HKSAR v. STAROSTIN ALEKSEI AND OTHERS

DCCC 602/2016

IN THE DISTRICT COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

CRIMINAL CASE NO 602 OF 2016

----------------------

----------------------

---------------------

Reasons for Verdict

---------------------

Charge

1.  The three defendants are jointly charged with one count of attempted theft, contrary to section 9 of the Theft Ordinance, Chapter 210 and section 159G of the Crimes Ordinance, Chapter 200, Laws of Hong Kong.

2.  The particulars of the charge are:- the three defendants, on the 17th day of February 2016, at HSBC, Ground Floor, Phase II, Tuen Mun Town Plaza, No 3 Tuen Lung Street, Tuen Mun, New Territories, in Hong Kong, attempted to steal a sum of money, property belonging to the Hong Kong and Shanghai Banking Corporation Limited.

3.  After hearing the undisputed evidence, this court came to the view that the above charge contained a problem.  It was about the charge location.  The present charge alleges that all three defendants were physically inside the bank when they attempted to steal, not that they were in Hong Kong, attempting to steal from the ATM machine which was inside the bank.  However, the undisputed evidence, as will be seen later, is that there was only one person who entered the bank and tampered with the ATM while the other related persons, if any, were all along physically outside the bank in the vicinity.  The prosecution’s attention was drawn to this charge problem but they insisted on this existing version, saying that the concept of joint enterprise encompassed this situation.  While this court does not agree with the prosecution’s proposition and was at some point about to amend, out of its own volition, the charge so that it is read as “Three defendants in Hong Kong attempted to steal from the ATM machine at the bank,” this idea never materialised.  As the case went on, the prosecution evidence was simply not sufficient to support the charge however drafted.

The Prosecution case

4.  The prosecution case, when opened, was this.  D1 entered the bank, tampered with the ATM machine while D2 and D4 were outside waiting to assist D1 whenever necessary.  D1 had with him a laptop computer which, if plugged into the ATM, can cause the cash inside to dispense.  The prosecution was trying to prove this laptop capability by way of forensic evidence.

5.  The prosecution case went on, ie, while tampering with the ATM, D1 triggered a remote security alarm which necessitated the calling of policemen to the scene.  About some 10 minutes later, police arrived.  D1 and D2 were stopped and searched on the same street, about 60 metres away from the bank.  A key which was capable of opening the casing or housing of all ATMs was found on the ground, next to the foot of D1.

6.  D1 and D2 were arrested. D2 was escorted back to his hotel room where his phone was seized. Tracing the source of the messages therein, D4’s identity was revealed.  D4 was located and was arrested at his home.  D4’s phone was also seized and produced as exhibit.  Messages of the above two phones were retrieved by experts.  Forensic evidence again, which, if admitted into evidence, are very damaging to D2 and D4 as they tend to prove that they each were involved in an obvious scheme to arrange people from Russia to try to steal from some ATM machines.

7.  It should be obvious by now that the prosecution relied heavily on forensic evidence in this case, ie, D1’s laptop computer ATM cash dispensing capability and the incriminating web chat messages inside D2 and D4 hand phones.  In fact, most of the trial time was devoted to these forensic issues.

Defence case

8.  On the other hand, the defence case, simply put, is this.  The three defendants were just tourists. D4, a Hong Kong resident, was showing D1 and D2 around in Hong Kong and all of them turned out to be there in Tuen Mun area at that early hour, ie, 2-something o’clock in the morning.  They were not there to steal.  They were there for sight-seeing. All three defendants elected not to give evidence, nor did they call any witness in the case.  However, the tourism allegations were what they each explained to the police in the respective cautioned interviews.  Each defence counsel agreed to have his client’s interviews admitted straight into evidence for me to consider.  But at the same time, they put the prosecution to strict proof of other areas of this case, especially the very important forensic evidence.

Forensic evidence

9.  As said, very important forensic evidence is involved in this case.  One, D1’s laptop computer cash dispensing capability; two, the damaging web chat messages in the hand phones of D2 (allegedly only because the phone ownership is challenged) and D4 (D4 has no challenge to ownership).

10.  This court has already canvassed admissibility issues and rejected both forensic evidence.  They were not accepted into the evidence, full reasons have been provided verbally at the time and it is desirable now to state the gist of it.  Alternative procedure was adopted to ascertain their admissibility.

11.  In relation to the laptop cash dispensing capability, “the expert”, PW13’s, evidence is this.  He installed the target software which is to be tested into a computer.  He connected it to the computer through some wires to a similar ATM machine, an ATM machine of the same model as the one being tampered to test whether the software worked on the ATM.  The result was this; it worked.  The software caused the ATM to dispense cash.  So the effect of his evidence is this.  If D1 managed to connect his laptop computer to the tampered ATM, D1 could have drawn cash from it.

12.  However, this test result was problematic and was rejected for two reasons; one is the unidentified source of the target software and the other being  PW13’s lack of expertise.  He said that he never connected D1’s laptop computer straight to the ATM to test.  He instead received a USB stick from a colleague, PW11, he believed (hearsay or opinion) that PW11 had probably downloaded the relevant software from D1’s laptop computer onto the USB stick.  On this note though, PW11 never testified about it.  PW11 never said that he gave any USB stick to PW13.  So the source of the tested software is a mystery.  Did the target software really come from D1’s laptop computer or from anywhere else?  The so-called chain is broken.

13.  Another question is this.  Even assuming that PW13’s opinion and belief is true, that in fact the USB stick actually contained what was downloaded by PW11 from D1’s laptop computer, whether the downloading was proper at all?

14.  The prosecution accepts that PW11, the downloader, is not an expert.  Perhaps he does not have to be so at all because downloading is simple and is akin to simple calculation.  But was he not required to testify at least that his downloading process was smooth and he encountered no problem, the hardware and software he used for downloading seemed to work properly and in any event, he checked the result, ie, he checked if the right target software was there alone in the USB stick after his job?  Even now, these questions were never asked, no answers were given.  He simply never mentioned downloading anything into a USB stick at all, nor the way he did it.

15.  Simply put, PW13’s test conclusion as to D1’s laptop computer cash dispensing capability began with the USB stick.  Whether the stick contained the right test target software is not known and the result and conclusion should not be admitted into evidence.  That was my order.

16.  Moreover, when it comes to PW13’s “expertise”, he said in open court that he is not an expert.  Since the prosecution all along relied on him as an expert, his testimony served to end the admissibility issue, in favour of the defence.  His cash dispensing conclusion was rejected on this ground alone.

17.  We shall now turn to another piece of forensic evidence, ie, the hand phone WeChat messages.  In a word, there are equally dubious.  This time, the problem is not at the source but at the end, the final printing part.

18.  It was the prosecution’s proposal to rely on these messages in printout form as truth of the content. The printout content was talking about stealing from ATM machine, how and by whom, keys are procured to open the casing or housing of the ATM machine.

19.  The printouts are obviously computer records and the prosecution is relying on section 22A of the Evidence Ordinance to introduce them into evidence.  A certificate signed by a responsible person, PW16, Mr Philip Fung, was produced in an attempt to satisfy the section 22A conditions.  However, in the course of his evidence, it became clear that he was not in charge of the whole process.  His job stopped after making the disc, the CD-ROM.  The final printing job was done by some other policeman who has never testified how he himself did the printing.

20.  Suffice to say for now, even assuming that the early stages, seizure, handling, downloading and the disc burned were all proper, the final part (printing) is missing.  Printing necessarily involved some printing software and hardware.  How could this court be sure that the printing was reliable?  Mr Fung’s section 22A certificate does not cover this part.  At best, Mr Fung’s certificate only certifies the period of his own work.  Unless the final printing policeman comes to court to testify to the proper functioning of the printer and/or the computer and he had checked with his eyes the content of the documents on the monitor against the content of the printout, the printout should not be admitted into evidence at all.  The prosecution did not produce the disc either.  So by now, at the end of the trial, nothing could be done.

21.  It has to be made clear that only the printouts were not admitted because the prosecution’s fallback situation is this.  The human memory of the phone messages should still be admitted to prove the state of mind and the knowledge of D2 and D4, the owners of the phones, of the messages, despite the fact that the content is not true, the messages did not mean what they meant, they might be jokes and they might be meaningless.  The case of Lau Shing Chung Simon [2015] 18 HKCFAR was referred to support this proposition. 

22.  There were a policeman and a Russian interpreter, who had testified to the court that they now still remember the content of the messages on the screen when the phone was turned on in front of them.  Interpreter scrolled down to some thousands of text messages to look and they also listened to the audio messages too.  The interpreter accurately translated the same in English to a nearby English interpreter who simultaneously translated in Chinese to the policeman to hear it.

23.  Given the huge amount of messages involved, this court doubts how much both witnesses can reliably remember unaided now, one year after, at the trial.  The weight to be attached to their human recollection is minimal and the prosecution’s theory to rely on them to prove that D2 and D4 knew some ongoing issues of ATM, meaning Automatic Teller Machine, and not AT & T, not M & M activities does not take the prosecution case any further.

Remaining evidence against D1

24.  The ATM was not just tampered once, but was tampered twice, one being the night in question, the other being the previous night.  Comparing the features, the colour and the apparent make of the garments that D1 was both wearing and having in his rucksack when he was stopped, against the bank CCTV images, and considering the undisputed evidence that a key, albeit apparently a small simple key, similar to an average key to open a work desk drawer, capable of opening the casing or housing of an ATM machine, which was found on the ground near D1’s foot when he was stopped, the inference is that it is highly likely though this court cannot be sure that the tamperer for the two nights was in fact D1.

25.  On assumption that D1 was the tamperer for two nights, this court asks what exactly he was trying to do.  Was he trying to steal?  And if so, was he trying to steal the cash?  Or as suggested by D4's counsel, he was trying to steal data from the machine, or he was just a troublemaker in pursuit of vandalism.

26.  Not assisted by the otherwise forensic evidence, ie, his laptop computer, if connected to ATMs, can bring cash flow, this court is simply left in doubt as to his purpose of tampering.

27.  Also, why did he leave the ATM machine on both nights after some brief tampering?  In the first night, no alarm was triggered at all.  In the second night, although the remote alarm at some distant security centre was triggered, no on-site alarm was activated. So why he kept leaving the ATM and not staying to finish whatever he was attempting to do?

28.  Even assuming that it was the cash in the ATM machine that he was up to, this court is not sure if he had “...actually tried to commit the act (stealing ATM cash) in question or whether he had only got ready or put himself in a position or equate himself to do so” – Archbold Hong Kong 2017 at Chapter 36, Paragraph 86.

29.  In conclusion, it is highly likely that it was D1 who tampered the ATM in question but his ultimate purpose cannot be said for certain.  Assuming that he was minded to steal the cash from the ATM machine, it remained doubtful he was already embarked on some acts more than merely preparatory to the act of stealing.  A lot more may remain to be done.  Of course, it appears absurd that some male tourists appear in a group on a street in Tuen Mun area at the early hours of the day instead of staying in a pub in Tsim Sha Tsui, but in the end, given the limited strength of the prosecution’s evidence remaining, this court could not reject totally D1’s explanation, in his two cautioned interviews, that he was simply a tourist.

Remaining evidence against D2

30.  As it is not certain that D1 was attempting to steal, the fact that D2 was in company of D1 was neither here nor there.  They could be together for any legitimate or tourism purpose. Nothing suspicious was found in D2's possession except the phone that was later seized in his hotel room, which he provided a PIN to the police to cause it to turn on.  On this note, the police was not cross-examined at all about the source of the PIN.  As a result, this court believes and accepts that the phone, P33, actually belonged to D2. This is because D2 could not have provided the correct PIN to the police unless it was his phone.

31.  There are some verbal recollections of the WeChat messages in the phone in evidence.  As I said, given the voluminous nature of the messages, these verbalized recollections cannot be relied on fully.  Apart from the memory loss problem, there should also have been some intellectual personal comprehension exercise involved.  Anyhow, questions like who sent or received those messages, intentionally or inadvertently, whether the messages meant what they purport to mean, remain unanswered.  At best, the inference is this:  D2 must have read those messages and he therefore knew that some ATM activities was going on.  However, this knowledge does not make him part of the scheme, whatever it was.

32.  In the end, while the court maintains that there is a case to answer against D2, it is certainly not enough to convict him.

Remaining evidence against D4

33.  D4 was arrested at his home.  The prosecution draws him to the joint enterprise, relying on the messages in his hand phone and also on his answers in three cautioned interviews where he admitted he knew the other defendants were trying to get a key to access an ATM, but he told the police at the same time that he simply refuses to be part of it because he knew it was illegal.  He just took them to sightseeing in the night in question.  He somehow lost them and he therefore went home by himself.  Two weeks later, police came to his house to find him.

34.  Again, being in the company with other defendants at the scene is neither here nor there unless it was proved that the other defendants were obviously committing crimes of this sort.

35.  Unlike D2, the prosecution does not need to rely wholly on the verbal recollection of the Russian interpreter to impute illegal ATM activities knowledge onto D4 because D4 simply admitted knowing it in his undisputed cautioned interviews.  However, D4 did not say he knew all.  He said he knew of the attempt to access ATM machines, full stop.

36.  Dishonestly accessing computer or ATM is a crime.  In fact, this offence was what D4 was cautioned when arrested.  However, accessing ATM is different from and does not necessarily point to stealing cash from it.  Other possibilities like vandalism or stealing data instead are alive.  It is therefore hard for the prosecution to rely on D4's admission to infer his knowledge and agreement to take part in the alleged ultimate cash stealing plot.

37.  In view of the existing state of the prosecution’s evidence, it is equally difficult to reject entirely D4’s explanation that he was just a tour guide.

Conclusion

38.  D1 is acquitted of the charge.  D2 is acquitted of the charge and D4 is also acquitted of the charge.