Personal details of thousands of Britons accused of illicit filesharing leaked from ACS:Law website

The Information Commissioner could levy a fine of up to £500,000 on the London law firm from which the personal details of more than 8,000 Sky broadband customers, 400 Plusnet customers and 5,000 Britons accused of illicit filesharing have leaked in the past few days.

The details were exposed in files on the website belonging to ACS:Law, a firm of solicitors which has attracted the ire of a number of online forums due to its aggressive approach to people accused by its clients of filesharing. The site was the target of a “denial of service” attack over the weekend which made it collapse – and the files, which would normally be hidden from unauthorised access, became visible when the site was brought back online.

If the Information Commissioner determines that the data exposure was through ACS:Law’s fault in operating its website, rather than directly as the result of hacking, then it could levy a fine against the company.

Alex Hanff, of the pressure group Privacy International, said the data breach was “one of the worst ever in the UK” and that the group has launched legal proceedings against the firm.

ACS:Law has come under intense scrutiny from consumer watchdogs and industry bodies for its methods of tracking and pursuing broadband users, and a number of customers are preparing to take the company to court on a harassment charge, the Guardian understands.

The company apparently works from lists of alleged infringers who have been tracked from file downloads to computers’ IP addresses; physical names and addresses are then obtained by contacting the relevant internet service provider (ISP). But this is not a surefire method of identifying infringers.

Today, the online advocacy organisation Open Rights Group warned that the “unwarranted private surveillance” of people accused of downloading is a direct outcome of the Digital Economy Act [DEA]. Jim Killock, executive director of the Open Rights Group, told the Guardian: “ACS:Law appears to be preparing to use DEA processes to target filesharers and Ofcom’s code is wide open for them using that process, so that’s a massive concern. This is all pretty terrible because, to be frank, Ofcom’s system is going to throw up these situations as they’re allowing private companies to exploit them.”

Killock described ACS:Law’s methods – in which a letter is sent to the person at the address it claims to have identified, demanding payment often of several hundred pounds for copyright infringement – as “notorious”. He suggested that the company likely finds success in embarrassing people into paying the fine, even if they are innocent. The company’s leaked records showed a list of more than 5,000 people it suspects of downloading pornographic films.

ACS:Law had no comment when contacted by the Guardian.

Hundreds of people contacted by the company claim to have been misidentified and the British Phonographic Industry has refused to endorse ACS:Law’s approach, prompting fears that the self-certification framework put in place by the Digital Economy Act and Ofcom allows no redress for the accused. A number of customers who claim to have been falsely accused of downloading are preparing to take the law firm to court for harassment. The company also faces a disciplinary tribunal after a long-running investigation into its practices by the Solicitors Regulation Authority.

Killock said: “The BPI [British Phonographic Industry] is also calling to have parts of the evidential system kept secret, but this incident shows that we need complete transparency in the way that evidence is gathered and the problems that everyone highlighted about privacy impact of the Digital Economy Act.

“We have private companies surveilling people without knowledge, collecting data and matching it with people through court orders. This has huge implications.”

Tony Dyhouse, director of cyber security at the Digital Systems Knowledge Transfer Network, said the apparent unreliability of the evidence gathered by private companies such as ACS:Law is grounds for a new wave of legal protection for the falsely accused. “It’s important to realise that IP addresses are a very unreliable way of attributing guilt to an individual in such cases,” he told the Guardian. “Very few people have static IP addresses and it is also very easy to use someone else’s computer if you gain access to their password, or can log into an unsecured wireless connection down the street. IP addresses are usually given out for a short period from a pool. They are easily faked.

“This is a perfect example of why the law needs to be changed in this country to allow victims of data breaches to sue for compensation on grounds of defamation, not just financial loss. At the moment, you can only seek compensation for loss of reputation once financial loss has been proven. This can’t be right. Imagine the consequences for a school teacher who erroneously appeared on this list.”

Technology news, comment and analysis | guardian.co.uk

Facebook is in court to defend yet another claim to ownership, this time from a web designer cum wood pellet distributor who says a previous contract entitles him to 84% of the company.

Filed in the Supreme Court in New York’s Allegany County last month, the lawsuit details how Paul Ceglia signed a contract with Facebook in April 2003 to design and develop the website TheFacebook.com for an agreed ,000 (£665) fee and a 50% stake in the site.

The contract stipulated, Ceglia claims, a further 1% stake for each day until the site was finished on 4 February 2004. Facebook is valued at an estimated .5bn, so an 84% share would be worth around .46bn.

Following Ceglia’s lawsuit, acting New York Supreme Court justice Thomas Brown issued a temporary restraining order that blocks Facebook from transfering assets. The case has now transferred to a federal court and Facebook is trying to have it annulled.

Facebook dimissed the case as “frivolous” and “outlandish”, said it will fight it vigorously and pointed out that a lawsuit over a contract broken in 2003 is “almost certainly barred” by the statute of limitation.

There are a number of reasons that success for Ceglia sounds unlikely – not least waiting until the site reaches 500 million global users before bringing his case, waiting until the outcome of the (successful) Winklevoss claim and the rather bizarre sidenote that a restraining order was granted against him in 2009 by an attorney who alleged Ceglia had defrauded customers of his wood-pellet fuel business to the tune of 0,000.

But imagine, for a minute, that Ceglia succeeded, and moved in to take 84% of Facebook. We might have a new entrant in the MediaGuardian 100…

Technology news, comment and analysis | guardian.co.uk