Plusnet will give your personal details to ACS Law with not informing you!!

[#1]

Quote from: davethir

CMW is only receiving one side of the argument and (my impression of what was said) suggested that he would like to see one of the Respondents put up some form of defence. CMW asked quite searching questions of GM because, as he said he was playing "Devils Advocate" as their was no one there to ask the questions themselves. There never has been any involvement from any ISP and as such he has no choice but to grant the Order. However...... He did not grant the Order yesterday, he adjourned until the 4th Oct 10 as he wanted GM to respond to a letter CMW had received from a member of the public, querying the process.

bt/pn sent a solicitor but not in any legal capacity, but just to sit and observe

[#2]

Quote from: jelv

Just seen some very good advice posted elsewhere: [quote=https://nodpi.org/forum/index.php/topic,3165.msg31431.html#msg31431]Can I please urge those of you who have access to either BT or PlusNet customer forums to post and give clear details of how ordinary ISP customers can make a complaint to the ICO. They don't have to have been in receipt of an ACS letter to make a complaint. Just to be a customer of an ISP that is handling and transmitting customer data insecurely. Refer them to the ICO website here http://www.ico.gov.uk/complaints/data_protection.aspx That page explains all the various ways you can complain including via a downloadable Word document to go by email. and please encourage ALL of them to make complaints, about the way their ISP has sent unencrypted customer data to ACS by email, whether or not they have had an ACS letter. They need to emphasise 1 - that their ISP owe them a duty of care in protecting their data 2 - that their ISP failed to follow clear court instructions in the NPO about encryption and the means of transmission and is therefore in breach of the court order itself. 3 - that their ISP has breached the DPA requirements 4 - that the nature of the breach and  the fact that many innocent people may be caught up in this process, has caused them distress and anxiety - ie HARM. 5 - that they are making a formal DPA complaint and wish the ICO to vigorously investigate, and if necessary, prosecute what appears to be a very serious breach. At the same time they should write to the BT CEO and make the same points. cceo AT bt.com - a publicly available email address for customer queries - and NORMALLY quite responsive (except to repetitive privacy complaints when it doesn't seem to work very well) I'm afraid I have access to neither forum.

Well I've done as Robert asked!

I've done the same.

[#3]

I think Plusnet and ACW:law should be issued a class action lawsuit. It's NOT o.k. to apologise you forget to encrypt data - how will plusnet compensate me? I understand from a friend who has apparently seen emails from ACS that allegedly Mr Crossley asked to remove passwords from PDF data lists to "speed up" processing.
ACS should be investigated by the Police immediately let alone the ICO.
I wouldn't mind but I was actually accused of doing uploading a crap song which I've never heard of, through a router which blocks P2P!

[#4]

Quote from: Asbo

bt sent a solicitor but not in any legal capacity, but just to sit and observe

BT did not send a solicitor. The gentleman present at the hearing that was an employee of BT expressly stated he was NOT a solicitor and was just there for 'the experience'.

[#5]

I am curious, how long do plusnet hold the data that they gave to ACS? do they hold IP address info forever? or 2 years or 6 months? if you are a live customer or how long after you leave?

[#6]

I don't believe there is any law that says data communication should be encrypted, but does say many things about doing securely, and part of the ICO's advice on how to do it securely is to encrypt it.  So strickly speaking I think the answer to your question is "No" however, in reality I think BT/Plusnet will find the answer is "Yes" once the ICO has finished with this.



The Data Protection Act - Security
The Data Protection Act places clear demands upon those holding personal data in terms of the security that must be applied to protect it.
http://www.legislation.org.uk/
Google were fined 5.5 milion quid  

[#7]

From http://www.bbc.co.uk/news/technology-11434809

Quote

A spokesperson for the Information Commissioner Office (ICO) told BBC News that the BT e-mail would be part of its ongoing investigation into ACS:Law, but they would also check to see if they had any specific complaints from PlusNet users.

The ICO seem to be giving out contradictory advice, here they seem to imply that Plusnet customers must complain, yet they appear to have advised Plusnet customers who do complain, not to as its already in hand.

[#8]

Quote from: HPsauce

Interestingly the BBC reports are now bearing down on BT, including naming their lawyer: http://www.bbc.co.uk/news/technology-11434809

From that article

Quote

The unsecured Excel documents were sent in late August by Prakash Mistry, a lawyer working for British Telecom, to Andrew Crossley - who runs ACS:Law. "In accordance with the Court's Order of 17 February 2010 ("the Order"), please find enclosed the data in accordance with paragraph 1 of the Order," wrote Mr Mistry in the e-mail. "Please acknowledge safe receipt and that the data will be held securely and shall be used only in accordance with the provisions of the Order," he added.

I would think when the heads start rolling, that of Mr Mistry will be the first.

[#9]

Finally, the guy responsible gets blamed in BBC News, I've been banging on about this from the start.
I hope you are sacked PRAKASH MISTRY and banned from ever using a computer again, or at least not before you learn to use email securely.
Was it PRAKASH MISTRY who they sent to observe?

It is amazing how badly PN have handled this. If you go back to when this actually came out they have changed their stories and defence several times and are now only blatantly admitting their fault because BBC has got a hold of it.
No way out now PN. I think you will be generous enough to waive my disconnection fee.

[#10]

Quote from: lowbug

ACS should be investigated by the Police immediately let alone the ICO.

If you want that to happen you should go to your local police station and make a statement about how ACS have broken the law effecting you.  Get a crime number of you do this, you may also want to review the Slyck conversation (particularly over the last few days) as people have been talking about doing the same.

[#11]

Did plusnet levy a charge per IP like SKY did?

[#12]

I'm curious about the reliability of the information provided.
On a technical level, I can't see how logs of IP address allocations to a particular phone number / customer would not be 100% accurate.  
On the other hand, there are an awful lot of people claiming "I really didn't do this".  Are they all be lying?  It seems unlikely.
I know there will be a few cases where the customer doesn't know what's being downloaded, for example though having open wifi, but those must be quite rare.
Anyone have any insight to this?

[#13]

I certainly have never donwloaded "Cascada - Evacuate the dancefloor", in fact i wasn't even living at that address at the time of alleged download, so PN have failed again as they had a completely wrong address in their system.
EPIC FAIL
adie:quote

[#14]

We don't know that anyone person is to "blame" or that one person in particular was themselves incompetent, it *maybe* that BT gave the job to someone not trained to do the job, I'm certain that BT will be doing whats needed either in correcting their own broken systems or in addressing the errors made by an employee, I find the public lynching of an individual who may be innocent to be very distasteful.

[#15]

Quote from: et0

I'm curious about the reliability of the information provided. On a technical level, I can't see how logs of IP address allocations to a particular phone number / customer would not be 100% accurate.   On the other hand, there are an awful lot of people claiming "I really didn't do this".  Are they all be lying?  It seems unlikely. I know there will be a few cases where the customer doesn't know what's being downloaded, for example though having open wifi, but those must be quite rare. Anyone have any insight to this?

This is it though, wi-fi is not secure against people who know what they are doing. However it's surely much easier to spoof an IP than to aircrack a WPA2 key? As I've never tried and only read about such things I don't know.