Grepular

Today, I convinced the good people at Livejournal to request that livejournal.com and all of it’s subdomains be added to the Phorm Webwise exclusion list. I contacted their privacy department, expecting a boiler plate non-informative response, but it went quite differently. I got a direct response from their Director of Engineering and Operations (Tupshin Harper), and permission to quote him. Here’s what was said:

To: privacy (at) livejournal (dot) com
Date: Wed, 08 Apr 2009 13:36:53 +0100
Subject: Phorm

Hi,

I've been a user of livejournal.com for a while now. My username is BLANK. I'm contacting you to ask if you intend to opt-out of the Phorm Webwise system that is going to be installed on several ISP systems in the UK in the near future?

All of my blog posts are friends only. The only people I want to see those blog posts are the people who I have chosen to see them. The trouble with Phorm's Webwise system is that Phorm sees what my friends see. I don't want my friends locked blog posts to be intercepted and analysed by Phorm. As you don't use SSL across your website, that's exactly what Phorm will do unless you opt-out your domains.

The procedure is quite simple, and just involves contacting Phorm and getting them to add your domain to its exclusion list (don't forget to request wildcard subdomains). See:

[http://www2.bt.com/static/i/btretail/webwise/help.html#how-do-i-prevent-webwise-from-scanning-my-site](http://www2.bt.com/static/i/btretail/webwise/help.html#how-do-i-prevent-webwise-from-scanning-my-site)

From a commercial perspective, if Livejournal doesn't opt out of Phorm, I'm limited in what I can post to my journal. For example, if I launched a company to sell product x, and I announced it on my Livejournal, Phorm would literally intercept that traffic, advertise my competitors who also sell product x, to my readers, and then drive business away from my company. Not a pleasing prospect.

Your privacy policy states that you "make efforts to ensure security on our systemsâ". Surely one of those efforts should be to prevent lawful interception as well as illegal interception, when possible?

Regards,

Mike Cardwell

The response I was received was short, but very sweet:

From: "LiveJournal.com Support" <webmaster+SNIP (at) livejournal (dot) com>
Date: Wed, 8 Apr 2009 16:30:08 +0100
Subject: Re: [staff] Phorm

I have requested exclusion of livejournal.com and all of its subdomains from Webwise indexing. Thank you for bringing this to our attention.

-Tupshin Harper
-Director of Engineering and Operations
-LiveJournal, Inc.

The moral of this? It doesn’t matter how big a website is, it’s quite possible that the management are still unaware of the existance and implications of Phorms Webwise system. If you use a website, and you don’t want Phorm scanning it, contact them. They might just listen.