UK ISP TalkTalk Caught Monitoring Its Customers 139
An anonymous reader writes "The UK ISP TalkTalk has been caught using a form of Deep Packet Inspection technology to monitor and record the websites that its customers visit, without getting their explicit consent. The system, which is not yet fully in place, ultimately aims to help block malware websites by comparing the URL that a person visits against a list of good and bad sites. Bad sites will then be restricted. TalkTalk claims that its method is totally anonymous and that the only people with visibility of the URL database itself are Chinese firm Huawei, which will no doubt help everybody to feel a lot better (apply sarc mark here) about potentially having their privacy invaded."
Twas ever thus (Score:5, Insightful)
Doesn't really sound any different to what the search companies store. Sans encryption, nothing you do on the Internet is private. Caveat Browsor. Or, erm, something.
End-to-end encryption (Score:5, Insightful)
It's the only way to be sure. I know of at least one German university which also filters all external web traffic through a proxy which blocks URLs, also supposedly to reduce malware infections. The road to hell is paved with good intentions. The same technology which is installed to fight malware is also ideally suited to work as censorship infrastructure. Once it's in place, the operators will undoubtedly be confronted with the question why they only filter malware and not other "illegal" content. Once they've succumbed to that, the list of URLs to block will grow to include "unruly" opinions, videos of police, etc.
End-to-end encryption. Now.
The difference should be obvious (Score:4, Insightful)
My ISP is often a matter of little choice, if I want to access the internet, I MUST go through an ISP.
I never ever have to go to google or any other domain. It is trivial to avoid any domain I wish, just put it in hosts file with local ip.
Especially since Google doesn't know my personal details. My ISP does.
Data protection (Score:4, Insightful)
Isn't passing personal information out for Europe without expressed permission a breach of the Data Protection Act? Though lets face it, peoples biggest privacy concerns here are their porn viewing habits. Perhaps some porn sites should set up shop that show up in the URL history as stocks and shares or Technology News.
Anna.Techsupport032a2.jpg, Anna.Techsupport032a3.jpg
Re:Twas ever thus (Score:3, Insightful)
Very true, and yet within ten minutes there will still be several hundred posts in this story decrying the evil wiretappers of the man and how this is breach of basic civil liberties.
So here is a question (and it's only half devil's advocate) :
If you send your data to a private company who has not signed any kind of contract to say that they will keep the data private: why wouldn't they look at it?
I don't see what the fuss is about... (Score:1, Insightful)
.. Huawei are usually the ones *buying* the stolen corporate data.
Just another reason for normal people to use encryption on everything and look suspicious for not wanting to be spied on.
Re:Twas ever thus (Score:2, Insightful)
Re:Twas ever thus (Score:5, Insightful)
They should indeed report them. It was not "ever thus" and quite demonstrably so because we've only had mass electronic communication relatively recently and in a form that is easy for third-parties to record en masse for substantially less time than that.
Each time a new frontier opens in the eternal war between the rulers and the ruled, a land-grab ensues where governments and corporations try to make the public accept something as inevitable or right whilst at the same time the public realizes just because they've allowed the government to make them do something in other areas, that doesn't mean it was right.
It's vitally important at times like this to defend our rights as forcefully as possible. We did a lot of damage to Phorm when this was tried previously. In fact, Phorm turned into a ugly business black hole that no-one wanted to touch, with a reputation as down the toilet as SCO and I pity the people associated with it (except I don't). Clearly someone hasn't learned their lesson and we need to burn down a few more companies before we finally establish our right to privacy.
So let's make them regret this.
Re:Twas ever thus (Score:4, Insightful)
It is English.
http://www.oxforddictionaries.com/view/entry/m_en_gb0131000#m_en_gb0131000 [oxforddictionaries.com]
As well as being Latin of course.
Re:Twas ever thus (Score:1, Insightful)
As for monitoring users for illegal activity, well, that is entirely fine.
No it's not. What is illegal and what is not, is more and more defined by corrupt politicians and lobby groups.
Re:Twas ever thus (Score:3, Insightful)
> Sans encryption, nothing you do on the Internet is private.
Even with encryption, your ISP can log every IP address you access, I would hardly call this a private activity!
So I would correct: nothing you do on the Internet is private, only semi-private with encryption, except if you are using either
1) encryption + TOR or
2) steganography.
And (1) is quite easy to detect for your ISP, so you would be "noticed": in some country this could be dangerous..
So the only really private communication you can have on the Internet is (2)..
How Much of the URL? (Score:3, Insightful)
Re:Twas ever thus (Score:3, Insightful)
http://www.example.com/account.php?e=myaddress@example.net. Bang. Personal data right there.
Unless they have a way that can guarantee email addresses, account numbers etc are stripped out of the URL, of course...
Re:Twas ever thus (Score:1, Insightful)
How about reading TFA? This is not an invasion of privacy at all.
Whether something is an invasion of privacy is the decision of the person potentially having their privacy invaded, not your decision, and most definitely not someone who will profit from invading privacy.
If I publicise my web browsing habits, people looking at the data are not invading my privacy. If I want to keep that info private, then those looking at that data are invading my privacy.
Given that most customers will never know about this monitoring, or will take TalkTalk's (marketing department's) representation of how it works as the truth, it is definitely a privacy invasion.
It doesn't record any personal data.
Yeah, they claim. Do you have access to the systems doing the monitoring and so actually know that?
I would wager that the difference between not recording and recording is one bit.
There is also a discussion linked from the comments on TFA where someone's private test site was being crawled by TalkTalk. The guy hadn't publicised the address, just visited it over his TalkTalk connection. So for them to do the crawling, they must be recording what URLs are being visited by users, and feeding that into their crawling system.
Do you work for TalkTalk or something? Why are you bullshitting so much?
It is in fact a great thing to do when 99.9% your customers are complete noobs.
That's probably the case for most ISPs, and even more so for the cheap ones like TalkTalk. But at the end of the day, TT are just exploiting those people, just like AV vendors do. They promise the world, will not deliver it, then hide behind terms and conditions, EULAs and the like. And all along, the customers do not learn anything at all about safe or sensible internet use because their ISP has told them they are safe.
Re:End-to-end encryption (Score:1, Insightful)
No, some ISPs claim to block access to CP, but the group that publishes that list is not publicly accountable. Many ISPs block the content by creating fake 404 messages, rather than telling you straight up that the content has been blocked, presumably to reduce support costs, and scrutiny of the list.
So if your ISP uses the IWF list, and you see a 404 error when surfing, it could be a missing file on the server, or it could be a private entity censoring. You have no way of knowing, and if you contact your ISP they will tell you they can't check. This is a lie, because a member of BE's tech support did confirm Wikipedia was on the list with the Virgin Killer's incident.
It always makes me laugh when people attack the messenger too, "tinfoil hat brigade" indeed. And trying to dismiss the message with bitching that the slippery slope isn't steep enough. Your ignorance of history is showing. There are people who are overly paranoid, but there are far too many who are trusting of any perceived authority.
Re:Deep deep packets (Score:1, Insightful)
Are you fucking stupid? You've been shitting all over this discussion with your privacy-violation apologies.
There is legal precedent about getting access to telephone records, or being able to listen in, etc.. There is mandated logging of internet activity. Make phones look superficially the same, but in reality have them work over an IP network, and bang, the old protections are gone. Those who didn't like the old barriers are now happy: businesses get another source of data to make their adverts more convincing, and the state gets to catch people who talk about certain things over the "phone" network. They will parade them as terrorists and how they have protected us all. Please vote again.
At this point you need to trot out some insult to do with tinfoil, because there aren't examples of those offered a power or profit grab and not taking it.
Re:Twas ever thus (Score:1, Insightful)
This is a system that clearly will be known about by the public though, they're not trying to hide it if it's actually displaying messages to people that the site they are visiting is "potentially harmful" type thing. Gah, it's so frustrating how retarded you guys are sometimes.
The public will clearly know about it? Well, they've not been very open about it so far. It has been discovered by Talk Talk subscribers, and the management started with denial. That doesn't jive well for future transparency.
And TalkTalk were one of the ISPs trialling Phorm.
Ignoring the attempted personal attack, your naivete about what companies will do in the quest for profits is stunning. And it isn't appreciated that you are obviously willing to give away other people's privacy when you give up yours.
Re:Twas ever thus (Score:3, Insightful)
No, a LOT more two faced. Anyone with even the slightest networking knowledge knows that any ISP such as this, who runs their own DNS server can simply drop the bad domains into the DNS servers and have them point to one of their own servers which will present a "This site has been blocked for... " page.
A simple example of something similar (in implementation) are the "not found" redirects that many ISPs are doing now, that bring you to one of their customized search pages.
They dont need to monitor what users are doing since they are not building a list of bad sites - they are (supposedly) comparing users' surfing to an already existing list.
I call massive bullshit on the part of TalkTalk.