Cybercrime
The Teacher’s Password
Case in Brief:
Chi Ming, a Form 3 student, has got hold of his teacher’s (Mr. Leung) intranet password by accident. What will Chi Ming do with the password?
Offences discussed
Q & A
What crime(s) has Chi Ming committed?
The possible offences are unauthorized access to the school’s intranet contrary to Section 27A of the Telecommunications Ordinance (Chapter 106), criminal damage contrary to Section 59(1A) and Section 60(1) of the Crimes Ordinance (Chapter 200) and dishonestly accessing a computer with intent to cause loss or gain contrary to Section 161(1)(c) of the Crimes Ordinance (Chapter 200).
If Chi Ming’s access to the school’s intranet using the teacher’s password was unauthorized, he would have committed an offence under Section 27A of the Telecommunications Ordinance (Chapter 106). The legal term for the offence is “unauthorized access to a computer by telecommunications”. The maximum penalty for this offence is a fine of $20,000.
When Chi Ming changed his mark on the school’s intranet, he committed the offence of criminal damage (“misuse of a computer” by altering data held in a computer) under Section 59(1A) and Section 60(1) of the Crimes Ordinance (Chapter 200). The offence carries a maximum sentence of 10 years imprisonment. The same applies to Chi Ming’s altering of the teacher’s profile on the school’s website.
Furthermore, by changing his mark on the school’s intranet (presumably giving himself a higher mark), he might have committed an offence under Section 161(1)(c) of the Crimes Ordinance (Chapter 200). The offence is called “access to a computer with criminal or dishonest intent”, with a view to dishonest gain for himself or another. The “gain” is the substituted higher mark which he has not earned. If convicted, Chi Ming might face a maximum sentence of 5 years imprisonment.
When Chi Ming accessed the school’s intranet the second time with intent to alter the marks of his two classmates (presumably giving them lower marks), he committed the offence of “access to a computer with criminal or dishonest intent”, with a dishonest intent to cause loss to another under Section 161(1)(d) of the Crimes Ordinance (Chapter 200). The loss would be the reduction in the marks the classmates had earned in the test. This offence carries a maximum sentence of 5 years imprisonment.
In addition, when Chi Ming altered the marks of his two classmates, he also committed the offence of criminal damage under Section 59(1A) and Section 60(1) of the Crimes Ordinance (Chapter 200), as discussed above.
Chi Ming has already restored the test marks of the two classmates. Has he still committed a crime?
As soon as Chi Ming accessed the school’s intranet the second time and altered the marks of his two classmates (presumably giving them lower marks), he had already committed both the offence of “access to a computer with criminal or dishonest intent”, with a dishonest intent to cause loss to another under Section 161(1)(d) of the Crimes Ordinance (Chapter 200), and the offence of “criminal damage” under Section 59(1A) and Section 60(1) of the Crimes Ordinance (Chapter 200).
He would still be liable even though he later changed his mind and restored the marks. Those later acts would only be relevant to mitigation in sentencing. In any event there would still be the offence of unauthorized access contrary to Section 27A of the Telecommunications Ordinance (Chapter 106).
If Chi Ming only stole a glance at the marks but did not make any alternation to them, has he committed a crime?
Chi Ming might still have committed the offence of “access to a computer with criminal or dishonest intent”, with a view to dishonest gain for himself or another under Section 161(1)(c) of the Crimes Ordinance (Chapter 200). If Chi Ming obtained access to the school’s intranet intending to look at his mark, he would have the intent to gain information that he did not have at that time. This is the “gain” that constitutes the offence. The remaining issue is whether Chi Ming’s intent to gain such information under the circumstances was dishonest.
The test for dishonesty is applied by the court in the form of two questions: (1) whether the defendant’s conduct would be regarded as dishonest by the ordinary standards of reasonable and honest people; and if the answer to (1) is “yes”, then (2) whether the defendant knew that his conduct was so regarded. If the answer to (2) is also “yes”, then the defendant’s conduct would be regarded as dishonest under the law; whether or not the defendant himself considered his conduct as dishonest is irrelevant.
It is likely that reasonable and honest people would regard Chi Ming’s act of obtaining advance notice of his test result without authority as dishonest. If there is also evidence to show that, at the time, Chi Ming knew he was doing something wrong in the eyes of reasonable and honest people, Chi Ming’s act would be regarded as dishonest under the law.
Irrespective of any offence under Section 161(1)(c) of the Crimes Ordinance (Chapter 200), Chi Ming’s accessing the school intranet to view his marks would be an offence under Section 27A of the Telecommunications Ordinance (Chapter 106).
If Chi Ming’s behaviour did not involve gaining or losing money, has he violated the law?
A gain or loss does not have to be economic. Section 161(2) of the Crimes Ordinance (Chapter 200) states that “gain” and “loss” are to be construed as extending not only to a gain or loss of money or other property, but as extending to any sort of temporary or permanent gain or loss.
“Gain” includes a gain by keeping what one already has, as well as a gain by getting what one did not have. “Loss” includes a loss by not getting what one might get, as well as a loss by parting with what one already has.