Digital Economy Act could raise DDoS threat

The ACS:Law data breach has opened a new avenue of security threat

The recent distributed denial-of-service (DDoS) attack on legal firm ACS:Law was perpetrated by online activists who wanted to punish the firm for its aggressive assault on illegal file sharers.

The activists, linked to the 4chan message board, had already attacked a number of high-profile trade organisations involved in promoting action against illegal file sharers, including the Motion Picture Association Of America, the Recording Industry Association of America and the British Phonographic Institute.

The attacks, described by the instigators as 'Operation Payback', raise important questions over whether the imminent implementation of the Digital Economy Act could threaten the security of the internet and people's data.

The Act outlines obligations for internet service providers (ISPs) to closely monitor illegal file-sharing activities, and notify web users who download illegal content that legal action may be taken.

Until now chief concerns have focused on the cost of implementing the legislation and on whether curbing people's internet freedoms can be justified. But the DDoS attacks have flagged up a need to address the potential security issues surrounding the legislation.

Commentators argue that the increasing amount of customer data that will be collected because of the Digital Economy Act means that the security practices of law firms and ISPs need to be closely monitored.

ACS:Law had been sending letters for over a year to people it believed were guilty of using illegal peer-to-peer sites, demanding payments of between £500 and £700 under the threat of court action.

BT, Sky and O2 sent ACS:Law the evidence it needed to threaten offenders, such as computer IP addresses and the time the users of those IP addresses were supposedly breaching copyright.

When the Digital Economy Act comes into force later this year, more law firms could potentially undertake similar work, and ISPs that had always refused to co-operate with the likes of ACS:Law, such as TalkTalk, may have to start handing over information.

At this point, commentators agree that the risk to the security of customer data will increase dramatically.