Why it's wrong
1. Webwise/Phorm intrudes on privacy
Most of us have nothing to hide. But we wouldn't want a little man following us around all day, watching where we went and what we bought in shops, following us while we played sports or went to the gym, sitting in the corner of the pub listening to us, inspecting our post as it came through the front door (apart from letters we insisted he ignore), reading our books and newspapers over our shoulders and recording where we were going on holiday.
There will be little of your life Webwise/Phorm will not know about. They may bundle it all up and assign you to a demographic segment. But that cookie on your PC will disclose your likes and dislikes, and it could be used to work out who you are.
2. Users may opt into Webwise/Phorm without being aware that the page contents of nearly everything they access do will be intercepted, read and analysed
Webwise is being presented primarily as providing greater protection from online fraud, with tailoring of advertising a secondary feature. Yet its primary purpose is to make advertising from participating websites more relevant.
The proposed BT sign-up page was released under a Freedom of Information request on 26th June 2008 and can be seen here .
Nowhere do BT state that equivalent protection from online fraud is standard with the latest free browsing software which more then 90% of UK users already have. Nor do they explicitly state that Webwise works by intercepting, reading and processing nearly everything users do on the Web.
If Webwise is such a good offer for users, why doesn't BT focus on Webwise's core purpose and clearly explain the privacy trade-off needed to customise advertisements for you?
3. Webwise/Phorm exploits web content without permission from its owners
Everything on the Internet is not free to use. While work published on the Internet may be publicly accessible, it is certainly not fully in the public domain. For example you cannot download a picture and then make money from publishing it in a book.
That a website owner is willing to send a particular page to anyone does not mean that they are willing to have the use of that page by a particular user profiled and added to a collection of other data about that user. This is particularly relevant for retailers, since that information may then be used to encourage that user to visit a competitor's website.
In their Conditions of Use and Sale, Amazon state: "This website or any portion of this website may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without our express written consent."
It seems unlikely that they, or many other website owners, would say that unless they meant it.
4. Many believe that the Webwise/Phorm Trials were unlawful
In the BT Webwise/Phorm Trials in 2006 and 2007, consent was neither sought from nor granted by any of the tens of thousands of users affected.
To carry out the kinds of communication interceptions used in the BT trials in 2006, either a warrant has to be obtained or the parties at both ends have to give their permission. This is covered by the Regulation of Investigatory Powers Act 2000.
In addition personal data has to be kept private and not misused. The Information Commissioner has stated that Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 would be likely to apply to BT's 2007 trials of Phorm.
Further legislation, such as the Data Protection Act 1998, may also apply.
The City of London Police are now investigating BT's trials of Phorm.
5. Webwise/Phorm deployment will probably be unlawful
The basic principles of Webwise/Phorm have not changed since the trials. It involves snooping on users as they access the web. It involves exploiting other people's copyright material for commercial gain.
Deployments of Webwise/Phorm will probably involve the following illegalities:
- Interception of communications, an offence contrary to section 1 of the Regulation of Investigatory Powers Act 2000
- Fraud, an offence contrary to section 1 of the Fraud Act 2006
- Unlawful processing of sensitive personal data, contrary to the Data Protection Act 1998
- Civil liability, and criminal offences under the Copyright, Designs and Patents Act 1988
6. Webwise/Phorm makes the Internet less secure
Webwise/Phorm operates by adding four message redirects to the way your data is handled by your Internet Service Provider. Webwise/Phorm also forges cookies on your PC which look as though they have come from the websites you have accessed.
This presents opportunities for abuse from within Internet Service Providers and Phorm itself, and also from external hackers and fraudsters. Internet Service Providers using Phorm will be more vulnerable to cyber-terrorist attacks. Ideas on how to compromise Phorm-based systems are already appearing on the Web.
For this reason, if Webwise/Phorm goes ahead many technically-aware people are considering moving to Internet Service Providers which have committed to not intercepting web traffic in this way.
7. Webwise/Phorm may compromise the Internet's integrity
In the BT Trials of Webwise/Phorm in 2006, messages from users to websites were actually altered by the Phorm system. Phorm offers the opportunity not just for tailoring the advertisements you see, but also what you see on the web.
While Phorm will only be used initially for tailoring advertisements, it opens up many opportunities for interference with the operation of the Internet. How will you know who you are communicating with when your message can be modified by your Internet Service Provider? How will you know that what you are reading on a website is what the website owner wants you to see, or what your ISP and Phorm want you to see?
An Internet which has integrity is essential to our freedom and essential to our economy. Webwise/Phorm puts this at risk.