On Second Thought... NebuAd Not Really Dead... Re-Emerges In The UK Under An Assumed Name

from the nice-one! dept

After writing about how NebuAd had shut down, a commenter pointed out this wasn't quite true. Instead, it appears the company has just re-appeared under a different name in the UK... where officials have ruled that clickstream tracking behavioral advertising can be legal (though that's gotten the UK into trouble with the EU). Apparently, NebuAd had opened a UK office, and with the shutdown of US operations, the UK office re-branded as Insight Ready Ltd., but it appears to be the same basic company, including same employees. And the Insight Ready domain name was registered by NebuAd....

3 Comments | Leave a Comment..

UK Officials Accused Of Colluding With Phorm

from the that-would-not-be-good dept

While the US quickly condemned clickstream tracking as a likely violation of privacy, many were quite surprised when UK officials went in the other direction, suggesting that Phorm's tracking was legal. The European Commission was so annoyed by this that it's taking legal action against the UK for privacy violations. But, still, many people are wondering why the UK government said something like Phorm was legal... and now accusations are coming out that it's because UK government officials let Phorm take part in writing the policy. There are a bunch of incriminating emails between the Home Office and Phorm, including one where officials ask Phorm execs if they would be "comforted" by the position the gov't was about to take. In another, the officials ask Phorm to review the document and give feedback, prior to the gov't releasing the actual policy. Talk about regulatory capture... The government, for its part, claims that people are misreading the emails, but it's difficult to see how the emails can be misread when they blatantly ask Phorm to review the document, and inquire whether the company and its partners will be comforted by the ruling.

Update: On top of this, it appears that Phorm is now lashing out at critics, claiming that they're "smear merchants" and "privacy pirates." That sounds convincing...

11 Comments | Leave a Comment..

Europe Begins Legal Action Against The UK For Allowing Phorm To Proceed

from the a-little-privacy,-please dept

We were quite surprised when the UK gave a basic approval of Phorm's clickstream tracking/behavioral advertising effort -- despite widespread consumer outrage that their internet surfing was being tracked and sold for advertising purposes. And given that simple approval, Phorm has been looking to aggressively expand. However, it appears that other officials may have a different idea. The European Commission has "started legal action" against the UK for allowing Phorm to proceed, saying that it seemed likely to violate European privacy rules. Who knows if this will actually go anywhere, but it seems pretty clear that the rather widespread mistrust of Phorm is making sure that it's not able to do much at all without additional scrutiny.

7 Comments | Leave a Comment..

Phorm, Apparently Deaf To Consumer Hatred Of Being Spied On, Plans Expansion

from the seriously? dept

Phorm is the highly controversial behavioral advertising firm that teams up with ISPs to spy on your surfing habits and deliver targeted ads. The practice has raised a number of legal challenges and protests from users who were "tested on," without their knowledge. While Phorm has been found to be legal in the UK, its practices have still engendered widespread anger. Yet, the company seems particularly deaf to those concerns, and is talking about plans to expand internationally, despite the fact that similar schemes have run into legal troubles elsewhere. Perhaps before looking to expand internationally, Phorm should work on fixing its business model.

21 Comments | Leave a Comment..

BT Bans Talking About Phorm, Erases Earlier Discussions

from the we-were-always-at-war-with-Eurasia dept

You may recall that BT was one of the bigger supporters of Phorm, the controversial clickstream tracking system that would allow ISPs like BT to insert their own behaviorally targeted ads into your web surfing. The company held extensive trials with the system, without letting users know that their clickstream data was being sold to advertisers in order to do more targeted advertising. Now that UK officials have decided that Phorm is legal, if clearly explained to consumers, BT has chosen a funny way to make sure there's clarity around the system. Slashdot points out that BT has apparently banned discussion of Phorm on its forums and erased earlier forum discussions about the technology. How's that for openness?

Is it really so hard to allow open discussion on such a topic? If BT believes that it's reasonable to use the technology, then why not explain why clearly, responding to the critics? The only reason to erase these discussions is if BT knows that what's it's doing is highly questionable, and BT would rather not have to explain itself.

15 Comments | Leave a Comment..

UK Police Stop Phorm Investigation, As They Don't See Any Criminal Behavior

from the civil,-however.., dept

While American competitor NebuAd may be on the verge of shutting down, it appears that Phorm, the controversial clickstream tracking, behavioral ad company that focused mainly on the UK market, may be dodging a series of bullets. First, the government said that clickstream tracking could be legal if the situation was clearly explained to customers and there was an obvious mechanism for opting out. Now, UK police are dropping their own investigation of earlier trials with BT, which many believed were illegal because they were done with no notice to consumers at all, and no way to opt-out. That would seem to go against the government's earlier statements, but the police are saying that there's no evidence that this is a criminal matter -- which would leave this open to civil lawsuits from individuals who were impacted by the trials.

8 Comments | Leave a Comment..

UK Says Phorm Clickstream Tracking Is Okay... If Clearly Explained To Customers

from the we'll-see-what-customers-say dept

With US-based clickstream tracking company NebuAd on the rocks, similar UK competitor Phorm has actually received approval from the UK government, despite concerns over legality. Apparently, the UK has decided that as long as Phorm clearly states what's happening, allows easy opt-outs (even if users change their minds later), then it's fine. What's not clear, though, is how the government will treat Phorm's early tests, which did not include clear notification or easy opt-outs. In the meantime, if such programs really are clearly communicated to users, do you think enough people would opt-in to make it worthwhile?

19 Comments | Leave a Comment..

Phorm Secretly Used By American ISPs As Well

from the totally-transparent? dept

Looks like Phorm may be facing another headache as The Register has found out that it was quietly used by some American ISPs, as well. Earlier stories had suggested that Phorm, which tracks your web surfing at the ISP level and customizes ads based on your clickstream data, was only testing the service in Europe, while competitor NebuAd was focused on the US. Phorm is facing some legal inquiries in Europe, while NebuAd is laying people off as Congress is investigating the legality of the service.

But the most bizarre aspect of this is Phorm's claim that its tests with US ISPs was "transparent." If that's the case, it's odd that no one had pointed it out before. That would suggest that it wasn't nearly as transparent as Phorm claims. In fact, it suggests the opposite.

10 Comments | Leave a Comment..

NebuAd In Trouble After Congress Suggests Its Entire Business Is Illegal

from the oops dept

We've covered the saga of companies like NebuAd and Phorm, who basically worked with ISPs to access your clickstream data and place advertisements based on your overall surfing habits, rather than the specific page that you're on at that moment. It didn't take long before people realized that such services (beyond just being somewhat deceptively implemented by ISPs) were probably illegal. And, of course, given the public outcry over these services, it didn't take long for Congress to get involved, suggesting that it felt these activities were illegal.

So, of course, if you happen to work at Phorm or NebuAd, you've got a bit of a business model problem (not to mention the potential legal problem). The Register is reporting that NebuAd has now laid off a bunch of employees -- and also dumped its PR firm. Considering the fact that no amount of PR probably could have stopped consumer outrage over how these services were implemented, it seems like the PR firm may have been something of a scapegoat --- or, perhaps, the company just realized that any PR work at this point is simply futile.

12 Comments | Leave a Comment..

Phorm Did Track IP Addresses, Replaced Charity Ads With Behavioral Ads

from the how-nice-of-them dept

Phorm, the extremely controversial former adware company that reinvented itself as a behavioral advertising firm that would work with ISPs to look at your clickstream data and serve you special ads instead of the ones you were supposed to see, has been working overtime to defend its program as being perfectly legitimate and no risk to anyone's privacy. Of course, that's not satisfying many, as it later came out that, despite claims of openness, BT and Phorm had secretly tested the service without letting anyone know their clickstream data was being used this way. Even worse, after this news came out, BT and Phorm downplayed the test, only to later have it come out that it was quite extensive.

And, now, it gets even worse. More information has been leaked out about that test. As for it being super duper secret without your IP address ever being compromised? Well, not so much. It turns out that an internal BT analysis found that IP addresses were likely used as the identifier, which is the exact opposite from what Phorm has insisted. And, as for how well the system works? Well, it was successful in covering up ads for various charities and replacing them with "targeted" behavioral ads instead. Wouldn't want those darn charities to have anyone see their ads.

Update: A representative of Phorm has gotten in touch to note that there were some incorrect statements in the original report on this. Specifically, it appears that Phorm purchased the original charity ads that were replaced -- so it's not as though the charity lost anything here. It's easy to understand why the original interpretation of the BT report would make one think this was not the case, as it stated: "The advertisements were used to replaced [sic] a 'default' charity advertisement (one of Oxfam, Make Trade Fair or SOS Children's Villages) when a suitable contextual or behavioural match could be made by the PageSense system." It does not appear to say that the ads were purchased by Phorm -- at least not in that same section. At this time, there is still no indication whether or not the charities knew their ads were going to be "covered up" in this manner. None of this, of course, answers the questions about whether or not this test was legal.

Update 2: And now BT has also gotten in touch with us to complain -- though they falsely accuse us of making false statements, saying that the headline still says they "hijacked" charity ads. It does not and has not. It has always said "replaced" which, I'll remind BT, is the exact word used in their own report. Unless BT was falsifying its own report, the word "replace" is correct. The mistake was in suggesting that Phorm had not purchased that ad space -- and that has already been corrected quite clearly. BT also is upset that we accused them of "misleading ICO." The only problem: we made no such statement. Finally, BT complains that no personal information was used in the trials -- which is a point that is still disputed. The original researcher who researched the report claims that IP addresses were passed to Phorm's proxy server and that personal info was requested on a web form. BT notes that the IP addresses were not stored -- but that doesn't mean they weren't used, which was what was in question. Also, to both Phorm and BT, the comments on this post are open, and you are free to make your case here where anyone else can see it. Contacting me personally, with vague, slightly threatening and sometimes incorrect statements is certainly less effective that making your case to the public. Part of the reason you're in this PR situation is because of your secrecy. Being a bit more open might help.

20 Comments | Leave a Comment..

Behavioral Targeting May Be Illegal

from the smells-like-wiretapping dept

A bunch of ISPs have been experimenting with systems such as Phorm and NebuAd that monitor their users' online behavior and create profiles that help third parties create more targeted advertisements. Back in March we noted that behavioral advertising may be illegal under UK law. And last week we reported that Congress was asking some tough questions about the plans. CNet's Declan Declan McCullagh has an in-depth look at American law, and concludes that such systems are probably illegal here too. The problem is that what Phorm and NebuAd do sounds a lot like wiretapping, and wiretapping is illegal under several federal laws. At least three federal laws govern when electronic communications providers can disclose their customers' communications to third parties. One of the key questions Declan looks at is consent: the law generally allows eavesdropping with customer consent, but the exact nature of the consent isn't clear. ISPs have tended to be very secretive about their use of these systems, so at the very least, privacy laws would require that ISPs disclose what they're doing and give consumers a way to opt out. But Declan suggests that this might not be sufficient. Some of the legal experts he talked to think the law would require the ISPs to obtain the affirmative consent of customers before commencing the use of these programs. Since it's hard to imagine customers being enthusiastic about having their ISPs eavesdrop on them, such a requirement might make these programs non-starters.

Timothy Lee is an expert at the Insight Community. To get insight and analysis from Timothy Lee and other experts on challenges your company faces, click here.

15 Comments | Leave a Comment..

Marketers Freak Out About Mandates To Make Clickstream Tracking Opt-In Only

from the but-what-about-our-data? dept

With all of the fuss finally being raised concerning clickstream tracking by companies like Phorm and NebuAd, there's an effort underway to force ISPs to make any such tracking strictly opt-in. That is, users would have to proactively agree to allow their data to be used in this manner. In response, various marketers are complaining about how much data they would lose, claiming it would be an "armageddon" for the industry. Don't believe them. This is the same thing marketers warned about when the US instituted a "Do Not Call" system, and it's hardly decimated the marketing industry. Instead, it's improved marketing by making firms focus less on intrusive telemarketing and more on useful marketing. The same would happen if ISPs were required to make this an opt-in instead of opt-out setup. It would force the ISPs and companies like Phorm to make sure that the services really benefited customers in meaningful and noticeable ways so that customers would be happy to make use of the services. By whining about an opt-in solution, all these firms are really admitting is that they do not add value to the surfing experience of users.

19 Comments | Leave a Comment..

Anti-Spyware Companies Debate Blocking ISP-Injected Advertising

from the the-battle-continues dept

With a growing number of ISPs using services from companies like Phorm and NebuAd to inject ads into your web browsing based on your surfing habits, anti-spyware companies are starting to take notice and debate whether or not they should start blocking some of these activities. While there's no downloaded software, these services all use cookies to track your surfing habits, and anti-spyware offerings could certainly step in and block those cookies or more proactively warn users that their surfing data is being used in this manner. Considering how hard Phorm has worked to shed the "spyware" label it had been given in a previous life, the company can't be too pleased to hear about this development. Of course, it's probably more concerned with questions being raised about whether or not its service is even legal.

16 Comments | Leave a Comment..

Growing Number Of ISPs Injecting Own Content Into Websites

from the this-is-not-a-good-trend dept

With growing concerns over companies like Phorm and NebuAd enabling ISPs to insert their own ads into your web surfing, some researchers decided to see if this is already happening -- and were surprised to find it more prevalent than they expected. It's still not a huge number, but in tests, they found that there definitely are some ISPs already using such technology to inject ads, though they tend to be smaller "no name" ISPs. The one big exception was XO Communications -- though XO claims that any ad injections must be done by downstream resellers of its wholesale service. Either way, this ought to raise some questions about what rights ISPs have to get in the middle and alter the data that you requested and which was served by a third party.

18 Comments | Leave a Comment..

Phorm Edits Negative History Right Out Of Wikipedia

from the and-gets-called-on-it dept

Phorm, the controversial "former" adware company that is aggressively defending its new ads-based-on-your-clickstream program, despite some serious questions about its legality apparently became a little "overzealous" in its defense, editing its own Wikipedia page to erase many of the negative stories about the company. Of course, doing that backfired pretty quickly, as the company got called out on it (and the edits got reverted). While first suggesting that it was merely trying to correct "inaccuracies" (such as questions over its legality?), the company admitted it was a bit too aggressive, and was unfamiliar with the rule that you're not supposed to edit your own Wikipedia entry.

8 Comments | Leave a Comment..

Turns Out BT's Phorm Tracking Tests Were More Extensive Than Previously Reported

from the transparency? dept

Last month, we noted that BT had secretly tested Phorm's tracking system without telling customers in the summer of 2007. This gave users no way to opt-out as they had no idea their surfing was being tracked. However, now it's being reported that BT's tests were even more extensive than originally reported, and the two companies secretly tracked the internet usage of 18,000 customers back in 2006, before Phorm was even called Phorm. That's back when Phorm was known as 121 Media and considered by many to be in the sneaky adware business. In fact, the BT internal report on the test noted that: "121Media [Phorm] will take action (both technical and public relations) to avoid any perception that their system is a virus, malware or spyware and to show that in effect it is a positive web development." Perhaps that explains Phorm's recent charm offensive. It's part of it's deal with BT.

3 Comments | Leave a Comment..

NY Legislator Looks To Outlaw Behavioral Targeted Ads Without Opt-In

from the a-bit-late-for-that dept

A New York Assembly member is pushing to outlaw targeted advertising without opt-in approval. Given the scrutiny facing companies like Phorm in the UK, this isn't all that surprising. However, the complaints around Phorm are that it tracks all of your surfing activity and generates ads based on that aggregate info. The bill that is being discussed in New York would apparently apply to websites that do targeted advertising within the site. That seems both extreme and unnecessary. Even though the law would technically only apply to New York, since it would be difficult to figure out who's in NY and who's elsewhere, it would force many providers to get rid of targeted advertising. It seems a bit extreme to think that targeted advertising should be banned entirely, without an initial opt-in. By this point, most people probably expect basic targeting to take place, and when done right, such targeted ads should be more effective. The real problem comes in when such targeting presents a privacy violation, but the focus then should be on privacy laws, not specifically targeting a single activity such as targeted ads.

15 Comments | Leave a Comment..

Questions Raised Over Phorm's Legality As BT Admits It Tested The Service Secretly

from the transparency,-transparency,-tranparency dept

While Phorm has gone on a charm offensive to try to convince people that its efforts are not as bad as some are making them out to be (including, by the way, using my post as a de facto forum), it appears that the effort still isn't convincing skeptics. Tim Berners-Lee made some news last week for suggesting he would switch ISPs if his started using a service like Phorm, but the bigger backlash may be coming from the legal arena. First, there was the news that BT (who had originally denied this) tested Phorm's technology, without letting users know, last summer. That has resulted in some people threatening a lawsuit. And, speaking of lawsuits, a bunch of scholars and think tankers are pointing out that Phorm may actually be illegal based on current UK laws, if it's used without first getting users to "opt-in."

6 Comments | Leave a Comment..

Phorm Goes On The Offensive To Defend Its Ad Program On Privacy Questions

from the but-do-you-believe-them dept

Last month, we wrote about the plan by a variety of UK-based ISPs to use all of your clickstream data to target ads to you as you surfed. That is, if you were surfing a golf site and then went and checked CNN, the system would still know that you liked golf and might serve up golf ads on CNN. At least that's the benign version of it. There are some serious questions raised by this. First of all, many people are likely to be uncomfortable with the idea that their ISP is watching what they do and then using it to target ads. Even worse, the company that the ISPs were partnering with to do all of this had previously been known as a spyware firm.

Phorm is now aggressively defending its reputation, insisting once again that it will keep all of the data it collects anonymized. However, while it says this and explains how it will try to anonymize the data, the company fails to address the fact that just about every time a company has tried to create an anonymized data set, it doesn't take long for someone to de-anonymize it. The company just assumes that it really can keep the data anonymous, when there are serious doubts as to whether or not that's really possible.

To its credit, the company isn't ignoring some of the complaints and has just done interviews with both the BBC and The Register to answer some of the concerns raised. Thankfully, both interviews do probe fairly deeply and ask some tough questions, and the Phorm execs answer each question directly. They claim that they were never "spyware" providers, only adware, but admit that the definition got blurred, which was why (they claim) they got out of the business. That sounds good until you look at some of the details about the company's former products, and the fact that it made a rather nasty rootkit injector.

That said, the execs do answer a bunch of questions about the privacy issues, noting that they're being audited by two separate firms to ensure they live up to the privacy promises. The clickstream data is immediately deleted and all the profiling is done at the ISP, not by Phorm, who is merely serving up the ads based on the profile kicked back by the ISP. While it's good to see the execs from Phorm willing to answer these questions, the company's history and the entire concept of what's being done still seems rather questionable. Phorm's insistence that this will actually decrease advertising seems like little consolation (and difficult to believe).

53 Comments | Leave a Comment..

British ISPs Hand Over Your Surfing Data To (Former?) Spyware Firm

from the privacy? dept

Earlier this month, we noted that three large UK ISPs had agreed to a questionable deal with a startup named "Phorm." The ISPs would share all of your surfing data with Phorm who would then target advertisements to you based on your surfing patterns. We raised some privacy concerns, and noted that Phorm's claims that it would anonymize the data were laughable, since every "anonymized" data set seems to get quickly de-anonymized. In the comments to that post, one commenter noted that the story was even worse, as Phorm was merely the reincarnation of a spyware firm that had made a rather infamous rootkit. Broadband Reports now has more on that story, noting that the firm has a very shady past. It makes you wonder why these big ISPs would link up with such a company and why more people aren't up in arms about what their ISPs are doing with their data.

8 Comments | Leave a Comment..