News - ACS:Law could cop £500k fine as ‘porn list’ is exposed

[HEXUS]

More ACS:Law revelations as info of people being 'investigated' is leaked to web.

Read more.

[neonplanet40]

ahahahahaha serves them right

[3dcandy]

probably does serve them right. If they wish to play hardball (which in all accounts they seem to have done) then they risk letting themselves open to being attacked by some organisations.

[aidanjt]

They should be looking at jail time for fraud and blackmail.

[hermano pequeño]

I love technology. Stick your head above the parapet and someone will knock it off. Couldn't happen to a nicer bunch, hope they burn.

[Tattysnuc]

I don't see how this will stick. If their data was "secured" (albeit poorly) and someone went in and hacked their data and then published it, I don't see how this constitutes them publishing it. I understand that they have a duty of care, but if they show tht they took "reasonable" precautions then this surely wont stick...?

[chuckskull]

Another 8000 released. http://www.bbc.co.uk/news/technology-11425789

Feel for sorry people, who've had their personal details, credit cards and alike made public because of this opportunist pig.

[alsenior]

I don't see how this will stick. If their data was "secured" (albeit poorly) and someone went in and hacked their data and then published it, I don't see how this constitutes them publishing it. I understand that they have a duty of care, but if they show tht they took "reasonable" precautions then this surely wont stick...?

that is the problem. the file was available to anyone accessing the site. it was a .tar file listed in a directory listing on the root of the site. anyone who went to the site legitimately could access the file. this counts as public disclosure

[kopite]

There is a website out there that allows you to search by post code for people near you who are on the list.

I`ve also heard that some on somethingawful is taking this list and the bnp list and cross referencing them against each other.

[HalloweenJack]

reading the press he is still as arrogant and pushing for criminal charges against those who did this - but as said above , its a total breach of the data protection act as the file in question was available , unencrypted through a link on the front page....

[scaryjim]

I'm not sure the file was available from a link on *their* home page - from what I've read their web server came back up after the DoS attack with a directory listing of the web site, rather than their homepage, and that's where the list was culled from.

But the bottom line is that you take better care of sensitive, personal identifiable data than that. The list should never have been on their web server: there's no reason for it to have been on their web server, and no excuse for the fact that it was on their web server. That's simply *not* taking reasonable precautions.

[Rob_B]

.....The list should never have been on their web server: there's no reason for it to have been on their web server, and no excuse for the fact that it was on their web server unencrypted!!. That's simply *not* taking reasonable precautions.

Fixed that for you

emails show that BT, for example, disclosed data via unencrypted Excel spreadsheet attachements.

Sky have said their was encrypted, seems ACS got whatever data they could & bunged it into Excel with no further thought.

[scaryjim]

Fixed that for you

No, I don't think you did. I was quite deliberate in what I said. There's no excuse for keeping personal identifiable data on your web server at all, whether it's encrypted or not. It just shouldn't be there.

[Rob_B]

Well, my aim was to add another reason rather than suggest it would be fine if it was encrypted.

Glad they did though

[Rob_B]

Well, my aim was to add another reason rather than suggest it would be fine if it was encrypted.

Glad they did though

As an Ex-Sky broadband subscriber I'm concerned my details may be floating around, not that I downloaded anything related to this matter but as IP addresses are in no way 100% accurate there are surely incorrect details that all ISPs involved have passed on. We've already seen the complaints from 'innocent' people (not all of which I imagine are lies)

I might have to download the thing to check I'm not on it, if I am, well it's a fun call to my card issuer

EDIT: Damn, double post.

[kopite]

Although Sky do use Dynamic IP addresses their logs should still show which was user was connected using which IP at a specific time there shouldnt be any incorrect details on that list. Although looking at some of the stuff people have downloaded it would be interesting to see if their partners realise they are into desperate house husbands and grannies that like other grannies.