DPP v Lennon

DPP v Lennon is the first reported criminal case in the United Kingdom concerning denial-of-service (DoS) attacks.^[1] The appeal court found that DoS attacks constituted an offence of unauthorised modification under s. 3 of the Computer Misuse Act 1990 (CMA) and thus clarified the law regarding DoS.^[2]

Facts

Lennon, a 16-year-old teenager, was employed by Domestic & General Group PLC (D&G) for three months until he was dismissed in December 2003. In January 2004, Lennon downloaded from the Internet a mail bombing program, the Avalanche v3.6, and used it to bombard D&G with emails.^[3] Email bombing is the action whereby a program deliberately sends large numbers of emails to a particular email address within a business and is an example of a DoS attack whereby multiple requests are made with objective to slow down or disable a network.^[4]^[5]^[6]

The Avalanche was set to "mail until it stopped". The emails also spoofed the name of Betty Rhodes, D&G's human resources manager, therefore they appeared to originate from Rhodes, rather than from Lennon.^[7] During the weekend, it was estimated that almost 5 million emails had been received by the group servers, with the last one sent to Ms Rhodes stating "it won’t stop". This consequently overwhelmed D&G's servers and brought them down along with the corporate website.^[7] The Metropolitan Police Service's Computer Crime Unit traced the attack to an address in the West Midlands. Lennon was arrested, interviewed and sent for trial at Wimbledon Youth Court.^[8]

Judgment

The defendant admitted on questioning that he had downloaded the program and sent the emails "modifying" the server of D&G, with the intention of causing a "bit of a mess up".^[9] However, he had not considered that he had done something criminal, neither had he realized the impact of his actions, nor the intention to cause damage to D&G, which was estimated nearly £18,000.^[10] Moreover, he stated that he could have carried out a "ping attack", but did not as that would merely slow the network for a few hours. Thus, he has recognized that at least he had considered the relative potential for interruption of two courses of action, and he had chosen the one which was more possible to cause problems to D&G.^[7]

Lennon was then charged with violating s.3 of the CMA for causing an "unauthorised modification" to a computer, with the knowledge that the modification was unauthorised and by doing so he impaired permanently or temporarily the right operation of that computer.^[3] The crucial question was whether this modification was authorised and whether D&G consented to those modifications.^[3] Ss. 17(7b) and 17(8)^[11] provide the statutory definitions of "unauthorised modification", where the first section makes clear that a modification includes the addition of any program or data and the second one defines "unauthorised" as where (the defendant) does not have consent to the modification from the person who is entitled to determine whether or not that addition should be made.^[12] At Wimbledon Magistrates' Court the prosecution submitted that Lennon had fulfilled the elements of s.3(1) as he had caused a modification of the contents of D&G's email servers.^[13]

The defence did not dispute that the sending and receipt of each email resulted in modification of D&G's server.^[10] Simultaneously, the defence made a submission of "no case to answer" on the grounds that the accused modification, by sending emails, was not capable to indicate that his activities have been unauthorised.^[14] The basis of the defendant's argument was that since the very function of the email server was to receive emails, then each individual email sent to the server is authorised to modify it and there can be no threshold over which a vast quantity of authorised transactions becomes unauthorised.^[12] Therefore, D&G must have consented to receive emails and modify the server, so he could not be guilty on the s.3(1) offence.

Per contra, the prosecution countered firstly, that there can only be consent to bona fide emails, which the defendant's were not. Secondly, the emails were unauthorised from the moment the Avalanche was instructed to send them. Thirdly, even if there was a number of emails that were impliedly authorised, there was a threshold at which their number transgressed into being unauthorised. Finally, they argued that all the emails were unauthorised since they came from the defendant rather than the purported sender.^[13]

The District Judge Grant, sitting as a youth court, accepted the defence's argument and held that there was no case to answer, dismissing the charges against Lennon. He also held that s.3 was to deal with the sending of malicious material like viruses, worms and Trojan horses which modify data, but not the sending of emails. Further, as D&G's servers were configured to receive emails, each email sent by the defendant on an individual basis, the implied consent to each resulted in implied consent collectively and thus, the modifications made were authorised.^[15]

Appeal

The Director of Public Prosecutions (DPP) appealed against the ruling of no case to answer. Lord Justice Keene and Justice Jack disagreed with Judge Grant's reasoning, allowed the appeal and remitted the case to the district judge to continue the hearing, stating that the district judge had "rather missed the reality of the situation by wrongfully finding that there was no case to answer".^[13] The issue this court had to consider was whether the addition to the data on D&G's server arising from the receipt of emails sent by Lennon was unauthorised within the meaning of s.17(8).^[16] This was unproblematic to answer since Lennon was not the person entitled to determine whether or not such "modification" should be made. So, s.17(8a) is satisfied. Then, the question was whether Lennon "had consent to the modification from any person who was so entitled" according to s. 17(8b).^[17]

As concern the issue of consent, a divisional court agreed that the owner of an email server would give consent to the receipt of emails. However, it held that this implied consent was not without limits.^[18] Thus, while D&G may have given implied consent for the sending of an email, it would not have agreed to being overwhelmed with the large number of emails. The court drew an analogy with a footpath on a private property. Just as a householder with the implied permission given to the members of the public walking up his or her path delivering mail through a letterbox, such implied permission could not be taken to extend to burglars using the path or having the letterbox to be "chocked with rubbish".^[16] It was not necessary to define the limits of that consent; it was enough to state that the implied consent covered emails sent for the purpose of communication with the owner and is withdrawn where emails are sent for the purpose of interrupting the operation and use of the system.^[19]

Contrary to the defendant's submission, his conduct should not be considered on a case-by-case basis, but as a whole, because the emails had been sent by a single program. Further, Avalanche was set to run until it stopped, so Lennon's purpose was obvious from the moment he started the program.^[13] Further, regarding prosecutions fourth submission of spoofed email addresses, referring to s.3(4) and the Zezev case, the court held that there was no consent to the sending of emails in the name of Ms Rhodes, there was no consent to the receipt of malicious emails purporting to come from an employee.^[17] However, the court expressly stated that not in all circumstances, an email purported to come from a person other than its originator should be treated as unauthorised, as the authorisation or not depends on the circumstances, i.e. where it was sent for a joke.^[12]

Remitting the case back for trial the court made a suggestion to the district judge to consider it as a test: Whether Lennon had knowledge that what he was doing was unauthorised, what answer would he have expected if he had asked D&G whether he might start the program.^[20] Lennon, 19 years old then, was convicted and sentenced to two months’ curfew by an electronic tag. Lord Dixon sitting at WMC ruled that Lennon's guilty plea indicated that a DoS attack is a serious and criminal offence.

Commentary

Although on appeal the court solved the problem of DoS that even a realization that there was a possibility that the unauthorised email might impair the operation of the target system would suffice, the problems regarding implied consent and thus authorisation to the receipt of email remain unresolved. The initial decision in the Magistrates' Court aroused considerable comment and consternation and led to renewed calls for the CMA to be updated so as to deal with changes in technology and use. The Police and Justice Act 2006 (s.36) amended s.3 of CMA criminalizing DoS attacks, punishable by a maximum of 10 years’ imprisonment.^[2] This amendment brought the UK in compliance with A.5 of the Council of Europe Cybercrime Convention and A.3 of the EU Framework Decision on Attacks against Information Systems.^[21]

References

^ Fafinski, S. (2007). "Cyber crime". The New Law Journal. 157 (7258): 159.
^ ^a ^b Pinsent Masons, DPP v Lennon, (2007), accessed 19 February 2012.
^ ^a ^b ^c Kon, Georgina; Church, Peter (2006). "A denial of service but not a denial of justice". Computer Law & Security Review. 22 (5): 416–417. doi:10.1016/j.clsr.2006.07.004.
^ Creaton, J. (2006). "Recent Judicial Decisions". Police Journal. 79 (4): 371. doi:10.1350/pojo.2006.79.4.371.
^ Creaton, Jane (2016). "Recent Judicial Decisions". The Police Journal: Theory, Practice and Principles. 80 (2): 167–183. doi:10.1350/pojo.2007.80.2.167.
^ Creaton, Jane (2016). "Recent Judicial Decisions". The Police Journal: Theory, Practice and Principles. 78 (2): 159–174. doi:10.1350/pojo.2005.78.2.159.
^ ^a ^b ^c Fafinski, S. (2006). "Service denied?". The New Law Journal. 156 (7248): 1712–1713.
^ Oate, J. (23 August 2006). "Kid who crashed email server gets tagged". The Register. Retrieved 17 February 2012.
^ Fafinski, Stefan (2007). "The security ramifications of the Police and Justice Act 2006". Network Security. 2007 (2): 8–11. doi:10.1016/S1353-4858(07)70017-X.
^ ^a ^b Consulting C., (2006) "Denial of service attacks- Lennon and the Computer not much use Act", Electronic Business Law 8, 1,9
^ s.17 Computer Misuse Act 1990
^ ^a ^b ^c Hörnle, J. (2006), "UK-Computer Misuse-Denial of service attack", Electronic Business Law 8(6), 13
^ ^a ^b ^c ^d Fafinski, Stefan (2016). "Computer Misuse: Denial-of-Service Attacks". The Journal of Criminal Law. 70 (6): 474–478. doi:10.1350/jcla.2006.70.6.474.
^ Fafinski, Stefan (2016). "Access Denied: Computer Misuse in an Era of Technological Change". The Journal of Criminal Law. 70 (5): 424–442. doi:10.1350/jcla.2006.70.5.424.
^ Lloyd., I., Information Technology Law (5th edn., OUP Oxford, 2008) pp. 236
^ ^a ^b "Computer misuse: consent to modification of computer", Archbold News, 2006 6, 1–2
^ ^a ^b [2006] EWHC 1201 (Admin), 2006 ALL ER (D) 147
^ Pinsent Masons, "Denial of Service attacker sentenced to curfew" (2006), accessed 17 February 2012
^ Edwards, L. & Waelde, C. (2009), Law and the Internet (3rd edn), Oxford: Hurt Publishing, p. 677
^ Lloyd 2008, p. 237.
^ Fafinski, Stefan (2008). "Computer Misuse: The Implications of the Police and Justice Act 2006". The Journal of Criminal Law. 72: 53–66. doi:10.1350/jcla.2008.72.1.477.

External links

Council Framework Decision on attacks against information systems, 17 January 2005, 15010/04.
Council of Europe Convention on Cybercrime, CETS No.: 185, 23/11/2001.
Council of Europe Additional Protocol to the Convention on cybercrime, concerning the criminalisation of acts of a racist and xenophobic nature committed through computer systems, ETS No.:189.
The Computer Misuse Act 1990.
Police and Justice Act, s.36.