Phorm had worked with major U.S. and British ISPs—including BT Group (formerly British Telecom), Virgin Media, and TalkTalk (at the time owned by The Carphone Warehouse)—on a behavioral targeting advertisement service to monitor browsing habits and serve relevant advertisements to the end user. Phorm say these deals would have given them access to the surfing habits of 70% of British households with broadband. The service, which uses deep packet inspection to check the content of requested web pages, has been compared to those of NebuAd and Front Porch.
The service, which would have been marketed to end-users as "Webwise" (in 2009 the BBC took legal advice over the trade mark Webwise), would work by categorising user interests and matching them with advertisers who wish to target that type of user. "As you browse we're able to categorise all of your Internet actions", said Phorm COO Virasb Vahidi. "We actually can see the entire Internet."
The company said that data collected would be completely anonymous and that Phorm would never be aware of the identity of the user or what they have browsed, and adds that Phorm's advertising categories exclude sensitive terms and have been widely drawn so as not to reveal the identity of the user. By monitoring users' browsing, Phorm even says they are able to offer some protection against online fraud and phishing.
Phorm formerly maintained an opt-out policy for its services. However, according to a spokesman for Phorm, the way the opt-out works means the contents of the websites visited will still be mirrored to its system. All computers, all users, and all http applications used by each user of each computer will need to be configured (or supplemented with add ons) to opt out. It has since been declared by the Information Commissioner's Office that Phorm would only be legal under UK law if it were an opt-in service.
Read the full text
Implementation
Richard Clayton, a Cambridge University security researcher, attended an on-the-record meeting with Phorm, and published his account of how their advertising system is implemented.
Phorm's system, like many websites, uses HTTP cookies (small pieces of text) to store user settings. The company said that an initial web request is redirected three times (using HTTP 307 responses) within their system, so that they can inspect cookies to determine if the user has opted out. The system then sets a unique Phorm tracking identifier (UID) for the user (or collects it if it already exists), and adds a cookie that is forged to appear to come from the requested website.
In an analysis titled "Stealing Phorm Cookies", Clayton wrote that Phorm's system stores a tracking cookie for each website visited on the user's PC, and that each contains an identical copy of the user's UID. Where possible, Phorm's system strips its tracking cookies from http requests before they are forwarded across the Internet to a website's server, but it cannot prevent the UID from being sent to websites using https. This would allow websites to associate the UID to any details the website collects about the visitor.
Phorm Senior Vice President of Technology Marc Burgess has said that the collected information also includes a timestamp. Burgess said, "This is enough information to accurately target an ad in [the] future, but cannot be used to find out a) who you are, or b) where you have browsed".
Incentives
In 2008, Phorm considered offering an incentive, in addition to the phishing protection it originally planned, as a means to convince end-users to opt into its Webwise system. The alternate incentives, suggested in a Toluna.com market research survey carried out on behalf of Phorm, included further phishing protection, a donation to charity, a free technical support line, or one pound off opted-in users' monthly broadband subscriptions.
Following the decision by Wikimedia Foundation and Amazon to opt their websites out of being profiled by Phorm's Webwise system, and as an incentive for websites to remain opted into the Phorm profiling system, Phorm launched Webwise Discover. The Korean launch of this web publisher incentive was announced in a press conference in Covent Garden in London on 3 June 2009. A survey by polling firm Populus revealed that after watching a demonstration video, 66% of the 2,075 individuals polled claimed to either like the idea or like it a lot.
Website publishers are invited to upload a web widget which will provide a small frame to display recommended web links, based on the tracked interests of any Phorm-tracked website visitors (those whose ISP uses Phorm Deep Packet Inspection to intercept and profile web traffic). There would be no charge to the website, and Phorm do not stand to make any money from Webwise Discover; however, there are plans to display targeted adverts in the future.[1] The widget would only deliver link recommendations if the user was signed up for targeted advertising with a Phorm-affiliated ISP, the widget would be invisible to everyone else..[2] At the press launch Phorm spokespersons admitted that at present not a single UK ISP or website has yet signed up to Webwise Discover system,[3] although they emphasised it was part of the current Korea Telecom Webwise trials. Legal advice has been offered to websites considering signing up to the OIX system by Susan Singleton.[4] Archived 26 January 2016 at the Wayback Machine
Legality
The Open Rights Group (ORG) raised questions about Phorm's legality and asked for clarification of how the service would work. FIPR has argued that Phorm's online advert system is illegal in the UK. Nicholas Bohm, general counsel at FIPR, said: "The need for both parties to consent to interception in order for it to be lawful is an extremely basic principle within the legislation, and it cannot be lightly ignored or treated as a technicality." His open letter to the Information Commissioner has been published on the FIPR web site.
The Conservative peer Lord Northesk has questioned whether the UK government is taking any action on the targeted advertising service offered by Phorm in the light of the questions about its legality under the Data Protection and Regulation of Investigatory Powers Acts.
On 9 April 2008, the Information Commissioner's Office ruled that Phorm would only be legal under UK law if it were an opt-in service. The Office stated it will closely monitor the testing and implementation of Phorm, in order to ensure data protection laws are observed.
The UK Home Office has indicated that Phorm's proposed service is only legal if users give explicit consent. The Office itself became a subject of controversy when emails between it and Phorm were released. The emails showed that the company edited a draft legal interpretation by the Office, and that an official responded "If we agree this, and this becomes our position do you think your clients and their prospective partners will be comforted". Liberal Democrat spokeswoman on Home Affairs, Baroness Sue Miller, considered it an act of collusion: "The fact the Home Office asks the very company they are worried is actually falling outside the laws whether the draft interpretation of the law is correct is completely bizarre."
The Register reported in May 2008 that Phorm's logo strongly resembled that of an unrelated UK company called Phorm Design. They quoted the smaller company's owner, Simon Griffiths: "I've had solicitors look at it and they say we'd have to go to court. [Phorm are] obviously a big player with a lot of clout. I'm a small design agency in Sheffield that employs three people."
Until 21 September 2010, Phorm's Webwise service also shared the same name as BBC WebWise.
Monitoring of the Phorm website using a Website change detection service alerted interested parties to changes on 21 September 2010. Phorm's website had been edited to remove references to the word 'Webwise'. Phorm's Webwise product had become 'PhormDiscover'.
The Office for Harmonization in the Internal Market (OHIM) Trade Marks and Designs Registration Office of the European Union website CTM-Online database lists Phorm's application for use of the 'Webwise' trade mark name. The British Broadcasting Corporation is listed as an opponent on grounds of 'Likelihood of confusion'. The City of London-based legal firm Bristows wrote to the OHIM on 22 September 2010, withdrawing the BBC's opposition saying, "The British Broadcasting Corporation have instructed us to request the withdrawal of the above Opposition No. B11538985".
On 28 October 2010, BT removed the Webwise pages from their company website although it was not until 12 November 2010 that all pages had finally been confirmed as removed by forum contributors at the campaign group called "NoDPI.org".
As of 22 June 2012, Virgin Media had not removed their Phorm and Webwise FAQs from their customer-news section.
European Commission case against UK over Phorm
European Union communications commissioner Viviane Reding has said that the commission was concerned Phorm was breaching consumer privacy directives, and called on the UK Government to take action to protect consumers' privacy. The European Commission wrote to the UK government on 30 June 2008 to set out the context of the EU's interest in the controversy, and asked detailed questions ahead of possible Commission intervention. It required the UK to respond to the letter one month after it was sent. A spokeswoman for the Department for Business, Enterprise and Regulatory Reform (BERR) admitted on 16 August that the UK had not met the deadline.
On 16 September, BERR refused The Register's request to release the full text of their reply to the European Commission, but released a statement to the effect that the UK authorities consider Phorm's products are capable of being operated in a lawful, appropriate and transparent fashion. Unsatisfied by the response, the European Commission wrote to the UK again on 6 October. Martin Selmayr, spokesman for Reding's Information Society and Media directorate-general said, "For us the matter is not finished. Quite the contrary."
The UK government responded again in November, but the Commission sent another letter to the government in January 2009. This third letter was sent because the commission was not satisfied with explanations about implementation of European law in the context of the Phorm case. Selmayr was quoted in The Register as saying, "The European Commission's investigation with regard to the Phorm case is still ongoing", and he went on to say that the Commission may have to proceed to formal action if the UK authorities do not provide a satisfactory response to the commission's concerns.
On 14 April, the European Commission said they had "opened an infringement proceeding against the United Kingdom" regarding ISPs' use of Phorm:
If the Commission receives no reply, or if the observations presented by the UK are not satisfactory, the Commission may decide to issue a reasoned opinion (the second stage in an infringement proceeding). If the UK still fails to fulfil its obligations under EU law after that, the Commission will refer the case to the European Court of Justice.
That day, in response to a news item by The Register regarding the European Commission's preparations to sue the UK government, Phorm said their technology "is fully compliant with UK legislation and relevant EU directives. This has been confirmed by BERR and by the UK regulatory authorities and we note that there is no suggestion to the contrary in the Commission's statement today." However, BERR denied such confirmation when they responded to a Freedom of Information (FOI) request also made that day:
An examination of our paper and electronic records has not revealed any such material. To add further clarification for your information, BERR has never provided such a statement to Phorm and has never confirmed to the company “that their technology is fully compliant”.
In January 2012, the EU dropped its case against the UK government.
Reaction
Initial reaction to the proposed service highlighted deep concerns with regards to individual privacy and property rights in data. Phorm has defended its technology in the face of what it called "misinformation" from bloggers claiming it threatens users' privacy.
Most security firms classify Phorm's targeting cookies as adware. Kaspersky Lab, whose anti-virus engine is licensed to many other security vendors, said it would detect the cookie as adware. Trend Micro said there was a "very high chance" that it would add detection for the tracking cookies as adware. PC Tools echoed Trend's concerns about privacy and security, urging Phorm to apply an opt-in approach. Specialist anti-spyware firm Sunbelt Software also expressed concerns, saying Phorm's tracking cookies were candidates for detection by its anti-spyware software.
Ross Anderson, professor of security engineering at Cambridge University, said: "The message has to be this: if you care about your privacy, do not use BT, Virgin or Talk-Talk as your internet provider." He added that, historically, anonymising technology had never worked. Even if it did, he stressed, it still posed huge privacy issues.
Phorm has engaged a number of public relations advisers including Freuds, Citigate Dewe Rogerson and ex-House of Commons media adviser John Stonborough in an attempt to save its reputation, and has engaged with audiences via moderated online webchats.
The creator of the World Wide Web, Sir Tim Berners-Lee, has criticised the idea of tracking his browsing history saying that "It's mine - you can't have it. If you want to use it for something, then you have to negotiate with me. I have to agree, I have to understand what I'm getting in return." He also said that he would change his ISP if they introduced the Phorm system. As Director of the World Wide Web Consortium, Berners-Lee also published a set of personal design notes titled "No Snooping", in which he explains his views on commercial use of packet inspection and references Phorm.
Simon Davies, a privacy advocate and founding member of Privacy International, said "Behavioural advertising is a rather spooky concept for many people." In a separate role at 80/20 Thinking, a consultancy start-up, he was engaged by Phorm to look at the system. He said: "We were impressed with the effort that had been put into minimising the collection of personal information". He was subsequently quoted as saying "[Privacy International] DOES NOT endorse Phorm, though we do applaud a number of developments in its process". "The system does appear to mitigate a number of core privacy problems in profiling, retention and tracking... [but] we won't as PI support any system that works on an opt-out basis." Kent Ertugrul later said he made a mistake when he suggested Privacy International had endorsed Phorm: "This was my confusion I apologise. The endorsement was in fact from Simon Davies, the MD of 80 / 20 who is also a director of privacy international."
Stopphoulplay.com
Ertugrul has set up a website called "Stopphoulplay.com", in reaction to Phorm critics Alexander Hanff and Marcus Williamson. Ertugrul called Hanff a "serial agitator" who has run campaigns against both Phorm and other companies such as Procter & Gamble, and says Williamson is trying to disgrace Ertugrul and Phorm through "serial letter writing". Hanff believes the Stopphoulplay website's statements are "completely irrelevant" to his campaign and that they will backfire on Ertugrul, while Williamson laments that Phorm "has now stooped to personal smears".
When it launched on 28 April 2009, Stopphoulplay.com discussed a petition to the UK Prime Minister on the Downing Street website. When originally launched the web page claimed, "The website managers at 10 Downing Street recognised their mistake in allowing a misleading petition to appear on their site, and have since provided assurances to Phorm that they will not permit this to happen again". That same day, the Freedom of Information (FOI) Act was used to request confirmation of the claim by Phorm and on 29 April Phorm removed the quoted text from the website and replaced it with nothing. The Prime Minister's Office replied to the FOI request on 28 May, stating they held no information in relation to the request concerning Phorm's claim.
A day after the site's launch, BBC correspondent Darren Waters wrote, "This is a battle with no sign of a ceasefire, with both sides [Phorm and anti-Phorm campaigners] settling down to a war of attrition, and with governments, both in the UK and the EU, drawn into the crossfire."
The site was closed down in September 2009 and is now an online casino. However, the pages http://stopphoulplay.com/this-is-how-they-work/ and http://stopphoulplay.com/this-is-who-they-are/ Archived 16 January 2022 at the Wayback Machine still contain the comments against Hanff and NoDPI.
BT trials
After initial denials, BT Group confirmed they ran a small scale trial, at one exchange, of a "prototype advertising platform" in 2007. The trial involved tens of thousands of end users. BT customers will be able to opt out of the trial—BT said they are developing an improved, non-cookie based opt-out of Phorm—but no decision has been made as to their post-trial approach.
The Register reported that BT ran an earlier secret trial in 2006, in which it intercepted and profiled the web browsing of 18,000 of its broadband customers. The technical report states that customers who participated in the trial were not made aware of the profiling, as one of the aims of the validation was not to affect their experience.
On 4 June 2008, a copy of a 52-page report allegedly from inside BT, titled "PageSense External Technical Validation", was uploaded to WikiLeaks. The report angered many members of the public; there are questions regarding the involvement of charity ads for Oxfam, Make Trade Fair and SOS Children's Villages, and whether or not they were made aware that their ads were being used in what many feel were highly illegal technical trials.
FIPR's Nicholas Bohm has said that trials of an online ad system carried out by BT involving more than 30,000 of its customers were potentially illegal.
BT's third trial of Phorm's Webwise system repeatedly slipped. The trial was to last for approximately two weeks on 10,000 subscribers, and was originally due to start in March 2008, then pushed to April and again to the end of May; it has yet to occur. The company is facing legal action over trials of Phorm that were carried out without user consent.
On 2 September 2008, while investigating a complaint made by anti-Phorm protestors, the City of London Police met with BT representatives to informally question them about the secret Phorm trials. On 25 September the Police announced that there will be no formal investigation of BT over its secret trials of Phorm in 2006 and 2007. According to Alex Hanff, the police said there was no criminal intent on behalf of BT and there was implied consent because the service was going to benefit customers. Bohm said of that police response:
Saying that BT customers gave implied consent is absurd. There was never any behaviour by BT customers that could be interpreted as implied consent because they were deliberately kept in the dark.
As for the issue of whether there was criminal intent, well, they intended to intercept communications. That was the purpose of what they were doing. To say that there was no criminal intent is to misunderstand the legal requirements for criminal intent.
