HKSAR v. Chung Kai Ming

DCCC 1050/2014

IN THE DISTRICT COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

CRIMINAL CASE NO. 1050 OF 2014

-----------------------------------

-----------------------------------

----------------------------

Reasons for Sentence

----------------------------

1.The defendant pleaded guilty to 10 charges of theft[1] and 2 charges of Obtaining access to computer with a view to dishonest gain for oneself or another[2].

Outline of facts

2.The defendant came to know a person online who claimed to have credit card information for sale. The defendant remitted RMB3,500 by depositing the equivalent value in Bitcoin (a digital currency) into a designated account. The defendant then received a file via QQ (communication application). About 50 to 60 sets of credit card information including the English names of credit card holders, credit card numbers, expiry dates and CVV (Card Verification Value) numbers were in that file.

3.The defendant used the credit card information in the file to make online purchases. One of the online vendor he used was “ComGateway”. The defendant opened a new account with Yahoo to make the purchases. He also used a VPN (Virtual Private Network) to hide his real IP address, pretending to be using a computer located in Taiwan to make the purchases. The defendant however did use his real name when he registered with ComGateway and other shopping websites.

4.Meanwhile, holders of the credit cards that the defendant had used to make the purchases found out from their monthly statement about the purchases that they had not made and reported the matter to the banks involved. The matter was then reported to the Police.

5.Upon investigation, Police found out that all the goods purchased were delivered to one residential address, which was the defendant’s residential address. The defendant was arrested on 2^nd November 2013.

6.Under caution and in subsequent interviews, the defendant admitted to his crimes and explained to the Police how they were committed.

7.The defendant had sold the purchased goods which consisted of computers, a memory card and video games in Sham Shui Po, spent about $20,000 while saving about $70,000 of the proceeds.

8.The computer particularized in charges 1 and 19 that the defendant had accessed with a view to dishonest gain was his own computer that was later found in his home. The total value of stolen goods involved in the 10 theft counts is $27,985.85.

Enhancement

9.The prosecution furnished information pursuant to s.27(2) of the Organized and Serious Crimes Ordinance, Cap.455, so that the court may consider whether to enhance the defendant’s sentence on the ground of prevalence of the specified offence of theft.

Previous convictions

10.The defendant is of previously clear record.

Mitigation

11.The defendant is 22 years old, single and resides with his parents and elder sister. The defendant was educated up to Form 5 level. He was working as a kitchen worker earning about $9,500 per month before his arrest.

12.The defendant’s mother suffers from cancer and is currently undergoing chemotherapy.

13.Mr. Michael Leung for the defendant submitted that the defendant was driven by curiosity when he entered a hacker’s website where the credit card information was being offered for sale. The defendant bought the information to see if it would really work, and when he found out it did, he just could not stop anymore.

14.Although the defendant used VPN to hide his IP address, he was using his own computer and his real address for goods delivery as well as providing his own mobile phone number to register with the online shopping sites. When the goods were delivered, the defendant signed for them with his own signature. It was only a matter of time that the defendant was discovered and arrested for his misdeeds.

15.When he was arrested, the defendant frankly admitted to everything, provided all the passwords and technical information to the Police, saving a lot of time and resources.

16.All the victims are from Hong Kong and there is no international element. None of the cardholders suffered any loss as all the transactions had been cancelled.

17.By way of restitution, the defendant handed over in court a cashier order in the amount of $27,985.85 to the prosecution, covering the full amount of the value of the goods stolen in the 10 theft charges.

18.As for the prosecution’s application to enhance, the defendant does not object to the enhancement but wishes to point out that the organization and planning of the defendant’s thefts fall into the least sophisticated category.

19.Mr. Leung suggests a global approach to be adopted in sentencing the 12 charges, taking into consideration the totality principle.

Sentencing cases

20.Ms. Chan for the prosecution referred to the case of HKSAR v Chow Wai-yip, DCCC 951/2014 where the defendant pleaded guilty to 18 charges of fraud, which took place over a 6-month period. The defendant advertised goods for sale online. The victims were buyers of those goods, which were in fact non-existent. Money was deposited by the victims into the bank account designated by the defendant. No goods were delivered in the end and the total loss suffered by all 18 victims was $30,469.

21.The defendant in that case had 2 previous similar convictions where he committed the same type of offences with the same modus operandi. There the prosecution applied to enhance the sentence under s.27(2) of the Organized and Serious Crimes Ordinance, Cap.455 as well.

22.A global approach was adopted and the learned judge took a starting point of 2 years’ imprisonment, discounted by one-third for his guilty pleas, resulting in a sentence of 16 months’ imprisonment. This was then further reduced by 2 months and then enhanced by about 30%, with a final overall sentence of 18 months’ imprisonment.

23.As far as can be deduced from the Reasons for Sentence, there the credit card information would have been provided for by the buyers and the defendant would have received the benefits by way of credit card deposits into his account. The only similarity is that the frauds there were perpetrated online. I find, with all due respect, that the case is not helpful for our present purpose given the entirely different factual scenarios.

Sentence

24.The maximum sentence for dishonest access to computer is that of 5 years’ imprisonment.

25.The maximum sentence for theft is that of 10 years’ imprisonment. In relation to the 10 theft charges, the overall amount of money involved is $27,985.85.

26.This is a credit card fraud case in its modern digitized incarnation. Before the advent of the internet, those minded to use another person’s credit card information to make a purchase would have to either physically take the person’s credit card, or the culprit would have to get in touch with those who would have the means to provide him or her with a physical credit card with either false or stolen information imprinted on to the forged card, and then proceed to use the card.

27.In our present case, the defendant is someone of clear record who was unable to curb first his curiosity and then his greediness. Unlike pre-internet times, the risk of being caught while in the process of acquiring the credit card information has become much smaller, since the seller and the buyer of the information do not have to meet physically, they can literally be at the opposite ends of the world. Payment to the seller was by way of Bitcoin, which is a virtual digital currency that is notoriously difficult to trace, again lowering the risk of being traced as the seller or buyer of the information.

28.Instead of having to visit a retail outlet in person and put the forged credit card to use, with online shopping, there need be no contact with another human being and the shop can also be at the other end of the world, provided that they are willing to ship their goods to Hong Kong.

29.I find that the online commission of credit card frauds such as in our present case is at least as serious as the usual physical credit card fraud cases, if not more serious, given that the risk for the criminals is much lower and that it is much easier to hide the identity of the user of the credit card information, thus making investigation of the crime and apprehension of the culprit more difficult.

30.The credit card is an indispensable tool in modern society. It is of paramount importance that the integrity of the credit card system be protected. It is most worrying how the defendant, someone of previously clear record and clearly not a hardened criminal, was able to obtain the credit card information online so easily.

31.As such, I find that there is a need to include a deterrent element in the sentence to drive home the message that despite the ease of its commission, online credit card fraud is a serious offence and those presented with the temptation must resist it or face imprisonment.

32.I find that given that the theft charges that the defendant had committed are in essence credit card frauds, the factors considered to be relevant for sentencing in the case of R v Chan Sui To, CACC 115 of 1996 would also be relevant when deciding on an appropriate starting point in our present case.

33.The factors to be considered therefore include: (a) the size of the operation, e.g. whether it involves large sums of money (there the Court of Appeal stated that they would consider amounts up to $50,000 as relatively small), large number of persons or forged credit cards; (b) the planning that has gone into perpetrating the fraud (in our case the thefts), whether it is elaborate or simple, whether technical skills were used and to what extent; (c) whether there is an international dimension; (d) whether the accused played a major role, e.g. running a syndicate, engaging in actual manufacture, organizing the use of the forged cards, or whether he is a mere ‘cog in the wheel’ as a courier or a custodian or keeper; and (e) whether there is a plea of guilty.

34.Just as Mr. Michael Leung for the defendant had suggested, I find that a global approach can be adopted when sentencing. I will first deal with the theft charges, then the two dishonest access to computer charges.

The theft charges

35.This is basically a one person operation, involving a small sum of money. Although a different victim’s credit card information was used in the commission of each the 10 theft charges, the information were all contained in one file that the defendant had purchased online on one single occasion and in one transaction. The defendant’s operation is by any standard a very small one.

36.Having paid for the file with the credit card information, the defendant proceeded to use them. There was obvious planning on his part as to how best to use the credit card information. He opened new email accounts, used a VPN service so that his true IP address could be hidden and the shop that he was dealing with would be tricked into thinking that the defendant buyer was conducting the transaction in Taiwan instead of Hong Kong. Be that as it may, the defendant’s plan was still a simple one, and one bound to expose him at some point as well, given that he ordered the stolen goods to be delivered to his own home. It was just a matter of time before the false transactions would be discovered and the delivery address exposed.

37.The defendant used his own home computer in Hong Kong to purchase the credit card information and to complete the purchases. Although the person who sold the information to the defendant might very well have been located in another country (price quoted was in RMB), there is insufficient evidence to prove that, nor would there be sufficient evidence to prove that the defendant knew that. I would find therefore that there is no international dimension in this case.

38.Apart from the person who sold the credit card information to the defendant, the defendant is the only person involved in the commission of the thefts. There is no evidence that he was part of a syndicate or that he was engaged in the obtaining of the credit card information in the first place. He was however not a mere ‘cog in the wheel’.

39.Lastly, the defendant did plead guilty.

40.In addition to those factors, I find it also relevant that the defendant had committed the thefts over a two month period from August to October 2013, and that he had sold the goods he had stolen and had spent or pocketed the money.

41.Bearing in mind all the above mentioned factors, I find that an appropriate global starting point for the 10 theft charges would be 3 years’ imprisonment.

42.I find that there are no aggravating features in the thefts other than the factors I have already taken into consideration when arriving at the starting point.

43.I find that there is a strong mitigating factor in that the defendant had made full restitution. For this, I would reduce the sentence by 6 months, resulting in a sentence of 2 years and 6 months’ imprisonment.

44.I will then apply the one-third discount for the defendant’s guilty plea, discounting the sentence to that of 20 months’ imprisonment.

45.This sentence will then be enhanced pursuant to my finding that the information of WSIP 4266 do support the prevalence of theft by way of credit card misuse in Hong Kong. Given the circumstances of the case, I will enhance the sentence by one-fourth, resulting in a sentence of 25 months’ imprisonment.

46.I therefore sentence the defendant on each of the 10 theft charges to 25 months’ imprisonment. The sentences for all 10 charges to be served concurrently.

The Dishonest access of computer charges

47.In relation to the 2 dishonest access of computer charges, I find that given that the defendant was accessing his own computer, and given that the particulars of the 2 charges are that the defendant had used his computer to conduct the online purchases in relation to the thefts in charges 2 and 20, the seriousness of these two offences are at the lower end of the spectrum of criminality.

48.I will adopt a starting point of 12 months’ imprisonment for each of the 2 charges, but since the restitution was related to the thefts and not the dishonest access offences, there will be no reduction for restitution on these two charges. I will however grant the defendant the full one-third discount for his guilty plea, leading to a sentence of 8 months’ imprisonment.

49.The ‘specified offence’ as set out in the prosecution’s Notice of intention to furnish information pursuant to s.27(2) is the offence of theft only. There is therefore no application to enhance the sentences under these two charges and the sentence for charge 1 and 19 remain at 8 months’ imprisonment.

Concurrent or consecutive

50.I find that the commission of charges 1 and 2 can be regarded as to have been conducted in one single transaction and order the sentences to run concurrently. I make the same finding and therefore the same order in relation to charges 19 and 20.

51.The final sentence for all 12 charges is therefore that of 25 months’ imprisonment.