BT admits tracking 18,000 users with Phorm systems

 

BT Broadband has admitted that it carried out secret trials on 18,000 user accounts in autumn 2006 with technology from 121Media, which became the targeted advertising company Phorm. Though BT has not yet said where the trials were done, the systems were used to analyse web traffic and then serve selected adverts on a number of selected websites.

 

The revelation, first detailed on The Register website, might lead to legal action by any of the users who can show their data was used. That is because it appears to breach the Regulation of Investigatory Powers Act (RIPA) 2000, which makes it an offence to intercept internet traffic without consent or a warrant.

Phorm is negotiating a deal with BT, Virgin Media and Talk Talk, the UK's three largest ISPs with about 10m users. It would analyse web browsing and offer targeted adverts, as well as warning about phishing sites. Talk Talk has said it will make the service opt-in; BT has implied it will be opt-out. Virgin Media had no comment.

BT's 2006 trials certainly involved some sort of interception, because the data streams had extra Javascript inserted into them - which puzzled a number of people at the time. Two examples can be seen at the forums of raisingkids.co.uk and progarchives.com. In both, the Javascript and other tags inserted by the 121Media system are clearly visible, with one showing the referring page and possibly "interests" of the member. Both contain links to sysip.net - the 121Media-owned site through which BT sent browser requests during the 2006 trials and later ones in summer 2007.

BT declined to comment beyond a prepared statement, saying: "The purpose of the test was to evaluate the functional and technical performance of the platform. It is important for BT to ensure that before any new technologies are deployed, they are robust and fit for purpose. No personally identifiable information was processed, stored or disclosed during this test."

But serious questions remain. BT said that the test was only carried out for two weeks - yet the second forum posting above was made in December 2006.

Last week Guardian News and Media, which publishes the Guardian, announced that it would not pursue any advertising tie-up with Phorm, after having initially expressed an interest. "We have concluded at this time that we do not want to be part of the network," said Simon Kilby, GNM's advertising manager. "Our decision was in no small part down to the conversations we had internally about how this product sits with the values of our company."

Phorm says its technology means adverts can be better targeted to individuals, by creating "profiles" of their browsing behaviour while not retaining any personally identifiable information; users are identified by randomly-numbered browser cookies, whose number matches to a profile on the Phorm system. Adverts could be better targeted, and because it monitors the sites people visit, could also warn users about known phishing sites.