ACS: Law Faces Hefty Fines

Andrew Crossley is the main partner of the company, and its only registered solicitor. He has twice been found guilty of conduct unbefitting a solicitor by the Solicitors Regulation Authority, in 2002 and again in 2006. In August 2010, the Solicitors Regulation Authority confirmed that Crossley was being summoned to his third disciplinary tribunal, in response to ACS:Law's action against suspected file sharers.

On September 24, 2010, ACS:Law’s Internet service provider took the site offline because of a previous DDoS (Distributed Denial of Service) attack. Attempts to visit the site gave users the typical ''Web site cannot be found'' error message that most browsers display.

When the site became available again, a 350MB file, which was a backup of the site, was, inexplicably, made available to anyone for a short period of time. This backup, also containing copies of emails sent by the company, was downloaded and made available as a torrent.

Some of the emails contained lists of people ACS:Law had accused of illegally sharing media; one contained over 5,300 Sky broadband customers who they had accused of illegally sharing pornography and another contained the details of 8,000 Sky customers and 400 Plusnet customers accused of sharing music. This alleged breach of the Data Protection Act has become part of the ongoing investigation into ACS:Law by the Information Commissioner's Office.

According to the September 28th article at itpro.co.uk, the Information Commissioner’s Office (ICO) will be contacting ACS:Law over the data breach, which reportedly exposed the details of thousands of internet users.

The data was stored by the law firm to track P2P users sharing copyrighted pornographic films, possibly illegally.

A data leak is believed to have occurred after members of 4chan, an image board website where activists recently organized attacks on film industry bodies, launched a distributed denial of service (DDoS) attack against ACS:Law’s site.

Jim Killock, executive director at the Open Rights Group, told IT PRO ACS:Law should never have had the data in the first place. He was quoted as saying: ''The hackers weren't trying to expose email traffic, of course. While we may think bringing down a website is irresponsible, ACS:Law placed sensitive data in a place which it never should have stored [it], which is simply negligent.”

In the September 28th article at slyck.com, Christopher Graham, UK Information Commissioner to the BBC was quoted as saying: ''The question we will be asking is how secure was this information and how it was so easily accessed from outside. I can't put ACS: Law out of business, but a company that is hit by a fine of up to half a million pounds suffers real reputation damage.''

ACS: Law could face fines of over $750,000.