HKSAR v. KO KANG SUK AND ANOTHER

DCCC 348/2021

[2022] HKDC 1145

IN THE DISTRICT COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

CRIMINAL CASE NO. 348 OF 2021

________________________

________________________

REASONS FOR VERDICT

1.  D1 and D2 are jointly charged with 2 offences of "Conspiracy to steal" (Charges 1 and 2). They pleaded not guilty to both charges. D1 also faces a charge of "Breach of condition of stay" (Charge 3), to which he pleaded guilty.

2.  This trial is concerned with Charges 1 and 2 only.

The Prosecution Case

Charge 1

3.  Mr. Lam (PW1)  is the proprietor of HK Bitcoin ATM Limited ("HK Bitcoin").  It engaged in the business of trading Bitcoins; it placed Bitcoin ATMs (Automated Teller Machines)  at various locations including Mongkok, Central, Sham Shui Po, Tsuen Wan and Fanling.

4.  At 1953 hours on 5 August 2020, someone received $12,000 cash from the Bitcoin ATM at Central by purporting to sell 0.147624 Bitcoin to HK Bitcoin.  PW1 said HK Bitcoin did not receive any Bitcoin for this transaction.  This is Incident 1-1.

5.  At 2211 hours on 5 August 2020, someone received $43,000 cash from the Bitcoin ATM at Sham Shui Po by purporting to sell 0.511224 Bitcoin to HK Bitcoin.  PW1 said HK Bitcoin did not receive any Bitcoin for this transaction.  This is Incident 1-2.

6.  At 1404 hours on 6 August 2020, someone received $52,000 cash from the Bitcoin ATM at Sham Shui Po by purporting to sell 0.61652 Bitcoin to HK Bitcoin.  PW1 said HK Bitcoin did not receive any Bitcoin for this transaction.  This is Incident 1-3.

7.  At 1745 hours on 6 August 2020, someone received $52,000 cash from the Bitcoin ATM at Mongkok by purporting to sell 0.617681 Bitcoin to HK Bitcoin.  PW1 said HK Bitcoin did not receive any Bitcoin for this transaction.  This is Incident 1-4.

8.  At 2048 hours on 13 August 2020, someone received $13,000 cash from the Bitcoin ATM at Mongkok by purporting to sell 0.156493 Bitcoin to HK Bitcoin.  PW1 said HK Bitcoin did not receive any Bitcoin for this transaction.  This is Incident 1-5.

9.  At 2050 hours on 13 August 2020, someone received $4,000 cash from the Bitcoin ATM at Mongkok by purporting to sell 0.156844 Bitcoin to HK Bitcoin.  PW1 said HK Bitcoin did not receive any Bitcoin for this transaction.  This is Incident 1-6.

10.  According to PW1, he carried out some tracing of the 6 transactions mentioned above.  He discovered that there was a loophole in the computer programme of his Bitcoin ATMs, namely that the ATMs would dispense cash to the Bitcoin seller even upon receiving an unconfirmed Bitcoin address (or link).  PW1 explained that the seller took advantage of the time gap which the "miners" would take to confirm the Bitcoin address by cancelling the transaction before it was confirmed.  The seller also used a function called RBF (Replaced By Fee)  in his/her Bitcoin wallet in order to cancel the transaction during its unconfirmed state[2].

11.  The total loss in cash suffered by HK Bitcoin was $176,000.

Charge 2

12.  Mr. Law (PW2)  is the proprietor of Nitroswap Limited ("Nitroswap").  It engaged in the business of trading Bitcoins; it placed Bitcoin ATMs at various locations including Yuen Long, Tuen Mun, Sham Shui Po, Tsim Sha Tsui and Mongkok.

13.  At 2015 hours on 10 August 2020, someone purportedly sold 0.200226 Bitcoin to Nitroswap at $17,000 via its Bitcoin ATM at Tuen Mun.  The ATM dispensed $6,600 cash only but the seller did not pick up the money.  PW2 checked the CCTV footage and discovered that a passer-by had picked up the money about 18 hours later.  PW2 said Nitroswap did not receive any Bitcoin for this transaction.  This is Incident 2-1.

14.  At 2019 hours on 10 August 2020, someone purportedly sold 0.11706 Bitcoin to Nitroswap at $10,000 via its Bitcoin ATM at Tuen Mun.  The ATM dispensed $10,000 cash but the seller did not pick up the money.  According to PW2, the same passer-by had picked up the money together with the $6,600 in Incident 2-1.  PW2 said Nitroswap did not receive any Bitcoin for this transaction.  This is Incident 2-2.

15.  At 2100 hours on 10 August 2020, someone purportedly sold 0.209088 Bitcoin to Nitroswap at $18,000 via its Bitcoin ATM at Yuen Long.  The ATM dispensed $8,500 cash only and the seller took it.  PW2 later received an SMS from the seller claiming that the cash from the ATM came out short.  PW2 refunded that person in Bitcoin equivalent to $9,500.  PW2 said Nitroswap did not receive any Bitcoin for this transaction.  This is Incident 2-3.

16.  The total loss suffered by Nitroswap was $25,100 in cash and Bitcoin equivalent to $9,500.

Allegations against D1 and D2

17.  By relying on circumstantial evidence such as CCTV footage of various locations, contents of WeChat, WhatsApp and Telegram messages, clothing items seized as well as D1's hotel registration record, the prosecution alleges that D1 and D2 had conspired together and with other persons to steal cash from the Bitcoin ATMs in the manners described above by cancelling the Bitcoin transactions after receiving cash from the ATMs.

The Defence Case

18.  D1 elected not to give evidence but called a defence witness Mr. Zhou (DW1).

19.  D2 elected not to give evidence or call any defence witness.

20.  Both D1 and D2 have the right to remain silent; I drew no adverse inference against them in this regard.

Assessment and Analysis of Evidence

21. The burden of proof is on the prosecution to prove each element of each offence beyond reasonable doubt. Regarding the element of dishonesty, I have directed myself according to the Ghosh principles.

22. I have reminded myself that D2's admissions can only be used against himself only; not D1 or any other persons.

23. In respect of identifying someone based on video footage or still photographs, the Court of Appeal in HKSAR v Tagao Saudee Abad CACC 366/2015 (24 May 2017)  held "a tribunal of fact may perform its own identification exercise and reach a view on whether the defendant is the person in the video recording or photo is now settled law[3]." In HKSAR v Riasat-Ali [2019] HKCA 312，the Court of Appeal re-affirmed the principle in Tagao Saudee Abad[4].

24. I have also directed myself according to the principles in Turnbull as well as Dodson & Williams [1984] 1 WLR 971. I am aware of the dangers in relying on identification evidence alone and making identification based solely on video footage and/or still photographs.

The Bitcoin ATM scam

25. With the CCTV footage and the transaction records, each incident of obtaining cash (actually taken by the ATM user or not)  is undeniable. As a juror, I believe the evidence of PW1 and PW2. I accept that they (or their companies)  did not receive the appropriate amount of Bitcoin in each purported Bitcoin sale transaction.

26. To put it in layman's terms, according to the evidence of Dr. Chow (PW8), who is an expert on cryptocurrency (including Bitcoin)  and digital forensics, in all of the above Bitcoin sale transactions (except Incident 2-3), the purported seller used the RBF method to invalidate the Bitcoin address (or link)  received by HK Bitcoin or Nitroswap; and then sent the same amount of Bitcoin back to his/her own wallet by creating a 2^nd Bitcoin address (or link)  which carried a much higher "mining fee" than the initial one.

27. I am aware of the comments made by D1's counsel Ms. Herbert on PW8's opinion, namely the mining fee of the 1^st transaction not set at the lowest possible value; the time gap between the 1^st and 2^nd transactions; and the possibility of someone's wallet being hacked[5]. I am also aware that in Incident 2-3, the RBF function was not enabled and the Bitcoin did not go back to the purported seller's wallet[6].

28. Notwithstanding Ms. Herbert's comments, the undeniable facts remain that in all the relevant Bitcoin ATM transactions, cash was dispensed from the ATMs and no Bitcoin was ever received by HK Bitcoin or Nitroswap. Except in Incident 2-3, the Bitcoin in each transaction went back to the purported seller's wallet. As an owner of Bitcoin ATMs, PW1's evidence was that in August 2020, by setting a very low mining fee and enabling the RBF function was the only way to cheat the ATMs. PW1 explained that it was his commercial decision then to allow his ATMs to dispense cash before a Bitcoin transaction was confirmed (i.e. when it was still in the "mempool")  so that the customers did not need to wait for a long time. After being cheated, PW1 decided to make the customers wait if his ATMs detect an RBF flag in the Bitcoin address sent by the seller. He said he rewrote the programme himself.

29. As a juror, I accept the evidence of PW1 and PW8 without reservation. The modus operandi of stealing cash from Bitcoin ATMs as well as the technicalities involved are clearly established. I find that all such purported Bitcoin sale transactions were a calculated scam with advance planning to steal cash from Bitcoin ATMs.

Identity of MC

30. According to the Royal Garden's record, the phone number registered under D1's booking was 5223 5454[7]. Mr. Chan (PW3), Director of Rooms of the Royal Garden, said in his evidence that the phone number could have been given to the hotel when the booking was made[8] or by the guest upon check-in.

31. Amongst other things, a China Mobile SIM card of phone number 5223 5454 was found and seized by the Police from Room 534 of the Royal Garden on 18 August 2020[9]. The room was registered under D1's name[10]. According to PW3, D1 checked into the hotel on 29 January 2020 and moved into Room 534 on 21 May 2020.

32. D2 communicated with MC (phone number 5223 5454)  via WhatsApp[11]. D2 also communicated with MC (ID: stevenko1229)  via WeChat[12]. DW1 (Mr. Zhou)  confirmed that he was texting D1 in Attachment 12, Exhibit P80B. DW1 agreed that the profile picture of D1 (a male holding a shot gun)  as shown in Attachment 12 of Exhibit P80B is very similar to the profile picture of MC as shown in Photo 267 of Exhibit P79.

33. The screenshots of certain text messages between DW1 and D1 (namely Attachments 12 and 47 of Exhibit P80B)  were sent to D2 by MC via WhatsApp (see Entries 150 to 151 and 494 to 520, Exhibit P80A). MC told D2 that he was chatting with Alex (who clearly was DW1).

34. Based on the above evidence, the prosecution has proved beyond reasonable doubt that MC is D1.

Clothing items worn by the same person

35. Still photographs of CCTV footage show that an Asian male often wore a pair of blue and white shoes, ripped jeans[13], a White Sox cap[14], blue sleeveless "Supreme" T-shirt and ripped denim shorts[15]. He was also seen carrying a black rucksack with rhombus pattern[16]. Some of these items were found in D1's room.

Identity of MK

36. D2 communicated with MK (username: @michael_chang1229)  via Telegram[17]. Around 9:00 p.m. on 12 August 2020, D2 texted MK asking him to deposit $2,200 in an account of Standard Chartered Bank[18] ("SCB"). Around 9:40 in the same evening, an Asian male wearing a rose gold/black watch, ripped denim shorts and blue and white shoes went to an SCB's ATM at Tsim Sha Tsui East. After using it, the Asian male took a picture of the deposit slip. D2 then received from MK a photo of an SCB deposit slip for $2,200 dated 2146 hours, 12 August 2020[19].

37. Based on the CCTV footage of SCB[20], I am satisfied beyond reasonable doubt that MK is D1[21]. Though not found in D1's hotel room, the blue and white shoes really gave him away.

Proof of the conspiracy

38. Prosecuting counsel Mr. Sujanani has helpfully summarized the circumstantial evidence which, when all added up, he submits can prove that D1, D2 and other persons were acting in concert to carry out the plan of stealing cash from Bitcoin ATMs. I need not repeat the details here; they are neatly and logically presented in Annex A of his written submissions[22].

39. In gist, MC would text D2. They would meet up at the Royal Garden. They would then head off to the Bitcoin ATMs. D2 or someone supervised by D2 would operate the ATMs and pick up the cash. In the process, D2 would send QR codes generated by the respective ATMs to MK or MC.

40. As early as the end of July 2020, MC and D2 clearly exchanged text messages via WhatsApp and WeChat about the RBF manoeuvre and fake Bitcoin transactions (see Annex G of Mr. Sujanani's written submissions). I have not a single doubt that both MC and D2 had knowledge of how the scam worked.

Too much of a coincidence

41. In Incident 1-1, someone wearing ripped jeans, blue and white shoes and a pink hoodie operated the ATM. In Incident 1-2, D2 was wearing the same pink hoodie. An Asian male was wearing a blue sleeveless "Supreme" T-shirt, a White Sox cap, ripped jeans and blue and white shoes. In Incident 1-3, the South Asian male who operated the ATM wore a White Sox cap and carried a black rucksack similar to the one found in D1's hotel room[23] (Exhibit P24). In Incident 1-4, the South Asian male who operated the ATM wore a White Sox cap and carried a black rucksack similar to Exhibit P24. Around 7:30 p.m. on 13 August 2020, at the Royal Garden, D1 was seen wearing a blue sleeveless "Supreme" T-shirt.

Putting everything together

42. Bokhary PJ in HKSAR v Kissel (2010)  13 HKCFAR 27 held:

"The prosecution can of course rely on the combined strength of all the material elements of a circumstantial case. For the purposes of making that point, it is common to liken each piece of circumstantial evidence to one strand of a rope. Unlike a chain only as strong as its weakest link, a rope takes its strength from all of its strands woven together. Chief Baron Pollock, as one sees in The Queen v Exall (1866)  4 F & F 922 at p.929, drew the contrast between a rope and a chain when directing the jury in that case. That is by far the most famous, but by no means the only, form of imagery available to make the point that the strength of a circumstantial case comes from all of its components taken together…"[24]

There is also the famous analogy of "strand and cord" from The Queen v Exall"One strand of the cord might be insufficient to sustain the weight, but three stranded together may be quite of sufficient strength. Thus, it may be in circumstantial evidence - there may be a combination of circumstances, no one of which would raise a reasonable conviction, or more than a mere suspicion; but the whole, taken together, may create a strong conclusion of guilt, that is, with as much certainty as human affairs can require or admit of."

43. At first glance, the prosecution's evidence in this case may seem piecemeal. After viewing and considering it in a systematic way, as a juror, I am sure that MC and MK are D1 and that D1 and D2 were acting in concert to steal cash from Bitcoin ATMs by using the RBF method. I made such findings bearing in mind D2's admissions in his 4 video recorded interviews[25].

44. The prosecution has proved each element of each offence against each defendant beyond reasonable doubt. I find both D1 and D2 guilty of Charges 1 and 2.