Concerns have been expressed by the UK's legal community this week regarding
a ruling which stated that a teenager who bombarded his ex-employer with several
million e-mails (known as a denial-of-service attack) had not committed a crime
under the Computer Misuse Act.
Ruling in Wimbledon's Magistrates Court, District Judge Kenneth Grant stated
that the youth - who has not been named due to his age - had not broken the
CMA.
The Act, introduced fifteen years ago, makes the 'unauthorised access' and
'unauthorised modification' of computer material illegal. Section 3, under which
the teenager was charged, concerns unauthorised data modification and tampering
with systems.
The counsel for the defence argued that sending unsolicited emails did not
represent unauthorised access or modification, as the email server's sole purpose
was to receive emails.
Acknowledging that "the computer world has considerably changed since the 1990
Act", and that consequently there is little legal precedent in this area, Judge
Grant ruled that the DoS attack was not illegal under the CMA.
In the wake of the ruling, the legal community has called for the CMA to be
updated to take into account technological developments.
Speaking to the IT Week news service, lawyer George Gardiner warned that:
"Hackers can [now] do what they want until this judgement is [reversed]
or the act modified."