From ukcrypto at chiark.greenend.org.uk Mon Jun 2 18:35:41 2008 From: ukcrypto at chiark.greenend.org.uk (Nicholas Bohm) Date: Mon, 02 Jun 2008 18:35:41 +0100 Subject: Phorm and the BT AGM Message-ID: <48442F6D.6020901@ernest.net> I have been asked to circulate the following: From: ALEXANDER JOHN HANFF Sent: 31 May 2008 01:08 Subject: Press Release - Protesters to Picket Shareholders at BT PLC AGM Protesters to Picket shareholders at BT PLC Annual General Meeting - 16th July 2008 On 16th July 2008 there will be a full day protest against the use of Deep Packet Inspection for the purpose of behavioural profiling. The event will focus on the plans by BT PLC, Virgin Media and Car Phone Warehouse to introduce deep packet inspection technologies through exclusive contracts with Phorm Inc. Since Phorm issued a press release on 14th February 2008 regarding these exclusive contracts there has been a storm of outrage amongst the public, leading academics, privacy advocates, Members of Parliament, Members of the European Parliament, Peers in the House of Lords and the industry as whole. The technology has been called illegal by Foundation for Information Policy Research, which was recently supported by a statement from the European Commission. As a result of the negative publicity generated over the past 3 months Phorm Inc.'s share price has plummeted by approx 70% and continues to struggle to develop confidence from investors. In 2006/2007 BT PLC have admitted to running covert trials of the technology without first obtaining the consent from customers required by EU and UK Data Protection and Communications regulations, directives and legislation. However, to date neither the Information Commissioner nor the Secretary of State have held BT PLC to account for these allegedly illegal actions. Therefore, the growing public campaign to seek justice for the victims of these covert trials and the wider mission of stopping the technology from being deployed, has led to an organised one day protest in London, UK. There is expected to be a significant press and media presence at the event which will begin at the Barbican Centre, continue on to BT Centre (BT's corporate HQ) and finally end with a march on to Charing Cross Metropolitan Police Station in the early evening. On arrival at the Metropolitan Police station a full case file with witness testimonies and supporting evidence, along with a petition demanding a criminal investigation will be handed to the senior officer on duty. For more details about the event, please visit the following two web sites: http://www.theregister.co.uk/2008/05/30/bt_agm_phorm_protest http://www.nodpi.org If you require further information please contact me via the NoDPI web site listed above. Sincerely, Alexander Hanff University of Cumbria From ukcrypto at chiark.greenend.org.uk Mon Jun 2 21:08:09 2008 From: ukcrypto at chiark.greenend.org.uk (Alexander Hanff) Date: Mon, 2 Jun 2008 21:08:09 +0100 Subject: Update on Phorm Protest In-Reply-To: <298c5f970806021137g1a1918c5j717485334dc28183@mail.gmail.com> References: <298c5f970806021137g1a1918c5j717485334dc28183@mail.gmail.com> Message-ID: <298c5f970806021308n12b441bbk3ba1cfefeccc45b2@mail.gmail.com> ------=_Part_1628_9475222.1212437289085 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Hello everyone, I just wanted to quickly mention that the plan for the event has changed slightly today in order to maximise our chances of media coverage and a successful protest. The updated plan can be found on http://nodpi.org/?p=7 I would just personally like to thank everyone on this list who has commented on the issues to date, you have been a valuable resource. Thanks also to Mr Bohm for forwarding the event announcement earlier today. Regards Alexander Hanff ------=_Part_1628_9475222.1212437289085 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline
Hello everyone,

I just wanted to quickly mention that the plan for the event has changed slightly today in order to maximise our chances of media coverage and a successful protest.

The updated plan can be found on http://nodpi.org/?p=7

I would just personally like to thank everyone on this list who has commented on the issues to date, you have been a valuable resource.  Thanks also to Mr Bohm for forwarding the event announcement earlier today.

Regards

Alexander Hanff

------=_Part_1628_9475222.1212437289085-- From ukcrypto at chiark.greenend.org.uk Tue Jun 3 03:42:00 2008 From: ukcrypto at chiark.greenend.org.uk (Peter Fairbrother) Date: Tue, 03 Jun 2008 03:42:00 +0100 Subject: Phorm and the BT AGM In-Reply-To: <48442F6D.6020901@ernest.net> References: <48442F6D.6020901@ernest.net> Message-ID: <4844AF78.9000107@zen.co.uk> Nicholas Bohm wrote: > I have been asked to circulate the following: > > From: ALEXANDER JOHN HANFF > Sent: 31 May 2008 01:08 > Subject: Press Release - Protesters to Picket Shareholders at BT PLC AGM > > Protesters to Picket shareholders at BT PLC Annual General Meeting - 16th > July 2008 > > On 16th July 2008 there will be a full day protest against the use of Deep > Packet Inspection for the purpose of behavioural profiling. The event will > focus on the plans by BT PLC, Virgin Media and Car Phone Warehouse to > introduce deep packet inspection technologies through exclusive contracts > with Phorm Inc. > > Since Phorm issued a press release on 14th February 2008 regarding these > exclusive contracts there has been a storm of outrage amongst the public, > leading academics, privacy advocates, Members of Parliament, Members of the > European Parliament, Peers in the House of Lords and the industry as whole. > The technology has been called illegal by Foundation for Information > Policy Research, which was recently supported by a statement from the > European Commission. > > As a result of the negative publicity generated over the past 3 months > Phorm Inc.'s share price has plummeted by approx 70% and continues to > struggle to develop confidence from investors. > > In 2006/2007 BT PLC have admitted to running covert trials of the > technology without first obtaining the consent from customers required by > EU and UK Data Protection and Communications regulations, directives and > legislation. However, to date neither the Information Commissioner nor the > Secretary of State have held BT PLC to account for these allegedly illegal ^H^H^H^H^H^H^H blatantly illegal > actions. > > Therefore, the growing public campaign to seek justice for the victims of > these covert trials and the wider mission of stopping the technology from > being deployed, has led to an organised one day protest in London, UK. > There is expected to be a significant press and media presence at the event > which will begin at the Barbican Centre, continue on to BT Centre (BT's > corporate HQ) and finally end with a march on to Charing Cross Metropolitan > Police Station in the early evening. On arrival at the Metropolitan Police > station a full case file with witness testimonies and supporting evidence, > along with a petition demanding a criminal investigation will be handed to > the senior officer on duty. > > For more details about the event, please visit the following two web sites: > > http://www.theregister.co.uk/2008/05/30/bt_agm_phorm_protest > > http://www.nodpi.org > > If you require further information please contact me via the NoDPI web site > listed above. > > Sincerely, > > Alexander Hanff > University of Cumbria > > > From ukcrypto at chiark.greenend.org.uk Mon Jun 2 19:37:51 2008 From: ukcrypto at chiark.greenend.org.uk (Alexander Hanff) Date: Mon, 2 Jun 2008 19:37:51 +0100 Subject: Update on Phorm Protest Message-ID: <298c5f970806021137g1a1918c5j717485334dc28183@mail.gmail.com> ------=_Part_1377_13009024.1212431871772 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Hello everyone, I just wanted to quickly mention that the plan for the event has changed slightly today in order to maximise our chances of media coverage and and a successful protest. The updated plan can be found on http://nodpi.org/?p=7 I would just personally like to thank everyone on this list who has commented on the issues to date, you have been a valuable resource. Regards Alexander Hanff ------=_Part_1377_13009024.1212431871772 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Hello everyone,

I just wanted to quickly mention that the plan for the event has changed slightly today in order to maximise our chances of media coverage and and a successful protest.

The updated plan can be found on http://nodpi.org/?p=7

I would just personally like to thank everyone on this list who has commented on the issues to date, you have been a valuable resource.

Regards

Alexander Hanff
------=_Part_1377_13009024.1212431871772-- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 08:56:45 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Thu, 05 Jun 2008 08:56:45 +0100 Subject: Telegraph article on RIP Message-ID: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> It appears that Telegraph readers are slowly waking up to Home Office plans to put us all in an open prison. About time too, though whether they do more than whine remains to be seen. is the result of my enquiries to the local Toms, Dicks and Harriets on this matter. As I expected they have never rejected an attack on the basis that it is neither necessary or proportionate. They appear to think that this is excellent, I think it stinks. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Thu Jun 5 10:52:46 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Thu, 5 Jun 2008 10:52:46 +0100 Subject: Mrs Roland on the Telly Message-ID: <6F1F6470-714D-41DA-8740-78A47FDD45CF@batten.eu.org> www.e-victims.org. That's WWW.E-VICTIMS.ORG. ian From ukcrypto at chiark.greenend.org.uk Thu Jun 5 11:04:10 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Thu, 5 Jun 2008 11:04:10 +0100 Subject: =?ISO-8859-1?Q?No_DPI_=BB_Blog_Archive_=BB_BT_covert_trials_in_2?= =?ISO-8859-1?Q?006_-_The_FACTS_about_PageSense?= Message-ID: <97F60DEB-1547-4666-953C-BA108735F1FC@batten.eu.org> --Apple-Mail-28-277333076 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit http://nodpi.org/?p=10 FULL REPORT AVAILABLE HERE --Apple-Mail-28-277333076 Content-Type: text/html; charset=US-ASCII Content-Transfer-Encoding: 7bit

http://nodpi.org/?p=10

FULL REPORT AVAILABLE HERE
--Apple-Mail-28-277333076-- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 12:28:28 2008 From: ukcrypto at chiark.greenend.org.uk (Roland Perry) Date: Thu, 5 Jun 2008 12:28:28 +0100 Subject: Telegraph article on RIP In-Reply-To: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> Message-ID: <97EObObc38RIFAG8@perry.co.uk> In article <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, David Hansen writes > "When Ripa was passed in 2000, only nine organisations, including the police and security services, were allowed to use it, but that number has since risen to 792, including 474 councils" Sums up their perspective on this. The number of public authorities required to use RIPA for comms data was never in any doubt, and the only real remaining debate is whether or not it's better for them to be doing it through the processes laid down in RIPA, or ad-hoc using DPA 29/3 (and often somewhat imagined "legacy powers" under a host of earlier legislation). It's interesting that this article is more about RIPA to gain comms data (mainly reverse DQ I expect, and I can't get too excited if the most active council has done all of 89 requests in a year) than previous ones that have been about councils now required to use RIPA surveillance rules when previously there were no rules at all. -- Roland Perry From ukcrypto at chiark.greenend.org.uk Thu Jun 5 12:39:51 2008 From: ukcrypto at chiark.greenend.org.uk (Richard Clayton) Date: Thu, 5 Jun 2008 12:39:51 +0100 Subject: BT 2006 trials of Phorm Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There is a newly arrived document on WikiLeaks (seems that crytome has lost street cred now that Home Office use them!). It appears to be an internal BT report assessing their 2006 trial of Phorm technology. A key point to make is that this trial used slightly different technology than the current Phorm system that I recently documented (it apparently appended a JavaScript tag to web pages and redirected the browser in such a way that the navigation bar in the browser "fluttered" and tags ended up in some web postings). It does seem to have been making use of cookies, but they were apparently placed on people's systems in an "honest" manner prior to the trial (viz: there was no forgery of other sites in order to trick the browsers into accepting them). An interesting sentence early on reads: Normally the PageSense system deploys cookies directly to user's machines. BT Broadband terms and conditions prevented this approach. Looking at BT's current T&C's I find it hard to identify if they have changed anything yet. The business conditions: http://www.btbroadbandoffice.com/broadband/terms_busi don't seem changed in any relevant way from what I can locate on www.archive.org for 2006. The consumer T&C's are on the page http://www.productsandservices.bt.com/consumerProducts/dynamicmodules/pa gecontentfooter/pageContentFooterPopup.jsp?pagecontentfooter_popupid=134 08 (!) but seem to have been somewhere else prior to April 2007, so I haven't managed to do a comparison to see if these are changed :( Anyway --- back to the 2006 trial. The trial was secret, in that users were experimented upon without their knowledge or consent (which is generally felt to have been illegal [even with consent it is FIPR and others view that is illegal -- without consent I can't see much doubt]). Also, the trial involved the building of browsing histories and the serving of ads on the basis of that history -- which seems to run counter to earlier assurances by BT as to the nature of the trial: http://www.theregister.co.uk/2008/03/17/bt_phorm_lies/ "Absolutely no personally identifiable information was processed, stored or disclosed during this trial" The "disclosed" has already been shown to be dubious (because of the way that the technology worked at that time), although the dates don't match well, it seems to be much the same technology: http://www.badphorm.co.uk/e107_plugins/forum/forum_viewtopic.php?2676.20 [of course the identifiers in the cookies can be leaked in the current system as well, which is one of the (many) objections to it]. We can now see from the internal document that "processed" is also false (the system used the data in order to build browsing histories): Which makes the only thing left intact from BT's statement is the lack of "storage" (the Phorm system records a distilled down profile against your personal identifier).... hmmmmm There's much more in the document, but this is a long enough message already, so I shall just note that the document contains the throw-away line "communications regarding advertisement systems and information collection could lead to negative perception if not carefully handled". - -- richard Richard Clayton They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. Benjamin Franklin -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBSEfQh5oAxkTY1oPiEQLjEQCgjp/IjSz0jyqZCtveeH/J0gWkh9QAnilH mmS6PUjmgRnarzY6ipl1XCA9 =de0C -----END PGP SIGNATURE----- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 13:00:44 2008 From: ukcrypto at chiark.greenend.org.uk (PeteM) Date: Thu, 05 Jun 2008 13:00:44 +0100 Subject: Telegraph article on RIP In-Reply-To: <97EObObc38RIFAG8@perry.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> <97EObObc38RIFAG8@perry.co.uk> Message-ID: <4847D56C.6010003@callnetuk.com> Roland Perry wrote on 5-06-08 12:28: > In article <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, David Hansen > writes >> > > "When Ripa was passed in 2000, only nine organisations, > including the police and security services, were allowed to use > it, but that number has since risen to 792, including 474 > councils" > > Sums up their perspective on this. The number of public authorities > required to use RIPA for comms data was never in any doubt, and the only > real remaining debate is whether or not it's better for them to be doing > it through the processes laid down in RIPA, or ad-hoc using DPA 29/3 For heavens' sake, Roland. How many times do you have to be reminded that DPA gave *no* powers to *anybody* to require telcos or ISPs to hand over communications data? > (and often somewhat imagined "legacy powers" under a host of earlier > legislation). In most cases, *totally* imaginary legacy powers. -- Pete Mitchell From ukcrypto at chiark.greenend.org.uk Thu Jun 5 13:16:05 2008 From: ukcrypto at chiark.greenend.org.uk (Alexander Hanff) Date: Thu, 5 Jun 2008 13:16:05 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: References: Message-ID: <298c5f970806050516u3d44b474uc48735cc8242452c@mail.gmail.com> ------=_Part_921_6258560.1212668165965 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Richard, The closing statement gave me a good laugh. But in seriousness the proxy based model they were using in 2006, in my mind actually damns them even further. I calculated something along the line of 113 million breaches of law over an 8 day period, based on 18.8M javascript insertions over the period each seeming to breach 6 Acts/Regulations/Directives as follows: PECR - Easy enough, regulation 6 and 7 appear to be knackered given that the table on page 45 shows clearly that IP data was stored and in fact was required to be stored for the proxy system to even begin to work, which covers "traffic data". RIPA - clear interception and modification of the communications. CMA - I think even under the English version of Computer Misuse Act, illustration of non compliance is reasonably trivial as I explained in my dissertation. Clearly the JavaScript is a program that uses client side resources as well as network resources and it would seem untenable for BT to say they were not aware of what they were doing or how the system worked considering they deployed the technology for a very specific purpose. Copyright Designs and Patents Act - Well inserting the JavaScript is creating a derivative works for starters. Torts (Interference with Goods) Act - IF CMA is applicable then realistically so should Interference with Goods be. DPA - IP addresses were passed on to Phorm's kit and stored (the proxy servers) and since IP is personally identifiable, it is covered by DPA. Then of course as you stated there is definitely processing going on. In some respect I wish this were the model they are currently trying to deploy, fair enough we lose Fraud Act, but I feel the others should be a "slam dunk". Alexander Hanff PS - Richard did you get my email re the protest? 2008/6/5 Richard Clayton : > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > There is a newly arrived document on WikiLeaks (seems that crytome has > lost street cred now that Home Office use them!). It appears to be an > internal BT report assessing their 2006 trial of Phorm technology. > > rnal_Validation_report> > > A key point to make is that this trial used slightly different > technology than the current Phorm system that I recently documented (it > apparently appended a JavaScript tag to web pages and redirected the > browser in such a way that the navigation bar in the browser "fluttered" > and tags ended up in some web postings). > > It does seem to have been making use of cookies, but they were > apparently placed on people's systems in an "honest" manner prior to the > trial (viz: there was no forgery of other sites in order to trick the > browsers into accepting them). > > An interesting sentence early on reads: > > Normally the PageSense system deploys cookies directly to user's > machines. BT Broadband terms and conditions prevented this approach. > > Looking at BT's current T&C's I find it hard to identify if they have > changed anything yet. The business conditions: > > http://www.btbroadbandoffice.com/broadband/terms_busi > > don't seem changed in any relevant way from what I can locate on > www.archive.org for 2006. The consumer T&C's are on the page > > http://www.productsandservices.bt.com/consumerProducts/dynamicmodules/pa > gecontentfooter/pageContentFooterPopup.jsp?pagecontentfooter_popupid=134 > 08 > > (!) but seem to have been somewhere else prior to April 2007, so I > haven't managed to do a comparison to see if these are changed :( > > > Anyway --- back to the 2006 trial. The trial was secret, in that users > were experimented upon without their knowledge or consent (which is > generally felt to have been illegal [even with consent it is FIPR and > others view that is illegal -- without consent I can't see much doubt]). > > Also, the trial involved the building of browsing histories and the > serving of ads on the basis of that history -- which seems to run > counter to earlier assurances by BT as to the nature of the trial: > > http://www.theregister.co.uk/2008/03/17/bt_phorm_lies/ > > "Absolutely no personally identifiable information was processed, > stored or disclosed during this trial" > > The "disclosed" has already been shown to be dubious (because of the way > that the technology worked at that time), although the dates don't match > well, it seems to be much the same technology: > > http://www.badphorm.co.uk/e107_plugins/forum/forum_viewtopic.php?2676.20 > > [of course the identifiers in the cookies can be leaked in the current > system as well, which is one of the (many) objections to it]. > > We can now see from the internal document that "processed" is also false > (the system used the data in order to build browsing histories): > > Which makes the only thing left intact from BT's statement is the lack > of "storage" (the Phorm system records a distilled down profile against > your personal identifier).... hmmmmm > > There's much more in the document, but this is a long enough message > already, so I shall just note that the document contains the throw-away > line "communications regarding advertisement systems and information > collection could lead to negative perception if not carefully handled". > > > - -- > richard Richard Clayton > > They that can give up essential liberty to obtain a little temporary > safety deserve neither liberty nor safety. Benjamin Franklin > > -----BEGIN PGP SIGNATURE----- > Version: PGPsdk version 1.7.1 > > iQA/AwUBSEfQh5oAxkTY1oPiEQLjEQCgjp/IjSz0jyqZCtveeH/J0gWkh9QAnilH > mmS6PUjmgRnarzY6ipl1XCA9 > =de0C > -----END PGP SIGNATURE----- > > ------=_Part_921_6258560.1212668165965 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Richard,

The closing statement gave me a good laugh.  But in seriousness the proxy based model they were using in 2006, in my mind actually damns them even further.  I calculated something along the line of 113 million breaches of law over an 8 day period, based on 18.8M javascript insertions over the period each seeming to breach 6 Acts/Regulations/Directives as follows:

PECR - Easy enough, regulation 6 and 7 appear to be knackered given that the table on page 45 shows clearly that IP data was stored and in fact was required to be stored for the proxy system to even begin to work, which covers "traffic data".

RIPA - clear interception and modification of the communications.

CMA - I think even under the English version of Computer Misuse Act, illustration of non compliance is reasonably trivial as I explained in my dissertation.  Clearly the JavaScript is a program that uses client side resources as well as network resources and it would seem untenable for BT to say they were not aware of what they were doing or how the system worked considering they deployed the technology for a very specific purpose.

Copyright Designs and Patents Act - Well inserting the JavaScript is creating a derivative works for starters.

Torts (Interference with Goods) Act - IF CMA is applicable then realistically so should Interference with Goods be.

DPA - IP addresses were passed on to Phorm's kit and stored (the proxy servers) and since IP is personally identifiable, it is covered by DPA.  Then of course as you stated there is definitely processing going on.

In some respect I wish this were the model they are currently trying to deploy, fair enough we lose Fraud Act, but I feel the others should be a "slam dunk".

Alexander Hanff
PS - Richard did you get my email re the protest?

2008/6/5 Richard Clayton <richard@highwayman.com>:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


There is a newly arrived document on WikiLeaks (seems that crytome has
lost street cred now that Home Office use them!). It appears to be an
internal BT report assessing their 2006 trial of Phorm technology.

<URL:http://www.wikileaks.org/wiki/British_Telecom_Phorm_Page_Sense_Exte
rnal_Validation_report>

A key point to make is that this trial used slightly different
technology than the current Phorm system that I recently documented (it
apparently appended a JavaScript tag to web pages and redirected the
browser in such a way that the navigation bar in the browser "fluttered"
and tags ended up in some web postings).

It does seem to have been making use of cookies, but they were
apparently placed on people's systems in an "honest" manner prior to the
trial (viz: there was no forgery of other sites in order to trick the
browsers into accepting them).

An interesting sentence early on reads:

  Normally the PageSense system deploys cookies directly to user's
  machines. BT Broadband terms and conditions prevented this approach.

Looking at BT's current T&C's I find it hard to identify if they have
changed anything yet. The business conditions:

  http://www.btbroadbandoffice.com/broadband/terms_busi

don't seem changed in any relevant way from what I can locate on
www.archive.org for 2006.  The consumer T&C's are on the page

http://www.productsandservices.bt.com/consumerProducts/dynamicmodules/pa
gecontentfooter/pageContentFooterPopup.jsp?pagecontentfooter_popupid=134

08

(!) but seem to have been somewhere else prior to April 2007, so I
haven't managed to do a comparison to see if these are changed :(


Anyway --- back to the 2006 trial. The trial was secret, in that users
were experimented upon without their knowledge or consent (which is
generally felt to have been illegal [even with consent it is FIPR and
others view that is illegal -- without consent I can't see much doubt]).

Also, the trial involved the building of browsing histories and the
serving of ads on the basis of that history -- which seems to run
counter to earlier assurances by BT as to the nature of the trial:

http://www.theregister.co.uk/2008/03/17/bt_phorm_lies/

  "Absolutely no personally identifiable information was processed,
  stored or disclosed during this trial"

The "disclosed" has already been shown to be dubious (because of the way
that the technology worked at that time), although the dates don't match
well, it seems to be much the same technology:

http://www.badphorm.co.uk/e107_plugins/forum/forum_viewtopic.php?2676.20

[of course the identifiers in the cookies can be leaked in the current
system as well, which is one of the (many) objections to it].

We can now see from the internal document that "processed" is also false
(the system used the data in order to build browsing histories):

Which makes the only thing left intact from BT's statement is the lack
of "storage" (the Phorm system records a distilled down profile against
your personal identifier).... hmmmmm

There's much more in the document, but this is a long enough message
already, so I shall just note that the document contains the throw-away
line "communications regarding advertisement systems and information
collection could lead to negative perception if not carefully handled".

<URL:http://www.urbandictionary.com/define.php?term=no+shit+sherlock>
- --
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBSEfQh5oAxkTY1oPiEQLjEQCgjp/IjSz0jyqZCtveeH/J0gWkh9QAnilH
mmS6PUjmgRnarzY6ipl1XCA9
=de0C
-----END PGP SIGNATURE-----


------=_Part_921_6258560.1212668165965-- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 13:43:03 2008 From: ukcrypto at chiark.greenend.org.uk (Alexander Hanff) Date: Thu, 5 Jun 2008 13:43:03 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: References: Message-ID: <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> ------=_Part_1043_13407186.1212669783354 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Oh I almost forgot. With regards posting the full report to Wikileaks it was simply the first place I thought of. I got home with the loose pages in my hand having read them on the train and realised I needed to get them into the pubic domain as soon as possible given the amount of sabre rattling coming from Phorm's direction in recent weeks (I have heard multiple stories of attempts to have press items blocked from being published). So I scanned the pages and uploaded as quickly as I could. Alexander Hanff 2008/6/5 Richard Clayton : > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > There is a newly arrived document on WikiLeaks (seems that crytome has > lost street cred now that Home Office use them!). It appears to be an > internal BT report assessing their 2006 trial of Phorm technology. > > rnal_Validation_report> > > A key point to make is that this trial used slightly different > technology than the current Phorm system that I recently documented (it > apparently appended a JavaScript tag to web pages and redirected the > browser in such a way that the navigation bar in the browser "fluttered" > and tags ended up in some web postings). > > It does seem to have been making use of cookies, but they were > apparently placed on people's systems in an "honest" manner prior to the > trial (viz: there was no forgery of other sites in order to trick the > browsers into accepting them). > > An interesting sentence early on reads: > > Normally the PageSense system deploys cookies directly to user's > machines. BT Broadband terms and conditions prevented this approach. > > Looking at BT's current T&C's I find it hard to identify if they have > changed anything yet. The business conditions: > > http://www.btbroadbandoffice.com/broadband/terms_busi > > don't seem changed in any relevant way from what I can locate on > www.archive.org for 2006. The consumer T&C's are on the page > > http://www.productsandservices.bt.com/consumerProducts/dynamicmodules/pa > gecontentfooter/pageContentFooterPopup.jsp?pagecontentfooter_popupid=134 > 08 > > (!) but seem to have been somewhere else prior to April 2007, so I > haven't managed to do a comparison to see if these are changed :( > > > Anyway --- back to the 2006 trial. The trial was secret, in that users > were experimented upon without their knowledge or consent (which is > generally felt to have been illegal [even with consent it is FIPR and > others view that is illegal -- without consent I can't see much doubt]). > > Also, the trial involved the building of browsing histories and the > serving of ads on the basis of that history -- which seems to run > counter to earlier assurances by BT as to the nature of the trial: > > http://www.theregister.co.uk/2008/03/17/bt_phorm_lies/ > > "Absolutely no personally identifiable information was processed, > stored or disclosed during this trial" > > The "disclosed" has already been shown to be dubious (because of the way > that the technology worked at that time), although the dates don't match > well, it seems to be much the same technology: > > http://www.badphorm.co.uk/e107_plugins/forum/forum_viewtopic.php?2676.20 > > [of course the identifiers in the cookies can be leaked in the current > system as well, which is one of the (many) objections to it]. > > We can now see from the internal document that "processed" is also false > (the system used the data in order to build browsing histories): > > Which makes the only thing left intact from BT's statement is the lack > of "storage" (the Phorm system records a distilled down profile against > your personal identifier).... hmmmmm > > There's much more in the document, but this is a long enough message > already, so I shall just note that the document contains the throw-away > line "communications regarding advertisement systems and information > collection could lead to negative perception if not carefully handled". > > > - -- > richard Richard Clayton > > They that can give up essential liberty to obtain a little temporary > safety deserve neither liberty nor safety. Benjamin Franklin > > -----BEGIN PGP SIGNATURE----- > Version: PGPsdk version 1.7.1 > > iQA/AwUBSEfQh5oAxkTY1oPiEQLjEQCgjp/IjSz0jyqZCtveeH/J0gWkh9QAnilH > mmS6PUjmgRnarzY6ipl1XCA9 > =de0C > -----END PGP SIGNATURE----- > > ------=_Part_1043_13407186.1212669783354 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Oh I almost forgot.  With regards posting the full report to Wikileaks it was simply the first place I thought of.  I got home with the loose pages in my hand having read them on the train and realised I needed to get them into the pubic domain as soon as possible given the amount of sabre rattling coming from Phorm's direction in recent weeks (I have heard multiple stories of attempts to have press items blocked from being published).  So I scanned the pages and uploaded as quickly as I could.

Alexander Hanff

2008/6/5 Richard Clayton <richard@highwayman.com>:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


There is a newly arrived document on WikiLeaks (seems that crytome has
lost street cred now that Home Office use them!). It appears to be an
internal BT report assessing their 2006 trial of Phorm technology.

<URL:http://www.wikileaks.org/wiki/British_Telecom_Phorm_Page_Sense_Exte
rnal_Validation_report>

A key point to make is that this trial used slightly different
technology than the current Phorm system that I recently documented (it
apparently appended a JavaScript tag to web pages and redirected the
browser in such a way that the navigation bar in the browser "fluttered"
and tags ended up in some web postings).

It does seem to have been making use of cookies, but they were
apparently placed on people's systems in an "honest" manner prior to the
trial (viz: there was no forgery of other sites in order to trick the
browsers into accepting them).

An interesting sentence early on reads:

  Normally the PageSense system deploys cookies directly to user's
  machines. BT Broadband terms and conditions prevented this approach.

Looking at BT's current T&C's I find it hard to identify if they have
changed anything yet. The business conditions:

  http://www.btbroadbandoffice.com/broadband/terms_busi

don't seem changed in any relevant way from what I can locate on
www.archive.org for 2006.  The consumer T&C's are on the page

http://www.productsandservices.bt.com/consumerProducts/dynamicmodules/pa
gecontentfooter/pageContentFooterPopup.jsp?pagecontentfooter_popupid=134

08

(!) but seem to have been somewhere else prior to April 2007, so I
haven't managed to do a comparison to see if these are changed :(


Anyway --- back to the 2006 trial. The trial was secret, in that users
were experimented upon without their knowledge or consent (which is
generally felt to have been illegal [even with consent it is FIPR and
others view that is illegal -- without consent I can't see much doubt]).

Also, the trial involved the building of browsing histories and the
serving of ads on the basis of that history -- which seems to run
counter to earlier assurances by BT as to the nature of the trial:

http://www.theregister.co.uk/2008/03/17/bt_phorm_lies/

  "Absolutely no personally identifiable information was processed,
  stored or disclosed during this trial"

The "disclosed" has already been shown to be dubious (because of the way
that the technology worked at that time), although the dates don't match
well, it seems to be much the same technology:

http://www.badphorm.co.uk/e107_plugins/forum/forum_viewtopic.php?2676.20

[of course the identifiers in the cookies can be leaked in the current
system as well, which is one of the (many) objections to it].

We can now see from the internal document that "processed" is also false
(the system used the data in order to build browsing histories):

Which makes the only thing left intact from BT's statement is the lack
of "storage" (the Phorm system records a distilled down profile against
your personal identifier).... hmmmmm

There's much more in the document, but this is a long enough message
already, so I shall just note that the document contains the throw-away
line "communications regarding advertisement systems and information
collection could lead to negative perception if not carefully handled".

<URL:http://www.urbandictionary.com/define.php?term=no+shit+sherlock>
- --
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBSEfQh5oAxkTY1oPiEQLjEQCgjp/IjSz0jyqZCtveeH/J0gWkh9QAnilH
mmS6PUjmgRnarzY6ipl1XCA9
=de0C
-----END PGP SIGNATURE-----


------=_Part_1043_13407186.1212669783354-- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 14:02:52 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Thu, 05 Jun 2008 14:02:52 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: References: Message-ID: <4847F20C.6869.1F1CE7@davidh.spidacom.co.uk> On 5 Jun 2008 at 12:39, Richard Clayton wrote: > There is a newly arrived document on WikiLeaks (seems that crytome has > lost street cred now that Home Office use them!). It appears to be an > internal BT report assessing their 2006 trial of Phorm technology. I wonder if the Home Office was made aware of this before they were asked to write their discreditable little note. If they were not I wonder what steps the Home Office took to find out the history before writing their discreditable little note. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Thu Jun 5 14:08:36 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Thu, 05 Jun 2008 14:08:36 +0100 Subject: Telegraph article on RIP In-Reply-To: <97EObObc38RIFAG8@perry.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <97EObObc38RIFAG8@perry.co.uk> Message-ID: <4847F364.27859.245E7C@davidh.spidacom.co.uk> On 5 Jun 2008 at 12:28, Roland Perry wrote: > It's interesting that this article is more about RIPA to gain comms data > (mainly reverse DQ I expect, and I can't get too excited if the most > active council has done all of 89 requests in a year) Im don't believe that the council in Birmingham would have done any of this had they not been egged on by the numbskulls in the Home Office. > than previous ones > that have been about councils now required to use RIPA surveillance > rules when previously there were no rules at all. Ditto. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Thu Jun 5 14:31:32 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Thu, 5 Jun 2008 14:31:32 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> References: <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> Message-ID: On 05 Jun 08, at 1343, Alexander Hanff wrote: > Oh I almost forgot. With regards posting the full report to > Wikileaks it was simply the first place I thought of. I got home > with the loose pages in my hand having read them on the train and > realised I needed to get them into the pubic domain as soon as > possible Just playing devil's advocate for a moment, if we're going to list lengthy sets of legislation which BT may or may not have broken as part of the trial, do we want to try listing the legislation that posting someone else's copyright document might fall foul of? ian From ukcrypto at chiark.greenend.org.uk Thu Jun 5 14:38:09 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Thu, 5 Jun 2008 14:38:09 +0100 Subject: Telegraph article on RIP In-Reply-To: <4847F364.27859.245E7C@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <97EObObc38RIFAG8@perry.co.uk> <4847F364.27859.245E7C@davidh.spidacom.co.uk> Message-ID: <09916231-A8E9-4127-856B-7021A6AAA327@batten.eu.org> On 05 Jun 08, at 1408, David Hansen wrote: > On 5 Jun 2008 at 12:28, Roland Perry wrote: > >> It's interesting that this article is more about RIPA to gain comms >> data >> (mainly reverse DQ I expect, and I can't get too excited if the most >> active council has done all of 89 requests in a year) > > Im don't believe that the council in Birmingham would have done any of > this had they not been egged on by the numbskulls in the Home Office. Disagree. In the past, reverse DQ was done on a nod and a wink basis between what you would calls bods in councils / large companies / law enforcement / spooks and what you would call bods in BT / GPO. We have no idea if the current regime reflects a lesser or a greater number of such requests, simply because the previous regime generated no audit trail. Itemised bills, caller data: all these things were, again, just handed over with no controls. ian From ukcrypto at chiark.greenend.org.uk Thu Jun 5 14:38:12 2008 From: ukcrypto at chiark.greenend.org.uk (Alexander Hanff) Date: Thu, 5 Jun 2008 14:38:12 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: References: <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> Message-ID: <298c5f970806050638i1be2fe1fxc3ca2da1f97fd286@mail.gmail.com> ------=_Part_1284_9739558.1212673092378 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Well I never saw any copyright notice anywhere in the document (which yes I know doesn't mean it is not copyrighted). Secondly BT were aware this document was already "out there". But more importantly, it is a document of significant public interest and last I checked I am pretty sure Copyright doesn't apply to journalistic use of works (although I am happy to be told otherwise). Alexander Hanff 2008/6/5 Ian Batten : > > On 05 Jun 08, at 1343, Alexander Hanff wrote: > > Oh I almost forgot. With regards posting the full report to Wikileaks it >> was simply the first place I thought of. I got home with the loose pages in >> my hand having read them on the train and realised I needed to get them into >> the pubic domain as soon as possible >> > > Just playing devil's advocate for a moment, if we're going to list lengthy > sets of legislation which BT may or may not have broken as part of the > trial, do we want to try listing the legislation that posting someone else's > copyright document might fall foul of? > > ian > > > ------=_Part_1284_9739558.1212673092378 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Well I never saw any copyright notice anywhere in the document (which yes I know doesn't mean it is not copyrighted).  Secondly BT were aware this document was already "out there".  But more importantly, it is a document of significant public interest and last I checked I am pretty sure Copyright doesn't apply to journalistic use of works (although I am happy to be told otherwise).

Alexander Hanff

2008/6/5 Ian Batten <igb@batten.eu.org>:

On 05 Jun 08, at 1343, Alexander Hanff wrote:

Oh I almost forgot.  With regards posting the full report to Wikileaks it was simply the first place I thought of.  I got home with the loose pages in my hand having read them on the train and realised I needed to get them into the pubic domain as soon as possible

Just playing devil's advocate for a moment, if we're going to list lengthy sets of legislation which BT may or may not have broken as part of the trial, do we want to try listing the legislation that posting someone else's copyright document might fall foul of?

ian



------=_Part_1284_9739558.1212673092378-- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 15:06:05 2008 From: ukcrypto at chiark.greenend.org.uk (James Firth) Date: Thu, 5 Jun 2008 15:06:05 +0100 Subject: Telegraph article on RIP In-Reply-To: <09916231-A8E9-4127-856B-7021A6AAA327@batten.eu.org> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <97EObObc38RIFAG8@perry.co.uk> <4847F364.27859.245E7C@davidh.spidacom.co.uk> <09916231-A8E9-4127-856B-7021A6AAA327@batten.eu.org> Message-ID: <00fc01c8c715$4d2d6380$e57ea8c0@Jinja> Ian Batten wrote: > > Disagree. In the past, reverse DQ was done on a nod and a wink basis > between what you would calls bods in councils / large companies / law > enforcement / spooks and what you would call bods in BT / GPO. >From what I remember from around 1990 onwards reverse DQ, for listed numbers at least, was done using a widely-available hack and a version of the national telephone directory available on CD-ROM! From ukcrypto at chiark.greenend.org.uk Thu Jun 5 15:38:48 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Thu, 5 Jun 2008 15:38:48 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <298c5f970806050638i1be2fe1fxc3ca2da1f97fd286@mail.gmail.com> References: <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> <298c5f970806050638i1be2fe1fxc3ca2da1f97fd286@mail.gmail.com> Message-ID: <71D3024D-4909-4C6F-AA92-4A9121ADFA31@batten.eu.org> Bear in mind this is devil's advocacy, but it does strike me that if you're going to attack your opponent on the grounds of the copyright in your web traffic you need to be fairly clean yourself to avoid getting into the mire. On 05 Jun 08, at 1438, Alexander Hanff wrote: > Well I never saw any copyright notice anywhere in the document > (which yes I know doesn't mean it is not copyrighted). Correct: under the Berne Convention, to which the UK is a signatory, everything is born copyright. > Secondly BT were aware this document was already "out there". So what? That doesn't mean it's been published, and it doesn't mean that they've relinquished copyright. > But more importantly, it is a document of significant public > interest and last I checked I am pretty sure Copyright doesn't apply > to journalistic use of works (although I am happy to be told > otherwise). Not for posting the complete document. Try it: ``Today's big news is next week's launch of the latest volume of J K Rowling's Harry Potter series. As our readers will be fascinated to learn why there are already queues outside bookshops, we include a 600 page supplement containing the text everyone is trying buy, which we got from our mate at the printing house. Enjoy!'' Fair dealing exemptions require that the document actually is published (which the document in question probably isn't) and that you use reasonable excerpts sufficient for your critical work (which is hard to demonstrate at 100%). Sure, BT would be throwing petrol on smouldering ashes if they argued copyright in this. But as a tactic, using a document with to say the least a questionable copyright status as a stick to beat people we're accusing of playing fast and loose with copyright might not be the best move. ian From ukcrypto at chiark.greenend.org.uk Thu Jun 5 15:42:00 2008 From: ukcrypto at chiark.greenend.org.uk (Roland Perry) Date: Thu, 5 Jun 2008 15:42:00 +0100 Subject: Telegraph article on RIP In-Reply-To: <4847D56C.6010003@callnetuk.com> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> <97EObObc38RIFAG8@perry.co.uk> <4847D56C.6010003@callnetuk.com> Message-ID: <$1tuIou4s$RIFAXf@perry.co.uk> In article <4847D56C.6010003@callnetuk.com>, PeteM writes >For heavens' sake, Roland. How many times do you have to be reminded >that DPA gave *no* powers to *anybody* to require telcos or ISPs to >hand over communications data? I never said that DPA did. But maintaining the balance of power between threats of court orders, or release under DPA was not, in my view, in the public interest. >> (and often somewhat imagined "legacy powers" under a host of earlier >> legislation). > >In most cases, *totally* imaginary legacy powers. I'm afraid you are mistaken there. CSPs who frequently got these requests had lists of at least a dozen commonly used legacy powers (for staff training purposes). -- Roland Perry From ukcrypto at chiark.greenend.org.uk Thu Jun 5 15:49:33 2008 From: ukcrypto at chiark.greenend.org.uk (Roland Perry) Date: Thu, 5 Jun 2008 15:49:33 +0100 Subject: Telegraph article on RIP In-Reply-To: <4847F364.27859.245E7C@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> <97EObObc38RIFAG8@perry.co.uk> <4847F364.27859.245E7C@davidh.spidacom.co.uk> Message-ID: <9lMuccv9z$RIFA3H@perry.co.uk> In article <4847F364.27859.245E7C@davidh.spidacom.co.uk>, David Hansen writes >> It's interesting that this article is more about RIPA to gain comms data >> (mainly reverse DQ I expect, and I can't get too excited if the most >> active council has done all of 89 requests in a year) > >Im don't believe that the council in Birmingham would have done any of >this had they not been egged on by the numbskulls in the Home Office. And I don't believe they didn't. In fact there was so much comms data being requested by council trading standards departments that they set up a special central unit to manage it. That unit was a casualty of RIPA because the rules say you have to make requests yourself, and not through a third party (this is in order to make tests of proportionality more immediate to the requester, and to reduce the number of people with access to the results). >> than previous ones >> that have been about councils now required to use RIPA surveillance >> rules when previously there were no rules at all. > >Ditto. As no-one was keeping records pre-RIPA, it's hard to prove. But I doubt the various enforcement branches in the councils were so ineffective that they never went out into the field to observe the alleged perpetrators. -- Roland Perry From ukcrypto at chiark.greenend.org.uk Thu Jun 5 16:15:14 2008 From: ukcrypto at chiark.greenend.org.uk (Chris Edwards) Date: Thu, 5 Jun 2008 16:15:14 +0100 (BST) Subject: BT 2006 trials of Phorm In-Reply-To: <298c5f970806050516u3d44b474uc48735cc8242452c@mail.gmail.com> References: <298c5f970806050516u3d44b474uc48735cc8242452c@mail.gmail.com> Message-ID: On Thu, 5 Jun 2008, Alexander Hanff wrote: | But in seriousness the proxy based model they were using in 2006, in my | mind actually damns them even further. Why ? Many ISPs operate (or used to operate) web proxies. I guess the legality or otherwise may depend on the purpose... From ukcrypto at chiark.greenend.org.uk Thu Jun 5 16:34:14 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Thu, 05 Jun 2008 16:34:14 +0100 Subject: Telegraph article on RIP In-Reply-To: <$1tuIou4s$RIFAXf@perry.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <4847D56C.6010003@callnetuk.com>, <$1tuIou4s$RIFAXf@perry.co.uk> Message-ID: <48481586.26231.A9B484@davidh.spidacom.co.uk> On 5 Jun 2008 at 15:42, Roland Perry wrote: > I never said that DPA did. But maintaining the balance of power between > threats of court orders, or release under DPA was not, in my view, in > the public interest. Who said anything about keeping things as they were? > I'm afraid you are mistaken there. CSPs who frequently got these > requests had lists of at least a dozen commonly used legacy powers (for > staff training purposes). And the number of these "legacy" "powers" which have been exterminated is? -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Thu Jun 5 16:36:53 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Thu, 05 Jun 2008 16:36:53 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> References: , <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> Message-ID: <48481625.22806.AC2239@davidh.spidacom.co.uk> On 5 Jun 2008 at 13:43, Alexander Hanff wrote: > I got home with the loose pages in > my hand having read them on the train and realised I needed to get them into > the pubic domain as soon as possible given the amount of sabre rattling > coming from Phorm's direction in recent weeks (I have heard multiple stories > of attempts to have press items blocked from being published). So I scanned > the pages and uploaded as quickly as I could. Well done. It was the right thing to do. I can see why the criminals involved in this would be keen to suppress information about their crimes. It is in the public interest to expose these crimes and the criminals who carried them out. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Thu Jun 5 14:58:36 2008 From: ukcrypto at chiark.greenend.org.uk (Burkitt-Gray, Alan (UK)) Date: Thu, 5 Jun 2008 14:58:36 +0100 Subject: BT 2006 trials of Phorm References: <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> <298c5f970806050638i1be2fe1fxc3ca2da1f97fd286@mail.gmail.com> Message-ID: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> This is a multi-part message in MIME format. ------_=_NextPart_001_01C8C714.40B34E03 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable "Copyright doesn't apply to journalistic use of works (although I am happy to be told otherwise)," said Alexander Hanff. =20 Oh yes it does.=20 =20 The rule is called "fair dealing" or "fair use".=20 =20 Academics, students, critics, journalists and others can include selective quotes to illustrate their arguments. I don't think there is any rule about what percentage of the original copyright work can be quoted under this rule, but the guideline is that it's probably around 5%. And that depends on the length of the work and the way it's quoted (so you couldn't quote the whole of one chapter of a 20-chapter book, for example). =20 Quoting 100% is definitely a breach of copyright.=20 =20 =20 =20 -- Alan Burkitt-Gray, Editor, Global Telecoms Business www.globaltelecomsbusiness.com DISCLAIMER: The information in this email is confidential. The contents = may not be disclosed or used by anyone other than the addressee. If you = are not the intended recipient(s), any use, disclosure, copying, = distribution or any action taken or omitted to be taken in reliance on = it is prohibited and may be unlawful. If you have received this = communication in error please notify us by e-mail or by telephone on +44 = (0) 20 7779 8888 and then delete the e-mail and all attachments and any = copies thereof.=20 Euromoney Institutional Investor PLC (its subsidiaries and associates) = cannot accept responsibility for the accuracy or completeness of this = email as it has been transmitted over a public network. If you suspect = that the email may have been intercepted or amended, please call the = sender. Any views expressed by an individual in this email do not = necessarily reflect views of Euromoney Institutional Investor PLC (its = subsidiaries and associates). This communication is from Euromoney = Institutional Investor PLC, a company registered in England and Wales = under company number 954730 with registered office at Nestor House, = Playhouse Yard, London ------_=_NextPart_001_01C8C714.40B34E03 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
"Copyright doesn't apply to journalistic use of works (although = I am=20 happy to be told otherwise)," said Alexander Hanff.
 
Oh = yes it does.=20
 
The = rule is called=20 "fair dealing" or "fair use".
 
Academics,=20 students, critics, journalists and others can include selective quotes = to=20 illustrate their arguments. I don't think there is any rule about what=20 percentage of the original copyright work can be quoted under this rule, = but the=20 guideline is that it's probably around 5%. And that depends on the = length of the=20 work and the way it's quoted (so you couldn't quote the whole of one = chapter of=20 a 20-chapter book, for example).
 
Quoting 100% is=20 definitely a breach of copyright.
 
 

 

--
Alan=20 Burkitt-Gray, Editor, Global Telecoms Business
www.globaltelecomsbusiness.com

DISCLAIMER: The information in this email is = confidential. The contents may not be disclosed or used by anyone other = than the addressee. If you are not the intended recipient(s), any use, = disclosure, copying, distribution or any action taken or omitted to be = taken in reliance on it is prohibited and may be unlawful. If you have = received this communication in error please notify us by e-mail or by = telephone on +44 (0) 20 7779 8888 and then delete the e-mail and all = attachments and any copies thereof.=20 Euromoney Institutional Investor PLC (its subsidiaries and associates) = cannot accept responsibility for the accuracy or completeness of this = email as it has been transmitted over a public network. If you suspect = that the email may have been intercepted or amended, please call the = sender. Any views expressed by an individual in this email do not = necessarily reflect views of Euromoney Institutional Investor PLC (its = subsidiaries and associates). This communication is from Euromoney = Institutional Investor PLC, a company registered in England and Wales = under company number 954730 with registered office at Nestor House, = Playhouse Yard, London ------_=_NextPart_001_01C8C714.40B34E03-- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 20:14:15 2008 From: ukcrypto at chiark.greenend.org.uk (Roland Perry) Date: Thu, 5 Jun 2008 20:14:15 +0100 Subject: Telegraph article on RIP In-Reply-To: <48481586.26231.A9B484@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> <4847D56C.6010003@callnetuk.com> <$1tuIou4s$RIFAXf@perry.co.uk> <48481586.26231.A9B484@davidh.spidacom.co.uk> Message-ID: In article <48481586.26231.A9B484@davidh.spidacom.co.uk>, David Hansen writes >On 5 Jun 2008 at 15:42, Roland Perry wrote: > >> I never said that DPA did. But maintaining the balance of power between >> threats of court orders, or release under DPA was not, in my view, in >> the public interest. > >Who said anything about keeping things as they were? The change that was introduced was RIPA Pt1 Ch2. - and later very similar powers in the Social Security Fraud Act, see insertion (2E). We all know it's not to your liking. >> I'm afraid you are mistaken there. CSPs who frequently got these >> requests had lists of at least a dozen commonly used legacy powers (for >> staff training purposes). > >And the number of these "legacy" "powers" which have been exterminated >is? The RIPA regime has removed the possibility of them being used for acquiring telecoms data, but they still persist for all other kinds of enquiry to which they can validly be applied, which might include such things as powers to get copies of your water bill; whatever might assist the investigators with the power. To give you some examples which I'm sure would apply to most of the legacy powers (but are probably not listed in them as assiduously) I quote below the laundry list in the SSFA: (a) any bank; (b) any person carrying on a business the whole or a significant part of which consists in the provision of credit (whether secured or unsecured) to members of the public; (c) any insurance company (within the meaning of the Insurance Companies Act 1982 (c. 50)); (d) any credit reference agency (within the meaning given by section 145(8) of the Consumer Credit Act 1974 (c. 39)); (e) any body the principal activity of which is to facilitate the exchange of information for the purpose of preventing or detecting fraud; (f) any person carrying on a business the whole or a significant part of which consists in the provision to members of the public of a service for transferring money from place to place; (g) any water undertaker or sewerage undertaker, any water and sewerage authority constituted under section 62 of the Local Government etc. (Scotland) Act 1994 (c. 39) or any authority which is a collecting authority for the purposes of section 79 of that Act; (h) any person who (within the meaning the Gas Act 1986 (c. 44)) supplies gas conveyed through pipes; (i) any person who (within the meaning of the Electricity Act 1989 (c. 29)) supplies electricity conveyed by distribution systems; (j) any person who provides a telecommunications service; (k) any person conducting any educational establishment or institution; (l) any body the principal activity of which is to provide services in connection with admissions to educational establishments or institutions; (m) the Student Loans Company; (n) any servant or agent of any person mentioned in any of the preceding paragraphs. -- Roland Perry From ukcrypto at chiark.greenend.org.uk Thu Jun 5 16:57:56 2008 From: ukcrypto at chiark.greenend.org.uk (Richard Lamont) Date: Thu, 05 Jun 2008 16:57:56 +0100 Subject: Telegraph article on RIP In-Reply-To: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> Message-ID: <48480D04.2080609@lamont.me.uk> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 David Hansen wrote: > It appears that Telegraph readers are slowly waking up to Home Office > plans to put us all in an open prison. About time too, though whether > they do more than whine remains to be seen. This story was also the front-page lead in today's Daily Mail. http://www.dailymail.co.uk/news/article-1024162/Council-snoopers-use-terror-powers-scour-peoples-phone-records----uncover-bogus-faith-healers-dog-smugglers.html - -- Richard Lamont http://www.lamont.me.uk/ OpenPGP Key ID: 0xBD89BE41 Fingerprint: CE78 C285 1F97 0BDA 886D BA78 26D8 6C34 BD89 BE41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFISAz8JthsNL2JvkERAnrqAJ4gXPB+RjAkZ7xTr7QpNMmahoddLQCeOFYC 0c77XB8t8v5R1cQUg1HDd0M= =5Spj -----END PGP SIGNATURE----- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 22:09:48 2008 From: ukcrypto at chiark.greenend.org.uk (Alexander Hanff) Date: Thu, 5 Jun 2008 22:09:48 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> References: <298c5f970806050543v16e5f0dt6586a47ab1427439@mail.gmail.com> <298c5f970806050638i1be2fe1fxc3ca2da1f97fd286@mail.gmail.com> <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> Message-ID: <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> ------=_Part_2651_17289894.1212700188083 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline If we were all to back off every time a company, or government or any other institutional organisation printed documents which indicate massive breaches of law on a scale which staggers most people, because of a fear of copyright, then the current world would be even darker than it is. I stand by my decision to scan the document and upload it to Wikileaks, it was of significant interest to the public and might help people to come forward as witnesses for a criminal investigation. I also take sole responsibility for the scanning and uploading of the document and if there is any action against me as a result, so be it, I will take it on the chin. Alexander Hanff 2008/6/5 Burkitt-Gray, Alan (UK) : > "Copyright doesn't apply to journalistic use of works (although I am > happy to be told otherwise)," said Alexander Hanff. > > Oh yes it does. > > The rule is called "fair dealing" or "fair use". > > Academics, students, critics, journalists and others can include selective > quotes to illustrate their arguments. I don't think there is any rule about > what percentage of the original copyright work can be quoted under this > rule, but the guideline is that it's probably around 5%. And that depends on > the length of the work and the way it's quoted (so you couldn't quote the > whole of one chapter of a 20-chapter book, for example). > > Quoting 100% is definitely a breach of copyright. > > > > > > -- > Alan Burkitt-Gray, Editor, Global Telecoms Business > *www.globaltelecomsbusiness.com* > > DISCLAIMER: The information in this email is confidential. The contents may > not be disclosed or used by anyone other than the addressee. If you are not > the intended recipient(s), any use, disclosure, copying, distribution or any > action taken or omitted to be taken in reliance on it is prohibited and may > be unlawful. If you have received this communication in error please notify > us by e-mail or by telephone on +44 (0) 20 7779 8888 and then delete the > e-mail and all attachments and any copies thereof. Euromoney Institutional > Investor PLC (its subsidiaries and associates) cannot accept responsibility > for the accuracy or completeness of this email as it has been transmitted > over a public network. If you suspect that the email may have been > intercepted or amended, please call the sender. Any views expressed by an > individual in this email do not necessarily reflect views of Euromoney > Institutional Investor PLC (its subsidiaries and associates). This > communication is from Euromoney Institutional Investor PLC, a company > registered in England and Wales under company number 954730 with registered > office at Nestor House, Playhouse Yard, London > ------=_Part_2651_17289894.1212700188083 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline If we were all to back off every time a company, or government or any other institutional organisation printed documents which indicate massive breaches of law on a scale which staggers most people, because of a fear of copyright, then the current world would be even darker than it is.

I stand by my decision to scan the document and upload it to Wikileaks, it was of significant interest to the public and might help people to come forward as witnesses for a criminal investigation.  I also take sole responsibility for the scanning and uploading of the document and if there is any action against me as a result, so be it, I will take it on the chin.

Alexander Hanff

2008/6/5 Burkitt-Gray, Alan (UK) <ABurkitt@euromoneyplc.com>:
"Copyright doesn't apply to journalistic use of works (although I am happy to be told otherwise)," said Alexander Hanff.
 
Oh yes it does.
 
The rule is called "fair dealing" or "fair use".
 
Academics, students, critics, journalists and others can include selective quotes to illustrate their arguments. I don't think there is any rule about what percentage of the original copyright work can be quoted under this rule, but the guideline is that it's probably around 5%. And that depends on the length of the work and the way it's quoted (so you couldn't quote the whole of one chapter of a 20-chapter book, for example).
 
Quoting 100% is definitely a breach of copyright.
 
 

 

--
Alan Burkitt-Gray, Editor, Global Telecoms Business
www.globaltelecomsbusiness.com

DISCLAIMER: The information in this email is confidential. The contents may not be disclosed or used by anyone other than the addressee. If you are not the intended recipient(s), any use, disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you have received this communication in error please notify us by e-mail or by telephone on +44 (0) 20 7779 8888 and then delete the e-mail and all attachments and any copies thereof. Euromoney Institutional Investor PLC (its subsidiaries and associates) cannot accept responsibility for the accuracy or completeness of this email as it has been transmitted over a public network. If you suspect that the email may have been intercepted or amended, please call the sender. Any views expressed by an individual in this email do not necessarily reflect views of Euromoney Institutional Investor PLC (its subsidiaries and associates). This communication is from Euromoney Institutional Investor PLC, a company registered in England and Wales under company number 954730 with registered office at Nestor House, Playhouse Yard, London

------=_Part_2651_17289894.1212700188083-- From ukcrypto at chiark.greenend.org.uk Thu Jun 5 23:37:54 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Mason) Date: Thu, 5 Jun 2008 23:37:54 +0100 Subject: Telegraph article on RIP In-Reply-To: <09916231-A8E9-4127-856B-7021A6AAA327@batten.eu.org> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <97EObObc38RIFAG8@perry.co.uk> <4847F364.27859.245E7C@davidh.spidacom.co.uk> <09916231-A8E9-4127-856B-7021A6AAA327@batten.eu.org> Message-ID: <24823417-E1F0-4641-8905-A9B6F528918D@sourcetagged.ian.co.uk> On 5 Jun 2008, at 14:38, Ian Batten wrote: > In the past, reverse DQ was done on a nod and a wink basis between > what you would calls bods in councils / large companies / law > enforcement / spooks and what you would call bods in BT / GPO. I personally witnessed a terminal in a police station incident room (right next to the PNC terminal) that had direct access to BT's full DQ listings in use circa 1987. No requirement to prove or record any basis for a query, just walk up and use it. Another terminal gave direct access to a central database of all electoral roll listings on the same basis. This was a main police station for a town, but not a force headquarters; I can't comment whether this was available at smaller stations. Ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 08:48:00 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Fri, 06 Jun 2008 08:48:00 +0100 Subject: Telegraph article on RIP In-Reply-To: <24823417-E1F0-4641-8905-A9B6F528918D@sourcetagged.ian.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <09916231-A8E9-4127-856B-7021A6AAA327@batten.eu.org>, <24823417-E1F0-4641-8905-A9B6F528918D@sourcetagged.ian.co.uk> Message-ID: <4848F9C0.22367.432AB3@davidh.spidacom.co.uk> On 5 Jun 2008 at 23:37, Ian Mason wrote: > I personally witnessed a terminal in a police station incident room > (right next to the PNC terminal) that had direct access to BT's full > DQ listings in use circa 1987. No requirement to prove or record any > basis for a query, just walk up and use it. Another terminal gave > direct access to a central database of all electoral roll listings on > the same basis. This was a main police station for a town, but not a > force headquarters; I can't comment whether this was available at > smaller stations. So far nobody has come up with councils doing this sort of thing. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Fri Jun 6 08:52:46 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Fri, 06 Jun 2008 08:52:46 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> References: , <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root>, <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> Message-ID: <4848FADE.21036.478999@davidh.spidacom.co.uk> On 5 Jun 2008 at 22:09, Alexander Hanff wrote: > If we were all to back off every time a company, or government or any other > institutional organisation printed documents which indicate massive breaches > of law on a scale which staggers most people, because of a fear of > copyright, then the current world would be even darker than it is. Precisely. Making it available to those outside the tents was the right thing to do, though saying so on a public mailing list brings extra dangers. If the criminals involved in this case do try and take action then the only way to fight them, due to the unfair legal system, is to be poor. That is why the McLibel two were able to take on the criminalcorporation, while their fellows who had also distributed the leaflet had to get on bended knee to the criminals. Different law, but equally biased against the free flow of information and ideas. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Fri Jun 6 08:54:56 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Fri, 06 Jun 2008 08:54:56 +0100 Subject: Telegraph article on RIP In-Reply-To: <48480D04.2080609@lamont.me.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <48480D04.2080609@lamont.me.uk> Message-ID: <4848FB60.27646.498394@davidh.spidacom.co.uk> On 5 Jun 2008 at 16:57, Richard Lamont wrote: > This story was also the front-page lead in today's Daily Mail. > > http://www.dailymail.co.uk/news/article-1024162/Council-snoopers-use-terror-powers-scour-peoples-phone-records----uncover-bogus-faith-healers-dog-smugglers.html I'm glad to hear it. While I dislike the Daily Wail it does have some influence and if the dear leader can be persuaded todo something about the RIP disaster by the Daily Wail I will be pleased. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Fri Jun 6 10:13:49 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 10:13:49 +0100 Subject: Telegraph article on RIP In-Reply-To: <4848F9C0.22367.432AB3@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <09916231-A8E9-4127-856B-7021A6AAA327@batten.eu.org>, <24823417-E1F0-4641-8905-A9B6F528918D@sourcetagged.ian.co.uk> <4848F9C0.22367.432AB3@davidh.spidacom.co.uk> Message-ID: <697DD8A0-A059-493E-9AA8-D7707A1A1D61@batten.eu.org> On 06 Jun 08, at 0848, David Hansen wrote: > On 5 Jun 2008 at 23:37, Ian Mason wrote: > >> I personally witnessed a terminal in a police station incident room >> (right next to the PNC terminal) that had direct access to BT's full >> DQ listings in use circa 1987. > > So far nobody has come up with councils doing this sort of thing. How do you think trading standards operated before RIPA? ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 10:50:57 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 10:50:57 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <4848FADE.21036.478999@davidh.spidacom.co.uk> References: , <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root>, <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> Message-ID: > > > That is why the McLibel two were able to take on Actually (and I've made my point at greater length to Alex in the proverbial private communication) I draw the opposite moral. I have nothing but the highest regard for Steel and Morris, I think they are not merely profoundly honest but also brave, and come over in the documentaries as also being rather nice people. But the `victory' is rather pyrrhic: McDonalds are still in every street, their employment and sourcing practices are precisely the same, Dave and Helen have lost ten years of their life and anyone else planning a campaign against a major corporation now has a brutal demonstration of how tough it would be. McDonalds may have lost in court, but I'd say they won in a larger sense: they've thrown a blanket of chilling effect over criticism of their business. The problem with the McLibel case, and I think the Phorm issue is running a similar risk, was two-fold. There comes a point, quite quickly, where the issue ceases to be about the company and becomes about the bravery, honesty and self-image of the critics. The narrative stops being ``look what this horrible company is doing to its staff, customers and the country'' and turns into ``look what this horrible company is doing to its critics, but I won't back down because I am brave and honest, unlike the faceless bureaucrats of my opponents''. At which point the battle is, to be honest, lost and the company can just sit back and rub its hands with glee. A lot of people have heard of the McLibel two, and (like me) admire their bravery. How many of them know the first things about the criticisms that were being made of McDonalds? Result for McDonalds: they can handle being seen as a bit heavy-handed over protest, because no one rational believes that companies like that are running nursery schools with flowery wallpaper. What they can't handle is being accused of selling dangerous food and exploiting their staff: customers are much less tolerant of that. Being accused of doing something most people think most businesses do (sniping at critics) is relatively safe; being accused of doing something most people think is the antithesis of your image (selling dangerous products) is really bad. If Phorm/BT can turn this into a debate about the critics, and not about what is being criticised, they win. A bunch of IT geeks cuts a similar figure to some vegan environmental protesters: amiable eccentrics, who the man in the street doesn't really listen to. And secondly, at risk of sounding like I've read more Gramsci than is good for me, there's a confusion between `war of position' and `war of manoeuvre'. If you read Cableforum or the BT Beta Forums or, worse, the comments pages on various blogs on the topic, it's filled with people who want the debate to happen at Web Speed. Documents are made available, and within the hour there is endless speculation based on speed-reading, accusations of bad faith, demands for retraction, etc. Nature abhors a vacuum, and more and more people pile in, making more and more lurid accusations based on mis-readings of things that are already based on mis-readings (and yes, before anyone says it, I personally have a long and ignoble track record of doing just this: consider this the lecture made from self-knowledge, not the lecture made from virtue). What people seem to want is to provoke a reaction, to justify their protest to themselves by showing that they're ``getting through'' to the object of their criticism. I know that's the psychology of my days of ranting on Usenet: they may hate me and mail wild flames to me, but at least they are noticing me. I can see myself doing it, and I don't like myself for it, but there it is... Meanwhile, all Phorm/BT have to do is sit back, say nothing that will look unreasonable later, and hope that Intel release a processor with a minor arithmetic flaw or Apple release a version of iTunes with some dubious DRM extension or Microsoft say something unwise to the OOXML standards process. The corollary of the process I'm describing is that people lose interest if they're not getting a rise out of The Man, and move on to the next flash-mob issue. Legal processes don't move at Web 2.0 Speed. Assuming you can make accusations on Monday, and if the people haven't been clapped in irons by Tuesday you need to make some more accusations, will rapidly escalate into you looking unreasonable. All your opponent needs to do is nothing, and wait for you to make a mistake. I'm sorry, but I think we're rapidly heading into that territory. If we want to fight to a glorious defeat, in which people show their bravery and commitment and personal self-sacrifice, and then gather in pubs every year for the next fifteen to tell war stories, recount tales of derring-do and remember the good old days, then fine: wild accusations are the way to go. It `worked' for the McLibel duo: everyone admires them, but McDonalds are in precisely the same position they were before [*]. It `worked' for CND: everyone knows about the Aldermaston marches, but forty-five years later the white train is still rolling. But if we want a victory in which a pragmatic campaign is ground out, resulting in a regulatory framework which protects our interests and prevents this encroachment on our privacy, the route is not the one that's being embarked on. It's a route of dealing rationally with regulators, industry bodies, consumer groups, journalists and so on. At the moment, we're heading for a glorious, meet in pubs and reminisce, defeat. Sorry for being so negative. ian [*] Yes, they're not quite the market presence they were twenty years ago. I ascribe that to changing fashions, not campaigns: Pizzaland and Spud'u'Like have gone, too. From ukcrypto at chiark.greenend.org.uk Fri Jun 6 12:51:29 2008 From: ukcrypto at chiark.greenend.org.uk (Richard Clayton) Date: Fri, 6 Jun 2008 12:51:29 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In article , Ian Batten writes >If Phorm/BT can turn this into a debate about the critics, and not >about what is being criticised, they win. They have already tried this tactic, by pointing out that FIPR had criticised the RIP Bill when it was going through Parliament, and so it was somehow wrong of FIPR to point out that their system would cause the ISPs to commit s1 offences... ... unfortunately, they don't seem to have understood that RIP comes in many Parts (nay Chapters) and that FIPR did _not_ campaign to keep the IOCA definition of interception (IOCA 85 has a definition of interception that makes it lawful if just one end gives permission, not both ends as in s3(1)). FIPRs main issues related to who signed warrants, what the oversight was, the definitions of comms data, and of course pretty much all of Part III. So Phorm just looked silly, and they seem to have moved on. > A bunch of IT geeks cuts a >similar figure to some vegan environmental protesters: amiable >eccentrics, who the man in the street doesn't really listen to. I think that people generally "get" the idea that BT were snooping on their browsing without telling them that they were listening in; Rather like the greengrocer suddenly having a special offer on carrots because the village postmistress, doubling as the switchboard operator, heard you nattering on the phone yesterday about how you might make a stew for hubbie this evening... ... you don't have to be a geek to understand the basics here! >But if we want a victory in which a pragmatic campaign is ground out, >resulting in a regulatory framework which protects our interests and >prevents this encroachment on our privacy, the route is not the one >that's being embarked on. It's a route of dealing rationally with >regulators, industry bodies, consumer groups, journalists and so on. I'd like to think that's the route that FIPR is taking :-) Look for various upcoming articles to move the debate along ! - -- richard Richard Clayton They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. Benjamin Franklin -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBSEkkwZoAxkTY1oPiEQJ5CACfT7Y5pPuVBT0/llo2/a5lzgSr9T0AoK1a +aOpWyX4IbWa2ip3JJqoIXxP =EPFE -----END PGP SIGNATURE----- From ukcrypto at chiark.greenend.org.uk Fri Jun 6 13:45:08 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Fri, 06 Jun 2008 13:45:08 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: References: , <4848FADE.21036.478999@davidh.spidacom.co.uk>, Message-ID: <48493F64.10946.15336AF@davidh.spidacom.co.uk> On 6 Jun 2008 at 10:50, Ian Batten wrote: > But the `victory' is rather pyrrhic: McDonalds are still in every > street, their employment and sourcing practices are precisely the > same, They claim otherwise. > McDonalds may have lost in court, Officially they won. The dice are so heavily loaded in favour of those with deep pockets, to the extent of the victims having to prove every one of the claims in the leaflet was correct beyond reasonable doubt. They were unable to prove all the points, not the least because of all the obstacles put in their way by the courts. They thus lost the case and the Hutton said that they must pay £60,000 damages to the criminals (he didn't quite use those words:-) In the real world McDonald's lost. They tried to prevent the "offending" leaflet being handed out. Not only did they fail to do that, one can read the "offending"leaflet at and its successor leaflets are still handed out today, for example the ones one may download from . I see people leafletting outside their "restaurants" from time to time and I doubt if anyone in the organisation would again try and stop such criticisms being made. What big business and their pals in the Labour Party have tried is getting the police to oppress anyone who disagrees with the dear leader's desire to spread big business everywhere. In a way this is good, oppressing the British just makes them more stubborn and less likely to worship the dear leader. At the moment this strategy is particularly being tried on animal rights people, recorded in , using the same "economic well being" bullshit we see in RIP. Once one disentangles the animal rights hyperbole a clear example of collusion between the state and big business interests emerges. I can't think of a better way of ensuring the animal rights bods eventually win. However, the police do try these things out on others, for example . Having spoken to people who went to the same school as one of those victims, a year or two before her, I have no doubt that the only people who should be in court over this are the police officers (and Fiscal rascals of they continue with the case). > There comes a point, quite quickly, where the issue ceases to be about > the company and becomes about the bravery, honesty and self-image of > the critics. Some of the mass media may prefer to adopt this approach and some may be misled by this into not dealing with the actual issues. Fools will always be with us. > A lot of people have heard of the McLibel two, and (like me) admire > their bravery. How many of them know the first things about the > criticisms that were being made of McDonalds? Most people are not going to take the time to find out the details. However, I don't think it follows from that they will think in the way you indicated. They can look up the facts if they want to. > If Phorm/BT can turn this into a debate about the critics, and not > about what is being criticised, they win. That is certainly a tactic they may/have tried. It is certainly something to be challenged if they try. > Meanwhile, all Phorm/BT have to do is sit back, say nothing that will > look unreasonable later, and hope that Intel release a processor with > a minor arithmetic flaw or Apple release a version of iTunes with some > dubious DRM extension or Microsoft say something unwise to the OOXML > standards process. The corollary of the process I'm describing is > that people lose interest if they're not getting a rise out of The > Man, and move on to the next flash-mob issue. Some people lose interest. Others do not. Always been the case, always will. However, campaigns are not always about numbers. > But if we want a victory in which a pragmatic campaign is ground out, > resulting in a regulatory framework which protects our interests and > prevents this encroachment on our privacy, the route is not the one > that's being embarked on. It's a route of dealing rationally with > regulators, industry bodies, consumer groups, journalists and so on. > At the moment, we're heading for a glorious, meet in pubs and > reminisce, defeat. Some people will shout loudly about the issue, others inform the public, others prod the regulators and so on. All three are important. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Fri Jun 6 13:54:01 2008 From: ukcrypto at chiark.greenend.org.uk (David Hansen) Date: Fri, 06 Jun 2008 13:54:01 +0100 Subject: Telegraph article on RIP In-Reply-To: <697DD8A0-A059-493E-9AA8-D7707A1A1D61@batten.eu.org> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <4848F9C0.22367.432AB3@davidh.spidacom.co.uk>, <697DD8A0-A059-493E-9AA8-D7707A1A1D61@batten.eu.org> Message-ID: <48494179.21644.15B5A2E@davidh.spidacom.co.uk> On 6 Jun 2008 at 10:13, Ian Batten wrote: > >> I personally witnessed a terminal in a police station incident room > >> (right next to the PNC terminal) that had direct access to BT's full > >> DQ listings in use circa 1987. > > > > So far nobody has come up with councils doing this sort of thing. > > How do you think trading standards operated before RIPA? Presumably they asked British Uselesscom, providing them with enough information to justify release of the information. Or are you telling me that British Uselesscom provided terminals in all/some council offices for officials to look this information up on a whim. Did council officials ever stalk families and make detailed notes on children (notes which are probably illegal under all sorts of "child protection" laws and would probably land someone outside the tent in prison)? I doubt it. I suspect they only started to do this when encouraged by the Home Office as part of its open prison/East Germany approach to ensuring us plebs don't have any independence of thought or action. -- David Hansen, Edinburgh I will *always* explain revoked encryption keys, unless RIP prevents me http://www.opsi.gov.uk/acts/acts2000/00023--e.htm#54 From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:08:01 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 14:08:01 +0100 Subject: Telegraph article on RIP In-Reply-To: <48494179.21644.15B5A2E@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <4848F9C0.22367.432AB3@davidh.spidacom.co.uk>, <697DD8A0-A059-493E-9AA8-D7707A1A1D61@batten.eu.org> <48494179.21644.15B5A2E@davidh.spidacom.co.uk> Message-ID: On 06 Jun 08, at 1354, David Hansen wrote: >> >> How do you think trading standards operated before RIPA? > > Presumably they asked British Uselesscom, providing them with enough > information to justify release of the information. Precisely. But that process was informal, unaudited and we have no way of knowing if it was used once a minute or once a year. > Did council officials ever stalk families and make detailed notes on > children (notes which are probably illegal under all sorts of "child > protection" laws and would probably land someone outside the tent in > prison)? I doubt it. But you have absolutely no way to know one way or the other. There would have been no regulatory framework. I'm aware locally of several admissions disputes of the late 90s in which precisely which house from several the child was living in: who knows by what mechanism they were ultimately resolved? Which is better: a translucent (I won't go so far as to say transparent) process, or one which is entirely opaque. You claim that the translucent process has increased the incidence over the opaque: I don't see how anyone can know that, and even if they do, it's not entirely obvious that 2X auditable events are worse than 1X secret ones. ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:14:50 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 14:14:50 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> Message-ID: <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> On 06 Jun 08, at 1251, Richard Clayton wrote: > > Rather like the greengrocer suddenly having a special offer on carrots > because the village postmistress, doubling as the switchboard > operator, > heard you nattering on the phone yesterday about how you might make a > stew for hubbie this evening... Step outside the world of security departments. A lot of people would say ``So, you mean I get cheap carrots?'' Another example would be the bank deciding to charge you double for travel insurance because the village postmistress, doubling as the switchboard operator, heard you nattering on the phone yesterday about how your brother who lives in Canada had taken up snow-boarding and misunderstood. A lot of people have a conditional attitude to privacy: they're prepared to sell it for small sums of money, and apply a ``what harm have I suffered?'' calculus to breaches. Privacy as an abstract concept doesn't resonate. Which is why ``those with nothing to hide'' has such traction: privacy in many peoples' minds equates to ``things you should make public but keep secret for your own advantage'', not helped by the regular whines about ``privacy'' from politicians which _are_ entirely about self-interest. I don't think that abstract privacy had, or has, broad appeal. We need to make the risks more concrete, demonstrating actual harm beyond ``your privacy was invaded''. Claims that, say, IP numbers are private information and any processing of them is a prima facie breach of privacy are a tough row to hoe. ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:22:43 2008 From: ukcrypto at chiark.greenend.org.uk (Wendy M. Grossman) Date: Fri, 06 Jun 2008 14:22:43 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> Message-ID: <48493A23.4070504@pelicancrossing.net> Ian Batten wrote: > > A lot of people have a conditional attitude to privacy: they're prepared > to sell it for small sums of money, and apply a ``what harm have I > suffered?'' calculus to breaches. Privacy as an abstract concept > doesn't resonate. Which is why ``those with nothing to hide'' has such My usual answer to the 'nothing to hide' meme is to suggest that the speaker would be happy to receive all his bank statements on post cards. > traction: privacy in many peoples' minds equates to ``things you should > make public but keep secret for your own advantage'', not helped by the > regular whines about ``privacy'' from politicians which _are_ entirely > about self-interest. > > I don't think that abstract privacy had, or has, broad appeal. We need > to make the risks more concrete, demonstrating actual harm beyond ``your > privacy was invaded''. Claims that, say, IP numbers are private > information and any processing of them is a prima facie breach of > privacy are a tough row to hoe. Yes. It really needs good graphical demonstrations where someone can see the amount of information that's being collected and the consequences of same. Unfortunately, that kind of transparency is exactly what's been lost in trying to make computers easy to use. wg From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:34:22 2008 From: ukcrypto at chiark.greenend.org.uk (Richard Lamont) Date: Fri, 06 Jun 2008 14:34:22 +0100 Subject: Telegraph article on RIP In-Reply-To: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk> Message-ID: <48493CDE.60405@lamont.me.uk> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 David Hansen wrote: > It appears that Telegraph readers are slowly waking up to Home Office > plans to put us all in an open prison. About time too, though whether > they do more than whine remains to be seen. > > phone-bills.html> > > > is the result of my enquiries to the local Toms, Dicks and Harriets on > this matter. As I expected they have never rejected an attack on the > basis that it is neither necessary or proportionate. They appear to > think that this is excellent, I think it stinks. When the RIP Bill was going through Parliament, I wrote twice to my MP (Bill Cash). Bill Cash received a reply (to points raised in my second letter) dated 7th July 2000 from Charles Clarke (then the junior minister at the Home Office responsible for the bill) which he forwarded to me. He responded to one of my points thus: Mr Lamont states that the Bill proposes to extend the power to obtain communications data to "a range of officials in several public-sector bodies including local authorities and ... government departments." Currently, the relevant public authorities listed on the face of the Bill who may seek authorisation for such data include the police, National Criminal Intelligence Service, the National Crime Squad, HM Customs and Excise and the three intelligence agencies. Mr Lamont may be referring to the provision in the Bill allowing for the Secretary of State to make further additions to this list at some future stage if it is deemed necessary. This provision has been added to the Bill so that a door remains open to take account of unforeseen future developments such as the amalgamation of law enforcement bodies or the creation of new ones. Mr Lamont may be reassured to know that any such proposals will be made by an order to be debated in both Houses of Parliament by means of the affirmative resolution procedure. I can, however, confirm even at this stage that such powers will not be made available to local authorities. It is now evident that such powers have been made available to local authorities and therefore Charles Clarke, by lying in a written response to a PQ, has lied to Parliament. If anyone wants a scanned PDF of the letter please contact me off-list. - -- Richard Lamont http://www.lamont.me.uk/ OpenPGP Key ID: 0xBD89BE41 Fingerprint: CE78 C285 1F97 0BDA 886D BA78 26D8 6C34 BD89 BE41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFISTzcJthsNL2JvkERAtxvAJ9UIQb7lqYgc9rnMIg7WWepby56SACfWGrI M/KtzTtUr0Gs9FTriktuEJk= =Krte -----END PGP SIGNATURE----- From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:36:03 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Mason) Date: Fri, 6 Jun 2008 14:36:03 +0100 Subject: Telegraph article on RIP In-Reply-To: <48494179.21644.15B5A2E@davidh.spidacom.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <4848F9C0.22367.432AB3@davidh.spidacom.co.uk>, <697DD8A0-A059-493E-9AA8-D7707A1A1D61@batten.eu.org> <48494179.21644.15B5A2E@davidh.spidacom.co.uk> Message-ID: <0B7BCAFF-45A8-439A-91C9-DDB0CEAEC06B@sourcetagged.ian.co.uk> On 6 Jun 2008, at 13:54, David Hansen wrote: > > Did council officials ever stalk families and make detailed notes on > children (notes which are probably illegal under all sorts of "child > protection" laws and would probably land someone outside the tent in > prison)? I doubt it. Oh lordy, yes! Case workers in council social services have indulged in all sorts of abuse of office, process, power etc. etc. over the years. I'll name the 'satanic' abuse allegations* of a few years back as just one of a long list of misdeeds. Ian *Thoroughly debunked by a friend of mine Gareth Medway in his book "Lure of the Sinister: The Unnatural History of Satanism", New York University Press 2001 From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:46:23 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 14:46:23 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <48493A23.4070504@pelicancrossing.net> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> Message-ID: <8B7881D4-DD51-43E1-9E14-324EC7A2B789@batten.eu.org> On 06 Jun 08, at 1422, Wendy M. Grossman wrote: > Ian Batten wrote: > >> A lot of people have a conditional attitude to privacy: they're >> prepared to sell it for small sums of money, and apply a ``what >> harm have I suffered?'' calculus to breaches. Privacy as an >> abstract concept doesn't resonate. Which is why ``those with >> nothing to hide'' has such > > My usual answer to the 'nothing to hide' meme is to suggest that the > speaker would be happy to receive all his bank statements on post > cards. I suspect that you're spending too much time amongst people you know. A great many people would, I suspect, be perfectly happy to do just that in exchange for a Mars Bar and a brightly coloured pen. There's a middle class squeamishness about revealing one's income, of course, but beyond that (a feeling many people don't have) I'm not sure I can see what the problem would be. Why do you think bank statements are uniquely or, at least, obviously invasive? What information is on them that is likely to cause a problem? ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:48:02 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 14:48:02 +0100 Subject: Telegraph article on RIP In-Reply-To: <0B7BCAFF-45A8-439A-91C9-DDB0CEAEC06B@sourcetagged.ian.co.uk> References: <4847AA4D.19383.4A6866@davidh.spidacom.co.uk>, <4848F9C0.22367.432AB3@davidh.spidacom.co.uk>, <697DD8A0-A059-493E-9AA8-D7707A1A1D61@batten.eu.org> <48494179.21644.15B5A2E@davidh.spidacom.co.uk> <0B7BCAFF-45A8-439A-91C9-DDB0CEAEC06B@sourcetagged.ian.co.uk> Message-ID: On 06 Jun 08, at 1436, Ian Mason wrote: > > On 6 Jun 2008, at 13:54, David Hansen wrote: > >> >> Did council officials ever stalk families and make detailed notes on >> children (notes which are probably illegal under all sorts of "child >> protection" laws and would probably land someone outside the tent in >> prison)? I doubt it. > > Oh lordy, yes! Case workers in council social services have indulged > in all sorts of abuse of office, process, power etc. etc. over the > years. I'll name the 'satanic' abuse allegations* of a few years > back as just one of a long list of misdeeds. I was going to use that as a (counter) example, because I was re- reading the Broxtowe JET report only last week. But there, of course, there are additional powers and often the police are involved. But pre-RIPA, we had no idea how often those powers were used. ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:48:29 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Mason) Date: Fri, 6 Jun 2008 14:48:29 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <48493A23.4070504@pelicancrossing.net> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> Message-ID: <57DA9481-D9DF-4EA4-891D-12907BE85427@sourcetagged.ian.co.uk> On 6 Jun 2008, at 14:22, Wendy M. Grossman wrote: > My usual answer to the 'nothing to hide' meme is to suggest that > the speaker would be happy to receive all his bank statements on > post cards. > My usual retort is more earthy. Something along the lines of "So next time you and your Missus want a shag you'll be dragging your bed into the middle of the road so that we can all come to watch?". This fails with a certain class of pervert, of which I appear to know a surprising number. Ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 14:51:57 2008 From: ukcrypto at chiark.greenend.org.uk (Wendy M. Grossman) Date: Fri, 06 Jun 2008 14:51:57 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <8B7881D4-DD51-43E1-9E14-324EC7A2B789@batten.eu.org> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> <8B7881D4-DD51-43E1-9E14-324EC7A2B789@batten.eu.org> Message-ID: <484940FD.7040906@pelicancrossing.net> Ian Batten wrote: > I suspect that you're spending too much time amongst people you know. A > great many people would, I suspect, be perfectly happy to do just that > in exchange for a Mars Bar and a brightly coloured pen. There's a > middle class squeamishness about revealing one's income, of course, but > beyond that (a feeling many people don't have) I'm not sure I can see > what the problem would be. Why do you think bank statements are > uniquely or, at least, obviously invasive? What information is on them > that is likely to cause a problem? I don't. but people are, as you say, squeamish about it nonetheless, and if you're trying to get a point across quickly, as I usually am, it seems to work. I haven't tried the test to see what gift they'd take to give up their bank statements. (Quibble: Isn't it difficult to spend a lot of time with people you don't know? After you've spent some time with them don't you know them?) wg From ukcrypto at chiark.greenend.org.uk Fri Jun 6 15:17:33 2008 From: ukcrypto at chiark.greenend.org.uk (Wendy M. Grossman) Date: Fri, 06 Jun 2008 15:17:33 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <4fab381639ukcrypto@vigay.com> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> <57DA9481-D9DF-4EA4-891D-12907BE85427@sourcetagged.ian.co.uk> <4fab381639ukcrypto@vigay.com> Message-ID: <484946FD.4020002@pelicancrossing.net> Paul Vigay wrote: > I must admit that I'm a bit more blunt and 'go for the shock factor' when > it comes to answering the "If you have nothing to hide...." question, > simply replying with, "try telling that to a holocaust survivor" - which > usually stops the conversation! Yes, but that's what's wrong with it. You don't want to end the conversation entirely - Godwin's Law - with a scenario they think is unlikely to happen to *them*. You want to get across things that are real and person to their own lives. wg From ukcrypto at chiark.greenend.org.uk Fri Jun 6 15:25:57 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 15:25:57 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <4fab37d980ukcrypto@vigay.com> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> <8B7881D4-DD51-43E1-9E14-324EC7A2B789@batten.eu.org> <4fab37d980ukcrypto@vigay.com> Message-ID: On 06 Jun 08, at 1503, Paul Vigay wrote: > Let's go for the devil's advocacy, shall we? > [Snippety snip] > >> sure I can see what the problem would be. Why do you think bank >> statements are uniquely or, at least, obviously invasive? What >> information is on them that is likely to cause a problem? > > OK, instead of bank statements, how about the results of that > embarrassing > medical test you had last week.... ? The vast majority of peoples' medical records aren't that interesting. Hence the vanishing small number of people opting out of NHS records: they regard any slight increase in utility and being worth any large decrease in privacy. There are, of course, people whose medical records _would_ cause them difficulty, and I have 93C3'd my records partly in solidarity with them. But I would be totally unconcerned, at a personal level, about arbitrary read-only access to my medical records, and I bet you the same applies to a solid majority of the population. > > or your ISP sending email login details on a postcard? That would be bad, but that's information with direct utility. I don't care about your knowing the password to my IMAP account as a fact: what I care about is what happens when you use it. Which is my point: people understand rapidly the consequences of data leakage when that data can be used to do them harm, but they don't understand the abstract concept of information which they can't see a direct damaging use for. > > or your gay/lesbian club membership details? If you're a closeted gay but nonetheless join a club that sends out membership details, you should be more careful. But again, my first point applies: that may affect `other people', but it doesn't affect me. I can think of things I receive in the post which would be useful to people, and those I'd like to keep private; but most of it's stuff that has no practical value to harm me, and that's a harder case to make. > > or, to get back onto the bank account one, your bank card PIN on a > postcard? See email login details. > > > There are loads of cases there people want to keep personal > information > private - and you shouldn't need to justify it to other people > either. The > mere fact an individual wishes something to be private, should be > respected > by others, without having to defend their choice. I think you misunderstand my position. I'm making the opposite argument: a lot of people _don't_ have a strong urge to keep this information private, so should they be allowed to trade that information for marginal benefits? ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 15:26:55 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 15:26:55 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <4fab381639ukcrypto@vigay.com> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> <57DA9481-D9DF-4EA4-891D-12907BE85427@sourcetagged.ian.co.uk> <4fab381639ukcrypto@vigay.com> Message-ID: On 06 Jun 08, at 1506, Paul Vigay wrote: > > I must admit that I'm a bit more blunt and 'go for the shock factor' I've never tried it --- wilting flower, me --- but an acquaintance claims that asking women their bra size works well. ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 15:28:13 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 15:28:13 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <484940FD.7040906@pelicancrossing.net> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> <8B7881D4-DD51-43E1-9E14-324EC7A2B789@batten.eu.org> <484940FD.7040906@pelicancrossing.net> Message-ID: <6A2A025B-CF6C-400D-AF7F-D99201E26D4D@batten.eu.org> On 06 Jun 08, at 1451, Wendy M. Grossman wrote: > I don't. but people are, as you say, squeamish about it nonetheless, > and if you're trying to get a point across quickly, as I usually am, > it seems to work. I haven't tried the test to see what gift they'd > take to give up their bank statements. I suspect most people would trade the privacy of their bank statement for sight of some small number of other peoples' bank statements. > > > (Quibble: Isn't it difficult to spend a lot of time with people you > don't know? After you've spent some time with them don't you know > them?) You know what I mean: too much time with people who share your background and assumptions. ian From ukcrypto at chiark.greenend.org.uk Fri Jun 6 15:34:21 2008 From: ukcrypto at chiark.greenend.org.uk (James Firth) Date: Fri, 6 Jun 2008 15:34:21 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <484946FD.4020002@pelicancrossing.net> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> <57DA9481-D9DF-4EA4-891D-12907BE85427@sourcetagged.ian.co.uk> <4fab381639ukcrypto@vigay.com> <484946FD.4020002@pelicancrossing.net> Message-ID: <011301c8c7e2$69e857f0$e57ea8c0@Jinja> Wendy M. Grossman wrote: > Paul Vigay wrote: > > > I must admit that I'm a bit more blunt and 'go for the shock factor' > when > > it comes to answering the "If you have nothing to hide...." question, > > simply replying with, "try telling that to a holocaust survivor" - which > > usually stops the conversation! > > Yes, but that's what's wrong with it. You don't want to end the > conversation entirely - Godwin's Law - with a scenario they think is > unlikely to happen to *them*. You want to get across things that are > real and person to their own lives. > Which neatly sums up the paradox faced by campaigners against data profiling. The true crux of the problem is the nightmare Godwin/Nazi scenario where instant access to a comprehensive profile of the majority of citizens is open to misuse by a rogue government. But of course the general public would arguably only believe this if the Daily Mail told them to. I personally think the majority of internet users do really think "I've got nothing to hide" and genuinely believe a lot of the data warehousing proposed by governments will help fight terrorism. So we try with lesser examples, medical records or the fact that your bank statement shows you purchasing "a meal" at 3:30am at some seedy joint. James Firth From ukcrypto at chiark.greenend.org.uk Fri Jun 6 16:06:42 2008 From: ukcrypto at chiark.greenend.org.uk (Ian Batten) Date: Fri, 6 Jun 2008 16:06:42 +0100 Subject: BT 2006 trials of Phorm In-Reply-To: <011301c8c7e2$69e857f0$e57ea8c0@Jinja> References: <2CE4162551153141919B1BFAAB1DC45268E5AE@EMCLMSX01.emea.global.root> <298c5f970806051409q3977d674je6a30edc03bd15a2@mail.gmail.com> <4848FADE.21036.478999@davidh.spidacom.co.uk> <950CCA63-8DC7-444D-9198-FE3BDE44F9AB@batten.eu.org> <48493A23.4070504@pelicancrossing.net> <57DA9481-D9DF-4EA4-891D-12907BE85427@sourcetagged.ian.co.uk> <4fab381639ukcrypto@vigay.com> <484946FD.4020002@pelicancrossing.net> <011301c8c7e2$69e857f0$e57ea8c0@Jinja> Message-ID: On 06 Jun 08, at 1534, James Firth wrote: > Wendy M. Grossman wrote: >> Paul Vigay wrote: >> >>> I must admit that I'm a bit more blunt and 'go for the shock factor' >> when >>> it comes to answering the "If you have nothing to hide...." >>> question, >>> simply replying with, "try telling that to a holocaust survivor" - >>> which >>> usually stops the conversation! >> >> Yes, but that's wha