Phorm's CEO hosted a public question and answer session tonight on the Phorm system and how it works. Below is an unedited transcript of the session, remarkable for the direcness of the answers which is refreshing from a senior company executive.


Welcome to Webwise Live Chat - March 6, 2008
KentErtugrul: Hello thank you all for coming..


MBurgess: Kent is just getting into the swing - he's answering a question from M4rk ...

m4rk: Hi Kent, how do I stop my browsing habits from being sent to Phorm's servers by my ISP?
KentErtugrul: Webwise is explicitly desined to make it posible for anybody to easily opt out. Not only will the first thing you see be a window offering you a choice as to whether or not to participate, you will be reminded periodically as you browse through the ad slots inside the websites that you browse, that Webwise is on / off. You will then be able, simply by clicking on any of the ads, to opt in or out. Once launched, Webwise will offer users an unprecedented level of transparency in freely chosing at any time whether or not to participate


KentErtugrul: Apologies for my poor typing at speed by the way

wg: My Question:- why is the IT community up in arms over Phorm, when they seem quite happy to use Google, knowing full well that Google uses the searchs to delivery contextual adds, AND have Google store the data for a year.
KentErtugrul: Good question - I firmly believe tht if people undersood better what we are doing, they would welcome what we are doing as a giant step forward in data storage, privacy and transparency


guest: Are we opting out of the ad system of of the actual IP packets from touching 3party systems (ie yours) within the ISP domain?
MBurgess: Both. When you opt out, your browsing information is not passed to Phorm, and as a result, you won't see any targeted ads.

However, the websites you view won't stop showing you ads - they will just be untargeted.


Jim_Murray: What is Phorm's response to the opinion of Professor Sommer (LSE) that the implementation of this technology as proposed by some ISP's may breach RIPA legisaltion?
KentErtugrul: Firstly, we do not believe that Professor Summer has a full understanding of how our system works. We have offered to walk him through it and would welcome the opportunity to do so, just as we have any number of reglatory authorities, including the Home Office which is responsible for the appllication of RIPA.
Secondly, you should be aware that we have spent an enormous amount of time, as have our ISP partners, verifying that all of our activities are fully compliant with all regulation. I believe that it is reasonable to suggest that if BT, Virgin and Carphone Warehouse are all participating, it is because they have fully satisfied themselves of the legality of their decision.

Dephormation.org.uk: Will Phorm be able to profile the http requests used by web services/SOAP commonly used by applications like iTunes, Windows Media Player, Google Earth, remote desktop, and instant messaging clients?

MBurgess: No, prior to the Phorm analysis, the system checks the HTTP user-agent header and ignores any requests that are not from a whitelist of supported browser types (Firefox, Opera, IE).

TheObserver: So if you opt out your data never touches a Phorm server? This is at odds with much coverage, which suggests the data still goes to your server but you discard it if the opt-out cookie is present.
MBurgess: Yes. There is widespread misunderstanding of how the system works, which is why we are keen to set the record straight...

Jim_Murray: Further, how do you respond to the statement by Professor Anderson (Cambridge University) in a This is Money article that 'if you care about your privacy, do not use BT, Virgin or Talk Talk'?
KentErtugrul: I believe that given the chance to fully understand our technology, Professor Anderson will reach the same conclusion as Privacy International, Ernst and Young and any number of key privacy stakeholders, that Phorm represents a major breakthrough in online privacy. There is no online participant today which manages to generate such a level of relevance in advertising while simultaneously maintaining complete anonymity, no storage whatsoever of browsing history and such a transaprency as to choice of participation. If you look at your browser right now, you will see that perhaps hundreds of cookies have traked your activity online. You never gave permission for any of that, they all store where you have been and shutting off cookies makes the internet basically unusable. Wold it not be better to have something far more useful from an advertiser's perspective, which stores no data at all as to browsing history and for the first time gives users a clear and readily accessible on / off switch?

Dephormation.org.uk: Will the 'opt out' cookie expire? Why? After what time period? If I flush my cookies, will I need to 'opt-out' again?
MBurgess: The opt-out cookie expires after two years. Why? Two years is a LONG TIME on the Internet! Seriously though, we would consider extending the lifetime if you think it's a big issue ...

Yes, if you delete your cookies, you would need to opt out again, unless you block cookies from webwise.net, in which case you will be opted out permanently.

Dephormation.org.uk: If I use a web mail or forum application, like HotMail, Slashdot, Yahoo Groups, or Virgin Webmail, will Phorm be able to see/use the contents of the emails/messages I read?

MBurgess: No, we don't analyse the content of webmail sites.

Jim_Murray: Mr Burgess stated that 'if you opt out, your browsing information is not passed to Phorm'. Does this mean that should a user opt out of the Phorm system no equipment belonging to Phorm will ever see any data? If so, how is the decision made as, being cookie bases, some interception must occur in order to make that decision.
MBurgess: The ISP controls whether the browsing data is passed to Phorm. Its systems check for the presence of the cookie.

fieldmouse: I don't want to be bombarded with more advertising
KentErtugrul: Nobody wants to be bombarded with ads. In fact if you want to reduce the amount of advertising you see,Webwise is probably the best thing to come along. The reason is simple: you get bombarded with ads because advertisers today have no idea of the interests of the people to whom they are advertising. So the only way they can get any cmpaign to work is to throw hundreds of ads at you to see what sticks. It is a terrible system. It wastes your time and attention and wastes their money, whilst generating minimal revenue for only a few websites. If advertisers were aware of the product categories which interested veiwerss, the net result wold be far less advertising.

m4rk: If you are so open about how your system works, why don't you simply publish the information on your website so that your detractors can inspect it?
MBurgess: We are going to update the website with more detailed information about how the system works for precisely that reason. Watch this space ...

Dephormation.org.uk: Will any data gathered be sent to China or the USA? Why isn't it processed in the UK?
MBurgess: Browsing data is ONLY processed within the UK ISP's network. It is not sent to China or anywhere else.

Dephormation.org.uk: Will the Virgin Phorm UID also cookie be encrypted? (the BT Phorm UID is). If Phorm were as open and transparent as you claim, this UID should not need to be encrypted.

MBurgess: The UID is not encrypted: it is a randomly generated binary string that contains no information, but is just used to guarantee uniqueness. You're unique!

AnthonyL: who are the advertisers that work with Phorm?
KentErtugrul: Advertisers generally have applauded the introduction of Phorm, which transforms their ability to only show ads to people who are interested in their products, thereby making their marketing budgets much more effective

Jim_Murray: Could Mr Burgess clarify exactly what he is considering to be a Phorm server? At present there does not seem to be a clear understanding of where, exactly the decision to process or not to porcess information is made and what information from the page is available at that point>
MBurgess: We're going to show the demarcation in the new detailed description on the website so that you can see what we mean. Sorry you've had to wait for this.

m4rk: Is it true that phorm intercepts and modifies the response to every single web page I view?
MBurgess: No, we do not modify pages at all.

Chroma: How vulnerable is the system to external parties? by that i mean, how concievable is it for a criminal organisation to effectively hijack the hardware and modify the code to gain details on peoples information?
MBurgess: Obviously we are very concerned about security, and we have precautions against compromise occurring, and monitoring to detect attempts. It's worth remembering though, that we don't have personal data or clickstream history stored in the same way as Google or AOL, so accidental or malicious disclosure is impossible.

phkphorm: MBurgess - why do we need to be "unique" if Phorm have no interest in tracking who we are?
MBurgess: We do not know and cannot know who you are. But to deliver relevant material to you, we need to distinguish your browser from the millions of others on the net.

Ksg: How does Phorm advantage us as a user?
KentErtugrul: Good question with several answers. Webwise brings the following benefits to users:

1) Reduces the amount of irrelevant advertising which you see as you browse
2) Long term, reduces the amount of advertising which you see altogether
3) Dramatically enhances the landscape of online privacy by introduding, for the first time, a system which is completely anonymous, keeps no record of where you ahev been or what you have searched for and gives you a clear and transparent on/ off switch
4) Makes many more of the websites which you visit much more profitable, making the internet a more vibrant, interesting and relevant place to be
5) Protects you from online fraud without having to download software, switch it on or update it. Remember that the most likely victims of phishing attacks are the least likely to to have taken the necessary steps to protect themselves
6) Allows ISPs to give you a better quality internet
7) Creates a "Google while browsing" web experience
8) Creates many other additional opportunities which we will be presenting in the future, each of which is very beneficial and each of which, like webwise, will always be an open choice on the part of users as to whether or not to embrace

narcosis: What sort of impact will the scanning & tagging of http traffic have on response times during peak surfing times ?
MBurgess: Pages are not tagged (or modified), and the keyword analysis process is offline so it can't affect response times. The ISPs are very concerned not to interfere with users' browsing experience.

Huw_Jerse: Isn't the truth of the opt-out versus opt-in not that no-one would opt in if allowed an informed free choice?
KentErtugrul: The reality is that extensive market research was conducted by the ISPs prior to launching webwise. Although many of the commentators in this forum represent a somwhat self-selected group of people whose reaction is negative, the overwhelming majority of people responded extremely positively to a safer, more relevant internet free of charge. Why not give it to them?
Similarly, how would you explain to the victim of a phishing attack that you could have protected them automatically but did not?

fred_Blogs: Whist Phorm's own system is detached from the ISP traffic surely the insertion of additional data (adverts) into a traffic stream is a prima face case of a breach of RIPA by the ISP involved?
KentErtugrul: Just to clarify: we do not serve adverts into the traffic stream. The websites within which the ads appear are in fact our partners. They choose to partner with us to bring you more helpful, relevant and yes, more valuable advertising

guest: Having a system that provides a form of customised marketing is one thing. But do you understand the real concern shown here and on other sites for what browsing information (or interet connection info, MAC address, IP address, ISP account info) is used or stored in order to provide this service?
MBurgess: Yes, we do understand people's privacy concerns. That's why do NOT tie into the ISP authentication systems, don't use MAC addresses and don't store IP addresses.

It's important to understand that our system uses page information to make a real-time match against advertiser categories (e.g. sport). We only store the category, not the browsing information, so we can't tell where you've been on the internet, or what the page contained.

r2d2d3d4d5: is any data sent abroad. for example the analysis of the anonymized users behaviour.
MBurgess: No, browsing data is only processed within the UK ISP network.

bob: Will this still work if I already block all adverts by default?
MBurgess: If you block all ads, then you'll block ours too!

Annon101: Will the duplication of pages to the Phorm server count towards any Traffic Management cap the ISP may have?
MBurgess: No, this is internal to the ISP infrastructure and won't affect your account.

narcosis: It would seem that the biggest issue so far is with the opt out feature. Can you please tell us, if opted out, will ANY data pass through ANY server owned by Phorm either within the ISP network or not ? If it does then why if we have opted out ?
MBurgess: No, if you opt out, none of your data will pass through a Phorm-owned server.

Dephormation.org.uk: Will Phorm be able to profile HTTP requests for content such as external images embedded in HTML email I view in an email client such as Outlook?
MBurgess: No, non-html content cannot be parsed.

Dephormation.org.uk: Please explain more about Kents links with Context Plus, Apropos, and PeopleOnPage. Why have these 'services' ceased?
KentErtugrul: We have never denied that we were in the adware business. Such a business is involved in the legitmate bundling of adserving technology with free sowftare applications willingly and knowingly downloaded by users. It is the very fact that people were always unable to distinguish between legitimate adware and illegitimate spyware that caused us to do something unprecedented: As the only publicly traded adware company, listed on the London Stock Exchange with Fidelity and a series of other blue chip shareholders and the former chairman of Microsoft UK as our Chairman, we unilaterally discontinued our entire revenue stream, concluding that the spyware association was inconsistent with our long term goals. This history is entirely a matter of public record which can be found on the london stock exchange's website


TH: It seems to me that by funnelling all HTTP traffic through phorms servers, you are introducing a massive bottleneck and single point of failure into the system; how confident are you that you your systems won't degrade performance when being used by 1000's of users at the same time?
MBurgess: Our systems are designed to integrate with the ISP networks and work with the existing aggregation points within those networks. They are also designed to be failsafe and specifically not to degrade the user experience even under heavy load. The ISPs are very protective of their networks ...

BogoBunny: How employees does webwise / phorm have and where are they located?
KentErtugrul: This is a matter of public record. We are a listed company with approximately 150 employees, with offices in London and New York. On our board of directors is the former Chairman / CEO of ATT, the current Vice-Chairman of Rothschild bank, the former president of the Coca-Cola company worldwide, the former head of strategy of ATT. Our executive team represents a "who's who" of stars from the internet and media industries: a founding member of Doubleclick, the former Head of technology of Atlas, the former CTO of BT retail, the former head of sales of Expedia, the former head of communications of Yahoo Europe, and so on. We are about as far away from the dark shadowy company portrayed by some of the blogs as it is possible for a company to be

narcosis: If the keyword analysis process is offline then in order to scan for keywords would you not have to have a copy of webpage in order to analyze it offline ?
MBurgess: Yes, a mirrored copy is analyzed.

revchips: how is it envisaged that an opt out will be presented?
KentErtugrul: The first thing which you will see will be a full size page offering you the opprtunity not to participate. You will then be reminded of the ability to switch off at any point inside the ad slots which you see as you browse. It is critical to both ourselves and the ISPs that users ALWAYS be aware of the fact that Webwise is a choice

PaulB: I agree roumour mill is dangerous. I think Phorm need to disclose all network information about how it works etc. Be very transparent. The feeling I get from Kent and MBurgess is that the system is very open, so why not be open with the public about it
MBurgess: Yes, we are going to provide more details about how the system works - and it's been nice to have the opportunity to explain a bit here.

I think we'll take all the unanswered questions and put them into a FAQ on the site, so take a look early next week...

Goodnight all, sorry if you got missed off this time, but I think we'll do it again soon!