Hacker News Reader

Comment by Torn | Hacker News Reader

I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx

View on HN

Can you post what you send and then we can all forward it?

Adjust as needed, here's roughly what I put:

-------------------------

SECTION 4:

Name: Telefonica O2 UK Address: 260 Bath Road Postcode: SL1 4DX Phone: 0800 089 0202 email: peter.erksine@o2.com website: http://www.o2.co.uk

SECTION 6:

When users of their network visit a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. O2 does this by modifying the HTTP request and inserting the number in the 'x-up-calling-line-id' HTTP header.

Alarmingly, it does this to all unencrypted site visits (i.e. 'http' not 'https'), and these end-sites can trivially harvest the mobile numbers of visitors and link these to content visited.

This can be verified by visiting http://lew.io/headers.php on an O2 mobile device. The site serves as a tool to show the visitor the HTTP headers received by the server when the user requests that particular page.

SECTION 10:

Online utility that will show you the headers sent in your page request: http://lew.io/headers.php

Discussion on technical forum 'hacker news': http://news.ycombinator.org/item?id=3508857

Official O2 Twitter responding to (and misunderstanding/misrepresenting) the problem: https://twitter.com/#!/O2/status/161872584634408960

-------------------------

COVERING LETTER WITH EMAIL TO casework@ico.gsi.gov.uk:

To whom it may concern,

Please find attached my complaint against O2 under the Data Protection Act.

When users of their network visits a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues.

Regards,

The tweet:

> "Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru"

Wow.

Their Twitter account ( https://twitter.com/#!/O2 ) has a burst of new activity. Looks like this has been passed up from Tier 1 support.

What are you guys sending as "supporting evidence"?

I put links to the lew.io tool, this thread and O2's official twitter response.

They seem to have taken down the header now though.

O2 have responded, admitting the issue existed, and stating they've now fixed it.

http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-...

Just been looking into this and from the little info I can find, it looks like your phone number would be classed as personal information and so covered by the data protection act.

Yeah. Just submitted a form as well and got response from ICO that case work has been received. According to the law, companies that break Data Protection, can be fined up to £500,000 per case.

Technically the organisation in breach would receive a penalty, not a fine. I realise that's a bit pedantic but there is a difference (fines can usually only be made and enforced by the courts).

The ICO can also prosecute the company and officers in the criminal courts under some situations, including: "unlawfully obtaining, disclosing, or procuring the disclosure of personal data;" (I don't know whether this would count as unlawful disclosure or not).

I'm talking to someone now in their live chat so that I have a record of contact that I need to file the complaint.

Fired them an email, don't really expect or care for a response, just want to make some noise about it.

You should absolutely expect a response. The ICO was set up exactly for cases like these and is funded by the taxes you are paying.

Make sure you have filled in the correct complaint forms and provided your personal details. Sending an email with a link to the lew.io site or this HN thread is useless to them.

The ICO does have a limited budget and powers though, so responding promptly to all complaints might not be possible.

That page suggests you can only complain if you've been personally affected.

Although I've been on O2 in the past, I don't have any evidence that the problem occurred during that time. I'm on Orange now, which appears to be unaffected.

It's a pain, because I'd been thinking about switching back to O2 to get Visual Voicemail, which no other UK provider appears to be able to support.

I use hullomail which provides free visual voicemail for iPhone and android. It works well, so definitely worth a try.

I am in the process of doing this now, also my contract expires this month with them and I will be moving to another provider - do we know it if only affects 02?

It also affects GiffGaff, a "virtual network operator" that uses O2's network.

I'm trying to do this but I downloaded the .doc complaint form off their website but it appears to be read only?

You have to save it before you can edit.

Reply on news.ycombinator.com