HKSAR v. Ko Kang Suk and Another
Read the full judgment text of DCCC 348/2021 on BabelCite. This District Court judgment was delivered on 7 October 2022.
1. D1 and D2 are jointly charged with 2 offences of "Conspiracy to steal" (Charges 1 and 2). They pleaded not guilty to both charges. D1 also faces a charge of "Breach of condition of stay" (Charge 3), to which he pleaded guilty.
Cites 4 cases
|
DCCC 348/2021 [2022] HKDC 1145 IN THE DISTRICT COURT OF THE HONG KONG SPECIAL ADMINISTRATIVE REGION CRIMINAL CASE NO. 348 OF 2021 ________________________
________________________
REASONS FOR VERDICT 1.D1 and D2 are jointly charged with 2 offences of "Conspiracy to steal" (Charges 1 and 2). They pleaded not guilty to both charges. D1 also faces a charge of "Breach of condition of stay" (Charge 3), to which he pleaded guilty. 2.This trial is concerned with Charges 1 and 2 only. The Prosecution Case Charge 1 3.Mr. Lam (PW1) is the proprietor of HK Bitcoin ATM Limited ("HK Bitcoin"). It engaged in the business of trading Bitcoins; it placed Bitcoin ATMs (Automated Teller Machines) at various locations including Mongkok, Central, Sham Shui Po, Tsuen Wan and Fanling. 4.At 1953 hours on 5 August 2020, someone received $12,000 cash from the Bitcoin ATM at Central by purporting to sell 0.147624 Bitcoin to HK Bitcoin. PW1 said HK Bitcoin did not receive any Bitcoin for this transaction. This is Incident 1-1. 5.At 2211 hours on 5 August 2020, someone received $43,000 cash from the Bitcoin ATM at Sham Shui Po by purporting to sell 0.511224 Bitcoin to HK Bitcoin. PW1 said HK Bitcoin did not receive any Bitcoin for this transaction. This is Incident 1-2. 6.At 1404 hours on 6 August 2020, someone received $52,000 cash from the Bitcoin ATM at Sham Shui Po by purporting to sell 0.61652 Bitcoin to HK Bitcoin. PW1 said HK Bitcoin did not receive any Bitcoin for this transaction. This is Incident 1-3. 7.At 1745 hours on 6 August 2020, someone received $52,000 cash from the Bitcoin ATM at Mongkok by purporting to sell 0.617681 Bitcoin to HK Bitcoin. PW1 said HK Bitcoin did not receive any Bitcoin for this transaction. This is Incident 1-4. 8.At 2048 hours on 13 August 2020, someone received $13,000 cash from the Bitcoin ATM at Mongkok by purporting to sell 0.156493 Bitcoin to HK Bitcoin. PW1 said HK Bitcoin did not receive any Bitcoin for this transaction. This is Incident 1-5. 9.At 2050 hours on 13 August 2020, someone received $4,000 cash from the Bitcoin ATM at Mongkok by purporting to sell 0.156844 Bitcoin to HK Bitcoin. PW1 said HK Bitcoin did not receive any Bitcoin for this transaction. This is Incident 1-6. 10.According to PW1, he carried out some tracing of the 6 transactions mentioned above. He discovered that there was a loophole in the computer programme of his Bitcoin ATMs, namely that the ATMs would dispense cash to the Bitcoin seller even upon receiving an unconfirmed Bitcoin address (or link). PW1 explained that the seller took advantage of the time gap which the "miners" would take to confirm the Bitcoin address by cancelling the transaction before it was confirmed. The seller also used a function called RBF (Replaced By Fee) in his/her Bitcoin wallet in order to cancel the transaction during its unconfirmed state[2]. 11.The total loss in cash suffered by HK Bitcoin was $176,000. Charge 2 12.Mr. Law (PW2) is the proprietor of Nitroswap Limited ("Nitroswap"). It engaged in the business of trading Bitcoins; it placed Bitcoin ATMs at various locations including Yuen Long, Tuen Mun, Sham Shui Po, Tsim Sha Tsui and Mongkok. 13.At 2015 hours on 10 August 2020, someone purportedly sold 0.200226 Bitcoin to Nitroswap at $17,000 via its Bitcoin ATM at Tuen Mun. The ATM dispensed $6,600 cash only but the seller did not pick up the money. PW2 checked the CCTV footage and discovered that a passer-by had picked up the money about 18 hours later. PW2 said Nitroswap did not receive any Bitcoin for this transaction. This is Incident 2-1. 14.At 2019 hours on 10 August 2020, someone purportedly sold 0.11706 Bitcoin to Nitroswap at $10,000 via its Bitcoin ATM at Tuen Mun. The ATM dispensed $10,000 cash but the seller did not pick up the money. According to PW2, the same passer-by had picked up the money together with the $6,600 in Incident 2-1. PW2 said Nitroswap did not receive any Bitcoin for this transaction. This is Incident 2-2. 15.At 2100 hours on 10 August 2020, someone purportedly sold 0.209088 Bitcoin to Nitroswap at $18,000 via its Bitcoin ATM at Yuen Long. The ATM dispensed $8,500 cash only and the seller took it. PW2 later received an SMS from the seller claiming that the cash from the ATM came out short. PW2 refunded that person in Bitcoin equivalent to $9,500. PW2 said Nitroswap did not receive any Bitcoin for this transaction. This is Incident 2-3. 16.The total loss suffered by Nitroswap was $25,100 in cash and Bitcoin equivalent to $9,500. Allegations against D1 and D2 17.By relying on circumstantial evidence such as CCTV footage of various locations, contents of WeChat, WhatsApp and Telegram messages, clothing items seized as well as D1's hotel registration record, the prosecution alleges that D1 and D2 had conspired together and with other persons to steal cash from the Bitcoin ATMs in the manners described above by cancelling the Bitcoin transactions after receiving cash from the ATMs. The Defence Case 18.D1 elected not to give evidence but called a defence witness Mr. Zhou (DW1). 19.D2 elected not to give evidence or call any defence witness. 20.Both D1 and D2 have the right to remain silent; I drew no adverse inference against them in this regard. Assessment and Analysis of Evidence 21.The burden of proof is on the prosecution to prove each element of each offence beyond reasonable doubt. Regarding the element of dishonesty, I have directed myself according to the Ghosh principles. 22.I have reminded myself that D2's admissions can only be used against himself only; not D1 or any other persons. 23.In respect of identifying someone based on video footage or still photographs, the Court of Appeal in HKSAR v Tagao Saudee Abad CACC 366/2015 (24 May 2017) held "a tribunal of fact may perform its own identification exercise and reach a view on whether the defendant is the person in the video recording or photo is now settled law[3]." In HKSAR v Riasat-Ali [2019] HKCA 312，the Court of Appeal re-affirmed the principle in Tagao Saudee Abad[4]. 24.I have also directed myself according to the principles in Turnbull as well as Dodson & Williams [1984] 1 WLR 971. I am aware of the dangers in relying on identification evidence alone and making identification based solely on video footage and/or still photographs. The Bitcoin ATM scam 25.With the CCTV footage and the transaction records, each incident of obtaining cash (actually taken by the ATM user or not) is undeniable. As a juror, I believe the evidence of PW1 and PW2. I accept that they (or their companies) did not receive the appropriate amount of Bitcoin in each purported Bitcoin sale transaction. 26.To put it in layman's terms, according to the evidence of Dr. Chow (PW8), who is an expert on cryptocurrency (including Bitcoin) and digital forensics, in all of the above Bitcoin sale transactions (except Incident 2-3), the purported seller used the RBF method to invalidate the Bitcoin address (or link) received by HK Bitcoin or Nitroswap; and then sent the same amount of Bitcoin back to his/her own wallet by creating a 2nd Bitcoin address (or link) which carried a much higher "mining fee" than the initial one. 27.I am aware of the comments made by D1's counsel Ms. Herbert on PW8's opinion, namely the mining fee of the 1st transaction not set at the lowest possible value; the time gap between the 1st and 2nd transactions; and the possibility of someone's wallet being hacked[5]. I am also aware that in Incident 2-3, the RBF function was not enabled and the Bitcoin did not go back to the purported seller's wallet[6]. 28.Notwithstanding Ms. Herbert's comments, the undeniable facts remain that in all the relevant Bitcoin ATM transactions, cash was dispensed from the ATMs and no Bitcoin was ever received by HK Bitcoin or Nitroswap. Except in Incident 2-3, the Bitcoin in each transaction went back to the purported seller's wallet. As an owner of Bitcoin ATMs, PW1's evidence was that in August 2020, by setting a very low mining fee and enabling the RBF function was the only way to cheat the ATMs. PW1 explained that it was his commercial decision then to allow his ATMs to dispense cash before a Bitcoin transaction was confirmed (i.e. when it was still in the "mempool") so that the customers did not need to wait for a long time. After being cheated, PW1 decided to make the customers wait if his ATMs detect an RBF flag in the Bitcoin address sent by the seller. He said he rewrote the programme himself. 29.As a juror, I accept the evidence of PW1 and PW8 without reservation. The modus operandi of stealing cash from Bitcoin ATMs as well as the technicalities involved are clearly established. I find that all such purported Bitcoin sale transactions were a calculated scam with advance planning to steal cash from Bitcoin ATMs. Identity of MC 30.According to the Royal Garden's record, the phone number registered under D1's booking was 5223 5454[7]. Mr. Chan (PW3), Director of Rooms of the Royal Garden, said in his evidence that the phone number could have been given to the hotel when the booking was made[8] or by the guest upon check-in. 31.Amongst other things, a China Mobile SIM card of phone number 5223 5454 was found and seized by the Police from Room 534 of the Royal Garden on 18 August 2020[9]. The room was registered under D1's name[10]. According to PW3, D1 checked into the hotel on 29 January 2020 and moved into Room 534 on 21 May 2020. 32.D2 communicated with MC (phone number 5223 5454) via WhatsApp[11]. D2 also communicated with MC (ID: stevenko1229) via WeChat[12]. DW1 (Mr. Zhou) confirmed that he was texting D1 in Attachment 12, Exhibit P80B. DW1 agreed that the profile picture of D1 (a male holding a shot gun) as shown in Attachment 12 of Exhibit P80B is very similar to the profile picture of MC as shown in Photo 267 of Exhibit P79. 33.The screenshots of certain text messages between DW1 and D1 (namely Attachments 12 and 47 of Exhibit P80B) were sent to D2 by MC via WhatsApp (see Entries 150 to 151 and 494 to 520, Exhibit P80A). MC told D2 that he was chatting with Alex (who clearly was DW1). 34.Based on the above evidence, the prosecution has proved beyond reasonable doubt that MC is D1. Clothing items worn by the same person 35.Still photographs of CCTV footage show that an Asian male often wore a pair of blue and white shoes, ripped jeans[13], a White Sox cap[14], blue sleeveless "Supreme" T-shirt and ripped denim shorts[15]. He was also seen carrying a black rucksack with rhombus pattern[16]. Some of these items were found in D1's room. Identity of MK 36.D2 communicated with MK (username: @michael_chang1229) via Telegram[17]. Around 9:00 p.m. on 12 August 2020, D2 texted MK asking him to deposit $2,200 in an account of Standard Chartered Bank[18] ("SCB"). Around 9:40 in the same evening, an Asian male wearing a rose gold/black watch, ripped denim shorts and blue and white shoes went to an SCB's ATM at Tsim Sha Tsui East. After using it, the Asian male took a picture of the deposit slip. D2 then received from MK a photo of an SCB deposit slip for $2,200 dated 2146 hours, 12 August 2020[19]. 37.Based on the CCTV footage of SCB[20], I am satisfied beyond reasonable doubt that MK is D1[21]. Though not found in D1's hotel room, the blue and white shoes really gave him away. Proof of the conspiracy 38.Prosecuting counsel Mr. Sujanani has helpfully summarized the circumstantial evidence which, when all added up, he submits can prove that D1, D2 and other persons were acting in concert to carry out the plan of stealing cash from Bitcoin ATMs. I need not repeat the details here; they are neatly and logically presented in Annex A of his written submissions[22]. 39.In gist, MC would text D2. They would meet up at the Royal Garden. They would then head off to the Bitcoin ATMs. D2 or someone supervised by D2 would operate the ATMs and pick up the cash. In the process, D2 would send QR codes generated by the respective ATMs to MK or MC. 40.As early as the end of July 2020, MC and D2 clearly exchanged text messages via WhatsApp and WeChat about the RBF manoeuvre and fake Bitcoin transactions (see Annex G of Mr. Sujanani's written submissions). I have not a single doubt that both MC and D2 had knowledge of how the scam worked. Too much of a coincidence 41.In Incident 1-1, someone wearing ripped jeans, blue and white shoes and a pink hoodie operated the ATM. In Incident 1-2, D2 was wearing the same pink hoodie. An Asian male was wearing a blue sleeveless "Supreme" T-shirt, a White Sox cap, ripped jeans and blue and white shoes. In Incident 1-3, the South Asian male who operated the ATM wore a White Sox cap and carried a black rucksack similar to the one found in D1's hotel room[23] (Exhibit P24). In Incident 1-4, the South Asian male who operated the ATM wore a White Sox cap and carried a black rucksack similar to Exhibit P24. Around 7:30 p.m. on 13 August 2020, at the Royal Garden, D1 was seen wearing a blue sleeveless "Supreme" T-shirt. Putting everything together 42.Bokhary PJ in HKSAR v Kissel (2010) 13 HKCFAR 27 held: "The prosecution can of course rely on the combined strength of all the material elements of a circumstantial case. For the purposes of making that point, it is common to liken each piece of circumstantial evidence to one strand of a rope. Unlike a chain only as strong as its weakest link, a rope takes its strength from all of its strands woven together. Chief Baron Pollock, as one sees in The Queen v Exall (1866) 4 F & F 922 at p.929, drew the contrast between a rope and a chain when directing the jury in that case. That is by far the most famous, but by no means the only, form of imagery available to make the point that the strength of a circumstantial case comes from all of its components taken together…"[24] There is also the famous analogy of "strand and cord" from The Queen v Exall"One strand of the cord might be insufficient to sustain the weight, but three stranded together may be quite of sufficient strength. Thus, it may be in circumstantial evidence - there may be a combination of circumstances, no one of which would raise a reasonable conviction, or more than a mere suspicion; but the whole, taken together, may create a strong conclusion of guilt, that is, with as much certainty as human affairs can require or admit of." 43.At first glance, the prosecution's evidence in this case may seem piecemeal. After viewing and considering it in a systematic way, as a juror, I am sure that MC and MK are D1 and that D1 and D2 were acting in concert to steal cash from Bitcoin ATMs by using the RBF method. I made such findings bearing in mind D2's admissions in his 4 video recorded interviews[25]. 44.The prosecution has proved each element of each offence against each defendant beyond reasonable doubt. I find both D1 and D2 guilty of Charges 1 and 2.
[1] The original date of verdict was 22 September 2022. As I was subjected to a Quarantine Order on 18 September 2022 and subsequently an Isolation Order on 22 September 2022, the date of verdict was re-fixed. [2] PW1 explained in court how this method worked. He said he tried it himself and it worked. It was by sending someone a Bitcoin transaction which carried a very low "mining fee" with an RBF flag turned on. He then sent another transaction (with the same wallet address) carrying a higher "mining fee" to another receiver. The former Bitcoin transaction immediately became invalid. [3] Paragraph 64. [4] See paragraphs 10 to 16 in Riasat-Ali. [5] See paragraphs 7 to 12 of D1's Closing Submissions (dated 13 July 2022). [6] See Exhibit P88. [7] See Exhibit P75. [8] By the person who made the booking. [9] See paragraphs 5 and 6(3) of the Admitted Facts (Exhibit P56). [10] There is evidence which indicates that in addition to D1, other person(s) could have been residing in D1's hotel room. [11] Exhibit P79, Photo 12. [12] Exhibit P79, Photo 266. [13] Exhibit P31, Photo 80 [14] Exhibit P31, Photo 78 (The White Sox are a professional baseball team in the United States). [15] Exhibit P31, Photo 88 and 89. [16] Exhibit P31, Photo 85 and 86. [17] Exhibit P79, Photo 52. [18] Exhibit P79, Photos 43 to 46. [19] Exhibit P79, Photo 47. [20] Exhibit P46 (see also Annex C of Mr. Sujanani's written submissions dated 14 July 2022). [21] Cross-reference the rose gold/black Audemars Piguet watch and ripped denim shorts found in D1's hotel room (see Exhibit P31, Photos 25 to 28 and 88 to 89). [22] Dated 14 July 2022. [23] Exhibit P31, Photo 85 and 86. [24] Paragraph 232. [25] D2 has identified himself in the respective CCTV footage. |
Cases cited in this judgment
Further hearings and rulings under DCCC 348/2021