The scandal about Phorm and Webwise continues apace, as the EC are now wading into the fray. As a growing number of people have heard or read about, Phorm is an online marketing company, promoting a product, Webwise, to ISP’s in the UK, designed to deliver targeted ads to those ISPs’ customers. However, they target those adverts based on your browsing habits, and they do that by intercepting and monitoring your private web traffic, giving them the potential to see everything you do online, as well as your private details, private emails, your bank details if you bank online, and so on (note, this has been confirmed by their own people, who said in an American press conference that they can, in fact, see the whole internet!)
Plus, let’s not forget that it’s entirely feasible that such a system could easily be applied (and probably would be, if the online version goes ahead) to the mobile phones you’re using, as I’ve stated before. Imagine a system like that; it can read your messages, find out what you like, and send you ads about it. And if your mobile phone has GPS, you could even be sent ads for the local pizza parlour or newsagent, since, hey, they know exactly where you are.
In a society where free speech is supposed to be paramount, and one of our inalienable rights, a situation that scares people into not speaking freely (because Big Brother would be watching you) is simply intolerable. Both the internet and mobile phones are designed to let us freely communicate, to let us express free thought, not to keep us in a cage, afraid of speaking out, lest our words are heard and used against us.
But if you’ve read the title of this post, then you’ll see that there may well be hope at the end of this rollercoaster ride. It’s quite simply the most important thing to happen in the Phorm / Webwise scandal so far. I’ll paste the entire statement from the EC, as it makes for illuminating reading, but to summarise the one, hugely important message in the statement:
According to the European Commission, Phorm and Webwise allegedly breach European laws about privacy and human rights, making them illegal.
I can’t say it any simpler than that. According to the statement from the EC, European laws and directives exist to prohibit “listening, tapping, storage or other kinds of interception or surveillance of communication and the related traffic data by persons other than the users without their consent, which must be freely given, specific and informed indication of the user’s wishes.”
In other words, they exist to stop people spying on you when you use the internet or mobile phones (Needless to say, the same goes for mobile broadband).
Not only are Phorm and Webwise morally and ethically questionable, in my opinion, but according to those EC laws, without EXPLICIT consent (in other words, Opt-Out is NOT good enough), they run the risk of being illegal. Which means the covert trials run by Phorm and any ISP’s involved (let’s face it, there could have been more than one, and we wouldn’t necessarily know) were, following that definition, ‘illegal’, because no matter how much they anonymised the data, people’s private data streams were intercepted without their consent. Hence why it is very easy to interpret from the EC statement, such as commentator Alex Hanff and legal counsel Nicholas Bohm have both done, that those trials were illegal.
That’s obviously a matter for the courts, NOT me, to decide, but let’s not forget that in a recent case in Germany, the high court killed a similar plan by the German government to snoop on people’s online activities (although, I confess, I can’t confirm whether that’s just for online activity, or whether it extends to mobile phones as well). The court’s decision was final: that kind of interception and surveillance was both oppressive and illegal. And if it’s already been ruled illegal in one EU country…
The EC statement goes further, though, clearly stating that if the ICO (Information Commissioner’s Office) does not deal with this situation satisfactorily, then it will step in, and act on the case.
This cannot come soon enough, as it’s a massive worry to me, to you, and to anyone who values both their privacy and security, The only way we can guarantee our privacy and security is if Phorm and Webwise do NOT go ahead. Being in a world where government ministers tell you to keep your identity safe with one breath, whilst actively egging on a system that makes it EASIER to steal your identity (from your internet use or your mobile phones) with the other, is not a world any of us want too live in. Even if Phorm have the best intentions in the world, they can NEVER guarantee our data wouldn’t identify us, and can NEVER guarantee it wouldn’t be hacked into, to let someone use your identity.
But before I conclude , let’s clear something up; I’m not against marketing per se. With opt-in systems, you’ve got a real chance to actually benefit the customer. If I, or you, say YES to a newsletter, then that’s cool, that means we want to be told about products, because there’s a reasonable chance they might make our lives better. Take Technical Markus, for example. He’s signed himself up to LOTS of drumming newsletters, because it benefits him. He’s opted-in, and that’s cool, no-one has any problem with that. There’s a world of difference between marketing to customers because they’ve told you they want that info, and telling your customers they have to have it, and it’s good for them, and they shouldn’t think about it themselves!
So, if I say NO to it, I don’t want my personal life to be watched, monitored, categorised, numbered and sold to the highest bidder. I don’t want my info stored in a database that can be hacked at all (no matter how unlikely hacking it is). I don’t want to lead a life where I’m wondering who’s listening to me speak on my mobile phone, or tracking me with GPS, or reading my emails to a friend, before categorising me as a terrorist, because I said a film ‘bombed’ at the box office.
Do you?
No?
Then we’d all better hope that the ICO and the EC act in the UK’s best interests, indeed the best interests of everyone in the UK’s population, and declare, that Phorm and Webwise are indeed illegal. It’ll start with the internet and mobile phones, but after that, it’s just one long slippery slope to us living in a George Orwell novel…
Full text of EC Statement on Phorm and Webwise (source, plus analysis by Alex Hanff can be found at p2p.net):
“The Comission is aware of the activities of the company Phorm in the UK, concerning the analysis of internet traffic for advertising purposes, the agreement between Phorm and major internet service providers in the UK and the concerns that have been raised about the effects on privacy of these activities.
Privacy and the protection of personal data are fundamental rights of the citizens of the EU. They are enshrined in articles 7 and 8 of the EU Charter of Fundamental Rights, and also protected by the European Convention on Human Rights and the related instruments of the Council fo Europe, to which all EU Member States are signatories.
The general principles of personal data are defined in Directive 95/46/EC and complemented and particularised for electronic communications by Directive 2002/58/EC on privacy and electronic communications (ePrivacy Directive). The ePrivacy Directive obliges Member States to ensure the confidentiality of communications and related traffic data through national legislation.
In particular, they shall prhobit listening, tapping, storage or other kinds of interception or surveillance of communication and the related traffic data by persons other than the users without their consent, which must be freely given, specific and informed indication of the user’s wishes. The data concerned in this particular matter i.e. the content of search queries, constitute communication within the meaning of this Directive and the URLs used in the packets constitute traffic data. This data should therefore be protected appropriately.
The responsibility for the enforcement of national legislation transposing EU Directives is with the competent national authorities. The ICO, the UK data protection authority, has issued several statements concerning Phorm. According to press information, the ICO is also investigating in at least one case, where a formal complaint has been made concerning alleged trials of Phorm technology by BT in 2007[3].
The Comission services will continue to follow this case and possible similar developments and take appropriate action, should the need arise.
The Comission confirms its commitment to the protection of privacy and security of electronic communications as one of its top priorities.”
