One of the things that astonished me in 1999 when I was campaigning against the Regulation of Investigatory Powers Bill was the way it would grant sweeping powers of surveillance not just to genuine security authorities, but effectively to every jobsworth in the country. And lo! so it has proved. Here’s a fascinating Telegraph report on the latest abuse.

A council has used powers intended for anti-terrorism surveillance to spy on a family who were wrongly accused of lying on a school application form.

For two weeks the middle-class family was followed by council officials who wanted to establish whether they had given a false address within the catchment area of an oversubscribed school to secure a place for their three-year-old.

The “spies” made copious notes on the movements of the mother and her three children, who they referred to as “targets” as they were trailed on school runs. The snoopers even watched the family home at night to establish where they were sleeping.

In fact, the 39-year-old mother – who described the snooping as “a grotesque invasion of privacy” – had held lengthy discussions with the council, which assured her that her school application was totally in order.

Poole borough council disclosed that it had legitimately used the Regulation of Investigatory Powers Act (RIPA) to spy on the family.

Ludicrously, the Council is correct. See here for a pdf of some of the snoopers’ logs.

From BBC NEWS…

Technical analysis of the Phorm online advertising system has reinforced an expert’s view that it is “illegal”.

The analysis was done by Dr Richard Clayton, a computer security researcher at the University of Cambridge.

What Dr Clayton learned while quizzing Phorm about its system only convinced him that it breaks laws designed to limit unwarranted interception of data…

Richard says, in part:

Phorm assumes that their system “anonymises” and therefore cannot possibly do anyone any harm; they assume that their processing is generic and so it cannot be interception; they assume that their business processes gives them the right to impersonate trusted websites and add tracking cookies under an assumed name; and they assume that if only people understood all the technical details they’d be happy.

Well now’s your chance to see all these technical details for yourself — I have, and I’m still not happy at all.

More here on the BT spokeswoman’s attempt to defend on TV the company’s covert experiment with Phorm.

From The Register…

BT secretly intercepted and profiled the web browsing of 18,000 of its broadband customers in 2006 using advertising technology provided by 121Media, the alleged spyware company that changed its name to Phorm last year.

BT Retail ran the “stealth” pilot without customer consent between 23 September and 6 October 2006. The technology was approved, pending a further trial*.

Documents seen by The Register show that the companies used the secret profiles to target advertising at broadband customers when they visited certain popular websites.

Phorm had purchased commercial space on these websites, although their URLs are not included in the documents. The groups targeted included people interested in finance (for an Egg credit card campaign), weight loss (a Weight Watchers campaign), and jobs (a Monster.com campaign).

The technical report drawn up by BT in the wake of the 2006 trial states: “The validation was made within BT’s live broadband environment and involved a user base of approximately 18,000 customers, with a maximum of 10,000 online concurrently.

“The customers who participated in the trial were not made aware of this fact as one of the aims of the validation was not to affect their experience.”

The cant implicit in that last sentence is breathtaking. But the more important question is whether BT has committed a criminal offence. Effectively all 18,000 test subjects were ‘opted-in’ without their knowledge.

BT has not answered The Register’s question, posed on Friday morning, over whether it believes intercepting and profiling the web traffic of 18,000 customers without telling them was a lawful act.

BT also refused to reveal where in the national broadband network the thousands of guinea pigs were sourced from.

One senior source in the broadband industry we spoke to was appalled by BT’s actions. “This is extremely serious,” he said. “Data protection errors are generally viewed as a potentially bad thing by the industry, but not a real threat to an ISP’s reputation. This seems like a breach of criminal law, which is much, much worse.”

Meanwhile, Don Foster, the Liberal Democrat shadow secretary of state for culture, media and sport, has written to the chairman of BT asking him to explain his firm’s secret trial of Phorm’s advertising technology last summer. And William Hague, the Conservative’s shadow foreign secretary, has written to the Department for Business, Employment and Regulatory Reform, voicing constituents’ opposition to the deals signed by BT, Virgin Media and Carphone Warehouse to spy on the web browsing of millions. It’ll be interesting to see what happens next.

If you’re thinking of signing up to a new ISP, you know which ones to avoid.