Plusnet will give your personal details to ACS Law with not informing you!!

[#1]

Quote from: Bob

Why is it incorrect? Like you say yourself, if the DDoS hadn't happened, the emails almost certainly wouldn't have been made available.

I'm not convinced that the emails were not there all along (i.e. before the attack) if you knew the correct URL to enter. The website being taken down because it was being attacked exposed the directory listing which led to it being discovered.
If that is the case you can't blame the attack for sloppy security procedures.

[#2]

I use Cpanel and can't see how that can be the cause - Human Error from start to the sorry finish.

[#3]

I just looked for the cpanel thing where I first saw it, and it has been removed, so perhaps a strong sign that cpanel was not and would not have been any part of it.

[#4]

I totally agree with "Acoden"
I have had it with Plusnet as I received a letter recently asking for large sums of money for sharing a tile I have never heard of before!  What also pisses me off is that Plusnet did not just share my IP, they informed ACS that it was a static address so if for some reason,again unknown to me there is any other hit against my address then I will be geting more letters!  With all the evidence out there indicating are many ways to spoof, borrow/steel an IP address to hide your own identity this is really worrying!  That identity protect is going to be really handy!!
Its a shame really as I thought Plusnet provided a relly decent service, but now even admitting that the data was sent un-encrypted, yes at least they are being honest, but balls to them, I have been with them over 5 years - thats customer care for you --------  NOT!

[#5]

In the midst of all the vitriol (including that from me 😕 , we should remember there are some good people at plusnet. Most of them are here, in the firing line, taking the flack from Plusnet's customers for a horrendous foul up - almost certainly not of their own making. At the same time, they are forced to peddle the company line due to the exceptionally difficult legal position Plusnet find themselves in. I wouldn't take that job for any money.
I know from personal previous experience that Bob, and Mand are both excellent in the role. Unfortunately I've only come accross Fletch on this thread, where he is probably not best placed to demonstrate CS shine - but he is certainly working hard to keep us informed, even if limited by string pulling.
So - thanks to you all, for being here, talking to us, and trying to sort out this godawfull mess - despite all the interference from TPTB.
The last post from Fletch is the first I've seen that gives me a glimmer of hope. Certainly the offer of identity protection service is an indication that Plusnet are taking their responsibilities seriously. Further, the statement that PN will resist future NPO's. (If I've understood correctly) is a huge step in the right direction.
Now - PLEASE don't stuff it up by failing to contest at the 4th October hearing - even if all you can do at short notice is present a counter technical argument to Master Chief (or whatever he is called)

[#6]

Hi, just heard about this story - Please can you tell me WHY PN was sending customer details to the following person???
"The main partner of the company, and its only registered solicitor, is Andrew Crossley. Crossley has twice been found guilty of conduct unbefitting a solicitor by the Solicitors Regulation Authority, in 2002 and again in 2006."
Clearly time to change IP, am I right in thinking Talk Talk look after their customers details a little better ?

[#7]

Hey - I just want to state that I am not having a go at the CS guys on this forum, they are doing a good job, its PN in general  company management (along with BT) are spineless in my opinion!

[#8]

Quote from: MarquisBarking

Sorry - I've just stumbled on this discussion and as it is over 80 pages long I don't have the time to take it all in.  I'm no downloader but I'm horrified by this - absolutely horrified.  Am I right in my understanding: 1.  PlusNet's standard response to an NPO order is to concede before the hearing and not even send a legal representative, although other ISPs both contest and attend? 2.  PlusNet do not ask for notifications of prosecutions and actions which result, even those these might form a defence against providing data in the future and are routinely required by other ISPs forced to comply with orders? 3.  PlusNet have been sending this data in unecrypted form even though the terms of the order requires/advises encryption? 4.  PlusNet have not said sorry?

1. We haven't contested previous orders, but as Fletch said here we will be resisiting future requests until the validity of the information has been clarified. Other ISP's have *not* contested these orders, but have stated their intention to do so publicly, and so have not received any requests.
2. We didn't, until the November 2009 order.
3.. The data leaked was sent unencrypted, we've taken measures to ensure that doesn't happen again if we provide any further data.
4. We have apologised, and will continue to do so. Whilst the leak wasn't our doing, we are very sorry for the customers affected, and that this situation has culminated in this way.

[#9]

Quote from: davethir

Fletch, fletch, fletch, I wish you hadn't said that as I think you have been working in our bests interests in the past, however I really cannot let you say this  "However, this was not the cause of the leak. At a later date, due to a cyber-attack on the systems of the law firm, data that it held was leaked." you must know by know that no hacking was involved, just incompetent system administration procedures which allowed a backup copy of the email database to be available on the Acs-law webpage. Point 2. Again I ask the question, with what is known now, is plusnet going to "work" with the likes of Gallant McMillan and supply names and addresses. Again fletch there is nothing personal in this post and I appreciate everything you have done behind the scenes. No other COO has spoken to their customers like you have. It is just a shame your bosses are BT

A DDOS is a cyber-attack is it not? The data wasn't available prior to said DDOS AFAIK.
Re point 2, Fletch says in his post that we will resist future requests until we're happy with the data obtained.

[#10]

@collinet, thanks, and I'm sure Fletch won't take the slight on his CS skills personally.

[#11]

Quote from: wavewater

Hi, just heard about this story - Please can you tell me WHY PN was sending customer details to the following person???

We did so because we received court orders saying we had to.
The issue of contesting the request for these orders has been discussed at length in this thread, but ultimately when a court order is granted we can't decline to cooperate.

[#12]

Quote from: Mand

The data wasn't available prior to said DDOS AFAIK.

How do you know that? It may not have been found prior to the attack, but that doesn't mean it was not available.
I don't understand why Plusnet/BT are making excuses for ACS when it was they who were responsible for the sloppy security.
(On the other hand some of the information I've seen elsewhere points to a fairly cosy relationship between BT and ACS with BT assisting ACS in the drafting of the NPO, so perhaps it is perfectly understandable)

[#13]

I don't think "requesting modifications" is the same thing as "assisting drafting"
If we are going to throw accusations - and we are all doing it - then lets at least have some  basis for them.

[#14]

Quote from: jelv

Quote from: Mand The data wasn't available prior to said DDOS AFAIK. How do you know that? It may not have been found prior to the attack, but that doesn't mean it was not available. I don't understand why Plusnet/BT are making excuses for ACS when it was they who were responsible for the sloppy security. (On the other hand some of the information I've seen elsewhere points to a fairly cosy relationship between BT and ACS with BT assisting ACS in the drafting of the NPO, so perhaps it is perfectly understandable)

I said AFAIK. The basis for this is that there wasn't any data leaked before the attack. I'm not defending ACS:Law, why would I? I just want to make sure this issue doesn't get derailed by conspiracy theories and random arguements.
Re your other comment, the amendments were requested to give us more information, I don't see how that's assisting ACS:Law.

[#15]

I think ANY customer who has received a letter from PN indicating that their details were communicated to ACS in clear format should be an EX customer.  
If anyone out there can recommend a good alternative in an non ADSL2+ area this would be apprecieted 😉
Cheers !!