Copyright Aid

We are a club of ~100 friends and ex-work colleagues who share a sporting interest and we maintained a small website giving basic details of the club for anyone who might like to join. Our sports activities are operated through a completely separate white-labelled sports club app which is provided by a commercial organisation.

Our public website got hacked and the hackers posted a page which looked something like a business news page. We then received a copyright infringement claim for ~£300 from a picture rights organisation because the hacked page included a photograph from a news agency.

£300 is a material slice of our annual club expenditure of ~£15,000 so we would prefer not to have to pay it. We have turned off the public website for the time being.

We would be very grateful for advice on: are we truly liable for this illegal act done by a hacker without our knowledge or consent? how should we deal with the picture rights organisation and/or the news agency?

Hi oldsalt,

Hacking is a criminal offence under section 1 of the Computer Misuse Act 1990 and so you would not be liable for any infringement which directly resulted from a crime. However the difficulty you face is in being able to prove this was a hacking. Was the incident reported to anyone, like Action Fraud or the local Police? I suspect not. It might be worth doing this immediately in order to get a crime number, which you can pass on to the picture rights organisation.

How long was the offending page active on your site? If it was only a few hours or days then it is surprising that the infringement was discovered so quickly. However if the hacked page was there for quite some time, then this weakens your bargaining position considerably. Assuming that it is obvious that the page containing the disputed material has nothing to do with the activities of club itself, I think the best approach would be to explain the circumstances and refuse to pay the claim.

Given the scenario, I am a little suspicious about this claim in the first place. Are you sure the claim has come from a bono fide rights organisation and is not a scam perpetrated by the hackers? Yet another reason for reporting the hacking retrospectively, in case this is a known attack vector.

Many thanks for being so quick with this valuable advice.