HKSAR v. Chan Chi Kong

CACC000245/1997

1997, No. 245
(Criminal)

Headnote

Crminial Law - Sentencing - Offence of criminal damage contrary to section 60(1) of the Crimes Ordinance, Cap.200, involving destruction of computer files of some banks and financial companies - breach of trust - Hong Kong SAR's position as internationally recognised commercial and financial centre a factor in sentencing.

1997, No. 245
(Criminal)

IN THE COURT OF APPEAL

_________________

_________________

Coram: Hon. Power, V.-P., Barnett and Saied, JJ. in Court

Date of hearing: 4 September 1997

Date of delivery of judgment: 25 September 1997

_________________

J U D G M E N T

_________________

Saied, J. ( Giving the judgment of the Court) :

1. The applicant was convicted in the District Court on his own plea of guilty of three counts of criminal damage contrary to section 60 (1) of the Crimes Ordinance, Cap. 200. The judge was also asked to take two other similar offences into consideration.

2. The criminal damage to which he pleaded guilty was the destruction without lawful excuse of computer files belonging to REUTERS Hong Kong Limited and installed in the offices of the Credit Agricole (Count 1), Regent Financial Services (Count 2) and at the offices of Jardine Fleming Holdings Limited (Count 3), intending to destroy or damage such property or being reckless as to whether such property would be destroyed or damaged.

3. In respect of the two other similar offences which the applicant asked to be taken into consideration those were the computer files that had been installed at the Standard Chartered Bank and at the offices of Wheelock Natwest Limited.

4. The sentencing judge, taking his starting point of four years and allowing a reduction of one-third for the plea of guilty and the applicant's cooperation when first apprehended, sentenced him to concurrent terms of two years and eight months on each of the three counts.

5. The applicant seeks leave to appeal against the sentence on the ground that it is manifestly excessive or wrong in principle.

6. The applicant was employed by REUTERS in March 1995 as a customer service engineer responsible for installation, repair and maintenance of those systems supplied by the company.

7. The judge summarised the facts, which he described as "most unusual", as follows :

"The defendant was, at the time in question, employed by a company which provides mainframe computer and associated equipment to various major financial institutions in Hong Kong. These companies use the facilities around the clock to keep abreast of worldwide movements in stocks prices, foreign exchange and other details essential to their businesses. The defendant's duties included responding to fault calls and, where possible, repairing them on site. He had, over a period, built up a reputation with his employer, its customers and his colleagues of skill and reliability. On five separate occasions, in the offices of the four separate customers of his employer, the defendant was apparently attending to these duties. In reality, however, he used his technical skills and knowledge of internal password to gain access to the systems for more nefarious means. In fact, in each case, he planted commands that the operating system be deleted from the hard drive after a period of delay, and this is what happened."

The judge went on :-

"To say there was disruption would be an understatement. Immediate emergency procedures had to be brought into play to restore the programmes that the virus he had planted had wiped out."

8. Suspicion almost immediately fell on the applicant who, upon being apprehended, admitted what he had done and how he had done it, giving as his reason a dispute with his superior.

9. All the systems were eventually restored by re-loading the deleted operating systems files. Whatever was lost was able to be retrieved. No financial transactions were lost but the applicant's employer was put to the trouble and expense of flying out experts from the United Kingdom and Singapore to repair the damage. The effects of this damage to the computer files were explained by a manager of REUTERS : the incident had badly stained the company's image and put at risk the trust placed in them by the company's valued customers over the past years; their clients on the other hand felt very exposed and uncomfortable with the threat of malicious damage to their dealing room systems. The total cost attributable to this incident was estimated by REUTERS to be GBP 108,000.00 based on estimated 1,752 man hours. An assistant director of IT for Jardine Fleming, estimated the cost at approximately HK$60,000.00 based on 10 man days.

10. The judge expressed the view that this was a "very serious matter on any view." He rejected as facetious that the applicant intended only to commit a practical joke and said,

"The defendant acting on no more than a grudge, substantially abused his position of trust and he did it with such ease that he and others must be deterred from doing it again."

Having regard to those factors, not the least the multiplicity of the offences which entitles a court to impose a higher sentence than if there had been only one offence, the judge adopted the starting point of four years. He paid heed to the letters of commendation of the applicant, the awards he had received and the high regard held for the applicant of hitherto solid, if not impeccable, character - he having one previous but unrelated conviction of shoplifting. The judge said however that little turned on those commendations as the applicant would not have been employed in that position had he not been seen to be of good character. He took into account that the applicant stood to gain nothing but on the other hand he would have all along been aware of the potentially catastrophic results of his action and he said,

"What he is entitled to be recognised for is his plea of guilty at first instance and admission and co-operation when first apprehended. For this, coupled with what I accept is an expression of remorse, I deduct one-third. Otherwise there is nothing remarkable that warrants further consideration."

11. Mr. Gerard McCoy S.C., who represented the applicant in this court but not below, said that in 1993 the Computer Crimes Ordinance (Ordinance 23 of 1993) amended the Crimes Ordinance to include computer programmes and data as property; and to introduce in s. 161 an offence of obtaining access to a computer with criminal or dishonest intent, the maximum penalty for which is imprisonment for 5 years. He submitted that, as this is the first prosecution of its type in Hong Kong, it is permissible for this court to consider the comparability between the two offences, the lower maximum sentence for specific computer crimes and any sentences which have been passed in relation to such crimes in other jurisdictions.

12. In our opinion that is totally misconceived. The correct approach is that which McMullin V.-P. stated in A.G. v. Ho Chun-chau [1985] 1 HKC 40,45 in these terms :

"We accept that the proper approach of the court should, when considering sentence, be to have regard to the intention of the legislature as indicated in the penalties provided and to measure the case before it against the kind of case capable of attracting the maximum penalty."

13. That was the approach which the judge correctly and properly took when he came to consider the appropriate sentence.

14. Mr. McCoy giving the applicant's personal circumstances said that he is 29, holds a B.Sc. (Hons) degree and was completing his M.Sc., that he stays at home and has no girl friend or female companion and is totally absorbed by the computer and computer literature. Mr. McCoy said, "It can almost be said he has only ever held hands with a computer." Of course the facts show quite clearly that what he did went far beyond that description of merely holding hands. We were told that his mother is a clerical assistant and his father who is unemployed has had a number of heart attacks. It was submitted that the applicant had had some dispute with his senior officer, that there was "seniority tension" between them and the intention behind the applicant's acts was anger and revenge against his superior. The applicant knew that as a backup system was in place there was only a possibility that the data would be lost for ever, and his three deletion commands which would eradicate the computer data amounted to a short term problem which would have come back to his superior officer who would then understand the enormous pressure that the applicant was under.

15. The fact that the applicant had had disputes with his senior officer was well-known to the judge. The other matters referred to by Mr. McCoy really amount to a course of conduct which was deliberate and calculated with the motive which to us seems far more serious than a mere 'practical joke' which the sentencing judge was told was the applicant's intention.

16. It was submitted that in their concern to preserve the company's image and reputation, REUTERS went "completely overboard" in flying out four people from the United Kingdom and four from Singapore, all geared to pacifying their clients because if the system was vulnerable then it may not have been a proper system. While counsel conceded that all this was not before the lower court, he complained, while maintaining that he was not resiling from the admitted facts, that the summary did not "assiduously" deal with the facts in that when the problem surfaced, the applicant was there to help and was actively involved in rectifying the systems.

17. After a short adjournment counsel produced a piece of handwritten paper intended to show how the applicant had assisted, in these terms :

18. Mr. McCoy conceded that during the emergency period the applicant never said that he had done it, or that he could tell his employer what had happened. This was no indication that he had 'actively' helped in restoring the system; on the contrary, he sat by and let all the experts be brought in. REUTERS cannot in the circumstances be criticised for having incurred all that expense; they realized and appreciated the potential damage that could result and responded to it to correct the situation as soon as was possible.

19. On sentence Mr. McCoy cited two English cases : R. v. Pile, Exeter Crown Court case (15 Nov. 1995), unreported, involving the notorious 'Black Baron', but the offences were under the Computer Misuse Act, the maximum sentence for which is 5 years. The other factor which makes that case inapplicable is that it did not deal with the breach of trust which exists in the case before us.

20. The second case - Whiteley, (1991) 93 Cr. App. R.25 concerned a computer hacker who gained unauthorized access to a computer network and altered data contained on discs in the system, thereby causing the computers in question to fail and, unable to operate properly, to be shut down for periods of time. He was convicted of causing damage to the discs and sentenced to 12 months. While the applicant's conduct and criminal acts in that case were far more serious, in our respectful opinion the sentence was remarkably lenient. The other distinguishing feature, like Pile, is that it did not involve breach of trust.

21. The trial judge quite properly took into account the fact that the applicant had been in breach of the trust that his employers reposed in him. In such cases it is well to keep in mind the pronouncement made in R v Barrick [1985] 81 Cr. App. R. 78 which has been followed by our courts, see, for example, R v Ying Lai-chau [1991] 1 HKLR 48,50 and HKSAR v Tsui Hi-shing, Cr. Appeal 206/97.

22. The other matter argued before us was that because of his unorthodox personality and his absorption with computers, the applicant has been devastated by the prison sentence, and feels himself to be in "intellectual solitary confinement". Being a very clever man having nothing common with the other inmates, that is "eating" him, and it is a waste of his natural resources. We agree that a man of his intellect and training will have that sort of discomfort, but this is a direct consequence of his own misconceived but deliberate and calculated plan to take revenge against his superior officer. People who think that they can flout their position of trust and abuse the confidence which their employers place in them deserve a prison sentence, unless of course there be exceptional or special circumstances of which there are none in this case. Lastly, we were informed by Mr. McCoy, and this was not challenged by the prosecution, that the applicant has since made a voluntary and unprompted restitution to Jardine Fleming Limited of $60,000.00. We agree this amounts to a mitigating factor for which he is entitled to some reduction in the sentence.

23. The judge rightly described this offence as very serious. The Hong Kong SAR is an internationally recognised commercial and financial centre, where modern computer technology is relied upon in all spheres of commerce and banking. It is the duty of the courts to ensure that they impose such sentences in cases which are likely to damage or have the potential to damage the trust and confidence which others place in this city, as will deter others similarly inclined from committing such offences. While we are of the opinion that in all the circumstances, the starting point of four years was too high, we stress that these offences are serious and call for sentences befitting the circumstances of the case.

24. We think that a starting point of 3 years would have been proper. In addition to the usual one-third discount for the plea of guilty, a further reasonable reduction ought to be allowed for the applicant's voluntary and unprompted restitution of $60,000.00 to Jardine Fleming Limited.

25. This application is allowed and treating it as the hearing of the appeal, we allow the appeal to the extent that the sentence is varied to one of one year nine months on each count, to run concurrently.

Representation:

Mr. John Reading, SADPP for D.P.P./Respondent.

Mr. Gerard McCoy, S.C. & Ms. Corrina Tai, instructed by (YIP TSE & Tang) for the appellant.