UK ISP Admitted to Spying on Customers

esocid writes "BT, an ISP located in the UK, tested secret spyware on tens of thousands of its broadband customers without their knowledge, it admitted yesterday. The scandal came to light only after some customers stumbled across tell-tale signs of spying. At first, they were wrongly told a software virus was to blame. BT said it randomly chose 36,000 broadband users for a 'small-scale technical trial' in 2006 and 2007. The monitoring system, developed by U.S. software company Phorm, formerly known as 121Media, known for being deeply involved in spyware, accesses information from a computer. It then scans every website a customer visits, silently checking for keywords and building up a unique picture of their interests. Executives insisted they had not broken the law and said no 'personally identifiable information' had been shared or divulged."

Idiots... don't do it client-side

[sd.fhasldff]

Why on Earth wouldn't BT just do this on their side of the connection? EVERYTHING that the user gets goes through their pipes, their routers. Just install some monitoring hardware+software and be done with it. There doesn't seem to be any logical reason to do this on a users computer. That's just plain stupid.

The only difference is that you don't have access to encrypted data and "other applications" installed by the user. The stuff they claim to have logged and analyzed is more easily obtainable from their own side.

Re:Idiots... don't do it client-side

[FliesLikeABrick]

I would guess that it is easier/cheaper for them to use 3rd party software on client machines than to spend quite a bit of money on network hardware that can filter/cateogrize/inspect every packet that flows through their infrastructure. Having a bit of software on tens of thousands of machines report condensed data back is likely to be much, much cheaper to do.

Even doing simple L3 inspection on the dataflows that ISPs like BT deal with would require insane amounts of hardware, let alone inspection on the application (5/7) layer.

Re:An ISP?

[Ashe Tyrael]

Actually, this is a misstatement these days. As part of the deals that mean BT didn't get truly hosed by the monopoly stick, it's ISP division and wholesale (lines) division have some very hefty chinese walls in place.

safe assumption....

[3seas]

.... that if you are online someone is watching you.

One of the Worst Providers in the UK

[lobiusmoop]

BT's ADSL internet service seems to be one of the worst in the UK. Unfortunately since they have a long history of providing landline connections in the UK, many people assume they must be a worthy internet provider also - not so. I'd recommend UK Slashdotters look at This ADSL ratings site [dslzoneuk.net] for more personal citations of BT's (and other providers) service.

Re:class action lawsuit?

[arth1]

BT is the equivalent of Bell/AT&T in the US. It's impossible to sue them into oblivion. The best you can hope for is that one of the sub-sub-sub-sub-sub-CEOs gets a slap on the wrist and won't be invited to the next golf tournament.

Re:What's the best method of defeating all this **

[cheater512]

They have defended our rights where others have not.

They are also relatively honest and havent done anything immoral in regards to privacy to date.

Re:An ISP?

[unlametheweak]

From the article:

Executives insisted they had not broken the law and said no 'personally identifiable information' had been shared or divulged.

If in fact no laws have been broken, then the laws need to be changed (and made retro-active in this case) to punish and make an example of this type of behaviour. People need to be put in jail for this.

Average people I will allow some lenience towards. Leaders I have no sympathy for; they all too often make excuses for their behavior and have the power (lawyers, political, etc) to get away with it.

Re:What's the best method of defeating all this **

[RiotingPacifist]

1) because i get something back, in exchange for tracking me, they get more data about what i want and their searches are more tailored.
2) because they dont charge me, in exchange for good search results they track me and give me non intrusive ads.
3) because its very easy to switch, if they change their privacy policy im not tied to searching with them for another 6-12 months
4) because they do good stuff with the money ( FF, SOC, etc)
5) because theyre geeks, the main way the information is mis used is if somebody hacks in and steals it, i doubt this will happen with google, but after BT pushed out insecure linux routers to thousands of homes, i cant say id have faith.
5) be

Traffic encryption?

[Anonymous Coward]

Can't we just encrypt everything, or do some sort of similar magic?

Re:An ISP?

[ultranova]

If in fact no laws have been broken, then the laws need to be changed (and made retro-active in this case) to punish and make an example of this type of behaviour. People need to be put in jail for this.

Retroactive laws make it impossible to know whether some behavior, which is perfectly legal when it was committed, will get you thrown into prison nonetheless. This makes a mockery of the rule of law, and can not be tolerated.

The only known alternative for the rule of law is the divine right of kings. We have already taken too many steps to that direction, and must not take any more.

Re:An ISP?

[Jurily]

(and made retro-active in this case)

Fuck that. No new law should be allowed to punish retroactively, EVER. No matter how you justify it, that's not a line you want to cross, especially not in a country where precedence is legally binding. The whole idea of being sent to jail for something that was legal when you did it...

I agree with you on those people deserving jail, but not at that price.