Director of Public Prosecutions v Hu

[2024] VCC 532

This

IN THE COUNTY COURT OF VICTORIA

AT MELBOURNE

CRIMINAL DIVISION

 Revised
Not Restricted
Suitable for Publication

CR 21-02168
CR 21-02169

DIRECTOR OF PUBLIC PROSECUTIONS

v

XI HU

---

JUDGE:	HIS HONOUR JUDGE BAYLES
WHERE HELD:	Melbourne
DATE OF HEARING:	15 April 2024
DATE OF SENTENCE:	23 April 2024
CASE MAY BE CITED AS:	DPP v HU
MEDIUM NEUTRAL CITATION:	[2024] VCC 532

REASONS FOR SENTENCE
---

Subject:CRIMINAL LAW – SENTENCE

Catchwords:              Unauthorised impairment of electronic communication – no relevant criminal history – malicious cyber attack – impact of cyber offending on business operations and conduct

Legislation Cited:      Sentencing Act 1991 (Vic)

Cases Cited:

Sentence:                  Aggregate sentence of 182 days imprisonment and a community corrections order of 15 months.

---

APPEARANCES:	Counsel	Solicitors
For the DPP	Mr F. Cameron	Office of Public Prosecutions
For the Accused	Mr P. Kounnas	Gallant Law

HIS HONOUR:

1Xi Hu you pleaded guilty to an indictment of 5 charges of unauthorised impairment of electronic communication. This charge carries a maximum penalty of 10 years' imprisonment.  Of some significance in the sentencing exercise, you served I believe 182 days being approximately six months, in custody prior to being granted bail before you ultimately pleaded guilty to these five charges.

2The matter was initially listed before me for pre-trial argument but turned into initially a sentence indication hearing. At that hearing, I indicated that if you were to plead guilty to the five proposed charges on a plea indictment, I would impose a sentence upon you that would be a combination of a term of imprisonment not exceeding the time that you had already served, and a community corrections order. Following that indication, you pleaded guilty to the plea indictment. I heard some further submissions at a plea hearing, and I will now proceed to impose the sentence and give my reasons for it.

3I received initially a summary of prosecution opening for sentence indication hearing dated 8 April 2024, and then a plea opening dated 10 April 2024. I adopt the plea opening as part of my reasons for this sentence. I will not repeat the facts here in any detail, suffice to say that your offending involves the following matters.

4The totality of the offending was between July 2018 and November 2019. You have worked in the IT and communications industry since 2007, and I was informed that you are an experienced network/systems engineer, with experience in computer programming, wireless telecommunications, administration of computer operating systems, cyber security, distributed denial of service methodology, otherwise referred to as 'DDoS' and routing and switching communication lines within and between networks.

5It seems that these skills were put to use by you in a variety of ways to constitute the criminal offending that is now before this court. I was informed that you had previously worked as a systems engineer for an IT business called Gateway ICT - cyber resilience services. In 2015 you were made redundant and lost that job, and it seems a grievance prevailed, and you initiated unsuccessful proceedings with Fair Work Australia. A customer of Gateway was The Blind Factory, and for reasons that do not seem to me to be entirely logical, they became a victim of yours when you caused their call centre to be inundated with automated calls of up to about 1,000 calls per day, blocking legitimate calls from being answered. That conduct constitutes Charge 1.

6In 2018, you were involved in divorce proceedings with your now ex-wife. The law firm Pentana Stanton represented your ex-wife. For reasons that also appear somewhat illogical, as I was informed that there were in fact no proceedings on foot and there was minimal involvement of the law firm Pentana Stanton, in July 2018 Pentana Stanton were the victim of a malicious DDoS attack directed at their IP address, preventing legitimate visitors from accessing their website. In addition, their Dandenong and Melbourne offices of the firm received a large number of malicious phone calls, preventing staff from making or receiving legitimate phone calls. That conduct constitutes Charge 2.

7Aussie Broadband was the victim of Charge 3, where the conduct occurred in June 2019. As I understand it, Aussie Broadband had received complaints that your account had been used for sending spam, attempting to access third-party servers, and suspected malicious activity against another ISP.  Aussie Broadband then reported sustaining two DDoS attacks on servers used by Aussie Broadband to host public facing websites. These attacks prevented Aussie Broadband from conducting its regular business, resulting in likely loss of sales over the period of the attacks and it was estimated approximately 1,632 hours of staff time spent trying to deal with the cyber attacks.

8Vicinity Centres are the managers of Chadstone Shopping Centre, and are the victims of Charges 4 and 5. On 18 October 2019, you were in a Kathmandu store located in Chadstone Shopping Centre, where you were confronted by staff and as I understand it ultimately detained in the store by security. During that time, you rang Triple 0 and reported that you were being unlawfully detained. It appears that you had a grievance over this, and as a result, in October 2019 various websites linked to Vicinity Centres were subject to DDoS attacks causing them to be unavailable to legitimate users. In addition, Chadstone Shopping Centre's main telephone line experienced a large volume of incoming automated silent calls, disrupting their daily business.

9On 18 November 2019, a cyber attack caused a website used by Chadstone Shopping Centre to book shuttle bus seats, caused that website to be off-line due to a spike in web traffic, and another webpage used to book Santa photos was also off-line and not responding to requests. The conduct causing these events constitute Charge 5.

10As was observed during the course of the proceedings before this court, this offending is somewhat novel in the sense that it is not often seen before the courts. Of course, that fact alone says nothing about the prevalence of this kind of activity, its existence in the community generally, or indeed about the assessment of the level of seriousness of this particular offending. I make the observation that in the modern world, malicious cyber activity of various forms does appear to be becoming more prevalent and certainly has the capacity to have enormous impact on both individuals as well as on corporate entities.

11The impact of your offending can perhaps be described as being that to different degrees, in relation to each of the charges, you targeted legitimate businesses with malicious cyber attacks, affecting either the operation of their telephone lines and telephone systems or their website activity. This impacted their ability to conduct their affairs in the normal and ordinary course of their business, and it would also seem to have impacted customers of the various businesses or potential customers, those being members of the public in contacting and interacting with the businesses either through the use of phone lines, or website activity.

12As I understand it, it has been difficult and not entirely possible to quantify the precise cost or loss to each of these businesses, but the cost and loss to businesses has certainly come in the form of potential loss of sales and/or business, wasted hours of staff time either through lack of productivity or time spent seeking to rectify the problem, in some cases expense in engaging cyber security services to rectify the problem and damage caused, and no doubt at least the potential and it would seem to me likelihood of high levels of frustration both for staff members of the business and for potential customers and members of the public.

13It seems to me that this is no trivial or insignificant matter and that cyber attacks, as I have said, have the potential first of all to come in a great range of forms.  They may range from at one end of the spectrum to be a nuisance level in terms of their level of impact, right through to the potential for extremely significant and it seems to me potentially catastrophic impact. It is difficult to know precisely where this conduct sits in a range of offending of its kind, however in assessing the level of seriousness of the offending, I pay close attention to the description given in the summary of prosecution opening and the impact, as best as it is able to be quantified and described, that your offending has had on each of the businesses affected. I also note in this regard that no victim impact statements were provided to the court.

14You pleaded guilty, and whilst it was not an early plea, I accept that a trial in this matter could have been potentially highly technical, complicated, probably lengthy and of considerable time and expense to the community. Your plea of guilty has significant utilitarian value, and I also accept that it does demonstrate ultimately an acceptance by you of responsibility for the offending and a willingness to facilitate the course of justice.

15There has been a considerable period of delay or what can certainly be described as the passage of time from the time of the original offending, though to the time of your plea and the ultimate sentence and resolution of this matter.  You were initially arrested and charged in October 2019; at which time you were released on bail. You were then further arrested on 21 November 2019 and as I understand it you were then remanded in custody and remained in custody until being released on bail on 20 May 2020. You have since then been on bail in the community for a significant period of time under the restrictions of certain bail conditions.

16As I see it and as was discussed to some extent in the plea hearing, your time in custody commenced before the period of the COVID‑19 pandemic, but you certainly served at least a couple of months in custody under the conditions of significant lockdown within the prison system which was a response to the outbreak of the COVID-19 pandemic in the community. I accept that that portion of your period of time in custody was onerous for you and had significant impact.

17It is now almost four and a half years since the offending. I was informed that you have no relevant criminal history, and I was informed in the course of the hearing that you have subsequently been charged with some relatively minor offending, but significantly there has been no further offending of a similar nature to that which is before this court.

18Mr Kounnas, who appeared on your behalf at both the sentence indication and plea hearings, outlined your personal history, which has included the traumatic experience of separation from your wife, and the matter of the subsequent care of your daughter. You have described the end of your marriage as the biggest cause of trauma and I understand that your parents have assisted in the process of caring for your daughter following the breakdown of your marriage, and your daughter now lives with your parents back in China.

19I was told that you first arrived in Australia in 2006 on a student visa, you were aged around 19 or 20 at that time. You obtained university qualifications, but I was informed that you are largely self-taught in the IT industry. You have worked extensively in this industry, although I was informed that the events and the proceedings that follow these charges have impacted your ability to work.

20You were assessed by Mr Geoffrey Cummins, psychologist, who provided a report that was relied upon. He stated that in custody you were diagnosed with PTSD, and you were prescribed sertraline 100 milligrams per day, and a mental health summary from your time in custody referred to PTSD and depression.

21It was said that the events surrounding the separation from your wife, and the issues to do with the care of your daughter, occurred somewhere from around 2017 or 2018, preceding the events constituting these charges. Mr Cummins observed that you presented as being of significantly above average intelligence. Mr Cummins noted a number of events of traumatic impact, and he formed the opinion that it was probable that you suffer from symptoms of complex PTSD although he was unable to elicit sufficient diagnostic criteria for a full diagnosis. I also note a letter or report regarding ongoing psychological treatment from Dr Sabeha Muzzafar.

22Although Mr Kounnas did not rely specifically on the principles in Verdins,[1] it was submitted and it does seem to me that there is certainly a background of some relevance of psychological factors that appear to have affected your conduct in some form or another and have manifested in a variety of ways in your life.

[1] R v Verdins &Ors [2007] VSCA 102.

23In the end, Mr Kounnas relied heavily on the 182 days of time you spend in custody, and the primary submission made on your behalf was that I could have regard to that time as being sufficient for sentencing purposes, or in the alternative if that time was not sufficient on its own, then a combination of imprisonment and a community corrections order with a treatment component would be an appropriate sentence in all the circumstances.

24Mr Cameron, who appeared on behalf of the prosecution, made submissions around the assessment of seriousness of the offending. Mr Cameron submitted, and I understood this to have been accepted by Mr Kounnas, that the offending against Aussie Broadband could be regarded as the most serious of the offending. It was offending that could be described as being more than a mischief or nuisance, and Mr Cameron submitted that there must be regarded as having been some level of malice involved, and a significant impact upon the operation of the business.

25In the end, the prosecution accepted that there has been a significant level of delay or at least the passage of time between the offending and the ultimate resolution of the matter, the prosecution accepted that there does appear to be relevant mental health issues involved both in your personal background, and most likely related in some way to the nature of the offending. The prosecution also accepted that any trial would have been technical in nature and that your plea has utilitarian value.

26Ultimately, the prosecution accepted that a combination sentence, involving the time that you have already served in custody, together with a community corrections order would be open and within range.

27As a result of these submissions by both Mr Kounnas and Mr Cameron, I ordered that you be assessed for your suitability for a community corrections order and I received a report of that assessment.

28Before proceeding to sentence in this matter I will make these final comments about the nature and circumstances of this offending, Mr Hu. As I think I have referred to already in these reasons, it does seem to me that offending of this nature is potentially a very serious matter.  This kind of conduct could vary greatly in the level of its impact upon victims, upon the community and its overall level of seriousness. As I have already said, at one end of the scale conduct of this nature could be trivial and of a nuisance in terms of its level of impact upon victims, but I also have no doubt that at the other end of the scale, malicious cyber attacks have the potential to have enormous impact both on individuals, on businesses and on the functioning of society. Businesses, of the kind that were attacked in this offending, have the right to go about the ordinary course of their business, to interact with the public and potential clients and customers in a way that is free from this kind of interference. The impact of your offending may have varied as between the different charges and the different victims, but in some of the cases and some of the charges that you have pleaded guilty to, and based on the information and the material before me, it must be regarded that your offending has had at least a moderately significant impact on some of the victims of this offending.

29Whilst, as I have already said, offending of this kind may be something that does not come before the courts often, it is nevertheless apparent that malicious cyber activity and cyber attacks are becoming more prevalent as a function of the modern world and our collective reliance on the cyber world and cyber based communications.

30To this end the courts must, when cases of this nature come before it, send a message both to you in particular and to others who would be minded to offend in this or any similar way in the future, that this kind of conduct is serious and it will be met with stern punishment.

31To this extent I am satisfied that a term of imprisonment is appropriate in all the circumstances of this case. Based on the material that is before me, and the plea that has been put on your behalf by Mr Kounnas, I am satisfied that a term of imprisonment not exceeding the time that you have already spent in custody is appropriate, and it is appropriate as the primary aspect of punishment in this matter, and I am satisfied that it is appropriate to impose a term of imprisonment in combination with a community corrections order.  I will ask you now to stand please, Mr Hu.

32On the five charges that are before this court you will be sentenced to an aggregate sentence, it will be a combination of imprisonment and a community corrections order. You will be sentenced to a period of 182 days in prison, together with a community corrections order.  The community corrections order will be for a period of 15 months. I note that in the assessment report that I have received supervision is not recommended in the report and I accept this recommendation. Accordingly, the sole condition that I will impose upon this order is a treatment and rehabilitation condition, and it be a condition that you attend as directed for mental health assessment and treatment.

33I will declare that you have already served 182 days in custody as pre-sentence detention and I will order that that number of days be deducted administratively from your sentence, with the effect that there is no further time to be spent in prison as a result of this sentence.

34Now, Mr Hu, I just want to indicate that the community corrections order that I impose upon you has a number of conditions that are attached to it, and Mr Kounnas will explain these conditions to you in more detail, and in a moment a document will be prepared and you will be asked to sign it, but before that is done I will say to you that I can only impose a community corrections order if you agree to being placed on that order, and participating in it and being bound by the conditions.  Do you agree to being placed on a community corrections order?

35OFFENDER:  Yes, Your Honour.

36HIS HONOUR:  All right, now I am just going to read to you the conditions that attach to all community corrections orders, and the first one is that you must not commit any further offence that is punishable by imprisonment within the period of the order, that is the period of 15 months.  You must first of all report to the Community Corrections Centre and the relevant centre will be the Sunshine office.  You must report within two clear working days of today.  You must report to and accept visits if directed to do so by Corrections.  You must notify Corrections of any change of address.  You must not leave the State of Victoria except with the permission of Corrections.  You must comply with any lawful directions of Corrections and you must comply with the specific condition that I have imposed upon you, which is that you attend for treatment.

37Now I note the travel restriction.  There is a restriction that you not leave the State of Victoria except with permission, which means that if you do intend to travel or leave the State of Victoria you must notify Corrections and receive their permission to do so.  So I will just ask you again, with those conditions having been stated, do you agree to being placed on a community corrections order?

38OFFENDER:  Yes.

39HIS HONOUR:  All right, thank you.  Just finally I will state two further things, and that is that there are two ways in which you can breach a community corrections order: (i), is if you fail to comply with a condition; and (ii), if you commit a further offence punishable by imprisonment.  If you do breach the order in either of those two ways, you may be charged with breaching the order and you may be brought back before me where you could fall to be re-sentenced for the original charges.  So I hope that you do not break the order, breach the order in either of those two ways.  Do you follow that?

40OFFENDER:  I do.

41HIS HONOUR:  All right.  So it might take a moment, you can be seated, Mr Hu. In a moment I will stand down and just have the paperwork prepared, that will just take a minute. 

42I am required to make a 6AAA declaration.[2]  I will just make this observation, that in a case like this I think it is difficult to impose a meaningful 6AAA declaration, but given that I am required to do so I will indicate that had you not pleaded guilty to these charges, I would have imposed a term of 10 months' imprisonment with a two year CCO.

[2] Sentencing Act 1991 (Vic) s. 6AAA.

43MR KOUNNAS:  As Your Honour pleases.

44MR CAMERON:  The court pleases.

45HIS HONOUR:  I will just stand down for a moment while that paperwork is prepared and then I will come back on the Bench.

46(Short adjournment.)

47HIS HONOUR:  Yes, thank you.  I believe we have the order, I will sign it. I will have Mr Hu sign that.  Mr Kounnas, would you mind accompanying my associate to the back of the court.

48MR KOUNNAS:  Of course, Your Honour.

49HIS HONOUR:  Thank you.  Thank you for that, Mr Kounnas.  Thanks, Mr Hu, that completes the order today.  Are there any further matters?

50COUNSEL:  No, Your Honour.

51HIS HONOUR:  Thank you, we will adjourn the court.

- - -