Phorm – a chapter closes?

Another chapter of the long-running Phorm saga seems to have come to a close, with the announcement by the European Commission that they have closed the infringement case with the UK about their implementation of rules on privacy in electronic communications. In order to get this closure, the UK had, in the words of the Commission press release

‘amended its national legislation so as not to allow interception of users’ electronic communications without their explicit consent, and established an additional sanction and supervisory mechanism to deal with breaches of confidentiality in electronic communications.’

This case came about as a result of the big mess that the UK government got into over Phorm – something which I’ve written about both academically and in blogs on more than one occasion before. In essence, the government decided to back Phorm, a business which privacy advocates and others had been telling them from the very beginning was deeply problematic, and that decision backfired pretty spectacularly. The amount of egg that ended up on government faces as a result of the affair was pretty spectacular. The action of the Commission was a direct result of the admirable work of campaigners like Alexander Hanff at Privacy International, drawing on the excellent investigatory analysis by the University of Cambridge Computer Lab’s Richard Clayton and the legal work of Nicholas Bohm for the Foundation for Information Policy Research – work that was effectively in direct opposition to the government. This work led to questions to the commission, upon which the commission acted, as well as, more directly, to the collapse of the Phorm business model as its business allies deserted it and opposition from the public became clearer and clearer.

Phorm’s business model was particularly pernicious from a privacy perspective. They took behavioural advertising (which is problematic in most of its forms) to an extreme, monitoring people’s entire browsing behaviour by intercepting each and every click made as you browse, in order to build up a profile which they then used to target advertising. All this without real consent from the user, or at least so it appeared, and indeed without the consent of the owners of the websites to whom these intercepted instructions were intended to be sent. As a model it appeared to break not only laws but people’s ideas about being under surveillance – Orwellian in the extreme. It failed here – thanks to the resistance noted above – and has since failed again in South Korea, and appears to be failing in Romania (about which I’ve blogged before) and Brazil, the three places that Phorm’s backers have tried it since. In each case, it looks as though people’s resistance has been a key….

There are lessons to learn for all concerned:

1) Those of us advocating and campaigning for privacy can take a good deal of heart from the whole affair – essentially, we won, stopping the pernicious Phorm business model and forcing the UK government not just to back down but to change the law in ways that, ultimately, are more ‘privacy-friendly’. ‘People power’ proved too strong for both business and government forces in this case – and it may be possible again. We certainly shouldn’t give up!

2) Businesses need to take note: privacy-invasive business models will face opposition, and that opposition is more powerful than you might imagine. From the perspective of the symbiotic web (my underlying theory, more about which can be found here), if a privacy-invasive model is to succeed, it must give something back to those whose privacy is invaded, something of sufficient value to compensate for the privacy that is either lost or compromised. In Phorm’s case, there was very little benefit to the people being monitored – the benefit was all for Phorm or Phorm’s advertising partners. That sort of model isn’t going to succeed nearly as easily as businesses might think – people will fight, and fight well! Businesses would do better to build more privacy-friendly models from the outset…

3) Governments need to understand the needs and abilities of the people – as well as the needs of businesses and business lobby groups. People are getting more and more aware and more and more able to articulate their needs and make their views known – and to wield powers beyond the understanding of most governments. The recent resistance to SOPA and PIPA in the US is perhaps another example – though the fact that people’s interests coincided with those of internet powerhouses like Wikipedia and Google may have been even more important.

This last point is perhaps the most important. Governments all over the world seem to be massively underestimating the influence and power of people, particularly people on the internet. People will fight for what they want – and, more often than governments realise, they will find ways to win those fights. There needs to be a significant shift in the attitude of those governments if we are not to have more conflicts of the sort that caused such a mess over Phorm. There are more conflicts already on the horizon – from the judicial review of the Digital Economy Act to the shady agreement that is ACTA. There will be a lot of mess, I suspect, much of which could be avoided if ‘authorities’ understood what we wanted a bit more.  The people of the net are starting to get mad, and they’re not going to take it anymore.