David Lennon, a U.K. teenager has been sentenced by a Magistrate Judge in Wimbledon Magistrates Court to a two-month curfew for sending 5 million e-mails to Domestic & General Group which crashed its servers. The conviction came under the Computer Misuse Act which explicitly outlaws the "unauthorized access" and "unauthorized modification" of computer material. 

Lennon’s case was reviewed earlier by another judge who held that massive amounts of e-mail did not violate the Computer Misuse Act because e-mail servers were set up to receive e-mail and therefore each individual email constitutes an "authorized modification" to the server under the Act. The previous ruling was challenged by the prosecution and was sent back to the Magistrate Court.

The Magistrate Judge, in realizing that some damage has been made, said,

Even given his age at the time, this was a grave offense and caused serious damage, so I need to impose something to make him think again.

It is interesting to note how the U.K. Courts have struggled with applying the Computer Misuse Act in computer contexts such as this one. Arguably, as the initial court held, sending e-mail messages to a server is "authorized" and should not be criminal even if done on a large scale basis (5 million).  In reality, some damage has been done to the servers because they crashed under the heavy load, and the Magistrate Judge seemed to realize this, but still seem uncomfortable.  In the United States, early e-mail spam cases were brought under the Computer Fraud and Abuse Act (or state equivalents) with mixed success. Although it is not exactly clear whether the CAN-SPAM Act has had any significant impact on the amount of spam, it has provided an easy to use and clear tool to fight spam in the United States.

Because of cases such as this one, the U.K. Computer Misuse Act has been considered insufficient to stop crimes such as large scale spam or denial-of-service attacks and amendments have been proposed which would increase penalties and would criminalize behavior such as "maliciously impairing the operation of a computer or preventing access to programs or data." [Will Sturgeon, U.K. cybercriminals threatened with 10-year term, CNET , Jan. 26, 2006]