HKSAR v. TSE MAN LAI

DCCC1318/2011

IN THE DISTRICT COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

CRIMINAL CASE NO. 1318 OF 2011

----------------------

---------------------

Reasons for Sentence

---------------------

1. Tse Man-lai, you were found guilty by me after trial of two offences of obtaining access to computer with criminal or dishonest intent, contrary to section 161(1)(c) of the Crimes Ordinance.

2. The offences occurred on two successive dates, 12 and 13 August 2011.  On each occasion, you accessed your own desktop computer at your home and using a UDP Flooder programme you had downloaded, you launched a Denial of Service attack on the web server of HKExnews, a website set up by the Hong Kong Exchange and Clearing Limited to disseminate news and price sensitive information to investors and other members of the public.

3. The first attack lasted 390 seconds and occurred between 13:17:09 and 13:23:39 on Friday, 12 August 2011.  The second attack lasted just 70 seconds and occurred between 03:25:06 and 03:26:16 in the early hours of Saturday, 13 August.  The first attack consumed 48 per cent of the network resources of the HKExnews web server and the second attack 54 per cent. Fortunately, because the remaining bandwidth was unimpaired, the attacks did not affect the accessibility of the website by members of the public. 

4. These were deliberate attacks by you on this website and they came at a very sensitive time.

5. On 10 August 2011, two days before your first attack, there were two distributed Denial of Service attacks launched against the HKExnews website from overseas.  The first attack started at 10.45 am and lasted 32 minutes.  The second attack started at 11.30 am and lasted about 1 day and 10 minutes.  These attacks, unlike your attack which was launched from one computer, were launched from more than 300 different computers. 

6. The effect of the attacks on 10 August caused such concern that the top management of the Hong Kong Exchange ordered that trading in seven listed companies, including HSBC Holdings and Cathay Pacific, which had arranged to distribute market messages on 10 August, be suspended.

7. There is no suggestion that you were involved in any way in these attacks on 10 August, but you were aware of them and the consequences because you had read of them on the Yahoo News website.  You were aware that, as a result, additional measures had been taken by the HKExnews to protect their website against similar attacks.  Despite knowing of the concern that these attacks on 10 August caused and without warning to HKExnews, you set out to demonstrate by launching your attacks that the HKExnews was still vulnerable to such attacks.  You would have been aware that your attacks would cause great concern to HKExnews. 

8. After your first attack, they took steps to block your IP address.  You nevertheless were able to launch a second attack from another IP address.

9. I was satisfied that your aim in launching your attacks was to promote the services of your company Pacswitch Globe Telecom Limited as being able to counter such attacks.  I am prepared, however, to accept that your motive was not deliberately to harm HKExnews but rather to obtain still and video images from your computer of your attacks to demonstrate that HKExnews website was still vulnerable to attack for the purposes of promoting your business.

10. In obtaining these images, you could not necessarily predict what the prejudicial consequences of your attack on the website would be.  What you did was highly irresponsible. 

11. I am also prepared to accept that your attacks, which were short, lasted no longer than was necessary to obtain the images you sought.  Moreover, in the case of the second attack, it was in the early hours of a Saturday morning.  I bear in mind that fortunately the accessibility of the HKExnews website to members of the public was not affected. 

12. You are a young married man of previous good character.  It is clear that you worked hard to obtain academic qualifications and have a good career.  You have assisted the community through your work for the Auxiliary Medical Service including in Amoy Gardens during the SARS outbreak.  You are obviously well thought of by all who have written letters in your support to the court. 

13. All these matters I take into account. Nevertheless, despite these mitigating circumstances, I cannot ignore the fact that you deliberately targeted a website of considerable public importance by launching a flood of UDP packets for your own ends. 

14. I take into account all that Mr Chung has said on your behalf and the letters that have been submitted to me this morning.

15. There are no guidelines for sentencing in cases such as this.  I am satisfied that the sentence of this court must make it clear that this sort of conduct is viewed very seriously; a term of immediate imprisonment is inevitable. 

16. Bearing in mind all the mitigating circumstances to which I have referred, I am satisfied that a sentence of 9 months’ imprisonment is appropriate in your case and that is the sentence I pass.