Personal details of thousands of Britons accused of illicit filesharing leaked from ACS:Law website
_______________________________________________________________________________
Josh Halliday
guardian.co.uk, Tuesday 28 September 2010 16.04 BST
_______________________________________________________________________________
guardian.co.uk, Tuesday 28 September 2010 16.04 BST
_______________________________________________________________________________
The Information Commissioner could levy a fine of up to £500,000 on the London law firm from which the personal details of more than 8,000 Sky broadband customers, 400 Plusnet customers and 5,000 Britons accused of illicit filesharing have leaked in the past few days.
The details were exposed in files on the website belonging to ACS:Law, a firm of solicitors which has attracted the ire of a number of online forums due to its aggressive approach to people accused by its clients of filesharing. The site was the target of a "denial of service" attack over the weekend which made it collapse – and the files, which would normally be hidden from unauthorised access, became visible when the site was brought back online.
If the Information Commissioner determines that the data exposure was through ACS:Law's fault in operating its website, rather than directly as the result of hacking, then it could levy a fine against the company.
Alex Hanff, of the pressure group Privacy International, said the data breach was "one of the worst ever in the UK" and that the group has launched legal proceedings against the firm.
ACS:Law has come under intense scrutiny from consumer watchdogs and industry bodies for its methods of tracking and pursuing broadband users, and a number of customers are preparing to take the company to court on a harassment charge, the Guardian understands.
The company apparently works from lists of alleged infringers who have been tracked from file downloads to computers' IP addresses; physical names and addresses are then obtained by contacting the relevant internet service provider (ISP). But this is not a surefire method of identifying infringers.
Today, the online advocacy organisation Open Rights Group warned that the "unwarranted private surveillance" of people accused of downloading is a direct outcome of the Digital Economy Act [DEA]. Jim Killock, executive director of the Open Rights Group, told the Guardian: "ACS:Law appears to be preparing to use DEA processes to target filesharers and Ofcom's code is wide open for them using that process, so that's a massive concern. This is all pretty terrible because, to be frank, Ofcom's system is going to throw up these situations as they're allowing private companies to exploit them."
Killock described ACS:Law's methods – in which a letter is sent to the person at the address it claims to have identified, demanding payment often of several hundred pounds for copyright infringement – as "notorious". He suggested that the company likely finds success in embarrassing people into paying the fine, even if they are innocent. The company's leaked records showed a list of more than 5,000 people it suspects of downloading pornographic films.
ACS:Law had no comment when contacted by the Guardian.
Hundreds of people contacted by the company claim to have been misidentified and the British Phonographic Industry has refused to endorse ACS:Law's approach, prompting fears that the self-certification framework put in place by the Digital Economy Act and Ofcom allows no redress for the accused. A number of customers who claim to have been falsely accused of downloading are preparing to take the law firm to court for harassment. The company also faces a disciplinary tribunal after a long-running investigation into its practices by the Solicitors Regulation Authority.
Killock said: "The BPI [British Phonographic Industry] is also calling to have parts of the evidential system kept secret, but this incident shows that we need complete transparency in the way that evidence is gathered and the problems that everyone highlighted about privacy impact of the Digital Economy Act.
"We have private companies surveilling people without knowledge, collecting data and matching it with people through court orders. This has huge implications."
Tony Dyhouse, director of cyber security at the Digital Systems Knowledge Transfer Network, said the apparent unreliability of the evidence gathered by private companies such as ACS:Law is grounds for a new wave of legal protection for the falsely accused. "It's important to realise that IP addresses are a very unreliable way of attributing guilt to an individual in such cases," he told the Guardian. "Very few people have static IP addresses and it is also very easy to use someone else's computer if you gain access to their password, or can log into an unsecured wireless connection down the street. IP addresses are usually given out for a short period from a pool. They are easily faked.
"This is a perfect example of why the law needs to be changed in this country to allow victims of data breaches to sue for compensation on grounds of defamation, not just financial loss. At the moment, you can only seek compensation for loss of reputation once financial loss has been proven. This can't be right. Imagine the consequences for a school teacher who erroneously appeared on this list."
The details were exposed in files on the website belonging to ACS:Law, a firm of solicitors which has attracted the ire of a number of online forums due to its aggressive approach to people accused by its clients of filesharing. The site was the target of a "denial of service" attack over the weekend which made it collapse – and the files, which would normally be hidden from unauthorised access, became visible when the site was brought back online.
If the Information Commissioner determines that the data exposure was through ACS:Law's fault in operating its website, rather than directly as the result of hacking, then it could levy a fine against the company.
Alex Hanff, of the pressure group Privacy International, said the data breach was "one of the worst ever in the UK" and that the group has launched legal proceedings against the firm.
ACS:Law has come under intense scrutiny from consumer watchdogs and industry bodies for its methods of tracking and pursuing broadband users, and a number of customers are preparing to take the company to court on a harassment charge, the Guardian understands.
The company apparently works from lists of alleged infringers who have been tracked from file downloads to computers' IP addresses; physical names and addresses are then obtained by contacting the relevant internet service provider (ISP). But this is not a surefire method of identifying infringers.
Today, the online advocacy organisation Open Rights Group warned that the "unwarranted private surveillance" of people accused of downloading is a direct outcome of the Digital Economy Act [DEA]. Jim Killock, executive director of the Open Rights Group, told the Guardian: "ACS:Law appears to be preparing to use DEA processes to target filesharers and Ofcom's code is wide open for them using that process, so that's a massive concern. This is all pretty terrible because, to be frank, Ofcom's system is going to throw up these situations as they're allowing private companies to exploit them."
Killock described ACS:Law's methods – in which a letter is sent to the person at the address it claims to have identified, demanding payment often of several hundred pounds for copyright infringement – as "notorious". He suggested that the company likely finds success in embarrassing people into paying the fine, even if they are innocent. The company's leaked records showed a list of more than 5,000 people it suspects of downloading pornographic films.
ACS:Law had no comment when contacted by the Guardian.
Hundreds of people contacted by the company claim to have been misidentified and the British Phonographic Industry has refused to endorse ACS:Law's approach, prompting fears that the self-certification framework put in place by the Digital Economy Act and Ofcom allows no redress for the accused. A number of customers who claim to have been falsely accused of downloading are preparing to take the law firm to court for harassment. The company also faces a disciplinary tribunal after a long-running investigation into its practices by the Solicitors Regulation Authority.
Killock said: "The BPI [British Phonographic Industry] is also calling to have parts of the evidential system kept secret, but this incident shows that we need complete transparency in the way that evidence is gathered and the problems that everyone highlighted about privacy impact of the Digital Economy Act.
"We have private companies surveilling people without knowledge, collecting data and matching it with people through court orders. This has huge implications."
Tony Dyhouse, director of cyber security at the Digital Systems Knowledge Transfer Network, said the apparent unreliability of the evidence gathered by private companies such as ACS:Law is grounds for a new wave of legal protection for the falsely accused. "It's important to realise that IP addresses are a very unreliable way of attributing guilt to an individual in such cases," he told the Guardian. "Very few people have static IP addresses and it is also very easy to use someone else's computer if you gain access to their password, or can log into an unsecured wireless connection down the street. IP addresses are usually given out for a short period from a pool. They are easily faked.
"This is a perfect example of why the law needs to be changed in this country to allow victims of data breaches to sue for compensation on grounds of defamation, not just financial loss. At the moment, you can only seek compensation for loss of reputation once financial loss has been proven. This can't be right. Imagine the consequences for a school teacher who erroneously appeared on this list."
