Slashdot Log In
UK ISP Admitted to Spying on Customers
Posted by
ScuttleMonkey
on Fri Apr 04, 2008 06:11 PM
from the don't-worry-sir-we're-from-the-internet dept.
from the don't-worry-sir-we're-from-the-internet dept.
esocid writes "BT, an ISP located in the UK, tested secret spyware on tens of thousands of its broadband customers without their knowledge, it admitted yesterday. The scandal came to light only after some customers stumbled across tell-tale signs of spying. At first, they were wrongly told a software virus was to blame. BT said it randomly chose 36,000 broadband users for a 'small-scale technical trial' in 2006 and 2007. The monitoring system, developed by U.S. software company Phorm, formerly known as 121Media, known for being deeply involved in spyware, accesses information from a computer. It then scans every website a customer visits, silently checking for keywords and building up a unique picture of their interests. Executives insisted they had not broken the law and said no 'personally identifiable information' had been shared or divulged."
Related Stories
[+]
Sears Installs Spyware 201 comments
Gandalf_the_Beardy writes in with news that's been around a while but is getting more attention lately. Last month Benjamin Googins, a security researcher at CA, determined that Sears Holding Corp. installed ComScore spyware without adequate disclosure. Sears said, yes we tell people about tracking their browsing. On Jan. 1 spyware researcher Ben Edelman weighed in, noting that Sears' notice occurs on page 10 of a 54-page privacy statement, and twits Sears because its installation identifies the software as "VoiceFive" and later claims it's coming from a company called "TMRG, Inc." even though a packet sniffer confirms the software belongs to ComScore, adding "These confusing name-changes fit the trend among spyware vendors."
[+]
ISPs Using "Deep Packet Inspection" On 100,000 Users 309 comments
dstates writes "The Washington Post is reporting that some Internet Service Providers (ISP) have been using deep-packet inspection to spy on the communications of more than 100,000 US customers. Deep packet inspection allows the ISP to read the content of communications including every Web page visited, every e-mail sent and every search entered, in short every click and keystroke that comes down the line. The companies involved assert that customers' privacy is protected because no personally identifying details are released, but they make money from advertisers who use the information to target their online pitches. Deep packet inspection is a significant expansion over tools like cookies in the ability to track a user. Critics liken it to a phone company listening in on conversations."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
An ISP? (Score:5, Informative)
BT is not "an ISP". British Telecom was for a very long time monopoly holder on telephone lines in the UK and still the gatekeeper for all ADSL access there. They have a market cap of 35 billion [google.com] and their revenue just about puts them in the top ten telecoms companies [cnn.com] in the world.
In my personal experience their service has been bad enough that they're almost as bad as their competitors. Given their history, it's not surprising if they've overstepped their bounds ... they're used to being in charge, after all.
Mod parent up (Score:3, Informative)
Re: (Score:3, Informative)
Re:An ISP? (Score:5, Informative)
The information commisioner, who ensures the data protection act is followed, is investigating BT [telegraph.co.uk] to see if the law has been broken - there's a strong possibility it has been.
Parent
Re:An ISP? (Score:4, Insightful)
Average people I will allow some lenience towards. Leaders I have no sympathy for; they all too often make excuses for their behavior and have the power (lawyers, political, etc) to get away with it.
Parent
Re:An ISP? (Score:5, Informative)
http://www.opsi.gov.uk/acts/acts1990/ukpga_19900018_en_1.htm [opsi.gov.uk]
See:
* Unauthorised access to computer material
A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.
* Unauthorised modification of computer material
A person guilty of an offence under this section shall be liable--
(a) on summary conviction, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum or to both; and
(b) on conviction on indictment, to imprisonment for a term not exceeding five years or to a fine or to both.
I don't see how the Act does not apply to the people involved.
If someone wrote malware or sniffed your keystrokes, the same law should apply whether the perpetrator is BT or some "Evil Hacker".
Parent
Re:An ISP? (Score:4, Interesting)
fraud is the crime or offense of deliberately deceiving another in order to damage them usually, to obtain property or services unjustly.
Deliberately returning false DNS responses in order to obtain marketing information from them without their permission.
Parent
Re:An ISP? (Score:5, Informative)
RIPA states: "For the purposes of this Act, but subject to the following provisions of this section, a person intercepts a communication in the course of its transmission by means of a telecommunication system if he... monitors transmissions made by means of the system."
RIPA goes on to allow for interception without a warrant - i.e. by Phorm and your ISP rather than law enforcement agencies - "if the communication is one sent by, or intended for, a person who has consented to the interception".
Given that consent wasn't even sought for the technicial trials of 36,000 users, let alone granted, and it isn't in the contract either - they may well be subject to criminal sanctions if the government decide to prosecute.
There are also possible sanctions under the Data Protection Act, as personal data was collected and passed to a 3rd party without proper safeguards. BT and phorm argue that no personal data is collected. Since all unencrypted traffic is recorded, including webmail, and associated with a unique ID and kept for 14 days, it seems they're taking a somewhat optimistic view about that.
If they accessed customer PCs directly with spyware, they could be prosecuted under the computer misuse act but as the interception took place at the ISP level, it probably doesn't apply.
Parent
Idiots... don't do it client-side (Score:5, Insightful)
The only difference is that you don't have access to encrypted data and "other applications" installed by the user. The stuff they claim to have logged and analyzed is more easily obtainable from their own side.
Re: (Score:3, Insightful)
Even doing simple L3 inspection on the dataflows that ISPs like BT deal with would require insane amounts of hardware, let alone inspection on the
Re:Idiots... don't do it client-side (Score:5, Informative)
Parent
Re: (Score:3, Interesting)
Yup. The RIPA act (which received an unwelcome reception) actually helps us out here. It basically says that a wiretap without police/government sanction is illegal without the consent of both parties involved in the communication.
Phorm says that their activities do not break RIPA because hosting a publicly available website implies public monitoring (duh?) and that ISPs may include an acceptance of monitoring clause in their Ts & Cs.
Re: (Score:3, Interesting)
That's really just a matter of semantics, either way it's still spying. Contrary to what is frequently espoused here on slashdot, there should still be an expectation of privacy even though the internet is largely public. If I yell my ATM pin number in the bank, then everyone knows it through no shady effort on their part, but if someone carefully looks over my shoul
No, the contract defines if it is legal (Score:3, Interesting)
The Home Office made available their views on whether phorm's user-profile-based tracking is legal w.r.t. the interception of communication legislation.
" Targeted online advertising services should be provided with the explicit consent of ISPs' users or by the acceptance of the ISP terms and conditions. The providers of targeted online advertising services, and ISPs contracting those services and making them available to their users, should then - to the
safe assumption.... (Score:4, Insightful)
One of the Worst Providers in the UK (Score:4, Insightful)
BT are going to get screwed big style over this (Score:4, Interesting)
Essentially they appear to have broken the Regulation of Investigatoy Powers Act (RIPA) by performing an unauthorised interception of a communication over telecommuncations infrastructure.
No word yet on legal action, although several MP's are kicking up a fuss about it.
BTW BT are the only ones who have confessedd to doing this so far, the other ISP's haveeither kept schtum, or muttered paltitudes like we will wait and see
Re: (Score:3, Interesting)
The spying begins: Phorm coming to 3 major UK ISPS (Score:5, Informative)
3 of the major UK ISPs: Virgin Media, BT and Talk Talk are getting all ready to implement and bring in Phorm. More information and details are available at the useful website BadPhorm: http://www.badphorm.co.uk/ [badphorm.co.uk]
Thousands and thousands of UK users are going to be subject to this inescapable violation of their privacy with little to do about it. There is an opt-out cookie, but this does not prevent the fact that the users browsing still goes through the Phorm servers. Would you be happy with all your internet browsing going through a third party server, let alone one owned by an advertising company that wants to profile you and "see the whole internet" (Reference: http://www.badphorm.co.uk/news.php?item.30.3 [badphorm.co.uk] ) through your browsing history.
There is lots of interesting discussion going on about this, particularly at Cable Forum by Virgin Media users, who are going to be thrown into this spying (Link: http://www.cableforum.co.uk/board/12/33628733-virgin-media-phorm-webwise-adverts-updated.html [cableforum.co.uk] )
A fast growing petition to the UK government on the governments website is nearing 10000 signatures, and just shows how many people do not want this to happen (Link: http://petitions.pm.gov.uk/ispphorm/ [pm.gov.uk] )
This may not concern many people in the US, or people on the smaller ISPs in the UK - but the worrying thing is, other ISPs are already saying that they are going to watch the results and see if the ISPs can get away with it - if they can, they will likely pick it up to. And your ISP might do too!
Re:Dupe! (Score:5, Informative)
Parent
Re: (Score:3, Insightful)
Re:What's the best method of defeating all this ** (Score:5, Interesting)
Parent
Re: (Score:3, Insightful)
They are also relatively honest and havent done anything immoral in regards to privacy to date.
Re: (Score:3, Informative)
Computer Misuse Act (Score:3, Interesting)
As I read it BT are guilty under CMA 1(1) [wikipedia.org] which relates to unauthorised access to any program or data held in a computer. Whether the information checking is done on the computer or the ADSL hub it is a violation. With regard to the Convention on Cybercrime [coe.int] they appear to be guilty under Articles 2, 3 and 6.
I hope someone sues their buttocks off.