A recent article in The Economist reports the development of a new behavioural approach to targeted internet advertising being developed by companies such as Phorm, NebuAd and FrontPorch (see http://www.economist.com/science/tq/displaystory.cfm?story_id=11482452 ). The current market leader is Phorm who have recently signed up the three biggest internet service providers (ISPs) in the UK, BT, Virgin Media and TalkTalk to use their technology. The ISPs can use the technology supplied by behavioural advertising companies to record information about the web pages that a user visits. This information is used to build up a profile of the user that is then used to select targeted advertising. So, if a user visits a number of sites for online booksellers and webpages concerning literature this information is added to his or her profile. Subsequently, the user will receive a high proportion of advertising that is targeted at people who have a greater than average interest in literature.
Behavioral information is already used by providers of cookies and by search engines to build up profiles of particular users and in some cases this information is already used to select advertising, so this new approach is not revolutionary. However, it is setting off alarm bells amongst internet users because it is much more systematic than other approaches and has the potential therefore, to invade people’s privacy more often and to a much greater extent. According to the same article in The Economist over 13,000 people have already signed an online petition opposing the implementation of Phorm’s new system.
A visit to Phorm’s website (see http://www.phorm.com/ ) reveals that they are very aware of the potential of their technology to invade peoples’ privacy. They have recently commissioned a Privacy Impact Statement, produced by Simon Davies of 80/20 Thinking which takes the view that Phorm has succeeded in designing their technology in such a way as to implement the value of privacy. Their profiling system does not collect data on a range of sensitive topics such as online banking sites and they have pledged that it will not be used to target advertising for pornographic sites. The data collected is carefully anonymised. Indeed the 80/20 Thinking Privacy Impact Statement concludes that Phorm do not use person data as defined by the UK Data Protection Act.
Much of the controversy about this new technology revolves around the issue of whether there should be an opt out or an opt in system of consent to the use of the technology. Industry advocates argue that an opt out system is sufficient to satisfy the concerns of those customers who remain worried about the technology despite the efforts of ISPs to protect privacy that have been implemented so far. Advocates of an opt in system argue that users should not have to opt out. They didn’t choose to participate in the system so they should not be expected to have to turn it off. An opt out system will end up being used by many more users than an opt in system because many customers can reasonably be expected to be unaware of the use of behavioural internet advertising and many will prefer the status quo to making the effort to change.
The question of whether we should have an opt out or an opt in system is important but there is a danger of becoming fixated on it and excluding consideration of other important issues. One important issue that needs to be addressed is whether or not it is obvious to users that behavioural advertising is being employed by their ISP. Another is how easy it is to change one’s status. Is the information provided to explain the process by which a change can be made ‘user-friendly’ or do users have to wade through pages and pages of technical gobbledygook to work out what is going on? Unless these issues are addressed the user is not in a good position to make an informed decision to either opt in or to opt out.
There are a few inaccuracies in that article. First of all, Phorm has not managed to sign up three ISPs: Virgin Media has not yet made any commitment to using Phorm spyware and it says so on their website.
Secondly, I would like to see where you found Simon Davis’ Privacy Impact Statement – as far as I know it has not been released yet. Your readers should note that Simon Davis was hired by Phorm to write this Privacy Impact statement. I imagine that, just like the town hall video of Kent Ertergral making a fool of himself, it will not be released unless it is favorable to Phorm.
In the interest of balance, you may wish to include the many other people, such as Richard Clayton, Oxford Professor of security, or the statement from the FIPR (Foundation for Information Policy Research) which found that:
“the operation of Phorm’s systems involves illegal interception of communications, fraud, and unlawful processing of sensitive personal data.”
Thirdly, 15,000 have now signed the petition, not 13,000.
Fourthly, the comparison with search engines like Google is misleading. Someone can always choose not to use Google search, or they can block Google cookies, or they can use something like Google Scraper, which anonymises their search. On the other hand, you cannot escape the clutches of Phorm’s spyway; it is deeply embedded at the level of your ISP. Search engines may track your searches, Phorm can track every single website you visit.
Finally, Phorm’s ‘opt-out’ is really no ‘opt-out’ at all, as user’s data is still being intercepted by Phorm’s servers, even though it is not used to serve targeted ads. The ICO has stated that Phorm must make their system opt-in in order to be legal.
Given Phorm’s history in creating spyware rootkits (see 121Media), it will be interesting to see whether BT and Phorm take notice of this legal advice and jeopardize their business model, or whether they will break the law, like they ‘allegedly’ did in 2006 and 2007, when BT and Phorm covertly carried out technical trials of Phorm’s spyware on tens of thousands of unsuspecting users without their consent.
Just say no to Phorm:
Sign the petition here: http://petitions.pm.gov.uk/ispphorm/
Join the anti-Phorm campaign: https://nodpi.org/ and http://badphorm.co.uk/page.php?2
Phil,
thank you for your comments which I am pleased to see published here in light of your concerns about balance.
I’m pleading (mostly) not guilty to to the charges of inaccuracies, however.
My responses to your four points.
1. Phorm plainly have an agreement with Virgin Media as the Economist reports. Virgin Media do not deny this. Virgin Media report that they have not yet decided whether to go ahead and use Phorm’s technology. They have not decided not to use it either. See http://www.virginmedia.com/customers/webwise.php.
2. On the Phorm website you will find a link to a ‘First Stage (Interim) Privacy Impact Assessment’ by Simon Davies. There is also a link to a ‘Privacy Examination Report’ by Ernst & Young.
3. I claimed, following the Economist, that *over* 13,000 people have signed the petition. So we are not in disagreement here.
4. Just as you currently have a choice of search engine you currently have a choice of ISP.
Hi Steve. Thanks for the reply. If I may address your points:
1) The agreement between VM and Phorm is of a ‘lets wait and see’ agreement – unlike BT, they have not committed themselves to implementing the spyware technology.
2) Yes, my mistake. Simon Davies is currently working on the next state Privacy Impact Assesment, which, I guess will no longer be considered an ‘interim’ report.
3) Fair enough
4) It’s not quite that simple to switch ISPs. It’s certainly not as easy as deciding to to use a search engine; most people have 12 month contracts with ISPs, and they cannot break the contract without paying the fees for the full twelve months. Secondly, we are still in a situation in many areas of the UK where ISP choice is practically limited. In some areas, only one or two ISPs are providing broadband to the region. It may be a choice of either BT or nothing, or BT and another service provider which is far more expensive or has an even worse reputation for customer service. The ‘free market’ does not provide effective solutions when competition is limited.
Thanks for the feedback.
Comments are closed.