URLs, IPs and interception

[Roland Perry]

In article <47C88EEE.9070806@zen.co.uk>, Peter Fairbrother 
<zenadsl6186@zen.co.uk> writes

>S.2(5) says:
>" (5) References in this Act to the interception of a communication in 
>the course of its transmission by means of a postal service or 
>telecommunication system do not include references to—

DO NOT include

>(a) any conduct that takes place in relation only to so much of the 
>communication as consists in any traffic data

TRAFFIC DATA

>comprised in or attached to a communication (whether by the sender or 
>otherwise) for the purposes of any postal service or telecommunication 
>system by means of which it is being or may be transmitted; or

OR  (not AND)

>(b) any such conduct, in connection with conduct falling within 
>paragraph (a), as gives a person who is neither the sender nor the 
>intended recipient only so much access to a communication as is 
>necessary for the purpose of identifying traffic data so comprised or 
>attached. "

>So Phorm is out.

I don't think Phorm's mode of operation is well understood enough yet 
amongst commentators (well, I haven't seen evidence of this) to know 
exactly what it is sending to whom that might be interception.

And then there's the issue of consent.

I'm reluctant to assume that BT's lawyers are completely wrong on this 
issue. It's a huge risk if they are.

>And so is giving clickstream or URL data, or traffic data, to anyone 
>unless authorised elsewhere.

Traffic data is never interception, but could be unlawfully given to 
third parties. URL data (aka Clickstream) is interception within the 
legal definition that it's the "host machine" only which can be 
identified. Normally, in practice that means "everything up to the first 
/" but it's trivial to construct counterexamples in both directions, and 
privacy can be infringed just seeing the IP address you browsed to [1].

>Am I incorrect here?

See the OR/AND issue, I think.

[1]  http://195.173.131.60/  (Apologies to the site owner).
-- 
Roland Perry