Slashdot Mirror
Covert BT Phorm Trial Report Leaked
stavros-59 writes "An internal BT report on the BT secret trials of Phorm (aka 121Media) Deep Packet Inspection has been revealed on Wikileaks today. The leaked document shows that during the covert trial a possible 18 million page requests were intercepted and injected with JavaScript and about 128 thousand charity ads were substituted with the Phorm Ad Network advertisements purchased by advertisers specifically for the covert trial period. Several ISPs are known to be using, or planning to use, DPI as a means of serving advertising directly through Layer 7 interception at ISP level in the USA and Europe.
NebuAd claim they are using DPI to enable their advertising to reach 10% of USA internet users." CT: nodpi has updated their page with a note that says that the charity ads were "purchased and not hijacked"- read there to see what the latest is.
That's a big leak and a big privacy breach, but can this realistically lead to legal action against BT?
Do it yourself, because no one else will do it yourself. [beta blockade 10-17 Feb]
So let me see - if I am paying for bandwidth (which will soon be metered), and my ISP in injecting its ads into the webpages I am requesting, then the ISP is running down my bandwidth on purpose?
Isn't that sort of like someone from the electrical company who breaks into your house to turn the lights on while you're gone?
I won't even mention the privacy issues, cause those aren't "in" nowadays, nor are they likely to be a sufficient cause to nip this practice in the bud. Cheating people out of money, on the other hand, is always a great way to apply the US tort law to the cause.
Changing content and injecting different ads? I could see two possible violations here, one being copyright (altering content without the consent of the provider of the content), the other one dealing with fraudulent ad change (someone other than the one paying for the ads being displayed).
It's like a cable company changing the channel ads with their own. I doubt any channel would sit and bear it, especially since their customers (i.e. ad buyers) won't accept that.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
BT stands for "British Telecom," Something they failed to mention, except in TFA
I hate it when people use too many arbitrary abbrivations. Let's start actually typing out names to set a context, then let people abbrivate in comments...
The Digital Sorceress
There's another issue. Say I post a banner for Charity X on my site, with a note saying "I support these guys with all my heart and soul, and I urge my readers to do all they can for this cause." You go to my site, but your ISP swaps said charity banner for an ad for personal ads or punching the monkey for a ringtone or some other damn thing, making it appear to you as though I'm imploring you to purchase something I would never willingly endorse.
The ISP is then responsible for using my image to endorse their product to my readership, without my permission. Do I have recourse against them for perpetrating such a fraud? IANAL, etc.
Slashdot Burying Stories About Slashdot Media Owned
I could see Oxfam (and the other charities who had their ads substituted) getting their lawyers to shakedown BT for a substantial "donation" as an alternative to being sued.
1) write a checksum to a page; if it doesn't match (or another hashing method doesn't match) warn the user that the page has been intercepted and corrupted; the code might not be too tough
2) Use page receipts to vet page authentication
3) litigate, especially for copyright violation as the page has been misused by an intermediary for a purpose not intended by the page's author
4) other solutions that someone will think of; stop the page vandals NOW!
---- Teach Peace. It's Cheaper Than War.
"Hi Jim, I just a bought a great new handheld console"
"Oh yeah, what did you get"
"A Sony Pzzzzzzzzzzzzzz^^^^^T Nintendo DS proudly sponsors this phonecall! Your pal loves Nintendo DS! bzzzzzt *click* so yeah you should totally get one so we can play against each other dude!"
It occurs to me that, at least in the US, an ISP that does ad injection *may* be losing its common-carrier status by changing the information that they convey from a Web site to the subscriber.
Consider that the data is being edited on-the-fly based on its content -- i.e., whether or not it's a banner ad. I think a good case could be made that this violates the conditions for a common carrier.
Question is, does this have any legally useful consequences in trying to prevent ISPs from doing it?
"My strength is as the strength of ten men, for I am wired to the eyeballs on espresso."
What if the phone company inserted commercial adds when you were talking to someone on the phone?
That's nothing. What if they intercepted and changed what was said:
You say: Hey Jim, How are ya?
He hears: Hey Jim, I wish I was eating a tasty Mars bar.
He says: Ok.
You hear: Ok.
You say: Wanna go see a movie?
He hears: Wanna go see Superbad, and get some popcorn?
He says: Uh... sure.
You hear: Uh... sure.
You say: Cool see ya.
He hears: Cool. Can you pick me up some Laramie cigarretes. They take me to flavor country!
He says: Uh... say what?
You hear: Uh... you too.
The system does provide an opt-out mechanism and this was laboratory tested and verified. However the method of opt-out requires consideration. Since it involves the dropping of a web-cookie on the users machine to indicate an opt-out preference, which if wiped by the user means they will be opted back in.
The solution would of course be to make it a opt-in instead of opt-out. Most users would of course not opt-in without seeing a clear benefit for doing so. One obvious benefit would be that those that opt-in recive a discount on their internet connection. Simple and fair.
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
ISPs complain that BitTorrent users are eating up all the bandwidth, and the MPAA and RIAA complain about "stealing" of IP through filesharing. Meanwhile, the RIAA and MPAA are breaking the law trying to turn a profit with their (pseudo) legal engine, and the ISPs are breaking the law with DoS/MITM attacks, and altering content on the fly! This is bullshit, complete and utter bullshit, and it needs to stop, NOW. Net Neutrality needs to be the LAW, and ISPs need to have the hammer dropped HARD on them over bullshit like this.
I think it is actually worse than copyright violation. It is fraud. When I have an ad on my website, it is an indicator that I either a) really like the product/service the advertised company is providing, b) will profit from viewing/clicking the ad, or c) really think that the charity being advertised is worthwhile. Phorm ads wouldn't fit any of those categories and yet are purposefully being injected into pages to make it look like A, B, or C are true. It is giving the impression of me approving/profiting from an ad that I am not approving and profiting from. In addition, it is taking money out of my pocket (or a charity's pocket) to make Phorm money. That's fraudulent activity in my book.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
There is just too much unencrypted web traffic on the net, and too much snooping and now man-in-the-middle attacks. SSL/TLS fixes that (unless Phorm subverts a certificate authority, which would REALLY be playing with fire). So now there's finally more incentive to start using it. Authentication and privacy in one now-fairly-simple operation. SSL isn't nearly widely enough used because years ago it was hard to set up and cpu-expensive. But the heavy computation is just during the session negotiation, and CPU's are fast enough now that it's just not significant (about 1 millisecond server-side on today's Core 2 processors vs a good fraction of a second in the early web era, to set up the key for the whole browsing session).
This was discussed in the forum digitalspy.co.uk
Phorm in the UK
One business user was updating the website for his home business. He used his home network connection to inspect the appearance of his website. To his surprise, he could not understand why the format of his website was consistently different from what he had intended. Disturbed by this, he reinstalled the OS on all his servers in fear of being rootkitted, rechecked all his security settings, reconfigured his firewall, and performed a packet trace on every connection made. In the end he noticed that various links on his webpages were being changed and that in particular some were coming from dns.sysip.net. Basically, this system redirected any links to adverts back to Phorm servers.
Customer who was Phormed
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
Well, firstly I am glad to see that the document has forked such a debate here on Slashdot and I thank you all for that (it is long overdue). As a result of some of my comments regarding the report, I am now facing legal threats from Phorm and BT. Alexander Hanff