Liew Cheong Wee Leslie v Public Prosecutor

Choo Han Teck J:

[1] The appellant was a 35-year-old engineer who was employed by Power Automation Pte Ltd (“PA”) from 17 January 2010. He left the company on 13 May 2010. At the time he was assigned to work in the Marina Bay Sands Integrated Resort in which PA was a sub-contractor for the setting up and installation of a “Power Monitoring Control System” or “PMCS”. It was a sophisticated computer system for managing and controlling all digitally controlled equipment in the resort including the casino. The trial judge summarised the description of the PMCS as –

[2] On 12 May 2010 there was a massive blackout at the casino around 12.20am. All levels from the basement to level 3 of the northern section of the casino were affected. The police were called because the security supervisor suspected that the blackout occurred because someone had wilfully tampered with the electrical system. After investigations, the appellant was charged on five counts under s 3(1) of the Computer Misuse Act (Cap 50A, 1998 Rev Ed) (“the Act”) and one count under s 3(2) of the Act. Sections 3(1) and (2) of the Act provide as follows –

He claimed trial and was eventually convicted by the court below on all six charges and was sentenced to a fine of $3,000 each for the first to fifth charges and two weeks imprisonment and $15,000 fine in respect of the sixth charge. He appealed against convictions and sentences before me. The prosecution cross-appealed against the sentences passed.

[3] It was not disputed that access to the sensitive and vital controls required special access codes. Mr Wee, counsel for the appellant, submitted that this was not a case of computer hacking because the appellant was working on a project for his employers at the MBS and was authorised to access the system. Counsel submitted at length as to the chain of command from the MBS to the main contractor, to PA and argued that the appellant had not misunderstood or overstepped his authority. What was being overlooked however, was that the appellant went through an elaborate process to give himself remote access through his personal computer, and further, he added the email address ‘ernie.masih@gmail.com’ (which was his but not used since 2009 and was not an address known to his employers) to the system administrator in order to gain access to the system. The unanswerable evidence was that the appellant completed the layers of security commands in order to execute the instruction causing the blackout. The procedure required for such an instruction to be executed ruled out an accidental activation of the command. The inescapable conclusion that must be drawn from all these acts is that the appellant deliberately intended to cause the blackout. When there were no instructions or reasons for doing so, the natural inference must be that he did so with mischief in mind. It might be that the appellant was angry with MBS or his employer (we do not know), but his actions were clearly an offence under s 3 of the Act. He had no authority to access the computer, let alone use it to create a blackout at MBS. The trial judge noted the inconsistent statements of the appellant as to whether he committed the act under the sixth charge deliberately, and found the appellant’s explanation to be without merit. The appeal against conviction is accordingly dismissed. Although the appellant appealed against the sentences imposed, counsel did not address me as to why he thought the sentences were manifestly harsh. In my view (with the exception of the sentence in respect of the sixth charge which I shall discuss shortly), they were not. I shall now address the Public Prosecutor’s appeal against the sentences, as well as the sixth charge in respect of the appeal by the appellant.

[4] Mr Ong, the DPP submitted that the sentences were inadequate and that a substantial fine be imposed on the first five charges and a higher term of imprisonment in respect of the sixth charge. Instead of the term of two weeks’ imprisonment, the learned DPP submitted that the sentence should be enhanced to eight weeks. Mr Ong submitted that the act under the sixth charge amounted to ‘an intentional sabotage’. The sixth charge is basically an enhanced version of a charge under s 3(1), and because damage is caused, the sentencing court has the power to impose an enhanced sentence of up to $50,000 fine or to imprisonment of a term not exceeding seven years or to both fine and imprisonment. In contrast, a conviction under s 3(1) attracts the punishment of a fine not exceeding $10,000 or imprisonment not exceeding three years or to both fine and imprisonment. The key to the enhancement under s 3(2) lies in the phrase ‘If any damage is caused’. Damage is not any damage but damage as defined in s 2 of the Act. Section 2 defines damage as follows:

[5] It will be seen that the four instances of damage are very specific. In the case of (d), there may also a distinction between ‘public health’ and ‘public safety’. It is the duty of the prosecution to ensure that all the particulars that constitute a charge are given so that the accused knows exactly what he needs to defend himself against. In the instance case, the original sixth charge appears to specify that the damage was under s 3(2)(a) because it contained the phrase ‘of at least $10,000’ immediately after the words ‘causing damage’ in the charge. However, the charge was then amended with the words ‘of at least $10,000’ struck out. That indicated that the prosecution was not going to allege and prove that the accused caused damage of at least $10,000. But what then was the damage caused? That the charge did not say, nor was any evidence led detailing so. The defence did not point it out, and the trial judge assumed that damage was proved. He held that ‘Financial losses would also have been sustained through a stop in the operations of the casino business. Inevitably, the reputation of the MBS would also have been marred as it would have ruined the experience for their patrons.’ With respect, that was not the damage that the prosecution had particularised and a loss of reputation is not defined as damage under the Act. Before me the DPP submitted that the trial judge failed to take into account that the blackout was caused in ‘one of Singapore’s integrated resorts, whose development and opening were widely publicised worldwide and attracted overwhelming media attention and scrutiny.' The DPP went on to submit that the ‘MBS was also the pinnacle of Singapore’s tourism industry at the time, and both its recent launch and its unique contribution to the Singapore skyline drew international attention.’ These are clearly not matters that are within the definition of ‘damage’ in s 2 of the Act. Private practice lawyers and the civil court might be interested in the reputation and standing of a private institution, but those are not matters that are the concern of the public prosecution service and the criminal court generally, and in this offence specifically.

[6] It was only on appeal that the DPP submitted that a blackout might be a threat to public safety. That might be a common sense proposition but it was not particularized in the charge and was thus not the prosecution’s case at trial. Neither was evidence led to support it. Since damage was not particularised or proved and since the trial judge did not make any findings on such damage based on any evidence (since such evidence was not presented before the court), the sixth charge was only a charge under s 3(1), and though properly convicted as such, the sentence ought be neither more or less than the sentences of the five other similar charges. I will amend the sixth charge by deleting the words ‘Section 3(2) read with’, and vary the sentence to a fine of $3,000, and in default, three weeks imprisonment. Conduct constituting an offence under s 3 of the Act can vary widely in scope and nature. An offence under s 3(2) will very likely attract custodial sentence, and an offence under s 3(1) may similarly attract a custodial sentence if sufficiently grave and serious even though no damage was caused.