YouView: business and security issues

YouView delivers television content via an ethernet connection to the home broadband. Because of this two-way connection rather than the traditional one-way connection in broadcast television, YouView offers great potential for interaction between viewer and broadcaster. However, there have been two major criticisms already levied: does the business model actually work; and does FreeView provide behavioral personal data that can be used for personalized advertising?

Nayeem Syed, a digital media legal consultant, has offered ‘7 reasons why it may fail’. One of these questions the market, suggesting that those viewers who will pay extra are already doing so as Sky or Virgin Media subscribers, and those who won’t pay extra and decline to pay £30 for Freeview are even less likely to pay £300 for YouView. Other criticisms focus more on the business model, including the ‘closed’ nature of the box, deterring the development of third-party apps. However, closed boxes could be opened at a later date. 

Syed finally questions the long-term objectives of the company. Was Lord Sugar brought on board to ‘kill or cure’? “Or, are they now doing it so they can convince... another company to buy and give YouView a good home?”

This links to the security issues. The Independent has pointed out that some of the company’s “employees worked for Phorm, a US technology firm accused of developing advertising spyware.” A few years ago Phorm was a highly contentious issue in the UK. The company collected internet users’ web behavior to sell on to advertisers. Although it always claimed that the data collected and sold was ‘anonymized’, this was questioned by security commentators who also accused Phorm of using ‘illegal’ deep packet inspection (DPI) techniques. Noticeably, the two main ISPs associated with YouView (BT and TalkTalk) have also been accused of operating covert monitoring projects in the past (TalkTalk on its own, and BT with Phorm).

The Independent points out that “YouView reports back to headquarters via the internet connection.” It adds, “The profile might contain information such as the type of box being used, when you first used YouView, your internet address, which programmes you have watched, and whether you prefer sports, news or cookery programmes and so on,” and that “information will be passed to third-party companies, allowing the introduction of advertising targeted at certain postcodes.”

YouView’s privacy policy is more than a little confusing on the issue. It states, “We and our content providers can determine the approximate geographic area in which you use your YouView device,” but also says, “We and our content providers will use your postcode....” Postcodes define a location to within a few houses, not an approximate geographic area. In short, YouView can collect a lot of data on its users. “In the event that a third party acquires some or all of our assets or business, the information we hold about you and your YouView device will be transferred to that third party,” continues the privacy policy. Syed suggests that this might indeed be part of the company’s business plan – in which case all bets are off on the future use of the collected personal data.

Incidentally, the whole project also depends upon adequate home broadband speeds. While this may not be a problem in areas serviced by Virgin Media’s fiber connections or BT’s Infinity broadband, large tranches of the UK's rural population will be excluded. One Infosecurity writer used the on-site YouView widget and was told, “Sorry, your broadband speed is not fast enough.”

What’s hot on Infosecurity Magazine?