HKSAR v. TSUN SHUI LUN

HCMA723/98

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATION REGION

COURT OF FIRST INSTANCE

MAGISTRACY APPEAL No. 723 OF 1998

(ON APPEAL FROM WSCC 5408 OF 1998)

___________

----------------------

J U D G M E N T

----------------------

Chan, CJHC:

1. The appellant was convicted after trial of obtaining access to a computer with a view to dishonest gain for himself, contrary to section 161(1)(c) of the Crimes Ordinance, Cap.200. He was sentenced to 6 months imprisonment. He now appeals against both conviction and sentence.

Background

2. In April 1998, the appellant was employed as a technical assistant by Dr Ooi who was a radiologist of the University of Hong Kong attached to the Radiology Department of the Queen Mary Hospital. The appellant's duties included making literature searches, arranging appointments for patients, liaising with other research assistants in the Hospital, and generally helping Dr Ooi in her research.

3. The Hospital's computer system had a Radiology Information System ("RIS") which contained some patients' medical records. In her research, Dr Ooi had access to the RIS. To prevent unauthorised access to these medical records, there was a security system in the computer. Access could only be gained to the RIS by the use of a password. Such password would be changed every now and then. Since the appellant was helping Dr Ooi, he too was given the password. But this was given only for the purpose of and to facilitate the discharge of his duties.

The facts

4. At 8:30 am on 2 April 1998, the Secretary for Justice was admitted to the Queen Mary Hospital for urgent treatment. Dr Chu who attended to her decided that computerised X-ray tomographic scanning ("CT scan") was required for diagnosis. The Secretary for Justice was then sent to the Radiology Department at about noon for scanning. A report was then prepared by the Consultant Radiologist. Because of this rather urgent arrangement, Dr Ooi's patients who were scheduled to have CT scanning at lunch time had to be delayed. Some time in the morning, Dr Ooi informed the appellant and her two secretaries of this delay. During this conversation, Dr Ooi disclosed that it was a very famous lady who required the CT scan. The appellant guessed that it might be the Secretary for Justice. Dr Ooi then indicated that this was confidential and that they should not talk about it any further. The conversation then concluded.

5. Between 3:30 pm and 6:00 pm, Dr Chu operated on the Secretary for Justice. Throughout, Dr Ooi had nothing to do with the Secretary's diagnosis or treatment. It would seem that the report of the CT scan had been input into the RIS.

6. At about the same time in the afternoon, the appellant made use of the password given to him by Dr Ooi and entered the RIS. He printed out a copy of the CT scan report. He took it home and showed it to his wife. After that, he threw it away.

7. On that day, the Government issued a Note to Editors of the local news media stating that the Secretary for Justice was admitted to hospital "for observation due to enterogastric disorder". This was reported on television in that evening and in the Ming Pao and Apple Daily newspapers on the following morning, 3 April.

8. Some time after 11:00 am on 3 April, the appellant again entered the RIS using the password and printed out another copy of the CT scan report. He took the copy to see two of his friends, a Mr Cheung and a Mr Ho who were research assistants in another department and showed it to them. It would seem that there was a brief discussion on the report but the two gentlemen did not keep the copy and did not seem to care too much about it. In the afternoon, the appellant faxed the copy report to the Ming Pao and Apply Daily. When he sent the faxes, he deleted the reference to his own identity and fax number.

9. In that evening, Dr Chu who treated the Secretary for Justice received inquiries from newspaper reporters but he did not disclose anything. On the following day, the Ming Pao and the Apply Daily published a story about it with a copy of the CT scan report.

10. Investigations started in the Hospital concerning this leak in the days that followed. The appellant was arrested on 9 April after it was traced to Dr Ooi's password. Under caution, the appellant admitted in two video-recorded interviews that he had accessed the RIS on 2 and 3 April and obtained copies of the CT scan report and that he had anonymously faxed a copy to two newspapers on 3 April. He also said that the reason for his doing so was because he thought the public had the right to know the truth. During the interviews, he further said that he "began to regret because (he) felt that (he) shouldn't do what (he) had done" and that he hoped the Secretary for Justice would forgive his foolish behaviour.

The appellant's evidence

11. During the trial, most of the prosecution evidence was not challenged. The appellant gave evidence. He denied that he was told by Dr Ooi of the restrictions regarding the access to the computer. He said that he faxed a copy of the CT scan report to the newspapers because he was "a little angry and discontent" and because he felt that the Government should not give false information in order to conceal from the public what really happened and to cheat them. He said that he sent the faxes anonymously at home because he feared that the Government might not like what he was doing and that there might be reprisals. He admitted that he did not consult Dr Ooi between the first and the second occasions he entered the RIS. He said that he did not hear Dr Ooi say on 2 April that the report was confidential and that they should not discuss it any further. He admitted that the purpose of his having the password was to ensure that the information in the RIS was not available to the public. However, at the material time, he did not think about whether Dr Ooi would have approved what he did. He only thought of faxing the report to the press and did not think about other details. He admitted under cross-examination that when he printed the second copy of the report, he had decided to send it to the press.

The magistrate's decision

12. It is not disputed that the appellant had obtained access to the RIS of the Hospital on two occasions. It is also not disputed that on these occasions he did obtain the information as set out in the CT scan report. On both occasions, he had not only obtained the information by reading it on the computer, but had also printed out copies of the report. The issue which remains to be decided is whether he did it with a view to dishonest gain for himself.

13. In his oral reasons for verdict, the trial magistrate said that it was conceded by leading counsel for the appellant that what was done by the appellant was done with a view to gain. In his Statement of Findings, the learned magistrate said that this was not challenged. It would seem that counsel for the appellant did not put forward any argument to the contrary. According to the learned magistrate, the only issue was whether there was any dishonesty. He reviewed all the evidence and found that the appellant was evasive, deceitful and inconsistent. He gave incidents of how the appellant answered questions and came to the conclusion that he was such a witness. He held that the appellant was aware that the information was confidential and that any leak of the information was a breach of hospital rules and a breach of confidentiality. He did not believe the appellant's assertion that he did what he did because he was angered by the Government misleading the public with their "lies" and felt that the public had the right to know the truth. The learned magistrate was therefore satisfied that the appellant's conduct was dishonest by the standards of reasonable and honest people and that he was aware that that was dishonest.

The issues in this appeal

14. In this appeal, Mr McCoy SC who did not represent the appellant at the trial challenges both the magistrate's conclusion that the appellant had a view to gain and the finding of dishonesty on the part of the appellant. There are therefore two issues in this appeal. First, upon the true construction of s.161(1)(c) of the Crimes Ordinance, did the appellant enter the computer with a view to gain? Second, applying the test of dishonesty as laid down in the case of R. v. Ghosh, [1982] 1 QB 1056, was the appellant dishonest?

Construction of section 161

15. Leading counsel for the appellant submits that the legislative intent of s.161, as stated by the Secretary for Security in his speech in the Legislative Council on the resumption of the second reading of the Computer Crimes Bill, is to create an offence aimed at penalising access to a computer for acts preparatory which fall short of the commission of a crime or a fraud. It is submitted that mens rea for an attempt is a specific intent and that this is required in the situations under s. 161(1)(a), (b) and (d). By way of contrast, the word intent is not used in subsection (c). That subsection was enacted to deal with acts preparatory, a stage earlier than an attempt. It is further argued that the offence was alleged to have occurred at Room K415 of the Queen Mary Hospital but that at the time the appellant accessed the computer, there was no act preparatory to any offence. The sending of the copy by fax to the newspapers occurred not in the Hospital but at home and at a later time. The facsimile transmission not only occurred much later than the access, but was also not an element of the offence. Counsel submits that the appellant had the authority to access the computer although he had exceeded it for a different purpose. When he accessed the computer, he thought that what he did was to achieve a legitimate purpose, i.e., to show that the Government was lying.

16. Section 161 came from the Computer Crimes Ordinance. This Ordinance was enacted in 1993 to "clarify and amend the criminal law relating to the misuse of computers and for related matters". Apart from amending certain definitions in some ordinances, this Ordinance has created two computer crimes which are to be included in other Ordinances. Both new offences relate to access to a computer. The first is section 27A of the Telecommunication Ordinance, Cap 106 which punishes any person who knowingly obtains unauthorised access to a computer by telecommunication. It is not necessary to look into the offender's intention or his motive in gaining access to the computer. However, if the access is not by way of tele-communication, it is not an offence under that section.

17. The second offence is that created under s. 161 of the Crimes Ordinance which deals with other types of access into the computer. The relevant parts of that section read as follows:

"161 Access to computer with criminal or dishonest intent

(1) Any person who obtains access to a computer -

(a) with intent to commit an offence;

(b) with a dishonest intent to deceive;

(c) with a view to dishonest gain for himself or another; or

(d) with a dishonest intent to cause loss to another,

whether on the same occasion as he obtains such access or on any further occasion, commits an offence and is liable on conviction upon indictment to imprisonment for 5 years.

(2) For the purpose of subsection (1) 'gain' and 'loss' are to be constructed as extending not only to gain or loss in money or other property, but as extending to any such gain or loss whether temporary or permanent; and -

(a) 'gain' includes a gain by keeping what one has, as well as a gain by getting what one has not; and

(b) 'loss' ........"

18. The offence with which the appellant was charged and of which he was convicted is s.161(1)(c) of the Crimes Ordinance.

19. In one respect, s.161 has a wider application than that under s.27A of the Telecommunication Ordinance since an offence under s.161 can be committed whether the access is obtained by telecommunication or not. On the other hand, a s.161 offence requires proof of a specific criminal or dishonest intent or purpose and is more serious (as can be reflected from the maximum penalty specified in the provision). It follows that not every kind of access into a computer constitutes an offence under s.161. This section stipulates four situations in which the access becomes a crime. Each situation constitutes one separate offence. The actus reus is obtaining access to a computer. Each of the four situations constitutes the mens rea of the respective crime. What s.161 is intended to do is to punish access into a computer with a particular intent or for a particular purpose. The intent with which or the purpose for which the access is made must be either criminal or dishonest. It would also follow that it is the intent or purpose of the offender at the time of the access which must be looked at, not his intent or purpose at some later stage.

20. It is clear from the section that it catches acts preparatory to the commission of a crime or fraud. But I do not agree that it is restricted to such acts. A person who makes an unauthorised access into another person's computer need not have any intention to commit a crime or fraud. He may be a businessman who wants to acquire information about his competitors in order to enable himself to have an advantage over them. He may be a disgruntled employee who wants to ruin his employer's business by revealing his employer's trade secrets to others. He may be an ex-employee who wants to obtain a list of his former employer's customers in order to solicit business from them. He may be a dissatisfied bank officer who wants to erase the bank's records from the computer in order to cause confusion or to irritate the bank's customers. All these acts may result in a gain to the perpetrator or cause huge losses, great embarrassment and serious harm to others. But they are not necessarily criminal or fraudulent. The perpetrator's access to the computer cannot therefore be regarded as an act preparatory to the commission of a crime or fraud. However, if such access is obtained dishonestly, the perpetrator ought to be punished. That in my view is the objective of s.161(1)(c) and (d). I should think that the Secretary for Security when he was addressing the Legislative Council in 1993 was only making a generalised statement in order to summarise what the section was aimed at doing.

21. The gravamen of the offence with which the appellant was charged was his obtaining access to the Hospital's computer with a specific view in mind. The actus reus of the offence was the access to the Hospital's RIS and this admittedly took place on 3 April while he was in the Hospital. The prosecution did not rely on his making a printout from the computer or his transmission of a copy by fax to the newspapers. These of course came after his access to the computer and at a later stage. The printout and the fax were only evidence which might cast light on his state of mind at the time of his access to the computer. There was evidence (and this came on his own admission) that at the time of his access into the computer on 3 April, he had decided to print out a copy and to leak it to the press. That was the purpose of his access on the second occasion. He had in fact committed the actus reus of the offence by obtaining access to the computer on the previous day. But it could be argued that on that previous occasion, he was doing it out of curiosity and without a view to dishonest gain to himself.

22. The situation on 3 April is quite different. On this later occasion, he gained access to the computer for a specific purpose : to obtain information in the form of a printout of the CT scan report for the purpose of sending it to the newspapers. The question is whether that was with a view to dishonest gain. If it is, then it falls within s.161(1)(c). The fact that he did it because he thought "the public have the right to know the truth" or he wanted to reveal the Government's "lies" is merely his motive. For the purpose of a s.161 offence, I do not think that there is or should be any difference between gaining access without authority and gaining access in excess of authority. The section makes no distinction between the two.

Meaning of gain

23. Counsel argues that gain must be a benefit or an advantage which is useful or which can be used. Making a printout of the information is not a use of the information. Hence, the appellant did not have any gain by looking at the computer and making a printout. He was merely using the computer and not using the information. Hence, there was no gain.

24. It can be seen that the definition of "gain" in s.161 of the Crimes Ordinance is similar in wording to that used in s.8 of the Theft Ordinance but with one vital difference. A number of observations can be made. First, it is not confined to financial or proprietary benefits, but is wide enough to cover intangible benefits. Second, it can be a transient as opposed to permanent benefit. Third, the keeping of what one has or the getting of what one has not is also regarded as a gain. Fourth, while "gain" under s.8 of the Theft Ordinance is to be construed as extending only to a monetary or proprietary benefit, the meaning of "gain" in s.161 is to be construed as extending not only to monetary and proprietary benefits. In other words, the definition under s.8 is restrictive, but that under s.161 is inclusive and casts an open net. This, in my view, is understandable since computer technology may in future be so advanced that it is difficult to envisage now, let alone in 1993, what one can obtain from a computer in say a few years time.

25. What can be obtained, in this day and age, by gaining access to a computer is normally information and images. Looking at the definition of gain in the context of a computer crime, it is clear, in my view, that the subject matter of a gain as defined in s.161 would include information which the person obtaining access to the computer did not have before the access. It is clear that the section is intended to cover the acquisition of information which is in itself (i) neither a monetary nor proprietary benefit; but is (ii) something that is capable of retaining at least temporarily if not permanently and (iii) something that is capable of keeping when one has already got it and capable of getting when one has not. What is anticipated by "gain" in s.161(1)(c) is a benefit or an advantage. However, I do not agree that it must be something which can be utilized or used. That is not expressed nor can it be implied in the section.

26. For these reasons, I take the view that s.161(1)(c), when it is construed in the context of a computer crime and the rest of the section, permits the construction of the word "gain" to include obtaining information which one did not have prior to his access to a computer. The information may be transient if it is read on the screen or permanent if it is printed out or copied onto another diskette. In the present case, it was a gain to obtain the information from the CT scan report which was stored in the RIS of the Hospital's computer.

Dishonesty

27. There is no assistance which can be derived from the Computer Crimes Ordinance with regard to the meaning of dishonesty in relation to the offence created in s.161. The parties, however, accepted, and in my view quite rightly so, that the test which is to be applied in this case to the requirement of a dishonest gain, is the test of dishonesty as laid down by the Court of Appeal in the case of Ghosh. Having regard to the test to be applied to dishonesty in the context of the Theft Ordinance, I do not think any other meaning of dishonesty or test regarding such concept should be adopted or applied in relation to an offence under s.161 of the Crimes Ordinance. After all, dishonesty is a common concept and it would seem that a common sense approach must be adopted.

28. The classic test of dishonesty was laid down by the Lord Chief Justice in Ghosh at page 1064D:

" In determining whether the prosecution has proved that the defendant was acting dishonestly, a jury must first of all decide whether according to the ordinary standards of reasonable and honest people what was done was dishonest. If it was not dishonest by those standards, that is the end of the matter and the prosecution fails.

If it was dishonest by those standards, then the jury must consider whether the defendant himself must have realised that what he was doing was by those standards dishonest. In most cases, where the actions are obviously dishonest by ordinary standards, there will be no doubt about it. It will be obvious that the defendant himself knew that he was acting dishonestly. It is dishonest for a defendant to act in a way which he knows ordinary people consider to be dishonest, even if he asserts or genuinely believes that he is morally justified in acting as he did."

29. It is a two-stage test. First, it must be decided whether what was done in a particular case will be regarded as dishonest according to the ordinary standards of reasonable and honest people. Secondly, it is necessary to decide whether the defendant knew or must have realised that what he was doing was dishonest by such standards. It must also be noted that it would still be dishonest even if an accused genuinely believed that he was morally justified to act in the way he did.

30. Leading counsel for the appellant submits that there was no dishonesty in the present case. He argues that the appellant thought that what he did was for a legitimate purpose. He had a subjective and genuine belief that what he was doing was a right thing to do, although such belief might be based on unreasonable grounds. He submits that the trial magistrate's finding of dishonesty was against the weight of evidence. The conduct of the appellant may be discreditable, dishonourable or inappropriate, but did not amount to dishonest conduct. Counsel says that it may well be a civil trespass into the computer because that is an unauthorized use of the computer. This only attracts civil consequences but is not a criminal offence. He argues that the appellant's intention was to rectify the misleading press releases from the Government's spokesman. He genuinely and honestly believed on reasonable grounds that the Government was suppressing or distorting the truth. Counsel draws analogy to a secretary who uses a typewriter after office hours for her own unauthorised purpose. She may also have used the office paper and typewriter ribbon. That may be improper but is certainly not criminal. Counsel further says that a breach of a contractual arrangement is again a civil wrong but it does not necessarily follow that what is done is dishonest.

31. On the other hand, Mr Marash SC for the prosecution submits that there was ample evidence upon which the magistrate could find that the appellant was dishonest. He says that according to the evidence in this case, ordinary, reasonable and honest people would regard the appellant's conduct as dishonest and that the appellant knew that it was dishonest. It is also submitted that the magistrate has made a finding upon an assessment of the facts and evidence before him. An appellate court should be slow to interfere with such finding of dishonesty.

32. The first question to decide is: would ordinary, reasonable and honest people regard what was done in the present case as dishonest? A number of matters have to be considered.

33. The appellant was given a password to access the computer for a particular purpose, i.e. to assist in Dr Ooi's research. Dr Ooi said that she had told the appellant about the restriction as to the access to the RIS using the password, but the appellant denied that she had done so. However, I should think that even if Dr Ooi had not informed the appellant of the restriction, it would be clear to any ordinary and reasonable person who has use of a computer that the need to have a password to gain access to a computer would necessarily indicate that there must be a certain amount of confidentiality in the information contained in the computer and that such information should not be disclosed to others. The appellant admitted in evidence that he knew this.

34. Second, any ordinary and reasonable person would realise the importance of privacy. He would know that no one would like his private affairs to be made known to other persons, let alone the public.

35. Third, it would be clear to any ordinary and reasonable person working in a hospital environment, whether he is employed by a hospital or not, and whether he is provided with a set of hospital rules or not, that it is important to maintain confidentiality between a patient and the hospital. That is the right of a patient. The appellant denied that he had been provided with the hospital rules. That, in my view, is neither here nor there.

36. Then, there is the undisputed conversation at around 1:30 pm on 2 April between Dr Ooi and the appellant in the presence of the two secretaries. It is not denied that Dr Ooi had concluded the conversation by saying that the matter was confidential and that they should not discuss the matter further. To any ordinary and reasonable person, that was clearly a reminder of the importance of keeping confidential the identity and/or information of the person described as the VIP lady. Those data should not be disclosed. This was particularly so when that VIP was not Dr Ooi's patient.

37. Next, the access to the computer on 3 April was not the first unauthorised access. It was not to satisfy one's curiosity. It was done with the specific purpose of leaking whatever information which could be obtained to the press. The probable consequence of this is that such information would be made known to the public.

38. Finally, before he faxed the copy report to the newspapers, the sender's identity and fax number had been concealed. Whatever was the reason for this, it must be clear that the sender knew it was wrong to do what he was doing and that it could bring unpleasant consequences to him.

39. It may be that out of curiosity, a person entrusted with a password to a computer containing confidential information may like to have a look at it. Human nature being what it is, he may be tempted to look at the information even though his employer or superior has expressly told him not to do so. This may be a breach of the contract between himself and the employer as this is a clear disobedience of instruction. This may be improper conduct, i.e. conduct which ordinary and reasonable people will not normally do but which some people out of curiosity may be tempted to do. I am not approving such conduct. However, that is not the case here. There was no reason for the appellant to look at the report again in the morning of 3 April except for the purpose of leaking it to the press.

40. While an employer or superior may tolerate or even forgive an employee for being nosy for looking at his private papers in breach of instruction, he would certainly find it unacceptable if the employee takes out those papers and shows copies of them to other people. It is a deliberate access for the purpose of leakage. It is not only a breach of instruction and hence a breach of contract, it is also a breach of trust and a gross abuse of that trust. If an employee requests his employer to let him have his confidential papers in order to show them to other people, it would be too much to expect that the employer would accede to that request. I do not think counsel's analogy to an office secretary is appropriate.

41. It is important to note that in this case, it was to be a leak to newspapers which is tantamount to leaking it to the public. Such a leak would be in direct contradiction to the obligation of confidentiality. It is a deliberate attempt to make public what those concerned and the person who is the subject matter of the confidential information have tried very hard to keep confidential.

42. I am satisfied that any ordinary and reasonable person would have considered such conduct as not only discreditable, dishonourable or inappropriate, but also dishonest and reprehensible . It is not only conduct which people would dislike or detest but conduct which they would regard as wrong and totally unacceptable.

43. The second question is : whether the appellant knew or must have realised that what he did was dishonest in the eyes of ordinary, reasonable and honest people. He is an intelligent and educated person. He had a first degree and was doing a master degree in business administration and a diploma in law. He knew the information was confidential and was reminded by Dr Ooi that it was confidential. He took the precaution to conceal his identity. He must be aware of the importance of privacy, particularly in a hospital setting. What was his reason for doing what he did?

44. In his interview with the police, he said that he did it because he thought the public have the right to know the truth since the Government had lied. In evidence, he confirmed what he said in his statement to the police but added that he felt that the Government should not give false information in order to conceal from the public what really happened and to cheat them. He also expressed his anger with the Government. The learned magistrate entertained some doubt as to his explanation. Having examined the evidence, I too share that view. The Government's press release was clearly inaccurate. There might be some reasons for that but they were not made known. It may be that the Government may not find it easy to explain the inaccuracy and it would be interesting to know what they may say. But it is not for the court in this case to find out why the press release was inaccurate. Nor is it necessary in this case for the court to rule whether the public have the right to know the truth. The court is concerned with whether the appellant was dishonest when he accessed the computer with a view to leak the CT scan report to the press. What is clear from the evidence is that the appellant did not raise the matter of correcting the Government with Dr Ooi or indeed any person. He did not say whether he had raised it with Mr Cheung or Mr Ho to whom he had shown a copy. Mr Cheung could not recall whether he did or not. However in his statement to the police, he admitted that after having faxed the report to the newspapers, he began to regret because he felt he should not have done what he had done. When he was cross-examined, he further accepted that the public do not have a right to know exactly what is wrong with a patient in the hospital unless the patient chooses to release that information. The learned magistrate came to the conclusion that the appellant did it for the thrill and excitement of showing that the Government was wrong rather than because he thought the public had a right to know the truth. It may be that in the process, that had also come to his mind. Having examined all the evidence, I have no reason to disagree with the learned magistrate's views. In any event, even if the appellant had genuinely believed that he was morally justified to do what he did, it would still, on the authority of Ghosh, be dishonesty.

45. Counsel relies on the case of R v. Hung Hak Sing & another [1995] 3 HKC 327 which held that the prosecution had failed to prove that the accused in that case was dishonest. That case is distinguishable from the present : there was other evidence tending to show that there was no dishonesty on the part of the accused.

46. In the circumstances of this case, it is not difficult to draw the inference, which is the only reasonable inference, that the appellant knew and must have realised that it was dishonest conduct to have access into the computer, print out a copy and leak it to the press.

Conclusion

47. For these reasons, I take the view that the learned magistrate had come to the right conclusion. There was access into the computer by the appellant. He did it in excess of his authority. At the time he did so, he intended to obtain the confidential information in the computer for the purpose of and with a view to printing out a copy and leaking it to the press. That is a gain within the definition in section 161. It was dishonest conduct and he knew it was dishonest. There is no merit in the appeal against conviction and it must be dismissed.

Sentence

48. Counsel for the appellant submits that the sentence of 6 months imprisonment is out of all proportion. The appellant is now aged 29, married and has one child. He has a clear record. He does voluntary and charitable work. He has a very good educational background. Because of this offence, he has lost his job. His future has been ruined. He is now helping his friend in a factory and earns about $5,000 only. He had expressed remorse when he was interviewed by the police. Through counsel, he expressed his remorse again before the trial magistrate for what he had done. In this appeal, he made a public apology to the Secretary for Justice. He had already been in custody for 7 days. Counsel further submits that the present offence is at the bottom of the scale since the type of offences which might be committed through gaining access to the computer as anticipated by the Ordinance would include blackmail, corruption, fraud and may cause serious consequences such as death or serious physical injury. It is argued that a deterrent sentence is wrong in principle.

49. Computer has become a fact of life in modern society. Daily activities are now so dependent on the computer that it is difficult to imagine what would happen without it. Business transactions are conducted through computers. Confidential and even secret information is stored in computers. Many lives are saved in hospital through computerised operations. If computers are misused or abused, or if access to computers with a criminal or dishonest intent or purpose is tolerated, it may lead to serious consequences. These must be avoided. In my view, this is precisely the object of the Computer Crimes Ordinance in creating two computer crimes. Section 27A of the Telecommunication Ordinance seeks to prevent hacking into a computer by means of telecommunication. Section 161 of the Crimes Ordinance is aimed at preventing access into a computer with the intent to commit a crime or a fraud or for the purpose of dishonestly causing gain or loss to others.

50. There is a very wide range of criminal and dishonest activities which fall within the ambit of s.161. In this day and age, very serious crimes or frauds can be committed by gaining access to other people's computers and uplifting information contained therein. Examples include meddling bank records, transferring large sums of money from one account to another, and stealing secret programmes and data such as customers lists and business records. Such activities can be very serious and obtaining access into computers with such intention or for such purposes is no less grave.

51. The maximum penalty under s.161 is 5 years imprisonment. I should think that the maximum is reserved for access which would lead to the commission of serious crimes or frauds or the acquisition of huge gains or serious losses, financial or otherwise. Where, as in the present case, no financial or proprietary gain is made by gaining access to the computer and the loss to others is not serious, it would, in my view, fall into the lower end of the scale. There is clearly a wide spectrum in the culpability of this type of offence. In my view, if access is gained into a computer in order to commit a crime or fraud or where the access is intended to cause huge gain or serious loss, whether financial, proprietary or otherwise, to another person, an immediate custodial sentence should be imposed. Where access is gained not for any personal benefit but for the purpose of vandalizing another person's system or causing great embarrassment and distress to him, the possibility of imprisonment cannot be ruled out. It is however not appropriate for me in this special case to set any sentencing guideline for a s.161 offence.

52. In the present case, there are some aggravating factors. There is no doubt a breach of trust by the appellant. He is also in breach of the patient and doctor confidentiality. What he did would seriously undermine public confidence in the medical profession. He had caused embarrassment and distress to Dr Ooi and the Secretary for Justice : to Dr Ooi, because she was at one stage under suspicion and to the Secretary, because she was, like any other patient, already suffering from physical ailment and was entitled to recover peacefully.

53. The appellant had also intruded into the privacy of a patient, be she an ordinary citizen or the Secretary for Justice. Privacy must be protected, whether it be that of a public figure or that of the man in the street. The reality is that people would be more interested to know the private affairs of a public figure than those of the man in the street. While the man in the street may suffer less embarrassment and distress if his privacy is intruded, the same may cause much greater embarrassment and distress to a public figure. Although some may argue that a public figure, particularly when he is performing a public duty, is subject to public scrutiny and thus may have to tolerate some degree of loss in privacy, that does not mean he is not entitled to his privacy. Having said that, I should think that the appellant should not be held more culpable just because the person affected is the Secretary for Justice.

54. The learned magistrate is clearly correct to say that the appellant's purpose of doing what he did was largely for the thrill and excitement of it. He would like to embarrass the Government and be seen to be instrumental to revealing what the Government had said was inaccurate. However, whatever the reason for its inaccuracy, the Government press release did give rise to the public perception that they were economical with the truth. If it was indeed part of the appellant's motive to correct the inaccuracy, I would accept that this would be a mitigating factor in his favour.

55. Bearing in mind all the circumstances of this case and his mitigation, I take the view that this is an exceptional case. While I would not rule out the possibility of imprisonment in this type of offence, I do think that in these peculiar circumstances, a term of 6 months imprisonment is clearly manifestly excessive. This appellant had been in custody for 7 days already. He had the prison door clanging behind him. He had a taste of imprisonment already. These, I should think, are enough to give a stern warning not only to him but also to others. I have considered the Community Service Report as to the suitability of making an order of community service. Here is a young man who, if he was indeed concerned that the public have the right to know the truth, is a righteous and public-spirited person. That being the case, I take the view that it is more appropriate that he should serve the community in return for the wrong he had done. In the circumstances, I would allow the appeal against sentence. I would set aside the sentence of 6 months imprisonment. In substitution thereof, I would order that he shall serve 100 hours of community service within the next 12 months in accordance with the directions of the probation officer.