Director of Public Prosecutions v Lennon

Implied consent to receive email does not extend to bulk or malicious emails sent to interrupt the proper operation of a computer system. Whether a modification is authorised under Computer Misuse Act 1990, section 17(8), depends on the purpose and circumstances of the conduct considered as a whole. Where emails are sent through an automated programme for that purpose, the sending may be unauthorised from the outset, rather than becoming unauthorised only after a particular volume is reached.

The Director of Public Prosecutions appealed by case stated against a Youth Court ruling that there was no case to answer on a charge under section 3(1) of the Computer Misuse Act 1990. The respondent, aged 16 at the relevant time, had used an automated programme to send approximately five million emails to his former employer’s servers. The central issue was whether the resulting additions to the servers’ data were unauthorised within section 17(8), given that the servers were configured to receive emails.

1. The appeal was allowed and the matter was remitted to the District Judge to continue the hearing.
2. Under section 17(8) of the Computer Misuse Act 1990, the owner or controller of an email server is ordinarily taken to consent to the sending of emails to it. That implied consent has limits. It does not extend to emails sent for the purpose of interrupting the proper operation and use of the system.
3. The question whether consent exists must be assessed by considering the defendant’s conduct as a whole. It is not determined email by email. Here, the respondent’s purpose was present from the beginning, and the single act of starting the automated programme initiated the unauthorised conduct.
4. The fact that a server is configured to receive emails does not imply consent to emails sent in a quantity and at a speed likely to overwhelm it. The same analysis applied to malicious emails purporting to come from another person, although the court left open whether every impersonating email would be unauthorised in all circumstances.
5. The prosecution still had to establish the respondent’s knowledge that the modifications were unauthorised under section 3(4). That issue had not been determined on the case stated and remained for the District Judge.

• High Court (Administrative Court): allowed the Director of Public Prosecutions’ appeal by case stated and remitted the matter to the District Judge.
• Youth Court sitting at Wimbledon: on 2 November 2005, District Judge Kenneth Grant ruled that there was no case to answer and dismissed the charge.