BT Webwise

You can read BT's version of Webwise at webwise.bt.com/webwise/help.html. The notes below have been gathered from other Internet resources and expand on the limited data available from BT's site. Answers given by BT's site relate to only one aspect of this new service: delivery of advertising and anti-phishing add-on. BT do not give any information about how the data is collected and stored. Webwise explained, www.cl.cam.ac.uk/~rnc1/080404phorm.pdf (technical details used in answers below).

Keep in mind, Lavasoft [supplier of Ad-Aware software] cannot do anything to detect Phorm’s [Webwise] products; this new system is set to be deployed at the ISP level.

About BT Webwise

What is BT Webwise?

An advertising platform which 'sees' everything you do on the internet so as to develop a behavioural profile of you which can then be used to sell prime advertising spots to advertisers who are interested in promoting to people who match your profile. Radio 4 interview - 16 April 2008.

Do I need to download any software to use BT Webwise?

No. All software and hardware which profiles your surfing and serves you adverts that match your profile are already hosted within BT's Webwise network: therefore no need to be downloaded onto your computer as per historical adware / spyware programs.

Do I have to have a PC to use BT Webwise?

You need to have a browser.

Will this disrupt my service or make browsing slower?

Yes, each page you request is intercepted before being passed to you.

Can I use any web browser with BT Webwise?

No, not all browsers accept the forged Webwise cookies used by the system.

Which parts of BT are considering deploying BT Webwise?

BT Retail - supplied to residential customers including all homeworkers who use the internet as part of their work.

How do you know that your customers want BT Webwise?

Good question. Were you asked if you wanted to have all your surfing data collated to profile you and to supply an additional revenue stream to your internet service provider?

When will you be trialling BT Webwise? And can you give any details?

Trials have already been run, in 2006 and 2007. news.bbc.co.uk/1/hi/technology/7325451.stm The latest trial version is due during April 2008.

About Privacy

How does BT Webwise match what I do with adverts?

A Webwise cookie is added to your computer which identifies you through a unique ID. When visiting a web page, that page's content is matched against an advertising 'channel' and that channel is recorded against your UID see the orange area. When you visit the Internet, the web page requests your UID and programs hosted within the page look up your UID in the Webwise hosted database to serve you a relevant advert.

Is BT selling customer data?

BT say no. They are earning income from your data. What would you call it?

Is what you are doing legal?

Legallity can only be tested through the UK courts and this has not yet happened. Richard Clayton on the Webwise System: The basic concept behind the Phorm architecture is that they wish to take a copy of the traffic that passes between an end-user and a website. This enables their systems to inspect what requests were made to the website and to determine what content came back from that website.
Under the Copyright Act, the copying of copyrighted web content without permission is illegal.

What is the relationship between BT Webwise, BT's current policy for BT Yahoo customers and the current EU/UK data protection legislation?

There is an on-going debate that the Webwise system in its current form is illegal.

Can't the anonymisation process be reversed?

This has still to be tested. Six months of surfing data could contain a lot of information that could be analysed to identify an individual.

What happens if I don't take or opt out of the BT Webwise service?

Every page requested is checked against the opt out cookie before being requested from the website and delivered to you.

How are BT subscribers' usage details collected?

Every page you visit is copied and analysed together with time stamps to record frequency.

Could this system be useful for tracking illegal online activity, etc, through browsing behaviour?

Systems for tracking such behaviour are already available to most internet service providers and is not part of this system. Webwise is supplied to earn revenue from presenting customers and their households (including children) relevant adverts. Each advert you view, each advert you click on, earns Webwise money.

Why does BT Webwise use cookies?

Because most computer users do not know how to manage their cookies which means that more people are being profiled than would be the case if explicit consent was requested and recorded against customer account profiles. Cookies are cheap. An explicit opt in would require man power and an audit trail which would decrease the money being earned by the internet service providers who are installing the tracking systems.

Does remaining opted out depend on the continued presence of an opt-out cookie on the user computer? What happens if I delete the cookie?

When you have no Webwise cookies, the illegal hijack that infects your browser for every web page request will result in your being presented with the Webwise opt in page rather than the website you requested. Your computer's own security features allow you to permanently block any such hijack through editing the little used hosts file.
 
When BT were asked if directing the Phorm / Webwise / OIX sites to 127.0.0.1 in the hosts file would ensure that no surfing was intercepted for either forging cookies or profiling the answer given was
If a customer who is invited to participate in the trial adds www.webwise.net to their local HOSTS file with the resolved address of 127.0.0.1, they will not be able to browse the Internet on HTTP port 80 on that PC for the period of the trial. This is because access to www.webwise.net is required in order to process the consent status of the user during the trial. Instead, and as per the advice on the www.bt.com/webwise site, the recommended approach for excluding a PC from the Webwise service if the user regularly deletes cookies is to add www.webwise.net to the browser's blocked cookie list. As previously stated, in parallel with the forthcoming trial, we are developing a solution which will manage the choice of users without the use of cookies. We believe this approach is reasonable and is supported by the advice we have received. Question 11

Isn't that a pain in the neck?

For most people, yes.
 
In other words, if you don't want your traffic intercepted, you will be unable to use BT for your broadband service. Sounds like a good time to find a broadband supplier who will not restrict your access to the internet when you employ security measures on your own computer.

What if the BT Webwise opt-out cookie is deleted by an antispyware utility? Will this mean that a customer gets opted in?

Yes. The ICO has requested that the system only be employed for those who have explicitly opted in, but this safeguard is not yet available.

Is my data still viewed when I am not participating?

Yes, data is always viewed. The only difference is that there is no record made against your UID to record that data.

Are you considering changing your Terms and Condition in a fine print in an email to customers (knowing well that most people will ignore it) and suddenly start peeking at every page I visit?

This happened during the trials in 2006 and 2007 which understandably upset many customers. The first you will know about current trials for Webwise is when your browser is hijacked to present you with the Webwise opt in / opt out page rather than the website you did request. At this point the Phorm / Webwise service will already be attached to your account. Opt out only affects not seeing relevant ads nor will your browser display a warning from Webwise when you request a phishing site.

What are the changes in the terms and conditions?

Only that Webwise is being added as a service which can be accepted or 'rejected'. Unfortunately no mention is made explaining the changes that need to be made to how you access the internet nor how forged Webwise cookies are placed onto your computer for all sites you visit in order for the system to work. Nor that you will be unable to access the internet if you use the hosts file to block sites.

Exactly what information passes from my computer to a third party with BT Webwise?

A clearer image of data which can be passed is available at the advertising promotion site for Webwise and advertisers create customised channels using behavioural keywords - keywords derived from searches, URLs, and contextual analysis of pages visited, with recency and frequency.

How do I permanently stop any of my personal data (which includes the sites I visit) being passed to a third party?

Stop using your BT broadband connection, or change to an Internet service provider who is not planning to use Webwise or similar profiling systems. Currently free-hotspots uses profiling revenue to fund the free service and BT, TalkTalk and VirginMedia are committed to Webwise. Other ISPs are looking to sign up.

What information does BT Webwise collect about browsing behaviour?

Everything including website addresses, keywords and search terms.

Does BT Webwise store a customer's IP address?

Yes, your IP address is stored in visitor logs of every site you visit, including the Webwise sites.

What's to stop a rogue employee of BT or Phorm collecting the data and selling it?

Good question. As this relates to security the controls are unlikely to be made public.

Do you collect any information that can identify me by name, address or any other personally-identifying information?

The data for every user is associated with a unique user identity code (UID) which is stored in Webwise cookies on your hard drive and it is the data stored by Webwise associated with the UID stored in the Webwise cookie which makes possible the matching of areas of interest for the targeted advertising.

How does BT Webwise make sure that it does not collect personal information?

Currently the program used chooses only the most common words and drops everything else including numbers longer than 3 digits. If personal data is within this, such as post codes, telephone area codes and family names nothing seen to date shows that this data can be removed.

What parties in the equation get the raw information about subscribers' activity?

BT, using software and hardware supplied by and maintained by Phorm, the owners of Webwise.

Will you use 'collective marketing' information, such as what advertising appears to be the most popular at particular times?

Webwise use this information for their own marketing metrics.

Can the service access private e-mails, webmails and other personal identifying information I enter into web forms?

All content not protected by https is profiled. Major webmail suppliers (who? - unknown) are on a 'blacklist' to prevent profiling. Form data is not accessible unless displayed on a confirmation page or included within the URL during a GET request.

If I type a postal address into a form, is that data passed on by BT to Phorm or one of their partners?

If this information is displayed on a confirmation page and the address matches words chosen to define an advertising channel, yes. As an example, "Paris" is a word match for a holiday channel. What will a post code match?

What is BT Webwise doing about password-protected areas of websites?

Nothing special. BT Webwise will use all content whether password protected or not if it is available on an http request.

If Phorm/Webwise doesn't capture form data, how does it collect search engine queries?

If Phorm behaved as it claims to behave, it would not be able to copy anything that you do on a search engine site - all scripts like Phorm are blocked from search engine domains to prevent the theft of their databases. However, when you make a search, the search term is included as part of the URL which fetches the results. It is this URL which is copied and used to find your search string. Any form data included in a URL can similarly be copied.

When will the Phorm software source code that is to be inserted into BT Webwise hardware on BT's network be independently audited/inspected, and by whom?

No data currently available. The independent expert who offered to audit the system was rejected on the grounds of having a 'conflict of interest'.

How long is any/all user data stored by Webwise/Phorm software on your Webwise/Phorm servers.

6 months

About BT Webwise Anti-fraud feature

How does BT Webwise help protect customers against online fraud?

It does not. BT Webwise requires you to have both cookies enabled and javascript enabled. Both these features DECREASE your security against online fraud. news.bbc.co.uk/1/hi/technology/7349715.stm

How does the anti-fraud feature work?

As part of the monitoring of your web surfing, pages requested are checked against a database of known phishing pages. Where a match is found, the page you requested is replaced by a page supplied by Webwise to warn you about the risk.

I already have anti-virus and anti-spam software installed. Why do I need additional security from BT Webwise?

You don't.

Why doesn't BT just block fraudulent sites?

Good question. BT could already do this by purchasing the data bases currently used by browsers and software vendors.

Can legitimate sites be accidentally listed by BT Webwise?

Legitimate sites are often hacked and infected with malware and are therefore included on warning lists supplied by some security vendors. There is no indication that the Webwise anti-phishing database will protect you from malware infected legitimate sites.

Will BT Webwise stop all fraudulent sites?

No. Only those within the database it purchases. Most fraudulent sites use https and none of these will be detected.

My web browser already provides anti-fraud protection. Will this work with BT Webwise?

Webwise hijacks browsers to read and write fraudulent Webwise cookies to your hard drive. This overwrites one of the anti-fraud protection features of your browser. As data received by the browser has been modified, browser controls and safeguards can no longer be relied upon.

About BT Webwise relevant advertising feature

How does BT Webwise's relevant advertising feature work?

Each web page you request is copied, analysed and its contents matched to advertising criteria. Your UID is updated for this match so that you will see adverts within this subject area when you visit pages that display adverts even when content is about subjects which have nothing to do with earlier page views.

Does it matter which ads I see?

Only you can answer that. Some people enjoy ads while others find them highly intrusive. When you have just booked your holiday, will you find being presented, for days and weeks afterwards, ads showing you where you should have booked intrusive?

Will BT Webwise change the ads I see when using BT Vision?

Currently only web content is included in the advertising channel partner sites. The supplier of Webwise already has the ability to include video and mobile users within the system.

Does BT have any say on nature or content of the adverts that are shown or what companies Phorm is doing business with? Does BT Webwise allow campaigns related to adult or illegal activities?

Adverts are controlled by Phorm, the supplier of Webwise's service. BT's only control over what adverts you see is dependant on data BT makes available to Webwise's advertising network to offer you targeted adverts.

About switching on and switching off BT Webwise

How can I check whether BT Webwise is on or off?

If you see webwise in your cookies with a 22 character value, webwise is on. You can also visit webwise.bt.com/webwise/index.html or webwise.com which will show the status of your webwise cookie.

How do I switch BT Webwise on or off?

Once Webwise is enabled at your ISP, you can't switch it off. Every web request is hijacked to look for whether or not the webwise cookie is in opt in or opt out mode. See webwise.bt.com/webwise/customer_choice.html where the green paths show the intercept which performs this hijack.

Will all users of my broadband connection be affected if I click 'BT Webwise Off' or 'BT Webwise On'?

The option is dependent on user login and browser choice.

What happens when I switch off BT Webwise?

The webwise cookie stored on your computer will have the UID replaced with an 'off' value. The Webwise cookie will still be requested for each website requested. The forged domain webwise cookies which store your UID will only expire after 3 days.
See PCPro Article:– Phorm boss: Opt-in is a "red herring" When you come online there will be a page saying [WebWise] is on, this is what it does and you can click and you can see a privacy video and you'll have a choice. It's not really about opt-in and opt-out, that's a red herring. It's about, do you know it is on and do you know what you're buying into. - when Webwise is on, cookies can't turn it off. Cookies just change the way the Webwise adware script behaves.

If I try to switch BT Webwise off twice, what happens?

The system will behave normally. Each time you request a new page, the webwise cookie is requested to confirm whether you have opted in or out, so it is possible to change the state between any request for web pages.

About Phorm

What is Phorm?

Phorm is an innovative technology company specialising in delivering behaviourally and contextually targeted advertising while preserving users' personal privacy and security. Phorm's partners include leading Internet Service Providers (ISPs), Publishers, Ad Networks and Advertisers.
Phorm is a Delaware, US incorporated company, with offices in New York, London and Moscow. The Company was admitted to the AIM market of the London Stock Exchange in 2004 and has over 100 employees. In 2007, 121Media (a supplier and distributor of unwelcome adware / spyware) changed its name to Phorm.

What's Phorm's connection to Russia and China?

The scripts used by Phorm are written by Russian programmers. The link with China relates to previous owners of domain names.

Does Webwise runs its own Javascript software on the users' machines? (relates to a Phorm patent where it claims it can do this)

During the trials of Phorm systems run by BT during 2006 and 2007 javascript was injected into the code written by websites. This was noticed by the users of BT broadband who understood they were infected with a virus or rootkit. You can read more about this at 2006 BT 121Media trials and 2007 BT Webwise trails
 
The Webwise scripts hosted at the ISP are used to read and write text files called cookies to your computer's disk. This includes forged cookies in the name of every website you visit, whether or not those sites themselves write cookies. You may see warning about these forged cookies when detected by security systems.

What should I do if I have further questions about BT Webwise?

Explore the Internet. As more data becomes available, it will be freely available through the Internet.

More information on protecting your data and your life from being sold is available at:

• www.badphorm.co.uk - news and technical information,
• phormwatch.blogspot.com,
• www.inphormationdesk.org
• baldyslap.blogspot.com - Draft letters requesting the Data Controller to a) stop processing data likely to cause damage or distress and b) cease, or not to begin, processing for the purposes of direct marketing personal data

Privacy is important. Those who value their right to keep their data private, and not sold to the highest bidder, run privacy protecting software on their computers and block all tracking cookies. When ISPs host the tracking software within their network there is nothing that you can do to protect your privacy.
Sign the 10 Downing Street Anti-Phorm Petition - 12,664 and counting.