HKSAR v. TSUN SHUI LUN - [1999] HKCFI 77; HCMA000723/1998, 15 January 1999

This is an appeal (against conviction and sentence) from the Magistrate's Court heard by the Chief Judge of the High Court, Hon. Patrick Chan.

The appellant was convicted after trial of obtaining access to a computer with a view to dishonest gain for himself, contrary to section 161(1)(c) of the Crimes Ordinance, Cap.200. He was sentenced to 6 months imprisonment. He now appeals against both conviction and sentence.

Background

In April 1998, the appellant was employed as a technical assistant by Dr Ooi who was a radiologist of the University of Hong Kong attached to the Radiology Department of the Queen Mary Hospital. The appellant's duties included making literature searches, arranging appointments for patients, liaising with other research assistants in the Hospital, and generally helping Dr Ooi in her research.

The Hospital's computer system had a Radiology Information System ("RIS") which contained some patients' medical records. In her research, Dr Ooi had access to the RIS. To prevent unauthorised access to these medical records, there was a security system in the computer. Access could only be gained to the RIS by the use of a password. Such password would be changed every now and then. Since the appellant was helping Dr Ooi, he too was given the password. But this was given only for the purpose of and to facilitate the discharge of his duties.

The Facts

At 8:30 am on 2 April 1998, the Secretary for Justice was admitted to the Queen Mary Hospital for urgent treatment. Dr Chu who attended to her decided that computerised X-ray tomographic scanning ("CT scan") was required for diagnosis. The Secretary for Justice was then sent to the Radiology Department at about noon for scanning. A report was then prepared by the Consultant Radiologist. Some time in the morning, during a conversation, Dr Ooi disclosed to the appellant that it was a very famous lady who required the CT scan. The appellant guessed that it might be the Secretary for Justice. Dr Ooi then indicated that this was confidential.

Between 3:30 pm and 6:00 pm, Dr Chu operated on the Secretary for Justice. The report of the CT scan had been input into the RIS.

At about the same time in the afternoon, the appellant made use of the password given to him by Dr Ooi and entered the RIS. He printed out a copy of the CT scan report. He took it home and showed it to his wife. After that, he threw it away.

On that day, the Government issued a Note to Editors of the local news media stating that the Secretary for Justice was admitted to hospital "for observation due to enterogastric disorder". This was reported on television in that evening and in the Ming Pao and Apple Daily newspapers on the following morning, 3 April.

Some time on 3 April, the appellant again entered the RIS using the password and printed out another copy of the CT scan report. He took the copy to see two of his friends, a Mr Cheung and a Mr Ho who were research assistants in another department and showed it to them. In the afternoon, the appellant faxed the copy report to the Ming Pao and Apply Daily. On the following day, the Ming Pao and the Apply Daily published a story about it with a copy of the CT scan report.

Investigations started in the Hospital concerning this leak in the days that followed. The appellant was arrested on 9 April after it was traced to Dr Ooi's password. Under caution, the appellant admitted in two video-recorded interviews that he had accessed the RIS on 2 and 3 April and obtained copies of the CT scan report and that he had anonymously faxed a copy to two newspapers on 3 April. He also said that the reason for his doing so was because he thought the public had the right to know the truth. During the interviews, he further said that he "began to regret because (he) felt that (he) shouldn't do what (he) had done" and that he hoped the Secretary for Justice would forgive his foolish behaviour.

Held:

The offence with which the appellant was charged and of which he was convicted is s.161(1)(c) of the Crimes Ordinance.

The gravamen of the offence with which the appellant was charged was his obtaining access to the Hospital's computer with a specific view in mind. The actus reus of the offence was the access to the Hospital's RIS and this admittedly took place on 3 April while he was in the Hospital. The prosecution did not rely on his making a printout from the computer or his transmission of a copy by fax to the newspapers. These of course came after his access to the computer and at a later stage. The printout and the fax were only evidence which might cast light on his state of mind at the time of his access to the computer. There was evidence (and this came on his own admission) that at the time of his access into the computer on 3 April, he had decided to print out a copy and to leak it to the press. That was the purpose of his access on the second occasion. He had in fact committed the actus reus of the offence by obtaining access to the computer on the previous day. But it could be argued that on that previous occasion, he was doing it out of curiosity and without a view to dishonest gain to himself.

The situation on 3 April is quite different. On this later occasion, he gained access to the computer for a specific purpose : to obtain information in the form of a printout of the CT scan report for the purpose of sending it to the newspapers. The question is whether that was with a view to dishonest gain. If it is, then it falls within s.161(1)(c). The fact that he did it because he thought "the public have the right to know the truth" or he wanted to reveal the Government's "lies" is merely his motive. For the purpose of a s.161 offence, there is or should be any difference between gaining access without authority and gaining access in excess of authority. The section makes no distinction between the two.
The Court was satisfied that any ordinary and reasonable person would have considered such conduct as not only discreditable, dishonourable or inappropriate, but also dishonest and reprehensible . It is not only conduct which people would dislike or detest but conduct which they would regard as wrong and totally unacceptable.

In the circumstances of the case, it is not difficult to draw the inference, which is the only reasonable inference, that the appellant knew and must have realised that it was dishonest conduct to have access into the computer, print out a copy and leak it to the press.

Conclusion

For these reasons, I take the view that the learned magistrate had come to the right conclusion. There was access into the computer by the appellant. He did it in excess of his authority. At the time he did so, he intended to obtain the confidential information in the computer for the purpose of and with a view to printing out a copy and leaking it to the press. That is a gain within the definition in section 161. It was dishonest conduct and he knew it was dishonest. There is no merit in the appeal against conviction and it must be dismissed.

Sentence: Community Service Order substituting 6-month of imprisonment

The appeal against sentence was allowed. The Court set aside the sentence of 6 months imprisonment and ordered that the appellant should serve 100 hours of community service within the next 12 months in accordance with the directions of the probation officer.

Coram : Hon Chan, CJHC in Court
Date of Hearing : 8 January 1999
Date of Judgment : 15 January 1999