Teen hacker escapes punishment

Judge rules that denial of service attacks are not illegal under the CMA

A judge has ruled that there was no case to answer after presiding over the trial of a teenager who allegedly flooded his former employer's email system with five million messages.

The ruling has called into question the effectiveness of the Computer Misuse Act (CMA) in prosecuting such cases.

The judge at Wimbledon Magistrates' Court ruled that the alleged actions did not fall foul of the CMA, even though the company involved claimed that the boy's actions had caused its email servers to crash.

The unnamed teenager was charged under Section 3 of the CMA, which covers the more serious offence of unauthorised modification of a computer system.

The defence argued that, since the firm's email server was set up for the express purpose of receiving emails, sending a flood of unsolicited emails could not be considered an act of unauthorised modification.

Judge Grant told the court that "the computer world has considerably changed since the 1990 Act", and that there is little legal precedent to refer back to. He then went on to rule that denial of service attacks are not illegal under the CMA.

In a written ruling, Judge Grant said: "In this case the individual emails each caused a modification which was in each case an 'authorised' modification.

"Although they were sent in bulk resulting in the overwhelming of the server, the effect on the server is not a modification addressed by section 3 [of the CMA]."

The CMA, introduced in 1990, explicitly outlaws the 'unauthorised access' and 'unauthorised modification' of computer material. Section 3 concerns unauthorised data modification and tampering with systems.

The defendant was not called into the witness box during the trial, so was unable to confirm whether or not the attack had taken place.