By: MarkJ - 30 July, 2010 (9:45 AM) - Score: 4316 - Security, Online Privacy

Broadband ISP TalkTalk UK has issued another statement in defence of its controversial new security system, which aims to block sites that contain malicious software by "anonymously" recording the URL addresses visited by its customers and comparing them against a list of good and bad websites. Sites that are not on one of its lists will also be "scanned for threats".

The news emerged earlier this week (here) after it was revealed that TalkTalk had begun recording customers website (URLs) visits without their consent. Many end-users felt that this should have been an optional opt-in trial and were angered at having not been informed. Some also feared that TalkTalk could be breaking the law by recording their web browsing activity.


The new statement is unlikely to allay all customer fears about how their data could be used or potentially abused, especially since the tracked URL's will apparently still be visible to Chinese firm Huawei; a firm that has suffered due to some high-profile allegations of state sponsored spying. We can certainly see some potential problems that TalkTalk has yet to fully address.

Firstly they claim that "no personal data such as a telephone number, account number or IP address will be included". It is difficult to see how that can be guaranteed, especially since dynamic website addresses themselves can at times contain exactly that sort of highly sensitive information (usernames, emails.. sometimes even passwords).

There are other problems too. Some webpage's contain copyright notices and other methods that prohibit automated processing of content, which TalkTalk's system could potentially just ignore. Re-requesting URLs that help web applications to function could also unintentionally result in a specific individuals remote website service or feature being accidentally enable or disabled. In some situations this could even disrupt private login routines.

The system will also add to the load of remote websites and could skew their statistical data. Some are also concerned about having the webpage's they visit scanned, typically private admin pages should not appear in either list and would thus be most susceptible. The fact that the URL logging will occur whether a customer chooses to use the resulting security service or not must also be of concern.

Despite such obvious objections, which TalkTalk has yet to fully address (explaining how the system works a second time does not address any of these), they still plan to launch the network security service later in the year. It will be available to all TalkTalk customers for free if they opt in. What they are doing may not be as worrying as Phorm's system but it is not devoid of problems.