SECRETARY FOR JUSTICE v. LI MAN WAI

HCMA 723/2002

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

MAGISTRACY APPEAL NO. 723 OF 2002

(ON APPEAL FROM ESCC 526/2002)

_______________

________________

_______________

J U D G M E N T

_______________

1. This is an appeal by way of case stated, pursuant to section 105 of the Magistrates Ordinance, Cap. 227. The Respondent was acquitted after trial of one charge of Obtaining Access to a Computer, contrary to section 161(1)(c) of the Crimes Ordinance, Cap. 200. The particulars were that the Respondent had obtained access to a computer, namely, the Inland Revenue Department (IRD) on-line system, with a view to dishonest gain for himself or another.

2. Section 161 of the Crimes Ordinance, Cap. 200 provides as follows:

"(1) Any person who obtains access to a computer-

(a) with intent to commit an offence;

(b) with a dishonest intent to deceive;

(c) with a view to dishonest gain for himself or another; or

(d) with a dishonest intent to cause loss to another,

whether on the same occasion as he obtains such access or on any future occasion, commits an offence and is liable on conviction upon indictment to imprisonment for 5 years.

(2) For the purposes of subsection (1) "gain" and "loss" are to be construed as extending not only to gain or loss in money or other property, but as extending to any such gain or loss whether temporary or permanent; and-

(a) "gain" includes a gain by keeping what one has, as well as a gain by getting what one has not; and

(b) "loss" includes a loss by not getting what one might get, as well as a loss by parting with what one has."

The facts

3. The facts of the case were not disputed at trial. The Respondent had been employed as an Assistant Assessor in the IRD since 1996. On 26 October 1996, he signed an Affirmation of Secrecy under section 4(2) of the Inland Revenue Ordinance, Cap. 112 which required him to preserve secrecy. The Respondent, as an Assessor, was given the means of obtaining access to the IRD's computer system and was assigned a User Identity number and a password on 28 October 1996.

4. In August 1999, December 1999 and again in April 2000, the Respondent was reminded, through routine IRD office procedures, to observe official secrecy and to perform on-line enquiries or updating only when discharging his official duties.

5. On 11 July 2000, the Respondent used his User Identity number and password to gain access to the computer system in order to find out the identity card number and address of the female complainant, who was a colleague of his and also a taxpayer. It was not disputed that the Respondent had no responsibility for the complainant's tax affairs, nor was it disputed that he obtained access to the data without her approval, or approval given by the IRD.

6. The Respondent used the information he obtained to fax a completed membership application form, in the name of the complainant, to the World Wide Fund for Nature ("WWF"). That application form included the name, identity card number and address of the complainant. The Respondent used his own name and Visa credit card number to pay the fee the complainant would otherwise have had to pay for the membership application to be accepted. The complainant had never asked the Respondent to make such an application on her behalf; it was made without her authority or knowledge.

Magistrate's Finding

7. The Magistrate found as a fact that the Respondent had gained access to the computer system of the IRD which was a serious breach of procedure. However she concluded eventually that no dishonesty was involved and this was not in fact a criminal matter at all.

8. In referring to her verdict, as set out in the case stated, she said:

"I found:

1) that the Respondent did obtain access to the computer system of the Inland Revenue Department;

2) this was a serious breach. However there was no dishonest intent or gain in this matter. I was satisfied that there was no dishonesty. Accordingly, I dismissed the charge and acquitted the Respondent;

3) I found that it was not a criminal matter as there was no evidence of dishonest intent or dishonest gain;

4) the Respondent had been dealt with by the Inland Revenue Department for the breach. He was still employed by the Inland Revenue Department."

Question Requiring Answer

9. The question that this Court is required to answer is, as stated by the Magistrate:

"DID I ERR IN LAW in finding that it was a mere unauthorized access to the IRD computer, and it could not be regarded as dishonest when applying the principle in R v Ghosh."

10. There appears to be little doubt that the Respondent in obtaining such information obtained a gain in terms of section 161, as "gain" is not confined to a monetary or proprietary benefit under that section.

11. In the HKSAR v. Tsun Shui-lun [1999] 2 HKC 547, Chan CJHC had to consider the question of gain in a comparable case. He stated at page 555:

"... it is clear, in my view, that the subject matter of a gain as defined in s. 161 would include information which the person obtaining access to the computer did not have before the access. It is clear that the section is intended to cover the acquisition of information which is in itself (i) neither a monetary nor a proprietary benefit; but is (ii) something that is capable of retaining at least temporarily if not permanently and (iii) something that is capable of keeping when one has already got it and capable of getting when one has not. What is anticipated by 'gain' in s. 161(1)(c) is a benefit or an advantage. However, I do not agree that it must be something which can be utilized or used. That is not expressed nor can it be implied in the section.

For these reasons, I take the view that s. 161(1)(c), when it is construed in the context of computer crime and the rest of this section, permits the construction of the word 'gain' to include obtaining information which one did not have prior to his access to a computer. The information may be transient if it is read on the screen or permanent if it is printed out or copied onto another diskette."

12. In the instant case, the Respondent gained personal information about the complainant which he did not have previously and acquired it by obtaining access to the IRD computer system which he was authorized to use only in accordance with his duties. The element of "gain" was established and that was acknowledged by the Magistrate. The question that needed to be decided was whether that was dishonest gain in terms of the Ghosh test.

13. The test as set out in R v Ghosh [1982] 1QB 1053 and 1054 has two limbs:

"a jury must first of all decide whether according to the ordinary standards of reasonable and honest people what was done was dishonest. If it was not dishonest by those standards, that is the end of the matter and the prosecution fails."

"If it was dishonest by those standards, then the jury must consider whether the defendant himself must have realized that what he was doing was by those standards dishonest. In most cases, where the actions are obviously dishonest by ordinary standards, there will be no doubt about it. It will be obvious that the defendant himself knew that he was acting dishonestly. It is dishonest for a defendant to act in a way which he knows ordinary people consider to be dishonest, even if he asserts or genuinely believes that he is morally justified in acting as he did."

Cases which might be described as borderline will depend upon the view taken by the tribunal of fact as to whether the defendant may have believed what he did was in accordance with the ordinary man's idea of honesty.

14. The Appellant submitted that for a person in a position of trust to use rights of access to a secure computer system to extract, without consent, protected information on a taxpayer in order to send that information to a third party not entitled to it, is to act with a view to a gain which was dishonest by the standards of reasonable and honest people. It was submitted further that this must have been apparent to the Respondent by virtue of his post and his knowledge of the secrecy requirement.

15. Certain parallels can be drawn between this case and Tsun Shui-lun. In each case, the defendant had a password which enabled him to gain access to a secure computer system for a limited purpose. In each case any ordinary reasonable person would realize the importance of privacy to the person affected by the computer information and that the person would not agree to the unauthorized release of personal data to a third party. (Tsun Shui-lun concerned the release, by a hospital employee, of sensitive medical records of a patient to the press.) In each case, it would be clear to any ordinary or reasonable person working in those institutions, that it was important to maintain confidentiality, whether of the patient in a hospital, or, as here, of the taxpayer.

16. In both Tsun Shui-lun and this case, the person in a position of trust used the password to gain confidential information, used that information for his own purposes and passed it to third parties without obtaining the authority of the person concerned, or the owner of the computer, and that was done for the purpose of furthering a personal scheme. The Appellant submitted that a gain in those circumstances must as a matter of law be treated as dishonest according to the ordinary standards of reasonable and honest people because it was conduct which pointed directly at a lack of honesty.

17. It was submitted that the Magistrate in considering whether the second limb at Ghosh was established, had to give full weight to the Respondent's position as an IRD employee; to his signing of the Affirmation of Secrecy, and to the fact he had been reminded, regularly, of his obligation to use data in the computer only in discharging his official duties.

Respondent's Case

18. The Respondent argued that it was for a jury or the Magistrate to decide whether an accused was dishonest and pointed out that the Magistrate had, after taking into account all circumstances, found the Respondent was not dishonest. Counsel submitted that the jury or Magistrate would have to apply the current standards of ordinary decent people and that it was not for judges to apply their own standards.

19. As the sole arbiter of fact the Magistrate was entitled to find, as she did, that no moral obloquy attached to the conduct of the Respondent in the criminal case. That was a determination of fact for her to make which was not open to review on a case stated. The Respondent referred to the case of R v. Feely [1973] QB 580 where an example was given of conduct that was not criminal as no moral obloquy attached to it. The Respondent also referred to Tsun Shui-lun where, at page 4554C-E, Chan CJHC gave examples of instances where a person might be found to have contravened section 161 if he acted dishonestly in obtaining unauthorized access to a computer. Such examples were:

(1) a businessman trying to obtain information about competitors in order to gain an advantage over them;

(2) a disgruntled employee trying to ruin his employer's business by revealing his trade secrets to others;

(3) an ex-employee trying to obtain a list of his former employer's customers with a view to soliciting business from them;

(4) a dissatisfied bank officer who wants to erase the bank's records to cause confusion or irritate customers.

The Respondent submitted that such examples were far removed from the facts of the present case.

20. In this case the Respondent had no underlying illegal purpose or desire for financial gain and his motives in obtaining this information were benign. That he used his own Visa card number and name on the application form was advanced as an indication that he had no dishonest intent as the inclusion of such information would make him readily traceable.

Conclusion

21. Under the first limb of the Ghosh test it is necessary to decide whether ordinary, reasonable and honest people would regard the Respondent's behaviour as dishonest. Various factors have to be considered before that question can be answered.

22. The Respondent was well aware of the need for confidentiality in IRD work and must have known that the purpose of the password was to ensure client/department privacy.

23. He must have realized that ordinary reasonable people would expect that personal information, including addresses and ID card numbers, which they, of necessity, had to impart to the IRD, would not be made known to other individuals or released to the general public without their express permission. The importance of secrecy in respect of a person's ID card number in particular could not have escaped the Respondent.

24. As an IRD employee he must have been aware of the need to maintain confidentiality between tax payers and the public.

25. The Respondent's access to the computer was for the express purpose of obtaining information to which he was not otherwise privy and which he used without the knowledge or consent of the complainant/colleague.

26. It seems to have been of importance in the Magistrate's decision that the use to which the information was applied was "friendly" or benevolent but that does not dispel the dishonesty in taking and using the information.

27. Whether the Respondent used the information obtained to enroll the complainant as a member of a subversive sect, or a charitable group is irrelevant. The dishonesty must lie in extracting the information intending to use it without the knowledge or consent of the complainant, rather than whether the motivation in making use of it was benevolent or not. The purpose of obtaining the information, or the defendant's motivation in doing so are matters relevant to mitigation.

28. The fact that the Respondent did not, as did the accused in Tsun Shui-lun, remove his own identifying material from the application form, does not negative the dishonesty, linked to the gain.

29. For these reasons I consider that an ordinary, reasonable person would conclude the Respondent's conduct was dishonest.

30. The second, subjective, limb of the Ghosh test is whether the Respondent himself knew or must have realized what he did was dishonest in the eyes of ordinary, reasonable and honest people. The circumstances of his employment, his age and his level of education were such that he must have known that his access was unauthorized and that his obtaining and using of such important information as an ID number and an address was dishonest, albeit it was used to obtain membership of an organization that might be regarded as innocuous.

31. It is for the tribunal of fact to decide whether the accused was dishonest and an appellate court does not lightly interfere with decisions of fact, but it is also the case that an erroneous decision by such tribunal may be reversed if the conclusions drawn from the determination of the facts are unreasonable.

32. Here the Magistrate appears to have concentrated too much on what she considered the benign aim of the Respondent in enrolling the complainant as a member of the WWF and ignored the dishonesty inherent in the Respondent's obtaining, using and transmitting to a third party confidential information about the complainant.

33. I am satisfied that there was dishonesty established according to both limbs of the Ghosh test and am satisfied that the question posed by the Magistrate must be answered in the affirmative.

34. Having answered affirmatively the question posed by the Magistrate it remains for this court to decide how to deal with the Respondent. The court's powers, which are wide-ranging, are set out in s. 119(d) of the Magistrates Ordinance, Cap. 227.

35. Counsel for the Respondent submitted that in the event of the court answering the question in the affirmative, the fairest way of disposing of the matter would be to make no order at all as to do otherwise would give the Respondent the impression that he was put in jeopardy a second time before the court.

36. The Appellant contends "that in a just society, the conviction of the guilty is in the public interest, as is the acquittal of the innocent" (Secretary for Justice v. Lam Tat-ming and Another [2000] 2 HKLRD 431 at page 441). Although the Court of Appeal declined to give sentencing guidelines in that case it indicated that such offences were not minor ones by saying "unless there are most unusual circumstances a non-custodial sentence would be inappropriate for offences under s. 161". It would be inappropriate to refrain from making any order as it is in the interest of the public at large and in the interest of the Appellant and Respondent that some finality and certainty be achieved in this case.

Ruling

Remarks: