Very scary! I would be dumping cox in a heartbeat if I got a letter like that - geez. Anyway - it is fairly easy to track if you are using Acquisition because the author has built in "back doors" that have the software connect to his website to pass along and validate data. As for file sharing in general - specific ports are used for specific networks. If they detect those ports in use, then viola, it is obvious what you are doing.