HKSAR v. CHU TING TING

[English Translation – 英譯本]

HCMA 33/2016

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

MAGISTRACY APPEAL NO 33 OF 2016

(ON APPEAL FROM ESCC NO 631 OF 2015)

_________________

_________________

JUDGMENT

1.  The appellant was charged with the following two offences:

Charge 1: criminal damage[1]

Charge 2: obtaining access to computer with criminal intent[2]

Charge 2 is an alternative charge to Charge 1.

2.  The defendant pleaded not guilty to both two charges in Eastern Magistracy and was convicted of Charge 1 after trial by the Deputy Magistrate (hereinafter Magistrate). She sought to appeal against her conviction.

The Prosecution Case

3.  The Prosecution alleged that the appellant on or about the 4^th day of October 2014, in Hong Kong, without lawful excuse damaged property belonging to another, namely the webserver of www.police.gov.hk, intending to damage such property or being reckless as to whether such property would be damaged.

4.  In the original trial, the Prosecution called the following four witnesses to testify:

PW1: Au Yeung Chi Yung, an employee of Hewlett- Packard Hong Kong (HP), HP is a government contractor responsible for managing the daily activities and operations of the government’s Central Internet Services (CIS);

PW2: police officer 8276, team member of the Technology Crime Division;

PW3: police officer 6158, computer forensics expert[3];

PW4: senior police inspector Lam Ka Chun, computer forensics and analysis expert[4].

The witness statements of the above 4 witnesses were produced in evidence pursuant to section 65B of the Criminal Procedure Ordinance[5].  They also testified in court respectively.

5.  In the original trial, apart from the evidence given by witnesses, the following facts were also admitted:

(1) According to the statement of Au Yeung Chi Yung, the Site Manager of the service contractor for CIS & CCNA Support Services under the Office of the Government Chief Information Officer, the Internet Protocol address of the website named “police website” (the website address being www.police.gov.hk) was 202.128.238.95 and 202.128.243.223 in the small hours on the 4^th day of October 2014.

(2) It was revealed in the log analysis conducted by police officer Wong Ka Chun (PW2) that there were visits from Hong Kong Internet Protocol addresses to the above police website.  The log record was an accurate record which had not been unlawfully tampered with from the time they were downloaded to the time they were produced in court.  The record was produced in court as prosecution exhibit P2.

(3) According to the record kept by Hong Kong Broadband Network Limited, the Internet Protocol address 203.186.172.192 was registered in the name of  “Law Yee Wah” of identity card number “G46----(-)”[6] and the registered address was “---- North Point Hong Kong”[7].  The account was activated on the 11^th day of September 2010 for the provision of broadband service.

(4)   At 02:15 hours on the 6^th day of October 2014, woman police officer 6910 seized a desktop computer of Apple brand, model A1418100-2402, Serial: D25LN1G6F8J3, EMC:2638, red tap S/N: AC022506.  It was produced in court as prosecution exhibit P4.  The said Apple desktop computer had not been unlawfully tampered with from the time it was seized to the time it was produced in court.

(5)   Woman police officer 6910 arrested the appellant for the offence of “obtaining access to computer with criminal or dishonest intent” at the address aforementioned in paragraph 5(3).  Having been cautioned, the appellant said voluntarily, ‘I knew of an operation called Anonymous, having read about a hacking operation in their Facebook, I logged on the Facebook and had entered the link during the time.  But once I entered, the screen went black and the computer got hanged, I therefore closed the browser page’.

6.  The appellant was interviewed on video after her arrest and the video recorded interview was admitted into evidence without dispute (prosecution exhibit P10). The magistrate pointed out the following admissions the appellant had made during the interview:

‘(i) prosecution exhibit P4 (the Apple desktop computer) belonged to her;

(ii) her younger brother had a Macbook notebook computer;

(iii) prosecution exhibit P4 was only used by her alone;

(iv) she was at home from 00:55 to 01:44 hours on the 4^th day of October 2014;

(v) she had browsed the webpage of Anonymous and it was a hacker organization;

(vi) she had browsed this webpage and kept pressing the button;

(vii) then the computer got “hanged”; and

(viii) she herself had tried hacking.’[8]

The Defence Case

7.  In the original trial, the appellant elected not to testify nor call any witness. The key issue was whether the Prosecution can prove its case.

The Magistrate’s Findings

8.  The magistrate accepted PW1’s evidence: It was abnormal for one IP address to make 7,000 odd attempts to browse the police website.  He considered it a DDoS attack.  The magistrate considered that PW1 was entitled to draw such a conclusion considering his qualifications and basic knowledge.  He pointed out that although PW1 only said the police website was “much slower” in response than usual as a consequence of the continuous DDos attacks on its server without computing exactly how much slower, his evidence in this regard was not disputed by the defence.

9.  Therefore, the magistrate considered that the circumstance was within the meaning of section 59 (1A) (a) of the Crimes Ordinance, i.e., ‘to cause a computer to function other than as it has been established to function by or on behalf of its owner’ is ‘misuse of a computer’ that constitutes ‘to destroy or damage any property’.

10.  The magistrate pointed out that it was not in dispute[9] that it was the data which had led the police to the appellant’s computer.

11.  He also pointed out that, as was shown in the video recorded interview, the appellant knew that the Anonymous webpage was a hacker’s webpage.  As regards whether she knew that entering the web page might result in hacker attacks, she made no direct admission.  She just said, ‘mainly wanted to see what kind of page they were doing’.[10]

12.  The magistrate came to the following conclusions[11] based on his understanding of what was admitted[12] by the appellant during the video recorded interview:

(a) the appellant knew that Anonymous is an international hacker group webpage;

(b) she knowingly logged in;

(c) she learnt from the webpage that it was to show sympathy and support for the students who went out to protest;

(d) she also learnt that the webpage had indicated that it would hack certain websites;

(e) she had checked and knew that those websites still existed, in other words, she knew which websites were the targets of attack after her checking;

(f) she pointed out that there was a button in the webpage for pressing. She did press the button and even kept pressing it.  She explained that it was because she saw no response after pressing the button.

13.  Based on the above conclusions, the magistrate considered that the irresistible inference to be drawn was that the appellant knew it well that the webpage was a hacker’s webpage.  She learnt of the hacker attack operation after she had logged in and continued to act by following the instructions.  It was without doubt that she knew that it might result in the targeted websites being attacked[13].  He also considered that the act of the appellant was sufficient to constitute participation in the attack operation targeted at the police website for the purpose of impairing the function of the website[14].  Based on the foregoing, the magistrate found that the Prosecution had proved beyond reasonable doubt that the appellant had committed the offence of criminal damage and convicted the appellant of Charge 1.

Grounds of Appeal

14.  During the appeal hearing, Mr Michael Leung[15] advanced the following grounds of appeal on behalf of the appellant:

(1)   the magistrate erred in finding that the prosecution evidence was sufficient to prove that the appellant had committed the requisite actus reus[16] of the offence;

(2)   the magistrate erred in finding that the prosecution evidence was sufficient to prove that the appellant had the requisite mens rea[17] of the offence;

Discussion and consideration

15.  In respect of the present case, in order to prove its case, the Prosecution has to prove beyond reasonable doubt that:

(1) the police website had been criminally damaged;

(2) the appellant was the person who committed the act that caused the damage;

(3) when she committed the act, she was intending to do criminal damage or being reckless[18].

16.  The guilty finding reached by the magistrate reflected that he considered the Prosecution had already discharged its burden of proving all the matters above.

17.  In respect of these three matters, matter (1) was not the major issue in dispute during the original trial.  Matter (2) was the subject matter of the ground of appeal (1) and matter (3) was the subject matter of the ground of appeal (2).  I am going to deal with these three matters one by one.

Whether the police website had been criminally damaged

18.  The appellant was charged with section 60 (1) of the Crimes Ordinance[19] which provides that:

“(1) A person who without lawful excuse destroys or damages any property belong to another intending to destroy or damage any such property or being reckless as to whether any such property would be destroyed or damaged shall be guilty of an offence.”

19.  Section 59 (1A) of the above Ordinance stipulates that:

‘In this part, “to destroy or damage any property” in relation to a computer includes the misuse of a computer. In this subsection, “misuse of computer” means –

(a)  to cause a computer to function other than as it has been established to function by or on behalf of its owner, notwithstanding that the misuse may not impair the operation of the computer or a program held in the computer or the reliability of data held in the computer;

(b)  to alter or erase any program or data held in a computer or in a computer storage medium;

(c)  to add any program or data to the contents of a computer or of a computer storage medium,

and any act which contributes towards causing the misuse of a kind referred to in paragraph (a), (b) or (c) shall be regarded as causing it.’

20.  The prosecution case relied on section 59 (1A) (a).

21.  Based on his acceptance of PW1’s evidence[20], the magistrate found that the police website was criminally damaged within the meaning of section 59 (1A)(a).

22.  I am of the view that there is absolutely no problem with this finding.

Ground of Appeal (1)

23.  The subject matter of this ground of appeal is whether the Prosecution had proved that the appellant had committed the actus reus of the offence.  The magistrate pointed out that the evidence in this regard includes the following:

(i) there were as many as 7,467 visits[21] to the police website from IP address 203.186.172.192 in the small hours of the 4^th day of October 2014 from 00:53 hours to 01:17 hours;

(ii) the appellant was not the registered person of the said IP address but the police arrested the appellant in the registered address of the IP address;

(iii) according to PW3, the webpage http://pastehtml.com/view/ckok6t524.html on the computer which was seized by the police [prosecution exhibit P4] was engaged in visiting the police website from 00:53 hours to 01:39 hours on the 4^th day of October 2014;[22]

(iv) the admissions made by the appellant herself;

(v) the evidence given by prosecution witnesses.

24.  In order to determine whether the Prosecution had proved that the appellant had committed the actus reus of the offence, as far as this case is concerned, it is necessary to determine firstly whether prosecution exhibit P4 was the computer that caused the police website to be attacked and secondly whether the appellant was the person who was operating the computer that resulted in the attacks at the material time.

25.  In order to prove the answer in the affirmative in respect of the first issue, namely whether prosecution exhibit P4 was the computer that caused the police website to be attacked, the Prosecution had adduced voluminous data records in respect of the police website and prosecution exhibit P4, namely the computer, and relied on the opinion evidence of expert witnesses.

26.  Admissibility of the above data records was not in dispute and the probative value of these data was explained by the prosecution expert witnesses.  The magistrate considered that the opinion evidence given by the expert witnesses in respect of these data was sufficient to prove that prosecution exhibit P4 was the computer that caused the police website to be attacked.

27.  In respect of the evidence given by the prosecution witnesses, Mr Leung had made some criticisms.  The following are the gist of each criticism, the reply from the Respondent and also my consideration and decision.

28.  Mr Leung pointed out that during examination-in-chief, the Prosecution’s request that PW1 explain as an expert witness some matters that were not mentioned in his witness statement was a departure from the accepted norm.

29.  Mr Wong Chun Yin, Senior Public Prosecutor representing the Respondent, pointed out that:

(i) during the original trial, the defence had indicated explicitly that they did not challenge the expert status of PW1[23];

(ii) the prosecutor only put questions to PW1 about matters that were relevant to the DDoS attacks when he learnt that PW1 wished to tell the court his observations and opinions after examining the server records[24] and under the circumstance that the defence had indicated explicitly that he had no objection[25];

(iii) PW1 told the court that he had a certified professional qualification on information security when he gave evidence in this regard and it was not questioned by the defence[26];

(iv) the magistrate had confirmed with the defence once again upon conclusion of the examination-in-chief that the defence did not challenge the expert status of PW1[27].

30.  Considering these circumstances and that the defence did not object to the admissibility of evidence in this regard, I am of the view that in the absence of any special reason, it would be difficult for Mr Leung to raise this matter to support this appeal.

31.  Mr Leung also made similar criticism against PW2’s evidence.  It was criticized that his evidence in-chief had gone beyond the scope of his written witness statement.  Furthermore, it compensated the deficiency of and even could replace the evidence of PW4 who testified subsequently.  It was therefore erroneous for the magistrate to still allow PW2 to give evidence on those matters irrespective of the defence’s objection in the original trial.  Moreover, the explanation given by PW2 under cross-examination was very far-fetched and unreasonable.

32.  As far as PW2’s evidence was concerned, the magistrate allowed it to be admitted irrespective of the defence’s objection.  The scenario was, therefore, different from the case of PW1’s evidence.  In any event, PW2’s evidence, which was under severe criticism, was categorically not taken into account by the magistrate in arriving at his finding because the magistrate considered that hardly any weight[28] should be attached to PW2’s evidence.  As such, this argument of Mr Leung had no significance in the present appeal.

33.  Another criticism made by Mr Leung was: the way the Prosecution had dealt with PW1 and PW3 was totally different: PW1 turned to an expert witness from an ordinary witness without prior notice whereas PW3’s professional qualification as an expert witness was challenged. Mr Leung pointed out that this was ‘cherry picking’ on the part of the Prosecution and it was unfair to the defence.  Based on the reasons stated in paragraph 29 and 40 (1) of this judgment, I do not consider this argument meritorious.

34.  Mr Leung also criticized PW4’s evidence and pointed out that the magistrate himself had mentioned that there were problems with PW4’s evidence.  Similarly, since the magistrate categorically did not take into account the relevant evidence[29]of PW4, this criticism had no significance in the present appeal.

35.  Another submission put forward by Mr Leung, which is probably the major ground of appeal, was that having disregarded the problematic evidence of PW2 and PW4, the remaining prosecution evidence was insufficient to prove that prosecution exhibit P4 was the computer that caused the attacks, let alone proving that the appellant was the person who committed the actus reus of the alleged offence.

36.  That the computer prosecution exhibit P4 was the computer that was caused to launch DDoS attacks against the police website with the web page http://pastehtml.com/view/ckok6t524.html at the material time[30] was one of the material findings based on which the magistrate reached a finding of guilt.  This finding was made on the basis of PW3’s evidence[31].

37.  Mr Leung submitted that when the magistrate made this finding, he had not taken into full consideration the defence’s criticisms against PW3’s evidence.

38.  In evaluating the evidence of PW3, the magistrate only had this to say:

‘in respect of PW3’s evidence, the defence counsel made numerous criticisms against it in his closing submissions from paragraph 12 to paragraph 18 on the one hand and pointed out places that were advantageous to the defence on the other.  However, I consider that the questions the defence put to PW3 was not based on substantive evidence.  In other words, they were merely based on hypothetical propositions.’[32]

39.  Mr Leung criticized that the magistrate’s evaluation was insufficient.  In his submission, PW3 was an expert witness.  It was anything but uncommon for an expert witness to provide the court with opinions that involved hypothetical propositions.  The defence is not required to establish a substantive evidential basis in order to put a question.  Besides, the questions put to PW3 by the defence were not based on hypothetical propositions.

40.  In respect of relevant legal issues involving expert witnesses, I have the following observations:

(1)   whether a witness can be allowed to give opinion evidence as an expert depends on whether he has the qualifications of an expert in respect of the matter upon which he is going to give opinion.  To make an analogy, the division of various specialties is now getting more precise.  Not every cardiologist can provide expert opinion on every matter or treatment in relation to heart diseases.  It depends on whether he has expert qualifications in that matter.  Therefore, if a witness under cross-examination was asked to provide an opinion but the expert qualifications of that witness in respect of that matter had yet to be confirmed, the calling party should not be denied the right to clarify the matter.

(2)   In the case where the expert witness is called by the Prosecution, it might happen from time to time during cross-examination that factual evidence is unestablished as yet because factual evidence might only emerge as the defence case transpires.  Besides, the mere purpose of the defence asking the expert for opinion may have been to impugn the evidence adduced by the Prosecution.  It therefore does not amount to being hypothetical.  Even in the absence of factual basis, the court still has the duty to consider the opinion evidence. That being said, the fundamental principle that opinion evidence must be based on admissible evidence has been succinctly elucidated along the line of authorities including R v Turner[33] and R v Abadom[34].   Therefore, if the opinion evidence given by the expert has ultimately no factual basis upon the conclusion of the trial, then the opinion evidence should be ignored.  Applying this important legal principle, if the questions put to PW3 by the defence was indeed not based on substantive evidence as it was pointed out by the magistrate, to say that the magistrate erred in not relying on those opinion evidence in reaching his verdict cannot stand.

41.  As it has been stated above, there are certainly different purposes to ask expert witnesses for opinions.  Expert evidence not only can be used to provide opinions for matters which are supported by evidence, it can also be used to impugn the credibility or reliability of adduced evidence.  Therefore, apart from the fundamental principle stated above, the purpose for adducing expert opinion should also be taken into account.

42.  The issue I have to consider is whether the magistrate had sufficiently dealt with PW3’s evidence and whether he was wrong to rely so heavily on PW3’s expert opinions.

43.  Paragraphs 12 to 18 of the defence’s written submissions are criticisms made against the prosecution evidence based on PW3’s testimony in the original trial.  The following are the salient matters:

(1)   The Prosecution had not adduced any evidence to prove that prosecution exhibit P4, namely the computer, was functioning normally at the material time.

(2)   The operating system of the computer and its version was the material evidence upon which the Prosecution relied to prove that prosecution exhibit P4 was the computer involved in the case.  However, the two computers in question were only seized several days after the occurrence of the incident.  There was no evidence as to whether the computer program has been updated or altered. Therefore, it follows that there is also no way to ascertain which version of the operating system the two computers were using at the material time.

(3)   The Prosecution only relied on the admitted facts to prove that the police had seized two computers.  But there was no evidence to prove that there were only two computers in the relevant establishment.  As revealed in PW3’s evidence, as long as there was a third computer inside that establishment or in its vicinity using the same Internet Protocol address to send messages via its wireless network, the messages shown to the recipient would have been coming from the same source, that is from the same Internet Protocol address, as the two computers which were seized.

(4)   PW3 agreed that existing technology allowed messages to be sent by an Internet Protocol address which was used without authorization or faked causing the recipient to mistakenly think that the messages were sent from a certain address.  The Prosecution had no evidence to rule out this possibility.

(5)   The log record showed that relevant visits to the police website under different names were made within one minute with a fixed repetitive pattern.  PW3 agreed that these browsing might not be caused by pressing a button in the keyboard manually but was rather launched by a website which was logged in by a computer user or a program which was designed by a webpage causing prosecution exhibit P4, namely the computer, to operate automatically and initiate those visits.  PW3 agreed that computer users might enter suspicious websites unknowingly while they were navigating a webpage.  That means it might simply take one click for the users to enter a link that would allow them to initiate an act without making any input or unknowingly because there was no indication or description about the act in the webpage.  Besides, depending on the preference of the webpage designer or manager, it is possible that the person who logs in the webpage would unknowingly cause the computer to make a high volume of network traffic request.  Ordinary computer users would never know the operation behind the webpage they have entered unless they have relevant network engineering knowledge.

(6)   PW3 also admitted that he could not tell which log in was manual and which log in was by robot operation that was driven by a program installed on the computer to initiate visits automatically.  Neither could PW3 tell from which entry or address in the browsing records the alleged 7467 “attacks” were launched.

44.  Putting it simply, Mr Leung was submitting that it was unreasonable and without sufficient grounds that the magistrate excluded the part of PW3’s evidence which was advantageous to the defendant.  According to PW3’s evidence, the following possibilities existed but they were neglected by the magistrate without any analysis or consideration:

(i)   Internet Protocol address can actually be overlapping[35];

(ii)   the Internet Protocol address tracked by the police in the case might be used by someone without authorization[36];

(iii)   there might be another computer in the unit in question using the same version of operating system as the computer prosecution exhibit P4 and it was that computer which had launched the attacks against the police website[37];

(iv)   the website shown in the browsing record in the

computer prosecution exhibit P4 might be programmed to automatically search for target websites and make related link on its own[38].

45.  Whereas Mr Wong, Senior Public Prosecutor for the Respondent, submitted that: although PW3 accepted under cross-examination that the things suggested by the defence might happen, there was in any event no evidence to support the defence’s suggestions in this regard.

46.  He stressed that the appellant did not give evidence in court nor call any witness nor submit any evidence during the original trial.  There was also no factual evidence from the prosecution to support the suggestions raised by the defence.  He cited R v CHONG Kin Cheong[39] to support his submission that it was not the court’s task to imagine all possible defences of which there is no evidence[40] when a defendant did not give evidence in the trial.  The duty of the court was to just consider on the evidence before him whether relevant inferences and findings could be drawn.

47.  I agree with this as a matter of law.

48.  Finally, whether it was safe and whether there was sufficient evidence for the magistrate to find that the appellant was the person who was doing the damage?  Mr Leung averred in the negative.

49.  Mr Leung pointed out that PW3 mainly relied on the following 4 matters to form the view that prosecution exhibit P4 was the computer that ‘attacked’ the police website at the material time:

(1)   the internet protocol address of the appellant’s residential address;

(2)   the operating system of the computer prosecution exhibit P4 and its version;

(3)   the browser of that exhibit and its version;

(4)   browsing records of the webpage ‘http://pastehtml.com/view/ckok6t524.html’ were stored in the exhibit.

50.  Mr Leung pointed out that there were deficiencies in each of these 4 matters.

51.  PW3 relied heavily on matter (4) because it would be a cogent evidence if the browsing records of the computer prosecution exhibit P4 tallied with the attack records of the police website.  I would therefore deal with it first.

52.  According to PW3’s witness statement[41], after he had examined the browsing records of the computer prosecution exhibit P4, he formed the view that [the computer][42] [had been engaged][43] in browsing the website http://pastehtml.com/view/ckok6t524.html at 22:54 hours on the 3^rd day of October 2014, 00:45 hours, 00:47 hours and 01:39 hours on the 4^th day of October.  In the end, his expert opinion was that he believed that the computer prosecution exhibit P4 was exactly the computer[44] which was engaged in using the webpage http://pastehtml.com/view/ckok6t524.html to launch DDoS attacks on government websites at 00:53 hours and 01:39 hours on the 4^th day of October 2014.

53.  Mr Leung pointed out the problem with this opinion was that PW3 had neither explained the source of this time of attack 00:53 in his witness statement nor in the evidence he gave in court.  In the circumstances, it appeared that the magistrate was simply adopting this time directly without making further investigation nor evaluating whether the evidence was credible.  Mr Leung criticized that directly adopting the expert opinion as such was a disregard of the function which was expected to be performed by a finder of facts.

54.  In any event, according to PW2’s witness statement, the 7,000 odd attacks launched by the internet protocol address 203.186.172.152 occurred between 00:53 hours and 01:17 hours on the 4^th day of October 2014[45].  It appeared that this information[46] had satisfied the magistrate.

55.  Mr Leung submitted that: even accepting for the time being the attack at 00:53 hours could be the consequence of the first three browsing sessions as stated in paragraph 52 above, there could hardly be any connection between the browsing at 01:39 hours and the attack of the

police website because the attack ended at 01:19 hours.  It was therefore unsafe for the magistrate to make adverse findings against the appellant without analyzing this situation.

56.  I agree that the magistrate had not analyzed the above situation.  Besides, it was also a fact that none of the witnesses had explained why the above situation would occur nor how different items of information coordinated with each other.

57.  In this respect, I agree with Mr Leung’s submission that even if there is a rehearing of the appeal, I would be handicapped in making a decision in the absence of relevant evidence.

58.  In respect of this issue, Mr Wong responded as follows:

“Be it in the original trial or in the present appeal hearing, the correct issue was whether the appellant had committed the relevant offence on the relevant date as particularized in the charge sheet instead of marshalling completely consistent and corroborated evidence from all witnesses to investigate the exact time when the commission of the offence was completed. The Respondent considered that the inconsistencies between the appellant’s and PW2 and PW3’s evidence in this respect were totally insignificant. What was worth taking note of was the relevant records in the server of the police website that were already set out in P2 comprehensively. These were exactly all the objective evidence that the magistrate was required to consider in deciding the issues of whether the DDoS attacks had happened, and, if they did happen, when did they happen.”

59.  I do not incline to agree to this argument.  Although the evidence given by different experts was complementary with each other, the evidence of PW3 was the most critical because he directly told the court that prosecution exhibit P4 was the computer that was used to attack the police website.  The magistrate therefore has a duty to evaluate this opinion in reaching his finding.  In view of the issue stated in the above paragraph 55, PW3’s evidence was neither easy to understand nor reasonable as it appeared to be nor was it the kind of evidence which could satisfy the court without further analysis.  Therefore, the way it was dealt with by the magistrate was unsafe.

60.  This is not the only matter[47] upon which PW3 relied to

provide his opinion.  His opinion[48] was a conclusion he arrived at based on four matters.  The question is, if matter (4) became unsafe to rely on as a consequence of the way the magistrate had dealt with it, whether the remaining 3 matters were sufficient to be relied upon to arrive at the same opinion?  It appeared not.  Moreover, none of the expert witnesses including PW3 had testified what purposes did the remaining 3 matters serve. Nor did the magistrate make any finding in this respect.

61.  Considering the voluminous computer data which was produced in court, a meticulous scrutiny on the records might shed some light on issues in respect of which findings are to be made.  However, scrutinizing the records concerns the question of how to comprehend the contents therein.  Even if magistracy appeals are by way of rehearing[49], I recognize that it would be inappropriate to scrutinize the records and comprehend the contents therein for the purpose of drawing inferences absent any evidence of facts in this respect.

62.  Mr Leung pointed out that each of the remaining 3 matters[50] has its shortcomings but I am of the view that it is no longer necessary to

pursue any further on these matters.  I just wish to point out that very often when we put each not so perfect circumstantial evidence together, they can be cogent and sufficient to support the requisite facts for the purpose of drawing inferences.

63.  Based on the foregoing[51], I agree that it was unsafe to find that prosecution exhibit P4 was the computer used to attack the police website.

64.  It follows that even though the appellant had made certain admissions to the police including the admission that she had used the computer in question and performed some operations, since the connection between this computer and the attacks on the police website was not safely established, the appellant’s admissions alone were insufficient to support the finding that the appellant must be the person who had committed the requisite act of this offence.

65.  In any event, Mr Leung also criticized that the way the magistrate had dealt with the statement of the appellant as inappropriate.

66.  According to the admitted facts[52], the appellant’s statement was made voluntarily.

67.  The statement made by the appellant was a mixed statement[53].  The magistrate had the following observation:

‘in respect of this video recorded interview, since the appellant elected not to testify, the responses she gave in the interview were therefore not tested under cross-examination, I consider that absolute weight could be attached to the admissions she made in the interview whereas no weight should be attached to her exculpatory explanations.’[54]

68.  This observation was totally in line with the principle and practice stated in the classical English authority R v SHARP[55] and Hong Kong Court of Appeal authorities such as HKSAR v MA ZHU JIANG[56].  In addition, the magistrate had also taken into account the appellant’s clear criminal conviction record[57].  There was no problem with the magistrate’s approach in dealing with the statement made by the appellant.

69.  The magistrate had taken into consideration one submission made by the defence lawyer at trial:

‘In paragraph 23 of the defence lawyer’s closing submissions, it was pointed out that the police were as a matter of fact denying an arrested person of 22 years (of age) without a previous criminal record the right to legal services by choosing to conduct interrogation in the small hours. The court can deny any weight to be attached to it.’[58]

70.  The magistrate has the following observation:

‘I consider that it was really not so satisfactory a decision for the police to choose to enquire of and interrogate the defendant in the early morning of just about 6 o’clock’ . However, the investigating officers had asked the defendant whether she required the presence of a lawyer during the conduct of the interview. The defendant indicated “no need”. The investigating officer also had asked whether the defendant was in fine fettle before conducting the interview. At that time, the defendant answered “yes”. During the interview, the defendant had mentioned she had headaches a few days before the date of the incident.  I therefore considered it necessary to watch the video interview.  I have watched the whole video recorded interview and have paid particular attention to whether the defendant was in fine fettle.  I do not, as a matter of fact, notice any weariness or anything that is causing concern about the defendant in this respect.  I therefore do not accept the defence’s submission[59].’

71.  Although the defence had admitted that the statement was made voluntarily by the appellant, it does not follow that the court could simply take it as satisfactory evidence and rely on it in reaching the verdict.  Because the court could accept the defence’s submission to attach no weight whatsoever to the statement or even exercise its discretion to rule the statement inadmissible should the court thinks fit after taking all the circumstances into consideration.  In this case, the magistrate’s finding in this regard was reasonable and properly founded.  I have no comment otherwise.

72.  Based on the analysis and consideration stated in paragraphs 51 to 61 above, I am of the view that it was unsafe for the magistrate to find that prosecution exhibit P4 was the computer that launched the attacks against the police website.  It follows that his finding of the appellant being the person who launched the attacks also could not be sustained.

73.  Ground of appeal (1) stands.

Ground of appeal (2)

74.  This ground of appeal concerns whether the appellant had the mens rea to commit the offence.

75.  If it cannot be proved that the appellant was the person who committed the relevant act of criminal damage, there is categorically no need to decide whether she had the relevant mens rea.

76.  But it is noteworthy to mention the way the magistrate had dealt with the case as shown in his statement of findings.  For the sake of completeness, I set out my observations.

77.  The mens rea in this offence can be either intentional or being reckless.  The magistrate pointed out that ‘the Prosecution also has to prove [the appellant’s] act was intentional or being reckless.’[60]  Although the magistrate did not make it clear, Mr Wong, the Senior Public Prosecutor, took the view that the basis for arriving at the conviction should be the latter.  In this respect, Mr Leung had no objection.

78.  The view of Mr Wong was reasonable.  However, we could only speculate the basis upon which the magistrate had arrived at his finding of guilt.  This is less than satisfactory because the approach and consideration for appeal would vary according to the basis on which a guilty finding was arrived at.  It even has an impact on the appeal outcome.

79.  Since the Respondent took the view that the basis for conviction was the appellant being reckless, I am going to look into this issue further.

80.  After the magistrate had considered the whole statement, he considered that the evidence supported the following inferences:

‘… I consider that the reasonable irresistible inference is that the defendant knew that the webpage was a hackers’ webpage. She learnt that there was a hacking operation after logging in and continued to act according to the instructions. Undoubtedly, she knew that there was the possibility that it would cause attacks on those targeted websites.’[61]

81.  In Sin Kam Wah v HKSAR[62], the Court of Final Appeal held that a person acts recklessly with respect to:

(1) (a) a circumstance when he is aware of a risk that it   exists or will exist;

(b) a result when he is aware of a risk that it will occur; and

(2) it is, in the circumstances known to him, unreasonable to take the risk.[63]

82.  This is the general standard which defines the mens rea requirements of recklessness.

83.  The first aspect of the standard concerns risk.  What is this risk?  It depends on the nature and circumstances of individual cases.  In the case of criminal damage, it generally refers to the risk of relevant property being damaged.

84.  In respect of a computer being damaged, the statutory definition for damage is broader than its general meaning.  This broader definition can be seen in the above paragraph 19.

85.  In view of this broader concept of damage and applying it in this case, the relevant risk would be whether the act would pose a risk to cause the computer to function otherwise than the way it was designed.

86.  The situation is not as easy to understand as in the case of ordinary property being damaged because there is a myriad of ways of misusing a computer.

87.  Therefore, a finder of fact must focus on the right issue with a thorough analysis and consideration before concluding whether the accused was reckless as to the consequence an act would cause.

88.  Moreover, a finder of fact should never neglect that aspect  (2)[64] of the standard is a separate aspect which must be proven and decided.

89.  It was stated in the authoritative Smith and Hogan’s Criminal Law that not all risk-taking constitutes recklessness.  Sometimes the accused will have identified a risk and rejected it as being so negligible as to be a reasonable one to take.  In other circumstances, the risk may have been rightly recognized to be much greater, but the social utility of the action justifies taking it[65].

90.  Under the general circumstances of criminal damage, it would not be difficult to determine aspect (2) of the standard as stated in paragraph 81 above after having determined aspect (1).

91.  In the present case, if the appellant was found to be the person who had pressed the button causing damage to the police website, even her knowledge of the risk had been established, considering what she did was only pressing a button which was the only button shown on the webpage and the fact that there was no particular evidence showing what kind of button it was, the court should also scrutinize what did the appellant see on the webpage and consider carefully whether she was acting unreasonably before coming to a conclusion.

92.  The magistrate, however, had made no finding in this respect in his statement of findings.

93.  Mr Leung’s arguments are based on whether the evidence before the court could support the guilty finding of recklessness.  Although his perspective is different from mine, based on the foregoing, I am of the view that the magistrate’s finding is unsafe.

Conclusion

94.  Appeal allowed, conviction set aside.

95.  Written submission is required if either party wishes to make relevant application.