Computer Crime

The dishonest use of a computer is addressed under s.161 of the Crimes Ordinance (Cap 200).
​A person commits an offence if he or she obtains access to a computer with:

1. Intent to commit an offence;
2. Dishonest intent to deceive;
3. A view to dishonest gain for themselves or another; or
4. Dishonest intent to cause loss to another.

The test for dishonesty involves both objective and subjective elements, namely: (1) whether a reasonable person would regard the access as dishonest; and (2) whether the person accessing the computer realized his/her actions were dishonest.

Upon conviction, the offence carries a maximum sentence of five years' imprisonment.

In the case of HKSAR v TSUN SHUI LUN - [1999] HKCFI 29, the appellant was found guilty after trial of obtaining access to a computer with a view to dishonest gain for himself, contrary to s 161(1)(c) of the Crimes Ordinance (Cap 200). He was sentenced to six months’ imprisonment. The appellant appealed against conviction and sentence.

The appellant was employed as a technical assistant to a radiologist at Queen Mary Hospital and had access to the hospital computer system which contained some patients’ records. Access could only be gained by password, which the appellant was given. On 2 April 1998, the Secretary for Justice was admitted to the hospital and received an urgent scan. The appellant was told she was a very famous lady, but was told the matter was confidential. During the afternoon the appellant accessed the computer and made a print-out of the Secretary’s scan report. He took it home and then threw it away. The next morning the press reported a government press release that the Secretary had been admitted to hospital for observation due to enterogastric disorder. The appellant then printed out another copy of the scan and later faxed it to two newspapers deleting his own identity and fax number. After investigation into the leak, the appellant was arrested and under caution admitted accessing the computer twice, obtaining copies of the scan report and faxing it anonymously to two newspapers. He said he did so because he thought the public had the right to know the truth, namely that the Secretary for Justice had a cancerous growth. At issue was whether he acted with a view to gain for himself when he accessed the computer and whether he acted dishonestly. Counsel for the appellant argued that s 161(1)(c) was aimed at penalizing access to a computer for acts preparatory to the commission of a crime or fraud, but which fell short of the commission of a crime or fraud. Further, a person who made an unauthorized access into another person’s computer need not have any intention to commit a crime or fraud.

On appeal against sentence, it was argued inter alia that a deterrent sentence was wrong in principle because the offence was at the bottom of the scale as no blackmail, corruption or fraud was involved. The maximum penalty under a s 161 offence was five years’ imprisonment. The appellant had a clear record. He had already spent seven days in custody.

The Courts dismissed the appeal against conviction but allowed the appeal against sentence, and held that:

1. Section 161(1)(c) of the Crimes Ordinance was enacted to catch acts preparatory to the commission of a crime or fraud, but it was not restricted to such acts. The legislative objective was if access into a computer was obtained dishonestly, the perpetrator should be punished.
   
   
2. The actus reus was accessing the hospital’s computer on the second occasion. The defendant admitted that at the time of this act he had decided to print out a copy and leak it to the press.
   
   
3. In the context of computer crime, the meaning of the word ‘gain’ included obtaining information which one did not have prior to accessing the computer. ‘Gain’ in s 161(1)(c) of the Crimes Ordinance was to be construed inclusively, cf ‘gain’ in s.8 of the Theft Ordinance. What was anticipated by ‘gain’ in s 161(1)(c) was a benefit or advantage. It did not have to be something that could be used. The information could be transient if read on the screen, or permanent if printed out or copied onto a diskette.
   
   
4. The test of dishonesty was the same test as laid down in the case of R v Ghosh. Any ordinary and reasonable person would have considered the appellant’s conduct as not only discreditable, dishonorable or inappropriate, but also dishonest and reprehensible. The appellant was an intelligent, educated person. He knew the information was confidential, he took precautions to conceal his identity. There was no reason to doubt the magistrate’s finding that the appellant did it for the thrill and excitement of showing that the Government was wrong in issuing an inaccurate statement rather than because he thought the public had a right to know the truth. Even if the appellant genuinely believed he was morally justified in doing what he did, it was still dishonest on the Ghosh test. The only reasonable inference to draw from the facts was that the appellant knew and must have realized that it was dishonest conduct to have access into the computer, print out a copy and leak it to the press. Dictum of Lord Lane CJ in the case of R v Ghosh [1982] QB 1053 applied.
   
   
5. The appellant gained access to the computer in excess of authority. He had intended to obtain the confidential information for the purpose of and with a view to printing out a copy and leaking it to the press. That was a gain within the definition of s 161 of the Crimes Ordinance. It was dishonest conduct, and the appellant knew it was dishonest. The appeal against conviction would be dismissed.
   
   
6. With regard to sentence, this was an exceptional case. Although there were aggravating features in this case, including breach of trust, breach of patient/doctor confidentiality and causing embarrassment and distress to the Secretary for Justice, there was no financial or proprietary gain and the loss to others was not serious. Taking into account all the above and mitigation on behalf of the appellant, the sentence of six months’ imprisonment was manifestly excessive. It was more appropriate that he should serve the community in return for the wrong he did. The custodial sentence would be set aside and a community service order of 100 hours would be substituted.

Appeal Courts also delivered to the public a warning that there was a very wide range of criminal and dishonest activities which fall within the ambit of s.161. In this day and age, very serious crimes or frauds could be committed by gaining access to other people's computers and uplifting information contained therein. Examples include meddling bank records, transferring large sums of money from one account to another, and stealing secret programs and data such as customers lists and business records. Such activities could be very serious and obtaining access into computers with such intention or for such purposes were no less grave.