Skip to navigation
Latest News

BT sent unencrypted customer data to file-sharing lawyers

Email

By Barry Collins

Posted on 29 Sep 2010 at 13:55

BT has become embroiled in the ACS:Law privacy scandal, after admitting it sent unencrypted personal details of more than 500 customers to the law firm.

ACS:Law rose to notoriety after sending out letters demanding damages payments from people accused of file-sharing. The law firm was subject to a denial-of-service attack on its website at the weekend, which resulted in the company's database being leaked online. The database contained personal details of people accused of file-sharing and the firm's private correspondence.

We do not believe any of BT's customers details have been compromised by this leak, although we are continuing to pressure ACS:Law for confirmation of this

Yesterday, details were published of Sky broadband customers who were accused of illegally sharing pornographic films.

Now, a BBC investigation has dragged BT into the controversy. It has emerged that BT sent the law firm two unencrypted files containing full names and addresses of more than 500 customers accused of distributing music and pornographic films. BT was required to hand over the details following a court order.

"One-off"

BT insists the incident was a one-off and that personal data is normally encrypted when passed onto copyright holders and their representatives. "I can confirm that this did happen but has no bearing on the current situation," a BT spokesman told PC Pro.

"We are investigating how this occurred as we have robust systems for managing data. We have already ensured that this will not happen again. In this circumstance our legal department sent data to a firm of solicitors (ACS:Law) which reached them safely and we trusted that they would keep the data safe.

"At a later date, due to an attack on the systems of the law firm, data was leaked, which was outside of our control. At this time we do not believe any of BT's customers details have been compromised by this leak, although we are continuing to pressure ACS:Law for confirmation of this.”

In contrary to BT's claim that the data hasn't been compromised, PC Pro has been contacted by readers who claim to have seen the unencrypted files.

Speaking to the BBC before details of BT's unencrypted files emerged, the Information Commissioner Christopher Graham said firms had a duty to take better care of their customers' data.

"There's far too much of this carelessness and laziness, and cavalier attitude towards people's personal data," he said.

Subscribe to PC Pro magazine. We'll give you 3 issues for £1 plus a free gift - click here

From around the web

User comments

When the rule of law is circumvented by the highest bidder

This is what happens. Private data of people who have been accused of crimes based on pretty flimsy evidence have their data, which should be protected by the data protection act, exchanged between legal firms an ISPs via spreadsheets and emails, treated as little more than "sucker lists", from which legal firms can blackmail people into paying "downloading fines".
Cowboy wheelclampers + Nigerian email scammers = ACS Law and their ilk.

By cheysuli on 29 Sep 2010

Responsible Action?

Debates in goverments (UK, Europe, where-ever), court-orders, and the like all make a flawed assumption: The Company/Corporation concerned will always act responsibly, proportionally and morally.

Based on this assumption, moving personal data around is fine. As is vesting authority in the ISP or Intellectual Property owner, where it comes to taking punative action.

I live in a real world. Where responsibility is shirked wherever possible, proportionality is based on self interest, and morality vanishes under the pen of an accountant.

The people making these decisions are either Naive or Incompetant. And it's the public who suffer. It's -us- who suffer. Simple so that Corporate Big Business can play the simpler Bullying game, rather than adapt to and deliver market expectations.

By matbailie on 29 Sep 2010

"trusted that they would keep the data safe"

Perhaps, in future, no data should be handed over without the specific details on how & where it is to be stored can be verified - court order or not.

Some hope...

By greemble on 29 Sep 2010

Badly implemented Rushed laws lead to...

seems like any chancer can get a court order for information which they can then use to blackmail people. What legal protection is their against people's data being misused in this way. This isn't the only organisation carrying out this scam and the ISPs seem powerless to stop it; the courts seem unable to challenge the scammers. Its a bizarre world.

By Manuel on 29 Sep 2010

Not the first time

This isn't the first time BT has sent out its customer data in an unencrypted format. I stumbled across a huge file of their customers' names, addresses, and telephone numbers. And when I say "stumbled upon" I really mean it - the bloody telephone book is quite a lump.

By PaulOckenden on 30 Sep 2010

So a law firm breaks the law at the same time as pointing the finger at others that are breaking the law? They are a legal firm and should know the law. The others often may not be aware they are breaking the law in what they do. So who is more in wrong here?

By pcwatcher on 30 Sep 2010

But ....

They (allegdly) have a screen shot of the BT file on the Ars Technica site. I think anyone downloading such classics as "My wife's first monster cock 9" or "The Uranus[sic] experiment" or even "Latino Spunk Gobblers" was asking for trouble :-))

By rjp2000 on 30 Sep 2010

A DDoS can't expose your files

The DDos didn't result in the email being leaked. They had the backup sitting in a folder of their website and when they (very ungracefully) brought the site back online it exposed their folder structure.

Protip: If you have personal information about people in your business, don't put it on your website.

By steviesteveo on 30 Sep 2010

R. Mark Clayton

I am no lover of BT, but there is no suggestion that the file was intercepted in the net, but only once it was on ACS law's system (where presumably the first thing they would have done is decrypt it) was it hacked.

It just looks like ACS trying to pass around the blame and anyway if they were any good they would / should have encrypted it on receipt.

With ACS demanding £500 for [perhaps inadvertently] downloading some files this operation is little more than the network equivalent of "cowboy" wheel clampers that the government are just about to legislate out of existence. If ACS are hoisted on their own petard I doubt many will cry about it.

By Mark_Clayton on 30 Sep 2010

Who's pockets are lined by the money received?

How much of the money collected through the Blackmail attempts of ACS Law actually goes to the artist or rights owner?

I would also suggest that just because some one downloads something, it doesn't mean they use/watch/listen to it. The download could fail or they may use it for five minutes, think it's crap and delete it.

By shrek59 on 30 Sep 2010

shrek59 - nail/head

I think you may have stated the real reason for he music/film industry fears over file sharing.

Lost sales due to people having a quick look at a film/music track/game, deciding they don't like it & deleting it.
Whereas previously we'd all have to buy the film/music track/game first to find out if it was any good or not.

Of course not in all cases, but doubtless there would be a number of sales before word got around about something being a waste of money.

By greemble on 1 Oct 2010

ACS LAW

RJP2000 doesn't really understand ACS laws policies, they don't chase people who are sharing files, most of the people they chase have never down loaded the file in question, its a bit like an unlucky dip, if they get your name and address then they will find away to get money out of you, evidence is the least of there concerns, they have the law and they have great experience of lets say embellishing it for profit

By talontopaz on 14 Oct 2010

Leave a comment

You need to Login or Register to comment.

(optional)

advertisement

Most Commented News Stories
More From PC Pro
Latest Blog Posts Subscribe to our RSS Feeds
Latest ReviewsSubscribe to our RSS Feeds
Latest Real World Computing

advertisement

Sponsored Links
 
SEARCH
SIGN UP

Your email:

Your password:

remember me

advertisement


Hitwise Top 10 Website 2010
 
 

PCPro-Computing in the Real World Printed from www.pcpro.co.uk

Register to receive our regular email newsletter at http://www.pcpro.co.uk/registration.

The newsletter contains links to our latest PC news, product reviews, features and how-to guides, plus special offers and competitions.