Andrew Crossley, the lawyer behind the UK's leading P2P settlement factory, is serious about mailing out his "pay up" letters, and he knows just what kind of return he'll get. As part of firm's huge e-mail leak (read our major investigation), Ars has now seen the company's "strictly private and confidential" business plan, along with detailed cash flow projections and salary statements. After poring over the data for the last few days, it's possible to say just how Crossley makes his money—and how much of it he makes.

Crossley's law firm, ACS Law, helps pornographers (and a few music labels and software publishers) defend their copyrighted works online, and after doing it for a while, Crossley has the business down to a science. According to a cash flow projection spreadsheet, the amount of money demanded in the letters varies by client. For instance, a campaign on behalf of Mediacat demanded £500, while another campaign for Digiprotect only asked for £400. "Lucky" targets of this scheme might be asked to pay just £350.

But how can Crossley have any idea who will settle and who won't? Given the volume business he's engaged in, this is really just a numbers game. ACS Law's business plan assumes a 15 percent recovery rate, but "in practice, we area able to demonstrate a 20 percent recovery rate."

A couple hundred pounds and a low response rate might not sound like the road to riches, but if you mail a lot of letters, it adds up quickly (and ACS Law will happily put people on an installment plan if they can't pay up right away). And Crossley does mail a lot of letters; his business plan notes that ACS Law has "invested in a high quality commercial printer to ensure it has sufficient capacity. In addition, it always keep [sic] another printer on site in case the main printer experiences any difficulties."

Crossley's spreadsheets show that a tiny campaign might snag 12,000 suspected IP addresses, only 3,550 of which are "usable." Of these 3,550, only 1,598 were turned into letters. With a 15 percent response rate and a demand for £400, this campaign is expected to pull in £81,000 pounds.

(Note that the raw data supplied by P2P detection companies is largely unusable. Only 40 percent of the IP addresses turned over to ACS Law can be used, and only 45 percent of these can actually be turned into usable names and addresses.)

Larger campaigns have sent up to 13,500 letters at once—a move projected to bring in a whopping £602,000 in gross revenue.

This doesn't all go to ACS Law, of course. Fifteen percent is set aside to pay ISPs for doing the actual IP address lookups, while the copyright holder and the P2P detection firm each get a big chunk. But ACS Law does well for itself; according to the business plan and the spreadsheets we reviewed, the law firm keeps "between 35 and 53 percent of net revenues" for itself.

In one spreadsheet, Crossley tots up his total projected income from 2010 and 2011; according to these calculations, his approach will rake in £10,235,700 of gross revenue by the end of 2011. After ACS Law pays its data supplier and the copyright holders, Crossley & Co. should be left with £4,261,585 of their own.

Expenses



Now, Crossley has expenses, of course. He keeps an office in Westminster, London. He employs a staff of 19 paralegals, five administrators, and a few supervisors. He has to pay for all that paper he uses to print his letters—believe it or not, paper costs Crossley more each year (£31,000) than he pays in salary to any one of his employees.

But these costs are minimal. Crossley pays his administrators only £13,500 a year, his paralegals get £16,000, and no one makes above £20,000. Rent is £6,000 a month. Each month, his total expenses come to just about £50,000, or £600,000 for an entire year.

So let's run the numbers. For 2010 and 2011, Crossley expects his firm's share to be £4,261,585, but he only has a total of £1,200,000 in expenses. Raw profit in Crossley's own pocket: £3,177,722. Nice work if you can get it, and it explains why he's been looking for a mansion to rent and buying a Bentley and a new Jeep.

Unfortunately for Crossley, much of this cash flow projection is speculative. As he notes in one e-mail, "The figures in reality have not yet matched these projected figures for one reason only; we are still awaiting a large amount of names and addresses from the ISPs to enable us to send our letters. However, from the letters we have been able to send out the figures have come in exactly as we have predicted... But for the delay in the data from the ISPs, which is temporary, all facts and matters stated in the business plan still prevail."

His recent loss of all these e-mails may put another big dent in his plans, thanks to data privacy laws. By losing the spreadsheets showing what UK citizen allegedly downloaded what, Crossley may have put himself at risk of a £500,000 fine.

The UK's Information Commissioner put out a statement today noting that "any organisation processing personal data must ensure that it is kept safe and secure. This is an important principle of the Act. The ICO will be contacting ACS Law to establish further facts of the case and to identify what action, if any, needs to be taken."

The Commissioner cares because the leak contained spreadsheets, like the one below from BT, showing just whose account was associated with a particular IP address—and a particular pornographic movie.

When BT turned over this data to ACS Law, it noted in an e-mail, "Please acknowledge safe receipt and that the data will be held securely and shall be used only in accordance with the provisions of the Order." But the spreadsheet that we saw wasn't even password-protected.

Still, unless the government or the judiciary shuts him down completely, not even a massive fine will mean much, so long as Crossley can turn his cash flow projections into reality.