Blog del Foro de Habeas Data

Un tribunal ingles concluyó en mayo del año 2006 que el envío indiscriminado de correos electrónicos no solicitados a usuarios de internet puede constituir una violación a la ley de delitos informáticos del año 1990, conocida como Computer Misuse Act.

Texto del fallo:

Caso: "Director of Public Prosecutions v Lennon"
Tribunal: QUEEN'S BENCH DIVISION (DIVISIONAL COURT)
Cita: 2006 All ER (D) 147 (May)
Fecha: 11 de mayo de 2006.

Criminal law - Computer - Misuse of computer - Unauthorised modification of contents of computer - Sending of large volume of emails - Consent of owner of computer able to receive emails to receipt of emails - Whether consent authorising large volume of emails sent for purpose of interrupting system - Computer Misuse Act 1990, ss 3, 17(8).
Section 3(1) of the Computer Misuse Act 1990, so far as material, provides: 'A person is guilty of an offence if (a) he does any act which causes an unauthorised modification of the contents of any computer; and ... '
Section 17 of the 1990 Act, so far as material, provides: '(7) A modification of the contents of any computer takes place if, by the operation of any function of the computer concerned or any other computer ... (b) any program or data is added to its contents ... (8) Such a modification is unauthorised if ... (b) [the person whose act causes it] does not have consent to the modification from any person who is so entitled.
Computer Misuse Act 1990: s 17(8)(b).

The defendant was charged with causing an unauthorised modification to a company's computer with intent to im-pair its operation, contrary to s 3 of the Computer Misuse Act 1990. The prosecution alleged that, having been dismis-sed from his employment with the company, the defendant had used a 'mail-bombing' program downloaded from the internet to send a half-million emails to the company, the majority of which purported to be from its human resources manager, R. In those circumstances, it was asserted that, having regard to ss 17(7) and (8) of the 1990 Act, the defen-dant had caused an unauthorised modification by adding data. The defendant made a submission of no case to answer before the district judge on the basis that the modification complained of, namely the sending of emails, could not be shown to have been unauthorised. He contended that since the function of the server was to receive emails, the compa-ny was to be taken as consenting to receive emails and thus to the modification of its server. The district judge was of the opinion that s 3 of the Act was intended to deal with the sending of malicious material rather than the sending of email and that, since the company's server was configured to receive emails, each modification upon the receipt of an email was authorised. The prosecution appealed by way of case stated.
An issue arose as to whether the addition of data by the sending of emails was authorised within the meaning of s 17(8)(b) of the 1990 Act.

COUNSEL:
Richard Brown (instructed by the Crown Prosecution Service) for the prosecution.; Tom Allen (instructed by Tuc-kers) for the defendant.

PANEL: KEENE LJ AND JACK J

DISPOSITION:
The appeal would be allowed.
The owner of a computer able to receive emails would ordinarily be taken to have consented to the sending of emails to the computer. However, such implied consent was not without limits, and it plainly did not cover emails that had been sent not for the purpose of communication with the owner but for the purpose of interrupting his system.
There was some analogy with a householder, whose consent to someone walking up the path to his front door would not extend to a burglar or to having his letterbox choked with rubbish. If the defendant had called R and reques-ted her consent to his sending her an email about his dismissal, she would be puzzled as to why he had bothered to ask. However, if he had asked her whether he could send the half-million emails he in fact sent, there would probably be quite a different answer.
Accordingly, the district judge had been wrong to conclude that there was no case to answer.
Per curiam: An email purporting to be from someone other than the true author is not necessarily to be treated as unauthorised. Whether it is or is not authorised depends on the circumstances.

[2006] All ER (D) 147 (May)