Who’s been a naughty file sharer, then?

It looks as though another nail is being hammered into the Digital Economy Act’s coffin. And this time it’s the Solicitors Regulation Authority wielding the hammer. So, if the SRA is getting uneasy about what some lawyers have been up to recently, I wonder what’s going to happen next.

Some lawyers have been accused of of knowingly "targeting people innocent of any copyright breach" when they sent "bullying" settlement letters to those suspected of being involved with unlawful ("illegal") broadband ISP based Peer 2 Peer File Sharing. This has come about because they gathered public Internet Protocol addresses from file transfers (uploads) on Peer to Peer networks, and used these records to get customer details from Internet Service Providers after having first obtained a court order.

Thousands of people whose addresses were subsequently obtained then received letters which suggested they were involved with copyright file sharing. Many of these letters demanded several hundred pounds in compensation for the alleged act and a further fee to cover costs. Those receiving the messages were threatened with legal proceedings if they refused to pay, which in reality rarely ever happened.

The real scandal was that the people who sent these letters (apparently) knew that IP addresses, which are assigned to your computer each time you go online, are not an effective way of determining a computer user's true identity. At least one middle aged lady received an allegation that she was involved in downloading gay pornography – which came as an awful surprise both to her and to her son, who had not previously discussed his sexuality with either of his parents.

Sensitive personal data? But whose?

We all know that Internet Protocol addresses can easily be faked, hijacked, redirected and generally abused or used in ways that can be hard to detect. And we all know that the owner of a particular internet connection, such as in case of a hotel, business or shared public/home Wi-Fi network (secure or not), may not be the individual responsible for the actual act itself.

So I wonder what Ofcom’s going to do now. I was at one meeting today to hear an official from the Information Commissioner's Office recommend that Privacy Impact Assessments be carried out for most initiatives that involve the processing of personal information. And we all know that the Information Commissioner can now carry out privacy audits on all public authorities, whether they want to learn of his views or not. Will Ofcom carry out and publish a Privacy Impact Assessment about these proposals, in order that everyone can be satisfied that the case has been made for the initiative and that all the legitimate privacy concerns have been addressed? Will the Information Commissioner demand to see one before the process which is currently under construction goes horribly wrong?

Will Ofcom really continue to tell the Internet Service Providers to keep logs of people whose IP addresses have been possibly used by someone else for nefarious purposes, in order that they can report to the copyright owners when there have been a number of similar allegations? Could the Internet Service Providers be accused of sending thousands of bullying letters, too? These providers like to send nice letters to their customers. Not letters containing threats.

And then, finally, are Internet Service Providers really expected to cut off the accounts of people whose IP Addresses have possibly been used by someone else? Is this madness?

Or will someone come to their senses and ask themselves how much angst really needs to be caused in possibly hundreds of thousands of households up and down the country, as parents realise what their offspring have actually been up to?


Source:
http://www.theregister.co.uk/2010/11/19/davenport_lyons_sra/
http://www.ispreview.co.uk/story/2010/11/19/sra-claims-uk-law-firm-knew-file-sharing-threat-letters-targeted-innocent-people.html

.

Shhh – don’t mention the Commission’s data retention conference

So little notice was taken about an obscure European Commission conference on communications data retention, held back in July 2009, that the Commission is going to hold another one. This event is to be held in just a couple of week’s time, although I bet that hardly anyone will be aware that it is either being arranged, or how the items for discussion actually affect them.

The first session was attended by some 140 participants and speakers made up of representatives from law enforcement authorities, industry, civil society, regulators, academics and other examples of the usual suspects. The participant list makes great reading, as it reveals the names and contact details of some extremely interesting people, including someone from the Hungarian Special Service for National Security, and someone from the Romanian Intelligence Service. I hope these spooks weren’t using their real contact details. If they were, they might want to ask for them to be deleted before anyone reads about it.

The presentations were of the predictable sort.

A representative from KPN, the Dutch telecommunications company, commented that KPN was struggling with implementation. The Data Retention Directive was aimed essentially at telephony but has been “copied” to the internet.

A Swedish privacy activist commented that there was a great deal of controversy surrounding the Data Retention Directive when it was discussed by the European Parliament and some MEPs expressed “indignation, anger and frustration” at the way in which negotiations had been carried out between the chairmen of the big political groups and the UK presidency of the EU at the time. This activist could have been referring to Charles Clarke who, at the time, was the British Home Secretary, and would therefore have chaired the relevant meetings of the Council of Ministers.

A representative for a Belgian internet service provider commented that there is uncertainty about implementation requirements with a lack of harmonisation across the EU for pan-European operators. Implementation guidelines are needed to support providers implement interoperable vendor solutions. There is a lack of technical guidance with regard to response times, the format for delivering data to LEAs, the retention obligations with regards to transit and third party providers, centralised storage, internet telephony services and unsuccessful calls, to mention a few issues, results in diverging implementations across Member States. Also, providers' systems were built to be business-grade rather than forensic-grade, designed to retain data for billing, and making them suitable for Law Enforcement Authority investigations requires significant adaptation and expense.

Nothing new here.

And now, there is to be another conference, and many of the issues under consideration look quite significant. They include questions such as
• The purpose of data retention, and whether the retained information ought to be available for investigations into issues other than serious crime. What types of less serious crime, or frivolous crime – or non criminal acts – ought this information be available for?
• Should the rules should be extended to include web browsing, as well as electronic communications. [And whether there is much point in extending the rules if users are going to spend over half their digital lives browsing on Facebook (or Google), which may not be affected by these retention rules if they can successfully argue that they are not a Communications Service Provider. All the internet service providers will be able to record is thet the user has gone to Facebook (or Google). Not what they've done once they've got there.]
• Should the retention periods be tweaked?
• Should the range of authorities able to access this information be changed?
• How should Member States deal with requests from law enforcement agencies from other Member States?
• Should there be changes to the cost recovery rules?
• Should there be more rules to guarantee the security of these systems?

All of this is pretty heavy going for a day’s conference. And quite relevant too, I suppose, if we are to take as gospel the Home Office’s business plan, which I blogged about last Monday, which contained a commitment to complete work on its plans to develop and publish proposals for the storage and acquisition of internet and e-mail records by the end of December, in order that it can start to implement the key proposals between January 2011 and the next General Election.

Perhaps, at some stage, in the new spirit of transparency which is spreading through all aspects of Government, the Home Office will consult widely on what its position ought to be on the issues that will be discussed on 3 December in Brussels. Or, perhaps it may embark on what it might call a “targeted consultation exercise” with the usual suspects, just to make sure it is going to be able to deliver on any commitments (or comments) it makes.

But then again, perhaps the Home Office won’t consult at all. It may not even turn up.

Let’s see if it does any of these.


Sources:
http://ec.europa.eu/home-affairs/doc_centre/police/docs/meeting_report_09_07_14_en.pdf
http://www.poptel.org.uk/statewatch/news/2010/nov/eu-com-data-retention-discussion-paper.pdf


.

Cracking the problem of cookies

The hot news (at least where I was) today was all about cookies. No mention of the engagement of HRH Prince William and Kate Middleton. The data protection community is obviously made of other stuff, and a select group congregated in central London this afternoon to work out what the Department for Business Innovation & Skills should get Parliament to approve as the law, and how Ofcom and the Information Commissioner’s Office should enforce it.

What’s the real problem, then?

Well, the European Commission is changing the rules about the way some cookies can be used, and how some types of information stored on a subscriber’s electronic device can be accessed. It appears that by next May, the UK will have fallen into line with the new regime.

Fallen into line may be a somewhat ambitious phrase – as, right now, no-one really knows what each Member State is going to do to achieve compliance with the rules. Not only are they extremely hard to comprehend, few Member States seem to have had the will so far to try to understand and propose how the rules should be implemented. So, three cheers for BIS and for the UK, and for providing leadership to the rest of the EU in this very important issue. Where we tiptoe, others will surely tread.

There appears to be no change to the law so long as the information in a consumer’s electronic device is only being accessed because it is strictly necessary to provide the user with an information society service which they had explicitly requested.

There will however be a change to the law if it is intended that information needs to accessed for other purposes. And in these cases, the subscriber will have to provide their freely given, specific and informed consent before the relevant information is accessed for these other purposes.

As you can imagine, everyone is having a wonderful time trying to work out what cookies provide stuff which is strictly necessary for the provision of the service, and what cookies might not be permitted until the freely given, specific and informed consent turns up. So, when I type a URL and press the "Enter" key, apparently some of what I see will arrive because it is what I wanted to see, and apparently some of what I see will arrive because I will have somehow consented to seeing it.

Does this matter?

It could matter if you run a website and try to make any money out of it. If all you do is provide what the geeks call an information society service, then you might be fine. Unless, of course, you use cookies for other purposes – such as counting unique users to your site, or working out what interests them on your site, so that they (whoever they are) can be served with more relevant advertising banners (that they probably won’t notice anyway). So I think it affects the Information Commissioner's own website as well as many other Government websites, as they try and do cool things like counting unique users to their site, too. In practice, though, I would expect people to adopt an increasingly flexible definition of what is strictly necessary. It could easily turn into something pretty close to what a website owner decides is simply useful to have.

What is going to happen?

Well, I think it’s likely that two separate things could happen.

First, the browser manufacturers (of whom you can count on the fingers of both hands) will probably be invited to meet and, in a concerted manner (but not in a manner that will incur the ire of the competition authorities) work out whether it’s possible to provide users with a more granular way of making choices about what types of cookies to accept, and from whom. The cool new descriptive term for this is the development of enhanced browser settings. It appears that the burgers at the European Union don’t like the concept of default browser settings, and instead want evidence that users have made choices about their settings. But, let’s get real here. How many people are really sufficiently interested and engaged in these matters to want to be provided with clear and comprehensive information about the consequences of the various browser setting choices that will be made available to them. I guess that far more people probably read the new terms and conditions on their iTunes account each time Apple changes them. And that’s not very many.

Second, the 4 million website owners (yes, there could be that many) will probably be expected to read the implementing guidance that will eventually appear on the BIS and ICO websites, and they will then be expected to work out for themselves whether it’s possible to provide users with a more granular way of making choices about what types of cookies to accept, and from whom. The cool new descriptive term for this activity is likely to be trying not to give the impression people are ignoring an incomprehensible law.

If I were a busy regulator, I would ask myself whether I should try and do a deal with, say, 10 browser manufacturers, or hold out and negotiate an understanding with 4 million website owners.

No contest, really.

I think I would start by approaching the browser manufacturers, and make so much noise that the website owners who use techniques other than cookies to access information for purposes other than to serve up the requested information on their website, begin to understand that they may have a bit of a problem. And I would wait and see if they came up with any cunning plans to become compliant with the law, and take no action - at least until anyone complained. If these web owners were causing harm to users and were not being transparent and were not getting their consent, then of course I would be down on them like a ton of bricks. But I suspect that, as a busy regulator, I might well have far more serious matters of poor compliance on my regulatory horizon. And I would want to focus on those matters, rather than waste scarce resources trying to improve behaviour that didn’t seem to be doing anyone any harm, anyway.



Postscript:
Perhaps, after all, I really am put of touch with the rest of society. What on earth am I really doing, blogging about cookies, when almost everyone else I know is celebrating the great news of the Royal engagement!

.

Oh Err, a radical approach to tackling illegal internet content

I’ve just read an unusually interesting contribution to the debate on how we should deal with illegal content on the internet.

It came in the form of a speech at last month’s Annual General Meeting of the Internet Watch Foundation, and was delivered by Martin Geddes, former Strategy Director at BT and a refreshingly radical thinker about this stuff. Don't switch off yet. If your mind is broad enough to take the music of the Gorillaz, it ought to be able to appreciate what Martin is trying to say. Here’s a flavour:

The danger to the Internet industry is political. Is it inevitable the agenda will be driven by politicians rather than industry? This depends on the amount of scare stories in media. Youth usage is up, and temptation to interfere becomes too high. Just as with the ill-considered Dangerous Dogs Act of 1991, we may see the ‘Dangerous Devices Act of 2013’ as being the low point that wakes the industry up to its responsibilities.

Given the size of the threat to their ability to innovate and revenue models, surprisingly little is spent on CSR by internet and online media companies. Mumsnet, Consumer Reports, and the Daily Mail can change the political environment faster than any technology solution can adapt. There is high uncertainty on future events. These stakeholders need to be involved, educated and participate in addressing these problems.

In tackling illegal content, there are powerful lessons to follow from the worlds of drugs, political and religious extremism, and copyright piracy. Most critically, decentralised and multi-disciplinary solutions work best. This requires transparency, open source techniques, peer networks of industry practitioners, and voluntary co-operatives to take action.

The achievable mission for the Internet industry is to prevent contagion of illegal content into mainstream society. Containment of the problem is realistic, eradication in the face of multiplying technology complexity is not.

The music industry, insisted that the utterly natural human impulse to share music non-commercially constitutes theft. As a result the industry lost the moral authority it needed to preserve copyright as a social institution. It became normal and acceptable to break the law, especially for younger people. At the extreme example of this social norm breaking down, The Economist reports that the total sales of CDs in China in 2009 was only $19 million .

The Internet is an amplifier of human social behaviour. Tackling determined paedophiles through Internet blocking technology is a futile exercise. Preventing widespread access to such content is not. Fortunately the use of illegal content is rightly seen as repulsive by the great majority of people, who do not seek to find it and wish to see it actively prevented. Contagion containment fits with the wishes of ordinary Internet users, and does not require ‘1984’-like total control over the Internet.

In order to prevent contagion into the mainstream, a broader response is required.

• Political: A ‘panic button’ in social media applications or in browsers, and safe harbour law on seeing and reporting illegal content, in order to capture data about the problem from the end users.
• Economic: As the Net evolves, make the cost for Chinese and Russian sites more expensive than revenue. Make it cost the bad guys more. Tax trade with low-compliance hosting sites to reflect social harm. Make payment and content delivery networks carry more responsibility for whom they do business with.
• Social: Make corporate social responsibility (CSR) a board-level priority, to pre-empt political interference. Engage with stakeholder groups outside of the technology industry – schools, journalists, mental health care providers, even mainstream adult content providers.
• Technical: Focus on traceability and auditability in content and communications, allow for a more flexible response to be built on top of this data. Put more blocking intelligence at the ‘edge’ in the device and operating system.

Martin was perhaps at his most radical when suggesting a social role for internet service providers to play in dealing with the users of illegal internet content. Those of a delicate constitution should avoid reading the rest of this blog. As far as he was colncerned, the best response is to help the mainstream media adopt a less hysterical attitude to casual users of illegal content; it is a mental health problem that demands education, not just vilification. Work with the NHS to offer helplines, and if you block access to a site make that transparent and offer a place to get such help for those at the margin of use of illegal content. Engage people with different skills sets: epidemiologists , psychologists, and anthropologists are as valuable as network engineers.

This is strong stuff. It makes an awful lot of sense, but I wonder how many politicians have the stomach to look their constituents in the eye and explain that they are helpless because they are being asked to deal with a behavioural condition rather than an issue that will readily respond to regulation. I think its the industry that needs to exert more control over this playground, not the politicians.

But that’s never prevented politicians from trying (and frequently failing) to regulate behavioural conditions before.


Source:
http://www.martingeddes.com/papers/

.

Clarifying the “right to be forgotten”

One of the proposals contained in the European Commission’s recent plan to amend the data protection directive came from the premise that individuals should always be able to access, rectify, delete or block their data, unless there are legitimate reasons, provided by law, for preventing this.

Today’s image appears in a number of newspapers, and is of a group of demonstrators in triumphal poses on the roof of Millbank Tower, during the riot on 10 November. I wonder how many of them are regretting their decision to climb to the top of the building, in protest at the Government's decision to increase tuition fees for students. I also wonder if this image includes a picture of the person who hurled a fire extinguisher from the roof. It crashed to the ground inches from policemen who said they would almost certainly have been killed if it had struck them. Police Federation representatives have called for the person responsible to be charged with attempted murder. Among the 55 or so arrested in relation to the protests, ten were still at school.

Millbank Tower is designed with one wing of 27 floors and the other wing of just 8 floors. The students climbed up to the 8th floor roof - above the offices occupied by the Conservative Party, Conveniently sited next door to the MI5 Headquarters, Millbank Tower provides office accommodation for a number of high profile political and other organisations. Current and previous tenants have included the Labour Party, the United Nations, the Central Statistical Office, the Parliamentary Ombudsman Commission, the Local Government Ombudsman, UK India Business Council and the Ministry of Justice Records Management Service. And yes, it’s also the London home of the Information Commissioner’s Office.

I was out in Westminster the night after the riot with someone who also works in that building. He described how the initial frisson of excitement among the office workers quickly turned to apprehension, as they realised that the mob was attacking a very thin blue line of riot police. And then the live television pictures of rioters, inside the building and just a few floors away from where he was working, caused growing consternation. It’s really not funny when you find yourself caught up as an innocent victim of the chaos. Many of the office workers were extremely distressed. You don't expect to face an angry mob, or to fear your life is in danger, just because you share an office building with workers from a mainstream political party.

But should the people in this image be able to re-write history and demand that their personal data be deleted from the image?

The answer can only be no – and the reason must be that it is not their personal data any more.

This seems to be the logic of the Commission’s proposal, as it suggests that the right to be forgotten relates to the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes. This is the case, for example, when processing is based on the person's consent and when he or she withdraws consent or when the storage period has expired.

In instances such as the riot, the processing of their personal information was never based on consent in the first place. It was based on other conditions in the Directive.

And what this will probably lead to is more data controllers wondering if consent really is an appropriate condition for processing personal information, or whether they ought not rely on other conditions if they can possibly help it. At work, for example, I always prefer to use the legitimate interests of the data controller condition, rather than rely on consent. It’s a much easier test to meet for all practical purposes. And it gives me much more control over how I use information that is required for, say, coroprate, purposes.

I would hate to see more politicians, for example, trying to argue that it is appropriate that they have a right to insist that we forget about any of their previous misdeeds. Memories of the recent sleazy Parliamentary expenses scandals have not yet faded away.

Indeed, we have Wikipedia to thank us for providing us with a tool that enable us to refresh our memories every now and again. The media are currently running stories about the ease with which journalists managed to hack their way into the voicemail accounts of many high profile individuals some 5 years ago. The House of Commons Home Affairs Select Committee is currently carrying out yet another enquiry into the way the Metropolitan Police investigated the allegations.

But take a good look at the record of the Chairman of the Home Affairs Select Committee. Look him up on Wikipedia. And ask yourself how many of those allegations of misbehaviour you’ve already forgotten (or didn’t know about in the first place). If people who have allegedly behaved like that can end up as the Chairman of an influential Parliamentary Committee, then the demonstrators who are pictured on the roof of Millbank Tower probably have nothing to fear should they wish to become public servants.


Sources:
http://ec.europa.eu/justice/news/consulting_public/0006/com_2010_609_en.pdf
http://www.dailymail.co.uk/news/article-1329132/TUITION-FEES-PROTEST-Student-arrested-throwing-extinguisher-police.html
http://en.wikipedia.org/wiki/Keith_Vaz

.

Depending on the kindness of strangers

It’s that time of the year when the corporate gift season gets into full swing. There can be few readers who haven’t at some stage in their career (or even this month) received a small gift as a token of appreciation for attending some corporate event or another.

Same with me.

My last two gifts were very appropriate.

First up was a data protection event sponsored by Sophos, the security specialists. As its website proudly proclaims: Trusted by 100 million users and endorsed by industry analysts as a leader, Sophos provides a full range of endpoint, encryption, email, web and NAC solutions that are simple to deploy, manage and use.

Their gift was a very handy book which, in just over 100 pages, explained in language that even my mother might understand, all a busy person really needed to know about security threats, security software, safety tips and how to avoid computer viruses. It’s the ideal primer if ever you were required to blag your way into an IT security conference and appear authentic.

Second up was a data protection event sponsored by Bird & Bird, the international commercial law firm which operates on the basis of an in-depth understanding of key industry sectors. As its website proudly proclaims: Our leading International Privacy & Data Protection Practice advises a wide range of corporate and other organisations around the world, reflecting the firm’s strengths in sectors such as Communications, Media, E-commerce, Financial Services, Health and IT.

Their gift was a pair of USB drives, suitably endorsed with the Bird & Bird logo. Woops. They weren’t in a sealed package so I wasn’t sure if they had been tampered with. (But of course I trust the team at Bird & Bird.) Nor were they encrypted USB drives – and we all know what the Information Commissioner’s Office thinks about personal data being transported when it’s not encrypted. Never mind – the session, on cookies, was being hosted by a former Deputy Information Commissioner, so surely their marketing team had checked the suitability of the gift with him before they ordered them ... Well, they certainly will do next time!

I don’t mean to be spiteful or overly critical about Bird & Bird – after all, their data protection advice is invariably of the highest quality, and they hold wonderful parties.

My point is that we data protection professionals should be careful when offering – or accepting – electronic storage media as we’ve all read the horror stories that abound. But never in my career as a recipient of corporate gifts have I been offered a USB drive that was either packaged and protected with a tamper proof seal, or accompanied with a warranty that it didn’t contain any spyware or computer viruses. And haven’t we all both received and presented a number of these USB drives to colleagues at various corporate events over the last few years?

Anyway, I am extremely grateful for both sets of gifts, and I can assure any future givers that I will most humbly thank them for their present and that I will try to make good use of it.

Especially when I unwrap the gift and it reveals itself to be a bar of chocolate.

.

The Home Office can't really want to prevent behavioural advertising

Oh dear. The Home Office may have, inadvertently, published some advice a few years ago that could now, if accepted, prevent the very practice it didn’t really intend to ban.

Yesterday’s blog referred to the issues that face organisations who are keen to understand what internet users are up to, in order that they can send them relevant adverts. Some of this activity may involve understanding what a user is doing while they are surfing the internet. This is likely to involve some form of interception of their communications.

In a world where definitions are very important, the definition of what constitutes a communication is very important. A communication does not only mean a voice or a text message. It also means, thanks to changes to the e-Privacy Directive (as amended by Directive 2009/136/EC), browsing on the internet. The definition covers any information exchanged or conveyed between a finite number of parties by means of a publicly available communications service. This does not include any information conveyed as part of a broadcasting service to the public over an electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information.

Back to the plot.

In the light of general concern among some people in the European Commission that British interception laws are too lax, the Home Office has decided that the hurdles over which the interceptors should jump are not sufficiently high. They’ve taken a good look, in particular, at the provisions in section 3(1) of RIPA, which allows interception to take place if both the sender and the recipient have reasonable grounds for believing that consent has been given. And they don’t like what they’ve seen.

My blog yesterday focussed on the fact that the Home Office hoped that all would be sweetness and light if it were simply to change the criteria which legitimises lawful interception. Rather than rely on the belief that both the sender and the recipient had reasonable grounds for believing that consent has been given, the Home Office was planning to up the ante to require that both sender and recipient of the communications must have consented to the interception. And, in this context, the consent would have to be freely given, specific and informed.

I pointed out that this might, in practice, be an impossibly high standard to achieve, and thus a lot of behavioural advertising activity which is currently considered lawful would suddenly become unlawful.

Having had the opportunity to reflect on this matter today, I’m even more sure that my fears are legitimate. Some types of behavioural advertising, particularly when they are carried out by third parties, rather than the user's Internet Service Provider or directly by the owner of the web page that the user is accessing, need to be looked at quite carefully. I do hope that these third parties take this opportunity to comment on the Home Office's proposals.

I’ve also just been reminded of some advice, dated January 2008, helpfully provided by a well-respected Home Office official to a privacy activist back in March 2008. (Well, I certainly respect that Home Office official.) The advice was entitled Targeted online advertising: interception of communications or not? If it is, is it lawful interception?

The advice concluded that targeted online advertising was a legitimate business activity as it was advertising undertaken with the highest regard to the respect for the privacy of ISPs' users and the protection of their personal data, and with the ISPs' users consent, expressed appropriately. And ... The purpose of Chapter 1 of Part 1 of RIPA is not to inhibit legitimate business practice particularly in the telecommunications sector. Where advertising services meet those high standards, it would not be in the public interest to criminalise such services or for their provision to be interpreted as criminal conduct. The section 1 offence is not something that should inhibit the development and provision of legitimate business activity to provide targeted online advertising to the users of ISP services.

But the advice also noted the difficulty of securing consent from the host or publisher of a web page in order to legitimise the interception activity. Section 15 of the note uses the fatal phrase implied consent: “It may be argued that section 3(1)(b) is satisfied in such a case because the host or publisher who makes a web page available for download from a server impliedly consents to those pages being downloaded.”

But hasn’t the Home Office just argued that implicit consent isn’t sufficient, and that instead it must be freely given, specific and informed?

And if so, how is the Home Office going to dig itself out of this hole?

My cunning plan to get round this mess is to change the law to allow lawful interception if at least one of the parties (the sender or the recipient) provides their freely given, specific and informed consent, and the other party can at least be presumed to have provided their consent. It's simply not going to work if both parties have to meet the high standard of freely given, specific and informed consent.



For those who are seriously interested in this issue, I have re-published the Home Office's advice and it appears below. I apologise for its length, but it makes very useful bedtime reading.


1.Targeted online advertising enables ISPs, web publishers and advertisers to target consumers with contextually and behaviourally relevant messages based upon real time analysis of users' browsing behaviour, and done anonymously without reference to any personally identifiable information. Equally it offers ISPs' users an enhanced user experience in terms of the advertising and marketing they may be exposed to.

2. This note offers informal guidance on issues relating to the provision of targeted online advertising services. It should not be taken as a definitive statement or interpretation of the law, which only the courts can give.

TARGETED ONLINE ADVERTISING: INTERCEPTION OF COMMUNICATIONS OR NOT?

** Do targeted online advertising services involve the interception of a communication within the meaning of sections 2(2) and 2(8) of the Regulation of Investigatory Powers Act 2000 (RIPA)? **

3. The meaning and scope of interception of communications is set out in sections 2(2) to 2(8) of RIPA.

4. Section 2(2), RIPA reads: "a person intercepts a communication in the course of its transmission .... if, and only if he ...... so monitors transmissions made by means of the system ...... as to make some or all of the contents of the communication available, while being transmitted, to a person other than the sender or intended recipient".

5. Section 2(8), RIPA reads: "... contents of a communications are to be taken to be made available to a person while being transmitted ... [in] any case in which any of the contents of the communication, while being transmitted, are diverted or recorded so as to be available to a person subsequently."

6. The provision of a service to deliver targeted online advertising will tend to involve a person (an ISP and/or a targeted advertising provider on behalf of an ISP) monitoring transmissions made by means of a relevant telecommunications system so as to make some of the contents of a communication available, while being transmitted, to a person (the ISP and/or the targeted advertising provider) other than the sender or intended recipient of the communication.

7. Targeted online advertising services operate by delivering a cookie, including a unique user identity (UID), to an internet service user's computer which supports the advertising service. The UID is processed automatically in a closed system (which does not associate an IP address with the UID). The system performs an analysis of URLs and key words from web pages which allocates the UID to relevant advertising categories. Once this analysis is completed the URLs and key words are deleted from the system. The system then uses that analysis to match advertisers' criteria and to enable ISPs' users to be targeted with advertising based on their browsing interests (which includes web pages viewed, search terms entered and responses to online advertisements).

8. For the purposes of section 2(2) and (8), "available" is likely to be taken to mean that a person could in practice obtain those contents for examination. Processing of the contents of a communication under human control will be likely to be regarded as having been made "available" to a person and will therefore have been intercepted within the meaning of RIPA.

9. Where the provision of a targeted online advertising service involves the content of a communication passing through a filter for analysis and held for a nominal period before being irretrievably deleted - there is an argument that the content of a communication has not been made available to a person.

10. Where the provision of a targeted online advertising service involves storing and processing the content of a communication in circumstances where it would be **technically possible** for a person to access the content that can be regarded as having been "diverted or recorded so as to be available to a person subsequently". This might include circumstances involving a proxy server analysing the request to view a web page, in the course of it being downloaded, and presenting the user with the web page and targeted advertising content.

11. Where the technology involves the user's browser executing a script to download targeted advertising content to complement a previously or near simultaneous download of a web page, it can be argued that the transmission of a communication ceased at the point the web page reaches the user's browser, that the end user's computer is not part of the telecommunications system and that the communication has not been made available to a person **while being transmitted**.

TARGETED ONLINE ADVERTISING: IS IT LAWFUL INTERCEPTION?

** To the extent that targeted online advertising services might involve interception of communications, can they be offered lawfully without an interception warrant in accordance with section 3 of RIPA? **

12. Section 3, RIPA, where relevant to targeted online advertising, creates two situations in which interception without a warrant may be lawful: section 3(1), interception with consent and section 3(3), interception for purposes connected with the operation of the telecommunications service.

13. Section 3(1), RIPA, provides that: "conduct consisting in the interception of a communications is authorised if the communication is one which, or which that person has reasonable grounds for believing is, **both**: (a) a communication sent by a person who has consented to the interception; **and** (b) a communication the intended recipient of which has so consented."

14. The provision of a targeted online advertising service to an ISP user who has consented to receive the service should be able to satisfy section 3(1)(a). Each service will have its own relevant user agreements. Where consent to receive targeted advertising is included in the user's contract and the user should be alerted to the possibility of opting out of the targeted online advertising service at regular intervals, 3(1)(a) is arguably satisfied.

15. A question may also arise as to whether a targeted online advertising provider has reasonable grounds for believing the host or publisher of a web page consents to the interception for the purposes of section 3(1)(b). It may be argued that section 3(1)(b) is satisfied in such a case because the host or publisher who makes a web page available for download from a server impliedly consents to those pages being downloaded.

16. Section 3(3), RIPA, provides that: "(3) Conduct consisting in the interception of a communication is authorised by this section if: (a) it is carried out by or on behalf of a person who provides a ...telecommunications service; and (b) it takes place for purposes connected with the provision or operation of that service ..."

17. The provision of a targeted online advertising service, contracted by an ISP as part of the service to the ISP's users, can probably be regarded as being carried out "on behalf of" the ISP for the purposes of section 3(3)(a).

18. It is arguable that a targeted online advertising service can be "connected with the provision or operation of [the ISP] service". The RIPA explanatory notes for section 3(3) state: "Subsection (3) authorises interception where it takes place for the purposes of providing or operating a postal or telecommunications service, or where any enactment relating to the use of a service is to be enforced. This might occur, for example, where the postal provider needs to open a postal item to determine the address of the sender because the recipient's address is unknown."

19. Examples of section 3(3) interception, very relevant to the provision of internet services, would include the examination of e-mail messages for the purposes of filtering or blocking spam, or filtering web pages which provide a service tailored to a specific cultural or religious market, and which takes place with user's consent whereby the user consents not to receive the filtered or blocked spam or consents (actively seeks) a service blocking culturally inappropriate material. The provision of targeted online advertising with the user's consent where the user is seeking an enhanced experience and the targeted advertising service provides that.

** Conclusion **

20. Targeted online advertising services should be provided with the explicit consent of ISPs' users or by the acceptance of the ISP terms and conditions. The providers of targeted online advertising services, and ISPs contracting those services and making them available to their users, should then - to the extent interception is at issue - be able to argue that the end user has consented to the interception (or that there are reasonable grounds for so believing). Interception is not likely to be at issue where the user's browser is processing the UID and material informing the advertising criteria.

21. Where targeted online advertising is determined and delivered to a user's browser as a consequence of a proxy server monitoring a communication to download a web page, there may be monitoring of a communication in the course of its transmission. Consent of the ISPs' user and web page host would make that interception clearly lawful. The ISPs' users' consent can be obtained expressly by acceptance of suitable terms and conditions for the ISP service. The implied consent of a web page host (as indicated in paragraph 15 above) may stand in the absence of any specific express consent.

22. Targeted online advertising can be regarded as being provided in connection with the telecommunication service provided by the ISP in the same way as the provision of services that examine e-mails for the purposes of filtering or blocking spam or filtering web pages to provide a specifically tailored content service.

22. Targeted online advertising undertaken with the highest regard to the respect for the privacy of ISPs' users and the protection of their personal data, and with the ISPs' users consent, expressed appropriately, is a legitimate business activity. The purpose of Chapter 1 of Part 1 of RIPA is not to inhibit legitimate business practice particularly in the telecommunications sector. Where advertising services meet those high standards, it would not be in the public interest to criminalise such services or for their provision to be interpreted as criminal conduct. The section 1 offence is not something that should inhibit the development and provision of legitimate business activity to provide targeted online advertising to the users of ISP services.



Sources:
http://www.homeoffice.gov.uk/publications/consultations/ripa-effect-lawful-intercep/ripa-amend-effect-lawful-incep?view=Binary
http://cryptome.org/ho-phorm.htm

.