Slashdot Mirror

← Back to Stories (view on slashdot.org)

UK ISP Admitted to Spying on Customers

Posted by ScuttleMonkey on from the don't-worry-sir-we're-from-the-internet dept.

esocid writes "BT, an ISP located in the UK, tested secret spyware on tens of thousands of its broadband customers without their knowledge, it admitted yesterday. The scandal came to light only after some customers stumbled across tell-tale signs of spying. At first, they were wrongly told a software virus was to blame. BT said it randomly chose 36,000 broadband users for a 'small-scale technical trial' in 2006 and 2007. The monitoring system, developed by U.S. software company Phorm, formerly known as 121Media, known for being deeply involved in spyware, accesses information from a computer. It then scans every website a customer visits, silently checking for keywords and building up a unique picture of their interests. Executives insisted they had not broken the law and said no 'personally identifiable information' had been shared or divulged."

14 of 163 comments (clear)

  1. An ISP? by 26199 · · Score: 5, Informative

    BT is not "an ISP". British Telecom was for a very long time monopoly holder on telephone lines in the UK and still the gatekeeper for all ADSL access there. They have a market cap of 35 billion and their revenue just about puts them in the top ten telecoms companies in the world.

    In my personal experience their service has been bad enough that they're almost as bad as their competitors. Given their history, it's not surprising if they've overstepped their bounds ... they're used to being in charge, after all.

    1. Re:An ISP? by arkhan_jg · · Score: 4, Informative

      BT broadband has about 27% of the UK market, and is the largest single ISP in the UK last I checked. There are fairly strong walls between the broadband business (BT retail/openworld) and the phone line last mile business (openreach), and the trunk network (BT wholesale) these days due to regulation by OFCOM since privatisation, though they are all part of BT group.

      The information commisioner, who ensures the data protection act is followed, is investigating BT to see if the law has been broken - there's a strong possibility it has been.

      --
      Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
    2. Re:An ISP? by TheLink · · Score: 5, Informative

      I believe the UK Computer Misuse act 1990 covers it.

      http://www.opsi.gov.uk/acts/acts1990/ukpga_19900018_en_1.htm

      See:
      * Unauthorised access to computer material
      A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.
      * Unauthorised modification of computer material
      A person guilty of an offence under this section shall be liable--
      (a) on summary conviction, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum or to both; and
      (b) on conviction on indictment, to imprisonment for a term not exceeding five years or to a fine or to both.

      I don't see how the Act does not apply to the people involved.

      If someone wrote malware or sniffed your keystrokes, the same law should apply whether the perpetrator is BT or some "Evil Hacker".

      --
    3. Re:An ISP? by arkhan_jg · · Score: 4, Informative

      It's illegal under the Regulation of Investigatory Powers Act also, according to several legal experts.

      RIPA states: "For the purposes of this Act, but subject to the following provisions of this section, a person intercepts a communication in the course of its transmission by means of a telecommunication system if he... monitors transmissions made by means of the system."

      RIPA goes on to allow for interception without a warrant - i.e. by Phorm and your ISP rather than law enforcement agencies - "if the communication is one sent by, or intended for, a person who has consented to the interception".
      Given that consent wasn't even sought for the technicial trials of 36,000 users, let alone granted, and it isn't in the contract either - they may well be subject to criminal sanctions if the government decide to prosecute.

      There are also possible sanctions under the Data Protection Act, as personal data was collected and passed to a 3rd party without proper safeguards. BT and phorm argue that no personal data is collected. Since all unencrypted traffic is recorded, including webmail, and associated with a unique ID and kept for 14 days, it seems they're taking a somewhat optimistic view about that.

      If they accessed customer PCs directly with spyware, they could be prosecuted under the computer misuse act but as the interception took place at the ISP level, it probably doesn't apply.

      --
      Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
  2. Re:Dupe! by moderatorrater · · Score: 5, Informative

    Not a dupe at all. The article you reference is about an ISP that tracks for the purposes of advertising and lets the customer know. This, on the other hand, is the ISP snooping on traffic without notifying anyone and lying to someone when they ask about it. It's the difference between consensual sodomy and what happens in prisons. It's also a dumb move on the ISP's side, because they're doing something to people that is rightly linked with illegal and shady practices.

  3. Mod parent up by InvisblePinkUnicorn · · Score: 2, Informative

    The parent is correct. BT was the state-run telecom monopoly in the UK, and was converted into a private monopoly in 1984. Not much of an improvement, but at least it finally allowed for the possibility of competition arising, however slim.

    1. Re:Mod parent up by gormanly · · Score: 2, Informative

      and used to be part of the Post Office, an even bigger monopoly.

    2. Re:Mod parent up by Anonymous Coward · · Score: 1, Informative

      and bought a US company called International Network Services for its US services branch. That company was in turn involved in some dirty finances in illinois with a well known storage vendor, and some people went to jail. fun fun fun. now you know who to do business with. and - apple, tree, ... I piss on that tree.

  4. Re:Idiots... don't do it client-side by joebp · · Score: 4, Informative

    The body of this story is misleading. Phorm *does* work on the ISP's side of the connection. It basically does a MITM attack on HTTP traffic to insert tracking cookies.

  5. Good British Channel 4 news video on this... by Anonymous Coward · · Score: 1, Informative

    http://www.youtube.com/watch?v=rgZjeckpUXY

  6. Re:Idiots... don't do it client-side by LiquidCoooled · · Score: 2, Informative

    There *IS* a client portion however:

    You can set an opt-out cookie on your computer which is meant to disable the processing of your web history and to tell the advert server at the far end that you do not want personal adverts.
    However this does not stop them still being sat in the middle and every page I open is still given to a spyware firm who have given a vague promise that they will not use my data for advertising if I opt out.

    It also does not help with multiple computers or browser configurations each with or without their own cookie handling.
    Aren't we meant to clean down our cookies etc on a regular basis, is there such a thing as a permanent cookie?

    I have Virgin media for my internet and they are also involved in this phorm tracking and I am pissed off about it.

    --
    liqbase :: faster than paper
  7. The spying begins: Phorm coming to 3 major UK ISPS by Sosigenes · · Score: 5, Informative

    The summary of the story doesn't emphasise the point that the spying test was just a small trial, and that Phorm is actually coming directly to the UK.

    3 of the major UK ISPs: Virgin Media, BT and Talk Talk are getting all ready to implement and bring in Phorm. More information and details are available at the useful website BadPhorm: http://www.badphorm.co.uk/

    Thousands and thousands of UK users are going to be subject to this inescapable violation of their privacy with little to do about it. There is an opt-out cookie, but this does not prevent the fact that the users browsing still goes through the Phorm servers. Would you be happy with all your internet browsing going through a third party server, let alone one owned by an advertising company that wants to profile you and "see the whole internet" (Reference: http://www.badphorm.co.uk/news.php?item.30.3 ) through your browsing history.

    There is lots of interesting discussion going on about this, particularly at Cable Forum by Virgin Media users, who are going to be thrown into this spying (Link: http://www.cableforum.co.uk/board/12/33628733-virgin-media-phorm-webwise-adverts-updated.html )

    A fast growing petition to the UK government on the governments website is nearing 10000 signatures, and just shows how many people do not want this to happen (Link: http://petitions.pm.gov.uk/ispphorm/ )

    This may not concern many people in the US, or people on the smaller ISPs in the UK - but the worrying thing is, other ISPs are already saying that they are going to watch the results and see if the ISPs can get away with it - if they can, they will likely pick it up to. And your ISP might do too!

  8. Re:What's the best method of defeating all this ** by fuego451 · · Score: 2, Informative

    Google at least gives you a reach around. Gmail has some nice features and I now have over 6.5 GiB of storage and counting. I use iGoogle to organize my most viewed sites with access to all the other Google features/tools/apps. Am I worried abut personal my personal info, shit, the IRS has it all from the late 50's, the FBI has it from the 60's (military secret clearance), the Veterans Administration from the 70's, employers, banks, the post office, state licensing agencies, mortgage companies, title companies, utilities you name it. Sure, I try to guard it as best I can but...

  9. Re:class action lawsuit? by mollymoo · · Score: 2, Informative

    There was nominal breakup of BT, though not into regional "baby bells". BT Broadband, the ISP in TFA, could be sued (or more likely regulated) out of existence and the rest of the telecoms network (most importantly - BT Openreach (last mile), BT Retail (telecoms), BT Wholesale (bulk services, including ADSL provision)) would carry on. Openreach and Wholesale are the bits with a near-monopoly on the last mile and national network and are heavily regulated to provide open access to other providers. BT Broadband is a customer of Openreach and Wholesale and receive no preferential treatment over other providers like Tiscali or Carphone Warehouse. Thus it's not impractical for them to be shut down and their customer base moved to other providers. Tiscali are of similar size to BT Broadband and are currently looking to sell their customer base and Carphone Warehouse bought AOL's substantial subscriber base not too long ago, so it would be far from unprecedented. I doubt it'll happen, but not because it's not possible.

    --
    Chernobyl 'not a wildlife haven' - BBC News