Iain

For anyone receiving a request to provide/transfer a website, ensure the request is genuine and obtain written authorisation to provide access/send data to a third party.  You don't want to be in the position of explaining how you gave away client data to a competitor!

There might well be good reasons to limit access if the site is on a shared hosting facility, or if the server is correctly locked down so that some of the resources you need (e.g. form to email scripts) are not accessible by FTP.  (In fact allowing FTP access is not considered security best practice at all).

But no, the behaviour doesn't sound ethical.  In an ideal world, the client could have ensured there were sufficient contractual conditions to manage the termination arrangements, and perhaps to set a cost for this.  However, everyone should ensure they have reasonably up-to-date copies of all the assets required for a website, no matter how simple this is.  If there are intellectual property issues, an escrow agreement may be the way forward.  You don't want to be left without your website design, content and data if the hosting company went bust, fell out with you or had a security breach which destroys your site.

If the database contains any sensitive data, you will need to make sure that no traces of it are left - security decommissioning.

Colin Watson
Technical Director
Watson Hall Ltd Website security
http://www.watsonhall.com