Tough penalties on cards to plug cybercrime loopholes

Hong Kong should establish a set of cybercrime laws to fight such offences as the SAR has no single ordinance to specifically tackle cybercrime, the Law Reform Commission has proposed.

The commission said that cybercrime offenders could be jailed for two to 14 years or a life term for those who endanger people's lives - for example, by hacking medical records or public transport infrastructure.

Releasing its 268-page Consultation Paper on Cyber-Dependent Crimes and Jurisdictional Issues yesterday, senior counsel Derek Chan Ching-lung, a member of the commission's cybercrime sub-committee, said: "We felt that it's time to update our whole cybercrime approach, to be consistent with other jurisdictions to put it into a specific set of ordinance to cover five categories of cybercrime."

These five - illegal access to a program or data, illegal interception of computer data, illegal interference of computer data, illegal interference of a computer system, and making available or possessing a device or data for committing a crime - should be covered by the law. These crimes can be committed only through the use of information and communication technology devices, where such devices are both the tool for committing the crimes and the target of the crimes.

While different offenses related to cybercrime are covered in the Crimes Ordinance and the Telecommunications Ordinance, some of them are outdated and do not account for crimes associated with new technologies.

Chan said the five categories were chosen based on internationally recognized definitions of cybercrime such as those provided by the Budapest Convention. Among the seven jurisdictions referenced in the commission's study, Australia, Canada, England and Wales, and the United States are parties to the convention, while mainland China, New Zealand and Singapore are not.

The commission recommended that offenders should be liable to maximum sentences of two years' imprisonment on summary conviction and 14 years on conviction on indictment. It also suggested that aggravated offenses involving the illegal interference of computer data and computer systems, depending on the severity and the harm done to the victim, could draw a life sentence.

Hong Kong courts should have jurisdiction over extra-territorial cases so long as the offenders or victims are from Hong Kong, or if the targeted computer or data is located in Hong Kong.

"We are concerned with whether exemptions should be granted to cybersecurity professionals and if unauthorized access or interception of data could be carried out for a legitimate purpose," Chan said.

But he also said, in response to inquiries about legal defenses for unauthorized access to computer data and systems, that the commission had not specifically recommended that "any unauthorized access for the public interest necessarily amounts to reasonable excuse."

Lawmaker Holden Chow Ho-ding, from the Democratic Alliance for the Betterment and Progress of Hong Kong, said he welcomed the Law Reform Commission's consultation, and that the current Criminal Ordinance cannot catch up with new technological developments.

One of the cases in the paper - HKSAR v Chan Chi-kong - was the first prosecuted for misuse of computer under the Crimes Ordinance. In 1997, Chan pleaded guilty to destroying his employer's computer files installed in the clients' offices without lawful excuse.

"At one point, even the Court of Final Appeal didn't know how to define access to a computer with criminal or dishonest intent. It's important that we catch up with the times and review existing legislation to recommend possible law reforms that address cybercrime," Chow said.

To clarify areas that are still unclear to the cybercrime subcommittee, a three-month public consultation on the consultation paper will last until October 19.

Members of the public may submit their views on the issues set out in the consultation paper by October 19 via e-mail - hklrc@hkreform.gov.hk, fax (3918-4096) - or mail to the Secretary of the Cybercrime Sub-committee, Law Reform Commission on 4/F, East Wing, Justice Place, 18 Lower Albert Road, Central.