Two recent court decisions highlighted perceived shortcomings of the Computer Misuse Act 1990 (the "Act"), which may finally be remedied later this year.
The first case concerned a denial of service attack. David Lennon allegedly downloaded a "mail-bombing" program called Avalanche from the Internet, which he then used to send approximately 5 million emails to his ex-employer. The majority of those e-mails purported to come from the company's Human Resources Manager.
He was arrested and charged under section 3(1) of the Act. This states that a person is guilty of an offence if he does any act which causes an unauthorised modification of the contents of any computer. Under the Act, a modification is unauthorised if the person whose act causes it is not himself entitled to determine whether the modification should be made, and he does not have consent to the modification from any person who is so entitled.
The Magistrate's Court held that section 3 of the Act was intended to deal with the sending of malicious material such as viruses, worms and Trojan horses which corrupt or change data, but not the sending of emails. The company's servers were configured to receive emails, and the judge held that the company had consented to receive emails (which did not contain such malicious material) and to any consequent modifications in data held on its servers. So Lennon had not carried out any unauthorised act and therefore had no case to answer.
On appeal, the court said that an implied consent to receive emails is not limitless. It only extends to emails sent for the purpose of communication with the owner, but not to those sent in order to interrupt the operation of his computer.
The judge used the analogy of a householder, who impliedly consents to lawful use of his path, but not to a burglar using it, nor to his post box being choked with rubbish. He also held that each email should not be considered separately, as they all resulted from a single act of running the Avalanche program. Whilst an owner may consent to receive a single email, the situation would be different in the case of 5 million.
The second case is that of Gary McKinnon, who allegedly hacked into and damaged several military computers in the US. As a result the US government successfully sought his extradition. He admitted that he had accessed the computers, but claimed that he was only searching for suppressed evidence of UFOs.
He also pleaded that he did not cause harm to the computers which he accessed. Were this argument to have succeeded, he could only have been convicted of unauthorised access under section 1 of the Act, which currently carries a maximum sentence of six months imprisonment. Under the provisions of the extradition treaty between the UK and the US, extradition is only justified for an offence for which the maximum sentence is at least one year. The judge accepted here that there was sufficient evidence of harm having been caused, which currently carries a maximum sentence of 5 years.
The issues raised in both of these cases are addressed under changes to the Act contained in the Police and Justice Bill currently being considered by Parliament. These include a specific denial of service offence and increases in maximum sentences, for example one year for an offence under section 3(1) of the Act. Hopefully the appeal decision in Lennon and the proposed amendments will finally clarify the position and give the law some extra teeth.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
