Marcus Evans Group | Worldwide Headquarters | American Offices | Latin America | European Offices | African / Asian Offices

O2 admits it gives users’ numbers to sites offering age-restricted content

Network plugs security hole after it inadvertently provides users’ numbers to websites accessed using 3G network

Mobile operator O2 has admitted that it regularly hands over subscribers’ phone numbers to sites that offer age-restricted material and premium-rate billing, whether the users realise it or not.

The admission followed the revelation late on Tuesday that the company had since 10 January inadvertently been providing user phone numbers to any sites that its millions of users browse from their phones using the 3G network. That would mean site owners could find the details in their server logs, and potentially use them for marketing or SMS campaigns without the user’s consent.

O2 is the UK’s second-biggest mobile network with about 27.2m subscribers, and another 2.8m using its network through Tesco Mobile, plus an unknown number on the GiffGaff SIM-only network. With smartphone penetration at around 50% that could mean that up to 15m people have been affected by the data leakage.

The Information Commissioner’s Office said it is considering whether to investigate further, although a spokesman said there was no immediate breach of the Data Protection Act. A mobile phone number on its own is not classed as “personally identifying information” (PII), because it does not identify an individual on its own; but the spokesman said the office would consider whether other personal data was being processed at the same time.

An ICO spokesperson said: “Keeping people’s personal information secure is a fundamental principle that sits at the heart of the Data Protection Act and the privacy and electronic communications regulations. When people visit a website via their mobile phone they would not expect their number to be made available to that website. We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed.”

O2 admitted in a blogpost that the widespread leaking of phone numbers had been going on since a maintenance update on 10 January, and was only fixed after a London-based programmer on the network pointed it out. The security hole was fixed by 2pm on Wednesday, the company said.

The privacy breach could open phone users up to reverse-charge SMS spams which could cost them huge amounts in bills when their number is used for scams.

But O2 has also revealed that it regularly reveals users’ phone numbers to a number of sites offering age-restricted material and premium content billing – an admission that has puzzled observers.

“It looks like I don’t get to make the decision about whether to share my phone number with those sites,” said Graham Cluley, security consultant with the online security firm Sophos. “I don’t see why. If I’m on a site and they need to know my phone number before I can proceed, why can’t I decide whether I let them see my number? If I don’t agree, they can stop me proceeding.”

O2 did not respond to requests for clarification on its policy. The Guardian could not find any clauses in its web and WAP policy or its general terms and conditions that suggest it shares subscribers’ mobile numbers.

A spokesman for the Information Commissioner’s Office said there was no an immediate breach of the Data Protection Act. A mobile phone number on its own is not classed as “personally identifying information” (PII), because it does not identify an individual on its own; but the office would consider whether other personal data was being processed at the same time.

Cluley warned: “there will be a lot of sites out there which will now realise that their logs for the past two weeks contain all sorts of juicy details. Some unscrupulous marketing people might scour them for mobile phone numbers that they can use for campaigns.” He said that he has a phone himself on a different network which he only uses for surfing – and that he has received text spam on it despite not entering the phone number anywhere. “That’s got me wondering whether this process is somehow behind it,” he said.

A number of O2 users who contacted the Guardian confirmed earlier on Wednesday that their phone number was being transmitted and offered links to screenshots of the data.

The phone number is handed over as part of the “header” data sent by the phone to the web site, which usually contains information such as which browser the phone has so that the site can serve an appropriately formatted page, because mobile phones have smaller screens than desktop or laptop computers.

Headers often contain other information about the device contacting the site – and in O2′s case it has also included the phone number.

However users of BlackBerry phones said that their numbers were not handed over – possibly because RIM, which makes the BlackBerry, uses its own encryption and forwarding system to connect to websites.

The discovery was made by Lewis Peckover, a London-based programmer who says he discovered the flaw on Tuesday lunchtime while working on a method of identifying whether users were accessing a site via their mobile.

The number forwarding only appears to happen on O2 and its associated virtual networks such as GiffGaff. Users of other networks confirmed to the Guardian that the number forwarding does not happen on Vodafone, Orange, T-Mobile or 3′s network. Peckover has created a web page specifically to let people check if their number is forwarded. © 2012 Guardian News and Media Limited or its affiliated companies. All rights reserved. | Use of this content is subject to our Terms & Conditions | More Feeds