to the information available to the United Kingdom authorities, what exactly will be the methodology followed by the ISPs in order to obtain their customers' consent for the deployment of Phorm technology in accordance with the relevant legal requirements and what is the United Kingdom authorities' assessment of this methodology?
A5.There will be a generic disclaimer placed within a microdot within the customer's contract permitting ISPs to do whatever they like in future.
Maybe if they'd asked for a response in 48 hours they'd have got one - a month is easily enough time to forget...
Dear Fab Fabio,
It's a Fair Cop. We wuz Robbin' the poor SAPs Blind. Wanna Piece of the Action? How Much of a Bung will it take for you to Look the other Way.
IT's amazing what Phorm can discover and the Private and Personal Leverage that ITs Technology can XXXXtraOrdinarily Render. It's like stealing Candy from a Baby.
Ps. Ever had a horse's head in the bed. Now run along to Viviane and tell her Thanks but no Thanks ..... in the nicest possible way, of course. Find your own Cash Cow to Milk Dry and give her a Good Seeing to.
Yours Most Sincerely, BT FCUK
This is my quadary :
1 : Hate Phorm. Think BT were [if not wrong] very VERY cheeky.
2 : What the "£$%££$%£W"$E%$!" has it got to do with a bunch of jacked up europeans. The B in BT is BRITISH telecom.
In the famous words of The Sun, Up Yours Delors......
I'd change it if OI could think of something offensive to rhyme with Redding......
P.
I was bounced between the Home Office and ICO multiple times, before one of them finally admitted that the CPS would have to instigate any proceedings...
From here I checked the CPS website, and then ended up deciding to go via my local police force (since I couldn't see anywhere on the CPS site to contact them for this sort of thing).
Got a call back from a nice policewoman stating that I was not the first person to raise this concern, and that it had been forwarded to the Metropolitan Police Computer Crimes department - who were already investigating multiple other complaints.
They're apparently due to decide what to do about this by mid September... So please, if you have the time/inclination - contact your local police force and get some more names behind the investigation...
Also, don't let this be buried. The time it's taking to get an answer is allowing the majority of people to forget about this issue - which is possibly part of the plan </tinfoil hat>
(Thanks for the update, Chris)
True.
Government ministers & the ICO may not 'fully understand' the implications of this technology.
But you can bet your sweet ass that there ARE people in the (un)Civil Service and security services who DO 'fully understand' not only the implications, but the possibilities of this technology.
Hence the large dose of official disregard being given to the subject.
On Saturday I cancelled my BT service, their Phorm trials irked me and the recent disclosures about their throttling of non port 80 traffic was the final straw. BT attempted to stall by various methods, disconnecting the call, telling us the MAC system wasn't working and they would call back in a day or two. They also tried reasoned argument. I was promised that Phorm would be on an opt-in basis only, controlled by cookies. How their salesman could give such an assurance, when the matter is debate between Phorm and BT is a mystery.
I thought the following quote was especially self serving: "... there is no evidence to suggest significant detriment to the individuals involved" i.e. we didn't hurt anyone, honest guv’. This statement speaks volumes about the monumentally presumptuous attitude BT are displaying to their customers. BT are essentially setting themselves as judge/jury; then acquitting themselves. I wonder how this defence would work for a postman at your local magistrates’ court: "No one was reading the letters, so I thought I would". Then again this could be a factually accurate; there is no evidence because they've hidden it.
by the EU is that it appears that interception of our internet traffic by Phorm will still take place even with an opt-out and that this is still illegal and objectionable.
Phorm's response to date is, a la Blair, 'trust us'. Not bloody likely.
The problem is who do we now trust. Answers on a postcard please!
"What happens if the EU parliament decides that the UK effectively has not implemented the statutory requirements since it has not included an investigatory body?"
AFAIK they have the powers to impose a daily fine on the UK for each day that goes by and they dont comply with the law. This amounts to little more than a joke with a bad punchline, there's one EU country (it may even be UK. Or Greece. Let's be honest, I don't know) that is constantly being fined for something (again, I don't know what for) and they just pay the fine and keep doing whatever it was.
"The fact that the (unelected) EU is taking action to protect its citizens - unlike our *democratically elected* government - is just TOO wierd."
I know, like a Tory MP taking steps to draw attention to the erosion of our liberties, and the (Equally unelected) house of lords stepping in to protect the common man from 42 days.
Alien, because I feel like I'm living in a virtual reality while I'm being probed
If they could tell me if they still planned on implementing Phorm at any point, as they tried to sell me broadband.
Of course the salesman had never heard of Phorm, nor was he aware that BT had been trialling it, so I decided to have a chat with his manager.
Of course, the manager had never heard of Phorm either.
Do BT think we're stupid, like the government who allow all this to take place, while ruining the economy (no national debt when NuLabour came to power, how many trillion now? 19 is it?), eroding civil liberties (no freedom to protest anymore, not without a permit!), ignoring all of their own scientific advisors (on global warming, on carbon offsetting, on the dangers of 'lethal' cannabis) while treating the population as an enemy that need to be controlled. Oooh, I mustn't forget the 10,000 odd NEW LAWS that they've introduced since 1998... (anyone else think that in 1998 we probably had the basics and most other stuff covered?).
Get a clue BT, get a clue Nulabour. The joyous part of this is how labour are sunk and havent a chance of staying in power, unless they buy some vote counting machines from a well known company in the states which is owned by the cousin of good old dubya.
I mean, sheeeyat! What does it take!?
Black helicopters as they're clearly going to be watching anyone who doesnt trust the government.
Mine's the one with the letter to the EU saying 'Get 'em Boys' in the pocket.
'What happens if the EU parliament decides that the UK effectively has not implemented the statutory requirements since it has not included an investigatory body?'
INAL - but - the next step would be for the EU Commission to take the UK government to the European Court of Justice which resolves matters about EU policy (confusingly called EC legislation). If the ECJ finds the UK to be in breach of its commitments under various pieces of EC legislation, the UK would be forced to amend its own legislation to be compatible with the relevant EC law since The Treaty of Rome, (implemented into UK legislation by the European Communities Act (1972)), states that European legislation is automatically supreme over domestic legislation.
The court can can also choose to fine the guilty parties which would be the government, and quite possibly, BT, if they are a party to the complaint.
Are a bunch of self serving time wasters who *still* can't get their accounts signed of due to fraud.
And they are the *GOOD* guys in this.
What does that say about our Government.
No Icon because El Reg seams to have missed out on the boot stamping on your face forever one.
Another great bit of work from Mr Williams.
Getting on for a month ago I sent my MP a letter asking WTF uk.gov was doing about Phorm and whether I should just refer my complaint to the EU. There has been no response since.
Perhaps the rather pointed letter from the gentleman from the EU is the cause of the non reply.
Wouldn't it be nice to see BT and Phorm get a MSFT style reaming from the EU - a wild fantasy I know!
I know there are problems with the European Parliament, but at least we get to hear about them, all sorts of things happen in this country that are hushed up.
This is the reason why the state and it cronies are so against the British people having a constitution, they would finally have some rights. Their stance, "because we say so" would no longer protect them from true justice.
This case embodies the very reason why we can't trust "our" law and state they just don't have our interests at heart, that is unless you are part of their clique.
I think it is great that finally the corrupt people who abuse their power over us are being brought to book.
Down with BT, PHORM and the old school network
OK, so we all know that the UK government is shit and that their business model is to employ the dross that couldn't make it in the private sector, but this goes beyond incompetence. I would be prepared to bet a lot of money that there is a UK Gov back door in to the Phorm system.
We live in a country where privacy watchdogs ENCOURAGE the use of interception laws by local councils to gather even more information. Over 500,000 'legal' intercepts last year alone (not counting the many illegal intercepts that are routinely made by our police and security services that cannot be entered in to evidence).
UK Gov will not investigate, no prosecutions will be taken and BT will get away with it.
"It requests answers on how and why the UK government has acted over both the secret trials of Phorm in 2006 and 2007, and planned future deployments of the technology."
... to reply "We haven't." ?
BERR and co are probably scrabbling around for someone to take the fall before they reply. Hopefully it will be Richard Thomas, who thoroughly deserves to be publicly horse whipped for his efforts in this, and other, matters.
I don't subscribe to BT's broadband service but I do have a broadband subscription. I access the internet through my BT phone line that goes to the telephone exchange. Phorm's kit would, generally, be located in the exchange systems.
So, if the Phorm technology is based in "deep packet inspection" of TCP/IP packets how does it know I'm not a BT Broadband customer - by the telephone number the packet has come from? Is it the case, therefore, that anyone with a BT line can have their browsing history intercepted and examined even though they're not to be targetted for ads?
I confess ignorance in these matters and do look to those who do know and do enforce the law to protect me. It seems as though those charged with this responsibility - and paid well for it! - don't want to.
Ah, but, its only adverts they're sending so that's alright then.....
RIPA requires ISPs to log all internet sites accessed by their customers and to provide to the government on demand. This is a large potential cost burden on ISPs.
So you can see why both ISPs and uk.gov are keen on Phorm. It could enable them to comply with the RIPA requirement to log all sites visited with no cost to the ISP. Phorm log all the sites accessed on behalf of the ISP "for free" in return for being able to place targeted advertising to the ISPs customers. The ISPs get to meet the otherwise overly burdensome RIPA requirements without having to spend anything. Indeed they might even get paid for the privilege. And uk.gov gets to see every website every citizen visits.
So you can see why uk.gov are not keen to close down Phorm. They need Phorm as much as BT, since they require all electronic communications to be logged so they can catch criminals like suspected terrorists and people who allow their dogs to foul the streets.
There's no reason to worry about that particular aspect of matters. Your voice traffic gets routed over one set of logical connections and your data (broadband) traffic gets routed over a different set. They may use the same copper wires and the same optical fibres, but, in all probability, they are technically independent operations. Allegedly.
"I look to those who do know and do enforce the law to protect me."
I'd worry about that, given the picture to date. The ones who know the law are seeing the law being ignored, and no authority enforcing the law, and no UK authority protecting UK citizens.
Never one to be a pro-EU person, I have to admit some delight in the letter from the EU to our government. It's been like pulling teeth trying to get the BT trial investigated properly and Im not finished trying to get it to happen yet.
So the EU wants to know who should be investigating it properly? We all want to know that!!!
Most of these comments treat BT as a monolithic entity, whereas in reality it's made up of several component units which operate largely independently, in many cases for regulatory reasons. Your broadband connection (on a BT line) via your local exchange is the responsibility of BT Wholesale, who pass the connection through to your chosen ISP. If your ISP is 'BT' then this is part of BT Retail, and it is this unit which is playing footsy with Phorm. The Phorm stuff is in the ISP part, not the Wholesale part.
I would like to inform all reg readers that the department responsible for this cock up did reply to the EU
All of the correspondence and a covering letter was placed in a brown envelope and posted 2 weeks ago.
Unfortunately the data was lost in the post and the laptop with a copy of the correspondence was left by mistake on the 8.00am from London to Manchester.
The laptop and the CD was password protected, so no worries..
Err sorry a password reminder was also included just in case, The reminder was written by the GMTV phone in quiz setters.
The PM is called.
a) Gordon Prat
b) Gordon Brown
c) Not a clue,
Just enter A, B or C into the password box and you will be fine
.. asking which UK Authority is competent. Haven't come across one yet since New Labour took over..
I like this one too {debate over opt-in versus opt-out is a "huge red herring"} - it is if you give absolutely squat about users's rights. Otherwise it's about the biggest thing going against being spammed out of your mailbox. As soon as you are forced to hand over your email address in order to register or otherwise be on the receiviong end of what is laughingly referred to as a "service" you are guaranteed to get it spammed by all sorts of guff, and worse, they are sold on.
If you then get someone emailing you from the UK (i.e. where you can at least scare them a bit with the DPA) you get all sorts of nonsense back as to where they got your email address. I think we should be entitled to KNOW who they bought the data of so we can go after them.
Now, back to Phorm. One of the problems with losing Phorm is that there appears to be a Secret Service angle to this (IMHO a very clever ploy from Phorm), and they're unlikely to let go of such an easy tool to ignore your privacy. I thus expect a lot of talk and little if none action to lose it. The only thing that may change is its name, because that causes the EU circus to have to start from scratch..
I don't think BT is alone in deserving to be beaten up - those who failed to recognise the illegality of this should have their rear ends birched as well. But I've always been for more direct means..
"RIPA requires ISPs to log all internet sites accessed by their customers and to provide to the government on demand. This is a large potential cost burden on ISPs."
Sorry, your understanding is misinphormed.
I suggest you read RIPA again. The ISPs do not need DPI to log any of this data: they have been logging it for years. And making summaries of the data and selling it off to anyone who is interested in knowing which are the most popular sites, the most popular hosts, the most popular anything-else-you-want-to-know.
RIPA is there to protect the common citizen from having his data intercepted without a court order. Why else do you think the ad networks who approached the Home Office were so worried that their interceptions for profiling would be a breach of RIPA? The simple thing is that if the 2 parties to a communication give their consent to the interception, then that interception is outside RIPA. The ad networks and the profilers can show that consent because there is a cookie sitting on the browser and the site delivering the ads is hosting a script which delivers the targeted ads.
The thorn in the side for the profiler/ad network is when it intercepts a page which does not contain any script to indicate it is part of the ad delivery system - and that is 99.99% of the content on the web which is outside the ad network and being intercepted without permission, which means a breach under RIPA.
No one can use the DPI and profiling system to record where you have been. They keep telling us that they don't know who they are tracking; it is all anonymous because of the use of the unique ID they store in the cookie (like anyone who worked with removing the malicious adware and pop-ups believes that something called a unique ID is anonymous). Show me any tracking cookie that follows from site to site and try to prove it is truly anonymous.
Even BT tell us that they don't know who was profiled during the 2006/7 trials. They know how many customers where profiled but don't know who they were. (How can you count IP address connections when you don't know who is connected?)
The government has already paid the ISPs for the cost of the intercepts already done - they can't use DPI because then they would be intercepting everyone on that node, and that would be illegal.
The government really don't want ISPs to use DPI. As soon as DPI starts to be used, all the websites will become encrypted to protect their content from being used to create a profile of their visitors - that is confidential and highly sensitive commercial data that the profilers are trying to copy. Once content is encrypted, the government can't do its snooping without the delay and expense of breaking the encryption.
The only entity that wants to use DPI to make a profit is the ISP (and the ad network collecting the data for their profit). Quite why the ISPs want to annoy and alienate their customers by changing their role from passive data conduit to active data interceptor is something only the ISPs can answer.
In all of this saga since the story first broke, the most deafening silence has been that from uk.gov. The ICO has shuffled it's feet in embarrassment and said as little as possible as ambiguously as possible. The rest have said virtually nothing, which is decidedly odd for a government that usually has an opinion on everything from the benefits of having super rich people to the goings on in the big brother house.
While "stupid and uncomprehending" is clearly a possibility, the quality of the silence seems to suggest something else beyond the usual capitalist love-in sentiment. It seems more like they wish it would all just go away and we'd go back to being docile, but should they publicly state their views on phorm, web surveiilance etc the shit really would hit the fan at escape velocity. I'm personally intrigued, because I can't recall NULab keeping their mouths shut for such a long time on anything.
Clearly not addressing the letter is not an option, and since the EU is famously leaky I suspect that one way or another the reply will come out sooner rather than later, and that the governments motives for inaction will not make for pretty reading.
I suspect the NuLab monkeys are in love with the idea of internet users generating the revenue for the private sector mechanics of their own surveillance by the state, in what would have to be the most revaolting imaginable convergence of private profit and state paranoia. It may take decades, but that road only leads to camps, ovens and war crimes trials in the end.
I seem to recall that there were two other noxious articles involved with it. One of them Luxembourg based or some such nether-end.
PH) PECR heads.
Glad that I am not involved, NO WAY!
HA! I am with eeeugh wait... WTF?
TALKTALK??
What was I thinking? Seriously though, how did Google know what sort of spam to send me to really upset me? Or am I paranoid?
ICO said "...Whilst it does appear likely that a technical breach of the [PECR] Regulations occured in the 2006 and 2007 trials, there is no evidence to suggest significant detriment to the individuals involved...."
chris, should that word "technical" be unbolded and subset to a a real small font?.
after all a 'breach is a breach' end of story, and under PECR is a crimial offence is it not.
weather they try and mask it as unimportant with the word "technical" in nature, does NOT (or should not!) hold any legal standing in a court of law.
if the BT executive and their team authorised and actioned this wiretap (clearly at least one executive there did) and broke PECR they are looking at real jail time.
why havent the commenting UK law firms/think tanks and end users slapped down some court orders on these executives and pulled them before the courts to answer for their actions as yet?
doesnt a court bundle/information pack exist to walk you though bringing an injunction to court?, if not perhaps some right minded court and legal readers here should provide one and an example cost (should it be required to pool cash reserves to do it), and walk the potential effected end users through it to force this through the courts and get the judges officially involved.
In particular, Directive 2002/58/EC on privacy and electronic communications, which particularises and complements for the electronic communications sector the general personal data protection principles defined in the directive 94/45/EC (Data Protection Directive), obliges Member States to ensure the confidentiality of communications and related traffic through national legislation. They are required to prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than the users without their consent (Article 5(1)). The consent must be freely given, specific and an informed indication of the user's wishes (Article 2(h) of Directive 95/46/EC). Traffic data may only be processed for certain defined purposes and for a limited period. The subscriber must be informed about the processing of traffic data and, depending on the purpose of processing, prior consent of the subscriber or user must be obtained (Article 6 of Directive 2002/58/EC).
That has Knocked it up a notch!!
Wheres the spice weasel Icon?
Why are they dragging their feet in responding?
Well didn't BT insist that UK.gov had advised them that the trials were legal?
Is it beyond the bounds of credibility to imagine that itnernal investigations withing UK.gov have turned up evidence that somebody somewhere in the civil service did advise BT that it was legal?
Assuming that some herbert (no doubt to be described as a "junior clerk") did tell BT their Phorm trials were lega,l then the delay could well be explained by the government trying to draft a plausible denial.
After all if BT did have government clearance to carry out the trials then it wouldn't be BT heading for the courts, but UK.gov itself.
Or maybe not.
'It requests answers on how and why the UK government has acted over both the secret trials of Phorm in 2006 and 2007'
Or more importantly, how and why the UK government HASN'T acted over both the secret trials.
@ @RIPA
Q - 'Quite why the ISPs want to annoy and alienate their customers by changing their role from passive data conduit to active data interceptor is something only the ISPs can answer.'
A - Cash.
Once this data has been collected by Phorm it is no longer personal, rather the property of a company. UK.gov can then request it in ways they could never get away with if they were taking it directly from you. It won't even cost them to collect it. No wonder they don't want to stop it.
Even if the data is "anonymous" it would be trivial for any agency to ask Phorm "The next time you see Phorm ID 123456 tell us the IP address and the time (BTW you owe us for not closing you down in 2008)"... 1.2.3.4 at 6pm "Hello BT Internet, who had IP address 1.2.3.4 at 6pm last night?" Your deviant/subversive/politically incorrect/suspicious ass is grass.
"Once this data has been collected by Phorm it is no longer personal, rather the property of a company."
No it isnt, its still the property of the owner,that is you the end user and your *unique datastream, and the website owner and their ^unique datastream being the two partys involved in the webpage transaction, the ISP is just a conduit according to them, any unlawful act of commercial piracy is werth £50000 a time now ;) or will be soon.
they collect the data without consent, make a derivative work and sell that data, its commercial piracy end of story.
they dont own it,they dont have a licence to make a derivative work from it, its not theirs to sell...
*its pritty clear cut
unique:
existing as the only one or as the sole example; single; solitary in type or characteristics
. the embodiment of unique characteristics; the only specimen of a given kind
"Anyone fancy a FOI
By Anonymous CowardPosted Wednesday 13th August 2008 09:43 GMT The next big question is does anyone fancy making a Freedom of Information request for questions put to, and questions selected for answering, by Patricia Hewitt in various recent webcasts? Im sure the selective nature of answers would be pretty informative..."
its not exactly hard to do, in the time you took to post here you could have posted that FOI on the web site here, it just seems people dot know about this site yet, go tell your friends etc ;)
http://www.whatdotheyknow.com/search/phorm
and for a bit of fun, you might want to bump talk talk up the charts a bit, their currently lagging the other 4.
http://www.kindlyfoxtrotoscar.com/?action=toplists
Dear Chris, El Reg,
Once again I am not so outraged - this is great work from you.
One thing has started to appear on forums is a call for a test case to decide if Phorm breaches RIPA, Computer Misuse Act, PECR, DPA, Copyright, Designs and Patents act, etc.
Would El Reg consider making this a campaign, to call on the government for a test case into data pimping by ISPs (Phorm)?
After all, it would be hard for governments, ISPs and Phorm to say they don't want a test case. If Phorm is legal, then go ahead, lets have a case. If it's illegal, then surely for the ISPs and govt. POV best to find out NOW!
A TEST CASE - LETS HAVE A TEST CASE!
@AC RE: I asked BT a couple of weeks ago....
Word on the blogs and newsgroups is that BT customer service and sales employees have been specifically told to deny they know anything about Phorm if asked.
" - 1 : Hate Phorm. Think BT were [if not wrong] very VERY cheeky.
- 2 : What the "£$%££$%£W"$E%$!" has it got to do with a bunch of jacked up europeans. The B in BT is BRITISH telecom. "
--
1) Well, the BT trials were ILLEGAL under PECR and RIPA. The key issue there is consent, and no customers were informed. IMO (call me naive?), corporations should not be allowed to wiretap people just for profit.
2) The EC are the people making the laws (directives) which the UK Govt translate into RIPA, PECR and so on. ICO and the Home Office have been passing the hot potato, BT are saying it took 'legal advice' at the time, and noone from the UK Govt wants to deal with this problematic issue.
The EC are the ONLY people pushing for accountability here. What's the point of signing in laws if you're going to f****** ignore them when the UK's most powerful comms monopoly craps all over them?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
