Hitwise and Compete: the user data ISPs do sell

Testifying before Congress last month, three of America's four largest ISPs said they wouldn’t sell customer data to the likes of Phorm and NebuAd without getting consent. And the press applauded. But no one thought to ask one more question: Are they selling customer data to anyone else? Addressing the Senate Commerce …

[dephormation.org.uk]

Industrial Espionage

Its not just the USA, Hitwise claim they have data from 8 million UK subscribers if I recall correctly.

If you have an online presence, a web site, an ecommerce business... UK ISPs consider they have the right to scam your copyright content ,and sell marketing intelligence about your visitors and customers to third parties... so that your competitors can benefit from your efforts.

Its automated mass industrial espionage.

If it were happening to telephone comms, you would expect people would be jailed.

Its no different for web traffic. Web comms are private point to point connections between web sites/online businesses and their visitors and customers. Not some kind of broadcast.

A communication company stealing that data and flogging it without the consent of either party is simply utterly illegal.

[Warren]

Anonymous???

I'm amazed at how any company can think such identifiers are anonymous. My name above doesn't mean you can necessarily track me down, but it's still my name. An identifier assigned to you, be it IP address or anything else, IS yours and should not be given to anyone else or used for anything you don't agree to. If the law and common practice don't match this then I'm not surprised.

[Anonymous Coward]

Virgin Media

I can remember discussing whether Virgin Media’s Terms and Conditions already allow for a system like Webwise. Section G.2 contains “profiling your usage”, and has been inherited from the old ntl Terms and Conditions. This not the same as something like counting bytes to implement STM. That would be covered by the preceding “tracking use of our services (including …usage…)”.

If you look at Virgin Media’s Privacy Policy, it contains something very similar to AT&T’s.

“We may use aggregate information and statistics for the purposes of monitoring web site usage in order to help us develop the web site and our service and may provide such aggregate information to third parties for example content partners and advertisers.”

[Dave]

So what they really mean is...

"...We'll do whatever the hell we like, with whatever data we can capture on you; and because you agreed to our service you have given us consent..."

And the passage giving consent? Buried in tiny print somewhere in section 28 of a 46 section contract of service as a single line not indented in anyway.

[Anonymous Coward]

From VirginMedia.com -- Legal stuff

"We reserve the right to monitor and control data volume and/or types of traffic transmitted via the interactive services on your Virgin TV and/or Internet access. In the event that you exceed any usage allowance applicable to your Internet access or your use does not comply with the 'acceptable use policy' which you can read on the Virgin Media website, we reserve the right (at our sole discretion) to reduce, suspend or terminate your Internet access. During any time of reduction or suspension, you will remain liable for the payment of your original level of Internet access charge. We also reserve the right (at our sole discretion) to re-grade your Internet access to a different speed and/or usage allowance at the appropriate charge. If we make such changes we will notify you as soon as possible."

It doesn't say anything about tracking destination addresses ... but I'm no lawyer.

[RW]

Does snoopiness sell anything?

The unending attacks on online privacy are mostly[*] due to marketers who claim that if they know all about your behavior, they can peddle crap to you more efficiently. A reductio ad absurdum example is "if we know how many squares of toilet tissue you use per b.m., we'll be better able to sell you replacement tires for your bicycle."

Now we all know that marketers are professional liars, so a natural question arises regarding the truth of this claim. The natural answer is, no, it isn't at all truthful. You could record every jot and tittle of my life (such as it is) and you'd still have no idea why I use the laundry detergent or condom brands I prefer.

The marketers (being stupid as well as dishonest) have confused broad statistical correlations with real correlations. Perhaps their mistake is closely akin to the elementary mistake of running, say, 100 different statistical tests and picking out the five that by chance have statistical significance and thinking they mean something.

At the end of the day, one has to wonder if our online privacy is being sacrificed in pursuit of a will'o'th'wisp. An interesting secondary question also arises: are marketers aware of the silliness of their statements (they are, after all, professional liars), or are they merely being stoopid?

[*] Footnote: plus political and Stasi folks who want to also know everything you do and say on some specious grounds or other. Gordon Brown, Jacqui Smith, and the US DHS are merely stoopid about this.

Paris icon because she only pretends to be stupid while making shitloads of money.

[Ash]

@AC (VirginMedia.com)

That's because you have the wrong portion of the Agreement.

Here's an interestsing snippet you may like, from Section G, Sub-Section 2:

"By having the services we provide installed in your home and/or by using them you are giving us your consent to use your personal information together with other information for the purposes of providing you with our services, service information and updates, administration, credit scoring, customer services, training, tracking use of our services (including processing call, usage, billing, viewing and interactive data), profiling your usage and purchasing preferences for so long as you are a customer and for as long as is necessary for these specified purposes after you terminate your services. We may occasionally use third parties to process your personal information in the ways outlined above. These third parties are permitted to use the data only in accordance with our instructions."

I particularly like the bit about "tracking use of our services (including processing call, usage, billing, viewing and interactive data) profiling your usage and purchasing preferences" and "use third parties to process your personal information in the ways outlined above"

Good catch-all for selling your usage to marketing companies aka "profiling your usage and purchasing preferences."

Phorm, anybody?

[Anonymous Coward]

@RW

And in fact most of the monitoring being discussed is purely for "commercial" purposes and this doesn't even begin to get into the full depth of the monitoring that the gubment is doing via direct hookup to the telecomms and cable companies where they are looking at EVERYTHING.

[Anonymous Coward]

You have no privacy.

Get over it :)

[Steven Knox]

Privacy Policy?

"We asked both companies to supply us with samples of their anonymized data...But Compete declined, saying this would violate its privacy policy..."

If the data are anonymized, how can a privacy policy even apply? How can you even have a privacy policy if you do not hold private information? Either the data are fully anonymized and therefore there would be no privacy issue in sharing samples, or there is a way to track the data back, say to specific IP addresses at specific times, thus to specific accounts, and so to specific people and hence the data are not properly anonymized.

Which is it, Compete?

[Zargof]

@You have no privacy.

I like the irony of you posting as AC.

[Anonymous Coward]

The Court ruled

in my case ,that because it was possible to identify the real name behind "mickey mouse" whom I allegedly defamed by obtaining a Court Order that I had defamed the person behind the name "mickey mouse". Turn that around and it means that it could well apply to this articles scenario where someone "could" be identified. It is easy to go to Court with an IP address and get a Court Order to Order the ISP to give you the name and address of their customer.

[Schultz]

It's not the name

that worries me (I and my brethren have our own phonebook, try to track that!).

But a unique identifier number ... sounds ominous

[Michael]

@Ash

In my opinion, the worst part there is "for so long as you are a customer and for as long as is necessary for these specified purposes after you terminate your services.".

So if you cancel right now, they might still be selling all your details to advertisers in 5 years time!

[James Butler]

Encrypt

Makes a case for end-to-end encryption, dunnit? They can still track your destinations, but the rest of your activities should be tougher to use.

And props to Metz for completely leaving Google out of this article. I'm glad to see that you're (possibly) on the road to recovery, Metz.

[Jeff Rowse]

I am not a number,

I am a name!

(signed)

24601.