Slashdot Mirror
Covert BT Phorm Trial Report Leaked
stavros-59 writes "An internal BT report on the BT secret trials of Phorm (aka 121Media) Deep Packet Inspection has been revealed on Wikileaks today. The leaked document shows that during the covert trial a possible 18 million page requests were intercepted and injected with JavaScript and about 128 thousand charity ads were substituted with the Phorm Ad Network advertisements purchased by advertisers specifically for the covert trial period. Several ISPs are known to be using, or planning to use, DPI as a means of serving advertising directly through Layer 7 interception at ISP level in the USA and Europe.
NebuAd claim they are using DPI to enable their advertising to reach 10% of USA internet users." CT: nodpi has updated their page with a note that says that the charity ads were "purchased and not hijacked"- read there to see what the latest is.
That's a big leak and a big privacy breach, but can this realistically lead to legal action against BT?
Do it yourself, because no one else will do it yourself. [beta blockade 10-17 Feb]
So let me see - if I am paying for bandwidth (which will soon be metered), and my ISP in injecting its ads into the webpages I am requesting, then the ISP is running down my bandwidth on purpose?
Isn't that sort of like someone from the electrical company who breaks into your house to turn the lights on while you're gone?
I won't even mention the privacy issues, cause those aren't "in" nowadays, nor are they likely to be a sufficient cause to nip this practice in the bud. Cheating people out of money, on the other hand, is always a great way to apply the US tort law to the cause.
Changing content and injecting different ads? I could see two possible violations here, one being copyright (altering content without the consent of the provider of the content), the other one dealing with fraudulent ad change (someone other than the one paying for the ads being displayed).
It's like a cable company changing the channel ads with their own. I doubt any channel would sit and bear it, especially since their customers (i.e. ad buyers) won't accept that.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
BT stands for "British Telecom," Something they failed to mention, except in TFA
I hate it when people use too many arbitrary abbrivations. Let's start actually typing out names to set a context, then let people abbrivate in comments...
The Digital Sorceress
There's another issue. Say I post a banner for Charity X on my site, with a note saying "I support these guys with all my heart and soul, and I urge my readers to do all they can for this cause." You go to my site, but your ISP swaps said charity banner for an ad for personal ads or punching the monkey for a ringtone or some other damn thing, making it appear to you as though I'm imploring you to purchase something I would never willingly endorse.
The ISP is then responsible for using my image to endorse their product to my readership, without my permission. Do I have recourse against them for perpetrating such a fraud? IANAL, etc.
Slashdot Burying Stories About Slashdot Media Owned
It's like the thinking goes "let's substitute out something utterly inconsequential and that will have no ramifications whatsoever". No, a charity isn't going to sue your pants off, so I guess it's okay, right?
What's next, Nike tests shoes (leaked codename: "rental") that deteriorate in 30 days -- on retarded children. Through a charity donation. That they write off their taxes the full value of.
Seriously: these are the times I'm glad to procrastinate about being an internet activist[1], because YOU CAN'T MAKE THIS STUFF UP. I couldn't have warned of this if I had tried.
[1] CHILL, guy with the sig 'whenever I hear the word activist I reach for my revolver' It's going to be all right.
I noticed that quote too. It is completely despicable that they would remove charity advertisements. Actually, I think the entire system boils down to theft and unlawful interception of traffic.
What if the phone company inserted commercial adds when you were talking to someone on the phone?
I could see Oxfam (and the other charities who had their ads substituted) getting their lawyers to shakedown BT for a substantial "donation" as an alternative to being sued.
1) write a checksum to a page; if it doesn't match (or another hashing method doesn't match) warn the user that the page has been intercepted and corrupted; the code might not be too tough
2) Use page receipts to vet page authentication
3) litigate, especially for copyright violation as the page has been misused by an intermediary for a purpose not intended by the page's author
4) other solutions that someone will think of; stop the page vandals NOW!
---- Teach Peace. It's Cheaper Than War.
Interesting - whole system runs on RHEL (told you it was evil..) and multiple Squid processes. Adds some latency into browsing (obviously...) Old system dropped javascript tags into URLs but later version did not (resulting in some users having some javascript appearing in their forum posts - like that guy on the motorbike phorum if anyone remembers that incident) Apple.com among the 'download target' sites (page 49) but surprisingly due to Evil, not Microsoft or Google.
Some legal eagle can set me straight here but this sounds a bit like a case of tortuous interference. The site owner and the user have a contract that the viewer views their ads in exchange for the content. The ISP is coming in and interfering with that contract in a material way by replacing ads. Somebody could make some big money on a class action -- as tortuous interference settlements are often very large.
It occurs to me that, at least in the US, an ISP that does ad injection *may* be losing its common-carrier status by changing the information that they convey from a Web site to the subscriber.
Consider that the data is being edited on-the-fly based on its content -- i.e., whether or not it's a banner ad. I think a good case could be made that this violates the conditions for a common carrier.
Question is, does this have any legally useful consequences in trying to prevent ISPs from doing it?
"My strength is as the strength of ten men, for I am wired to the eyeballs on espresso."
BT stole part of my donation to Oxfam.
I give money to Oxfam. They take my money, and use it to run their charity, which includes helping people as well as doing some overhead like, for example, creating ads and managing ad campaigns. Seems like a perfectly good use of my donation.
But now I find out that some of these efforts have been sabotaged, stealing part of the money I donated!
Not only does Oxfam have standing to sue, I would think Oxfam donors have also been wronged.
But worst of all, of course, is the loss of aid to the people who really need it. Hijack an Oxfam ad today, and another child goes hungry tomorrow.
The system does provide an opt-out mechanism and this was laboratory tested and verified. However the method of opt-out requires consideration. Since it involves the dropping of a web-cookie on the users machine to indicate an opt-out preference, which if wiped by the user means they will be opted back in.
The solution would of course be to make it a opt-in instead of opt-out. Most users would of course not opt-in without seeing a clear benefit for doing so. One obvious benefit would be that those that opt-in recive a discount on their internet connection. Simple and fair.
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
ISPs complain that BitTorrent users are eating up all the bandwidth, and the MPAA and RIAA complain about "stealing" of IP through filesharing. Meanwhile, the RIAA and MPAA are breaking the law trying to turn a profit with their (pseudo) legal engine, and the ISPs are breaking the law with DoS/MITM attacks, and altering content on the fly! This is bullshit, complete and utter bullshit, and it needs to stop, NOW. Net Neutrality needs to be the LAW, and ISPs need to have the hammer dropped HARD on them over bullshit like this.
From a legal point of view, I would say this is clearly something that the source web sites can sue over.
Insertion or replacement of advertising is vandalism, which is a criminal act.
It is probably arguable as product tampering.
I would say that even if the ISP has an agreement with the end user (overlooked in the small print) that allows this, they need to properly compensate the originating web site. These hijacked ads represent an improper interference of lawful business practices of the web site, i.e. providing a service sponsored by advertisement. By hijacking the ads, they deprive the website of earned revenue, which is theft.
I think the best argument against this is twofold, from a legal perspective: a)compilation copyright issues and b)unwanted traffic. If you are, in fact, metered, the company most likely has your standard "bend over and smile while we do what we like" ToS attached - and this may or may not be enough to get around these issues. I think the unwanted traffic issue will be covered until a court is presented with a REALLY EXTREME example - like someone who an ISP accidentally sent 250gb of data to and tried to make them pay for it. The compilation copyright claim is probably stronger, but would require action from a third party - namely, the website owner or some such. For example, if an ad I've put up on my webcomic page for, say, t-shirts I sell to do with my comic is replaced. That's quite possibly a relevant claim, BUT I, as the WEBCOMIC OWNER, would need to present a claim (since I've suffered the harm). You haven't been harmed, technically. Relatedly, if an ad I serve on my webpage (and am being paid to do so) is replaced by the ISP, I'm losing money - so that's a fair claim. Net neutrality legislation would almost certainly bar this type of practice - it would just be prioritizing ISP ads over website ads, and if that isn't biased, I don't know what is. The free market doesn't work in a situation like that, where any one website, unless it's Google or Amazon, is nothing but a puny gnat compared to the near-monopolistic ISP's. Another interesting question would be to do with those sites where you go and do nothing but click ads to donate money to charity, or the like. Those sites would become basically completely defunct, and though ISP's would try to say "oh, we'll except you!" it's very problematic to actually do so in practice, for every site, every time, with perfect reliability, as new sites pop up and old ones have subtle programming changes. Even if they do "fix" it, those are great examples to bring into court! In short, I think an American company that uses this should expect to be sued posthaste. There's no reason to think there's any level of benevolence in American ISP's, so expect this to be adopted as quickly as they can get away with it - just like Time Warner is trying to pull with its "test" of bandwidth "caps" that's really a staged setup. Nothing is really going to change until legislation or large legal judgments come down, I fear.
I think it is actually worse than copyright violation. It is fraud. When I have an ad on my website, it is an indicator that I either a) really like the product/service the advertised company is providing, b) will profit from viewing/clicking the ad, or c) really think that the charity being advertised is worthwhile. Phorm ads wouldn't fit any of those categories and yet are purposefully being injected into pages to make it look like A, B, or C are true. It is giving the impression of me approving/profiting from an ad that I am not approving and profiting from. In addition, it is taking money out of my pocket (or a charity's pocket) to make Phorm money. That's fraudulent activity in my book.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
There is just too much unencrypted web traffic on the net, and too much snooping and now man-in-the-middle attacks. SSL/TLS fixes that (unless Phorm subverts a certificate authority, which would REALLY be playing with fire). So now there's finally more incentive to start using it. Authentication and privacy in one now-fairly-simple operation. SSL isn't nearly widely enough used because years ago it was hard to set up and cpu-expensive. But the heavy computation is just during the session negotiation, and CPU's are fast enough now that it's just not significant (about 1 millisecond server-side on today's Core 2 processors vs a good fraction of a second in the early web era, to set up the key for the whole browsing session).
This was discussed in the forum digitalspy.co.uk
Phorm in the UK
One business user was updating the website for his home business. He used his home network connection to inspect the appearance of his website. To his surprise, he could not understand why the format of his website was consistently different from what he had intended. Disturbed by this, he reinstalled the OS on all his servers in fear of being rootkitted, rechecked all his security settings, reconfigured his firewall, and performed a packet trace on every connection made. In the end he noticed that various links on his webpages were being changed and that in particular some were coming from dns.sysip.net. Basically, this system redirected any links to adverts back to Phorm servers.
Customer who was Phormed
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
Well, firstly I am glad to see that the document has forked such a debate here on Slashdot and I thank you all for that (it is long overdue). As a result of some of my comments regarding the report, I am now facing legal threats from Phorm and BT. Alexander Hanff