Frontier Systems Ltd (t/a Voiceflex) v Frip Finishing Ltd

A customer is liable for usage-based telecommunications charges only where the contract makes liability depend on the customer’s use, or where the customer is in material breach of a relevant contractual obligation. Supplying an always-available service does not, without more, make the customer liable for fraudulent calls made by unknown third parties. Contractual security obligations must be pleaded with sufficient particularity. Implied terms may be incorporated where necessary to give business efficacy to the contract or where they represent the obvious but unexpressed intention of the parties. General condition 11 did not allocate the risk of fraudulent third-party calls to the provider.

Voiceflex supplied internet-based telephony services to Frip under a contract formed in 2006. Unknown hackers accessed Frip’s router and caused more than 10,000 calls, principally to a premium-rate number in Poland. Voiceflex invoiced Frip £35,560.20 and claimed the amount either as the price of services supplied or as damages for breach of contract.

Voiceflex alleged that Frip had breached express and implied security obligations. Frip denied liability and relied alternatively on general condition 11 published by Ofcom and section 104 of the Communications Act 2003. The issues were whether Frip had used the service, whether it had breached the contract, and whether the regulatory provisions affected any liability.

Judgment for Frip. Voiceflex failed on both alternative bases of its claim.

1. Contractual terms. The parties’ contract incorporated Voiceflex’s terms and conditions. The alleged implied obligations requiring Frip to take reasonable steps to secure its network and hardware were sufficiently necessary or obvious to be implied. The alleged terms concerning password confidentiality replicated the express obligation in clause 6.4.
2. Alleged breaches. The allegation that Frip had failed to secure its network was insufficiently particularised. The evidence did not establish that port 5060 had been open before the hack. Nor did it establish that Frip had used an insufficiently robust password; an eight-digit password was generally accepted as strong for the relevant period.
3. Price claim. On the proper construction of the contract, repeated references to the customer “using” the service showed that payment was triggered by use rather than mere availability. Clause 6.4 indicated that a customer which used all reasonable endeavours to keep its password confidential and inaccessible to third parties would not be liable for calls made by unknown third parties. The later insertion of a fraud clause confirmed that no equivalent allocation of risk existed at the material time. There was also no established contractual limit of one simultaneous call.
4. Obiter regulatory conclusions. General condition 11 was directed to the accuracy of billing and did not allocate responsibility for fraudulent third-party use. It would require clear words to produce that effect. Section 104 of the Communications Act 2003 did not prevent a defendant from relying on a breach of general condition 11 defensively. The section operated as a sword enabling proceedings, not as a bar to using the breach as a shield.