• 
  
• 
  

  ACS:Law chases those it suspects of sharing copyrighted content Photograph: Stringer Shanghai/REUTERS

  BSkyB, one of the UK's largest broadband providers, has said it will no longer cooperate with the requests of controversial solicitors' firm ACS:Law and that it will challenge them in court, after around 8,000 of its customers had their personal information leaked online.
  The details – including credit card details and addresses – of thousands of broadband users became accessible via the firm's website in the aftermath of a series of "denial of service" attacks, orchestrated by members of internet forums protesting about the methods of tracking and notification employed by the company.
  The Information Commissioner has said a fine of £500,000 could be levied upon ACS:Law, which also faces a disciplinary tribunal by the Solicitors Regulation Authority, legal action by pressure group Privacy International and legal action from people it apparently wrongly-identified as downloading illegal material.
  The company appears to compile lists of alleged infringers tracked by IP addresses, then appeals for a court order to the relevant internet service provider to hand over more information about the customer before taking the accused to court.
  Sky now says it will challenge these court orders until ACS:Law can prove it stores customer informtion in a secure way. A Sky spokesman said:
  

  "Following recent events, we have suspended all cooperation with ACS:Law with immediate effect. This suspension will remain in place until ACS:Law demonstrates adequate measures to protect the security of personal information.
  "We continue to be very concerned at the apparent loss of data held by ACS:Law and by the actions of those who have sought to publicise the identities of individual customers. Like other broadband providers, Sky can be required to disclose information about customers whose accounts are alleged to have been used for illegal downloading. We support the principle that copyright material should be protected and we cooperate with court orders requiring disclosure.
  "Because the security of customer information is also a high priority, we only ever disclose such data in encrypted form. In addition, we have an agreement with ACS:Law that requires data to be stored and used safely and securely."

  • Update 29/09: Separately, broadband provider Plusnet – which had around 400 of its customers' information exposed during the security breach of ACS:Law's website – today appeared to throw its weight behind increased transparency in the way companies collect information about those it suspects of downloading copyrighted content. The ISP, which was bought by BT in 2007, also suspended cooperation with ACS:Law. It said: "Due to serious concerns about the integrity of the processes used to obtain and store private customer information we are suspending with immediate effect the supply of any further customer data to ACS:Law until we are satisfied that weaknesses in these procedures have been addressed."
  

  A spokewoman told the Guardian: "Our first concern is with our customers but we have been obliged to respond to court orders requiring that we disclose customer data. However, there is increasing evidence that there are deep concerns regarding the integrity of the process being used by rights holders to obtain customer data from ISPs for pursuing alleged copyright infringements.
  "We need to have further confidence that the initial information gathered by rights holders is robust and that our customers will not be treated unfairly. We are urgently exploring how this can be assured, including through the assistance of the courts."

  The investigation by the Information Commissioner will try to determine whether the data exposure was a result of ACS:Law's method of storing information about people it suspects of sharing copyrighted material, or whether it was a direct result of the denial of service attacks against the website. The 365MB of information – which has since been distributed around the internet – containts the details of around 8,000 Sky broadband subscribers, 400 Plusnet customers, 5,000 Britons accused of illicit filesharing and emails between ACS:Law and its clients.
  
  Alex Hanff, of Privacy International, said the data breach was "one of the worst ever in the UK", while online advocacy organisation Open Rights Group today warned that the "unwarranted private surveillance" of people accused of downloading is a direct outcome of the Digital Economy Act [DEA]. Jim Killock, executive director of the Open Rights Group, told the Guardian: "ACS:Law appears to be preparing to use DEA processes to target filesharers and Ofcom's code is wide open for them using that process, so that's a massive concern. This is all pretty terrible because, to be frank, Ofcom's system is going to throw up these situations as they're allowing private companies to exploit them."