Soyke v R

[2016] NSWCCA 112

Court of Criminal Appeal

Supreme Court

New South Wales

Medium Neutral Citation:	Soyke v R [2016] NSWCCA 112
Hearing dates:	18 May 2016
Decision date:	10 June 2016
Before:	Basten JA at [1]; Schmidt J at [2]; Wilson J at [73]
Decision:	(1)   Notice of motion dismissed. (2)   Leave to appeal granted. (3)   Appeal dismissed.
Catchwords:	CRIMINAL LAW – leave to appeal and appeal against sentence – whether error in assessment of seriousness of offences – whether sentence was manifestly excessive – no error – appeal dismissed   CRIMINAL LAW – appeal – notice of motion – leave sought to rely on expert reports on appeal – reports not admissible – motion dismissed
Legislation Cited:	Children (Criminal Proceedings) Act 1987 (NSW), s 33 Crimes Act 1914 (Cth), s 16BA Criminal Appeal Rules (NSW), r 25A Criminal Appeal Act 1912 (NSW), s 6 Criminal Code Act 1995 (Cth), ss 477, 478
Cases Cited:	Einfeld v R [2010] NSWCCA 87; (2010) 200 A Crim R 1 Khoury v R [2011] NSWCCA 118; (2011) 209 A Crim R 509 R v Lamella [2014] NSWCCA 122 R v Stevens [1999] NSWCCA 69
Category:	Principal judgment
Parties:	Justin Soyke (Applicant) Regina (Respondent)
Representation:	Counsel: Mr P Coady (Applicant) Ms M England (Respondent)   Solicitors: Legal Aid Commission (NSW) (Applicant Commonwealth Director of Public Prosecutions (Respondent)
File Number(s):	2014/154222
Decision under appeal	Court or tribunal: District Court of NSW Jurisdiction: Criminal Date of Decision: 15 October 2015 Before: Culver DCJ File Number(s): 2014/154222

Judgment

1. BASTEN JA: I agree with the orders proposed by Schmidt J, and with her reasons.

2. SCHMIDT J: The applicant pleaded guilty to four computer related offences under s 477 of the Criminal Code Act 1995 (Cth), which each carry a maximum penalty of 10 years imprisonment. Another 17 offences of attempt to cause unauthorised access to restricted data under ss 478.1(1) and 11.1(1) of the Code, which each carried maximum penalties of 2 years imprisonment, were also taken into account on sentence, in accordance with s 16BA of the Crimes Act 1914 (Cth).

3. On 15 October 2015, Culver DCJ sentenced the applicant to 3 years imprisonment. He is due to be released on 14 October 2016 on recognisance to be of good behaviour of $5,000.

4. The individual offences to which the appellant entered his pleas were:

• Sequence 1: Cause unauthorised modification of computer data, contrary to s 477.2(1) Criminal Code Act 1995 (Cth); imprisonment for 18 months to commence on the date of sentence (15 October 2015), expiring on 14 April 2017.

• Sequence 3: Attempt cause unauthorised modification of data contrary to s 477.2(1) and 11.1(1); imprisonment for 12 months to commence on the date of sentence (15 October 2015) expiring 14 October 2016.

• Sequence 6: Unauthorised access to data with intent to commit serious indictable offence, contrary to s 477.1(1)(a)(i); imprisonment for 2.5 years, to commence on 15 April 2016 expiring on 14 October 2016.

• Sequence 7: Unauthorised access to data with intent to commit serious offence, contrary to s 477.1(1)(a)(i); imprisonment for 18 months to commence on 15 August 2016, expiring on 14 February 2018.

5. Initially the applicant sought leave to pursue two grounds of appeal:

“1.   Her Honour erred in the assessment of the seriousness of the offences.

2.   The sentence was manifestly excessive in the circumstances of the Applicant’s case.”

6. By motion later filed the applicant sought an order under Rule 25A of the Criminal Appeal Rules (NSW), so that he could pursue a third ground of appeal:

“3.   The sentencing exercise miscarried in the absence of evidence of the Applicant’s mental state, namely that he had developed an addiction present at the time of committing the offences.”

7. That leave was sought in order that the applicant could pursue an application for leave to rely on a report of 8 October 2015 of Dr Butler, a consultant paediatrician, which had not been relied on at the sentencing hearing on 15 October, as well as a 4 May 2016 report from the psychologist Ms Robilliard, who had only interviewed the applicant on 21 March 2016.

8. The leave sought was opposed by the Crown. In issue is whether either report is admissible. The resolution of what lies in issue requires consideration to be given to the contents of the reports and the oral evidence given by Ms Robilliard, as well as the affidavit evidence of the applicant’s solicitor.

The reports are not admissible

The applicable principles

9. There is no issue that had the two reports been tendered at the sentencing hearing, they would have been admissible, going as they do to the applicant’s mental health. Dr Butler’s report was then available, but Ms Robilliard's was not. Admissibility of the reports on appeal against sentence depends on their nature.

10. In Khoury v R [2011] NSWCCA 118; (2011) 209 A Crim R 509 the applicable principles were discussed at [104] - [110]. The general principle is that “parties to litigation, including criminal litigation, are bound by the manner in which their cases are presented at first instance and will not be permitted to enhance their cases on appeal by producing fresh, or new, evidence” (at [104]). In criminal cases the rigour with which that rule is applied “must be tempered in order to accommodate the interests of justice” (at [105]). There the competing considerations were identified to be:

“(1)    that the administration of justice requires finality in litigation; in general, parties to litigation (including criminal litigation) have one, and one only, opportunity to present their cases in the best light they can, and are bound by the conduct of their cases at first instance;

(2)    that error in the sentencing process, however caused, that is the occasion of injustice, ought to be remedied.”

11. There are also, however, recognised limits on when the Court may legitimately accept additional evidence on sentencing. They depend on whether the evidence is "fresh" evidence, or "new" evidence. The distinction between the two was identified at [107] to be:

“107       "Fresh" evidence has been defined by Mason J (as he then was) in Lawless v The Queen [1979] HCA 49; 142 CLR 659 at p 675 as:

"... evidence of which the accused was unaware at the time of his trial and ... evidence which he could not have discovered with reasonable diligence."

"New" evidence, on the other hand, is evidence that does not qualify as "fresh", either because it was available, but not used, at first instance, or because, in the exercise of reasonable diligence it could have been obtained. The distinction is important in the present case.”

12. New evidence is not admissible. Even fresh evidence may not be admitted if it is concluded that it would not have affected the outcome of the proceedings at first instance (at [108]). If fresh evidence is not judged to have that capacity, its admission is pointless.

13. Further, as discussed in Khoury v R (at 110), because of the provisions of subs-s 6(3) of the Criminal Appeal Act 1912 (NSW), on which the Court’s jurisdiction on a sentence appeal depends:

“evidence of events or circumstances or facts that have arisen entirely since sentencing cannot be taken into account, no matter how compelling they may be. If the facts did not exist at the time of sentencing, it cannot have been an error for the sentencing judge not to have taken them into account. In those circumstances, the impact on the sentence is a matter for the executive government.”

14. In this case the application to lead additional evidence arises in circumstances where any psychological conditions which the applicant suffers existed at sentencing and so the evidence is not precluded by s 6(3). The nature of the evidence sought to be led must, however, be properly identified.

15. One of the reports was prepared before sentence and the other afterwards, accordingly one contains the opinions Dr Butler held at the time of sentence and the other the opinions Ms Robilliard formed subsequently. In Einfeld v R [2010] NSWCCA 87; (2010) 200 A Crim R 1, Basten JA observed at [45] and [50]:

"45    Whether the relevant ‘event or circumstance' is the psychological condition, or the diagnosis, is one of the matters which has not been definitively resolved. There are fine distinctions to be drawn, in a practical way, between susceptibility to and suffering from a particular condition, different degrees of a known condition and the development of a syndrome (such as AIDS) from an infection (with HIV).

...

50   Because such material was not before the sentencing judge, it cannot provide a basis for identifying error on his Honour's part, at least in the ordinary meaning of that term. It may be that ‘error’ is established in a technical sense in that, for reasons with which his Honour was not familiar, the applicant did not have a ‘fair sentencing hearing’ because a particular matter was not exposed. This would appear to be a somewhat artificial approach to what must be treated, in substance, as an appeal by way of rehearing. To support such an appeal, one would expect to find an express power permitting a court to admit either fresh, or further, evidence: cf, Supreme Court Act 1970 (NSW), s 75A. Absent such a power, it is usual to characterise the appeal as an appeal ‘in the strict sense’, namely a determination of whether the primary judge erred in applying the law in force at the time of judgment, to the materials before the Court at that time: Victorian Stevedoring & General Contracting Co Pty Ltd and Meakes v Dignan [1931] HCA 34; 46 CLR 73 at 109. There is no provision equivalent to s 75A in the Criminal Appeal Act, nor in the Criminal Appeal Rules. In the absence of such a provision, the Court is presumably required to make up its own conditions respecting the admission and use of such material. Although it has been accepted that events occurring subsequent to sentence cannot form the basis of further evidence before this Court - see R v Munday [1981] 2 NSWLR 177 at 178D (Street CJ, Moffitt P and Lee J agreeing) - there is a fine line between a psychiatric condition which existed at the relevant time and a diagnosis which occurred subsequently."

16. In Khoury, Simpson J considered (at [120] – [121]):

“120   For myself, I would question the too ready acceptance that a psychological report post dating sentencing, is, because it is prepared after sentencing, fresh or new evidence. The substance of the evidence is not the existence of the report, but the history and opinions expressed in the report concerning the applicant's psychological condition. That may or may not be something of which the offender was (or his legal representative were) aware at the time of sentencing, but it is almost certainly evidence that, in the ordinary course, could with reasonable diligence have been obtained prior to sentencing.

121   That the evidence may cast light on circumstances known, but not fully appreciated, at sentencing, does not dictate that it will be admitted. The judgment remains a discretionary one. It is proper for the Court examine the circumstances of, and any explanation for, the non-production of the evidence - a deliberate decision on the part either of the applicant, or his or her legal representatives, ignorance in the applicant of the significance of the evidence, resulting in its not being communicated to the legal representatives, incompetent legal representation. At the outer limits, the cases also include those in which post sentencing circumstances are taken into account as relevant to known pre-sentencing circumstances (for example, Springer ). Also relevant will be the potential significance of the evidence to have affected the outcome at first instance (for example, Ashton).”

The reports

17. The applicant was aged 18 when he committed these offences between November 2013 and May 2014, having been born in November 1995.

18. Dr Butler’s one page October 2015 report disclosed that he had treated the applicant for ADHD from June 2000, when he was aged 4 years, to January 2012, when he was aged 16. When Dr Butler last treated him in 2012, the applicant’s symptoms of impulsivity, aggression and hyperactivity were being treated with medication, without which he became irritable and picked on his siblings and other people. In February 2011 he had also been diagnosed to be suffering a mood disorder, for which a mood stabiliser was prescribed without which he became overly aggressive over confident and not caring about himself or what he was doing. Dr Butler said that his mania was characterised by a distorted perception of reality and a feeling that he was always right and at times invincible. The prescribed medication improved these behaviours.

19. Ms Robilliard saw the applicant when he was aged 20 years. Her May 2016 report indicated that his presentation was consistent with ADHD. He reported having received no treatment since he stopped seeing Dr Butler; that he was taking no medication; and that he was binge drinking when he had sufficient money, as well as smoking cannabis regularly, on occasions daily, as well as MDMA on weekends. He also reported spending 16 to 18 hours per day, including all night, using computers at the time of the offending, about 2 hours of which were devoted to his computer course and the balance looking for hacking opportunities and talking to other hackers. He also described the cyber community in which he was involved, as well as his co-offender. He also reported continuing his level of computer use after being charged with these offences, but then confining his activities to playing online games, particularly “War Game”. He was a “clan leader” for that game because of his skill and experience in that game and was able to recruit people through the cyber system and then to help them as an advisor/mentor.

20. The explanation the applicant gave Ms Robilliard for his offending, committed after conviction for other such offences, was that it was fun at the time and that the urge to re-join his hacker community and his friends, had overwhelmed his self control.

21. Ms Robilliard administered a “Clinical Assessment of Internet Addicted Clients” which suggested that the applicant suffered moderate internet addiction, which she clarified in cross-examination to be “internet gaming disorder”. She considered that his addiction could have been higher at the time of arrest. She also confirmed a now adult ADHD diagnosis. She considered that the urge to engage in his addictive behaviour had been overwhelming and irrational; that the rewards were access to his cyber community and the sense of kudos and social recognition which his ability to hack into data bases gave him, the admiration of others being highly rewarding to someone whose self-image and self-esteem were poor. She also considered that his ADHD facilitated his internet addiction; predisposed him to engaging in reckless impulsive activity; and limited his capacity to limit his behavioural responses.

22. In her cross-examination, Ms Robilliard explained that internet addiction was the first behavioural addiction to be included in the DSM-5 diagnostic criteria guide used by health care professionals and that there were, as yet, but proposed criteria, which were being hotly debated. Those criteria were not in evidence.

23. Ms Robilliard also explained that while the diagnosis was clinically useful, it was difficult to distinguish between what was compulsive and what was a passionate interest. Her view was that there was a continuum and that the argument about the criteria was around finding a definitive diagnostic point. The diagnosis of “internet gaming disorder” was thus something which required further study.

24. Ms Robilliard agreed that in the applicant’s case he had told her that after he was charged with these offences, he had confined himself to playing online games, which permitted him to communicate with a cyber-community formed around such games and that gave him status and provided him with a reward contingency, which he did not have in real life.

25. Mr Robilliard also said it was the number of hours per day, more than 16, and the resulting disruption to his day and night patterns, which were indicative of addiction. She considered that disruption to be dangerous for mood disorders. In re-examination she also said that it was his online activities generally, which started his addiction and that he had described stopping illegal hacking and focussing on playing the war game after arrest.

Dr Butler’s report is not admissible

26. Dr Butler’s report is not admissible because it is new evidence. It was available, but not used, on sentence. There is no evidence that the applicant was unaware of it. On the evidence, even if he was, in the exercise of reasonable diligence, it could have been obtained.

27. There is also no suggestion that the applicant was unaware of his diagnosis of ADHD, or his past treatment for that condition, even though no reference was made to it in the agreed facts. The case advanced in written submissions on sentence also made no reference to his psychological condition. Nor was it referred to in the presentence report in evidence, prepared after interview with the applicant and his parents, or in any of the other evidence tendered. There was no explanation given as to why this issue was not raised on sentence. The applicant did not give evidence on sentence or on appeal.

28. In his 12 May affidavit the applicant’s solicitor deposed that he had spoken to the applicant’s mother, who had informed him that it was she who had obtained the report from Dr Butler and that she believed that she had provided it to the solicitor who represented the applicant on sentence, on the day of the hearing. He had also spoken to that solicitor, who had advised him that she had not previously seen that report. He had reviewed the Legal Aid file and there was no copy of the report on that file. Neither the solicitor nor the applicant’s mother swore an affidavit or were called to give oral evidence on appeal.

29. It was not the applicant’s case that there had been representative error on sentence. The case advanced on sentence turned on the applicant’s motivation for his offending, which was said not to have been malice or to cause damage such as data deletion, or reputational or financial harm, but rather wanting attention.

30. The proper inference from the evidence is that Dr Butler’s report cannot have been provided to the solicitor on the day of the sentence hearing, nor can she have been told about it, or the applicant’s prior diagnosis and treatment for ADHD, either then or previously. Had she been provided with such information, or even if the applicant or his parents had disclosed it to those who had prepared the presentence report, its relevance on sentencing would have been apparent.

31. Dr Butler’s report is thus not admissible on appeal, given that it was available at the time of sentence and even if its existence was not then known to the applicant, or his solicitor, it could undoubtedly have been obtained by the exercise of reasonable diligence.

Ms Robilliard’s report is also not admissible

32. The position in relation to Ms Robilliard’s report is somewhat different, but it cannot be concluded that it is fresh evidence and so admissible. Despite the submission that absent this report, the Court had no information which would enable it to assess the applicant’s motive and the objective seriousness of his further offending, so soon after he was sentenced for similar offences in the Children’s Court, in circumstances where it is now known that he was acting under an irrational and compulsive addiction, the report is not admissible.

33. That is because while the report did not exist at the time of sentence and the applicant was not aware that Ms Robilliard’s examination of him would result in the identification of a new condition, internet gaming disorder, which he had not previously been diagnosed to be suffering, it must also be concluded that reasonable diligence could have resulted in such a report being obtained for sentence.

32. There was no evidence that suggested that there was any impediment to the applicant obtaining an up to date report as to his psychological condition prior to sentence. ADHD is a condition which can, but does not necessarily, persist into adulthood. At the time of his offending he was not pursuing any treatment for that condition. Dr Butler had not treated the applicant since 2012. What he had to say in 2015 could shed limited light on the applicant’s psychological condition at the time he committed these offences in 2013 and 2014.

33. Once a report was sought from Ms Robilliard, she not only identified that the applicant’s ADHD had persisted into adulthood, but also that he was suffering from a previously unidentified addiction. That diagnosis is, however, as she explained in cross-examination, debatable.

34. Even if that be overlooked, it is difficult to see how that diagnosis could explain the applicant’s offending behaviour, or that it could have had much impact on his sentence, if then relied on.

35. In the account which he gave to the author of the presentence report, the applicant said that he was pursuing a Diploma of Information Technology and justified his actions by claiming to be of the belief that the commission of his offences provided a level of appeal to prospective employers in the IT industry, through showcasing his ability. He later told Dr Robilliard that he had pursued his offending because it was fun and the urge to rejoin his hacker community had overwhelmed his self restraint.

36. That evidence is consistent with the applicant’s offending not being the result of an internet gaming addiction, even if he has such an addiction. Such an addiction would help explain the applicant’s pattern of excessive internet use, but not his illegal hacking activities. On his account to Ms Robilliard, the applicant’s internet use continued after he was charged, for similar lengths of time and over similar times of the day, but he was able to limit his internet activities to legal ones.

37. That is not consistent with his criminal hacking being explained by his compulsive internet use. Had such illegal activities formed part of the diagnostic criteria for internet gaming addiction, no doubt that would have been explained.

38. In the result, it is difficult to see how this debatable diagnosis could have affected the outcome of the proceedings, to the applicant’s advantage. While Ms Robilliard’s report would shed light on his subjective circumstances and questions of rehabilitation and risks of reoffending, it is difficult to see that the existence of an internet gaming addiction could have led to favourable conclusions as to his sentence.

39. In those circumstances it cannot be concluded that the report is admissible as fresh evidence and accordingly, the leave sought in the motion must be refused.

Ground 1 – the seriousness of the offences

42. The agreed facts were lengthy and complex; a chart setting out the details of the offences, prepared by the applicant’s solicitor advocate, was attached to the sentencing judgment. In summary, the applicant came to police attention after unauthorised access by an unknown person, using an identified moniker, to the system of an internet service provider, Netspeed Communications. The applicant was identified as having used Vodafone Telecommunication Services held in both his own and his mother’s name to gain that access. He pursued a variety of steps which it is unnecessary to describe, to hide his own Internal Protocol address, but used his laptop to access his personal email and Facebook accounts, where traces of these measures were left behind. The applicant also associated with identified persons online, Australian and Danish nationals, in the pursuit of his offending.

43. Charges 1 and 3 concerned the applicant’s unauthorised intrusion into Netspeed’s systems. Charge 1 involved uploading an exploit file to a directory and making it publically viewable. This provided access to privileges normally reserved for trusted system administrators. The result was that the security of a website was altered, the uploaded file enabling files to be read, modified and deleted, user accounts and passwords to be obtained, programs to be downloaded and other steps to be taken, which would impair the security of the server.

44. Charge 2 involved the uploading of an exploit file which also provided the applicant with access reserved for system and website administrators, impairing the system’s security system.

45. Charge 3 involved the compilation and execution of exploit files which gave the applicant administrator privileges to the entire Netspeed VM, a program hosting 129 separate websites. Commands involving the downloading of files were entered and executed, but failed to run. There were also attempts to obtain further control, which would have given unrestricted access to the system and permitted any function to be performed. There was evidence that the applicant communicated with an unknown person who had viewed the page and obtained access to the website link.

46. Charge 4 involved unauthorised access to an ACT Government account hosted on the Netspeed VM, which gave the applicant access to its Long Service Leave Authority account. Thereby he also gained access reserved for system and website administrators, impairing security of this system.

47. Charge 5 involved unauthorised access to an account belonging to ATM Computers, also hosted on the Netspeed VM. Again the applicant gained access reserved for system and website administrators, impairing security of the system.

48. In April 2014 it became public that a vulnerability known as “Heartbleed” was affecting certain computer systems. The applicant began researching that vulnerability and searching for remote access to sites which may have become vulnerable, using various means, to connect to targeted servers.

49. Charge 6 concerned the applicant’s unauthorised access to a Telstra Corporation Limited server, using the Heartbleed vulnerability. This system included internet names, user names, as well as password and billing information. Telstra captured the internet traffic between its server and the applicant’s computer. His intention was disclosed to have been to upload further exploits, in order to impair the server’s security.

50. Charge 7 involved unauthorised access to a Computer Sciences Corporation website and discussions about further exploits being pursued to gain further access, which resulted in him gaining unauthorised access to another database and attempting to modify the server, to gain further access to the system.

51. Charges 8-24 were matters listed on a form for the purposes of s 16BA and taken into account in sentencing. Charges 8 to 16 involved attempts to gain unauthorised access using the Heartbleed vulnerability to identified State and Federal Government’s servers, which mostly failed because they were not vulnerable to Heartbleed attacks. Counts 17-19 involved three further attempts to gain unauthorised access to other Australian servers. Counts 20-24 involved repeated attempts to gain unauthorised access to international servers including those belonging to NASA, NATO, the United Nations and the American Department of Defence.

52. The applicant was also involved in conversations with others as to vulnerable servers he had identified and steps he was going to pursue, to obtain access to them.

53. On arrest and execution of a search warrant at his home, numerous electronic devices were seized. In his police interview the applicant made certain admissions. At the time of the commission of his offences he was subject to a good behaviour bond under s 33(1) of the Children (Criminal Proceedings) Act 1987 (NSW), for an earlier cybercrime offence.

54. The Crown’s case on sentence was that, given the number of attacks involved in his offending, the number of victims and the sustained nature of those attacks, when considered with his networking with similar minded hackers, his criminal conduct was serious.

55. It was conceded that it was relevant that the Form 1 offences involving Government bodies did not involve harm, but rather attempts at offending. Further, it was accepted to be relevant that while security of various systems had been impaired, there was no actual harm or change to data in accounts, even though there had been access to private information.

56. While it was agreed that the applicant had boasted about his activities, on sentence his case was that there was no evidence that he had caused actual damage, other than impairing security, or that he had financial or other malicious motives for his offending. Accordingly, the seriousness of his offending was in issue.

57. Offending such as this has long been recognised to be potentially serious. In R v Stevens [1999] NSWCCA 69 it was observed at [54]:

“The applicant’s offences must be regarded as grave. Computer technology plays an important role in modern society. The potential for harm by computer abuse of the type that occurred in this case, in a society which is becoming increasingly dependent upon computers, requires that considerations of deterrence, not only of the offender but of others who might be tempted to offend in a similar way, should be adequately reflected when it comes to sentence.”

58. Culver DCJ concluded at p8-9, that:

“I am of the view that these offences are indeed serious offences for the reasons that firstly, the offender committed these offences over a period of some six months. Secondly, the offender targeted numerous victims. Thirdly, the offender engaged in behaviour that was in some respects and to some extent communicated with others potentially opening up access to confidential information by others, or at least another, being Larson.

Fourthly, the offender furthermore has targeted information which is not just simply confidential commercial information, but potentially gave access to I very private and personal information. For example, to hack into the system where the offender had access to the ACT Long Service Leave Board presumably has a potential to reveal quite personal information.

A consideration of the seriousness of the matter cannot be conducted without considering the next item under section 16A(2) and that is in subs (c). The Court is required to consider if the offence forms part of a course of conduct consistent with a series of criminal acts of the same or similar character. Whilst one might assume that hacking would ordinarily occur in a course of conduct, there are matters that deal with one offence, with one considered effort by an offender or one set of acts in order to commit the hacking offence. Here, however, the Crown is not only relying on multiple offences but also multiple acts by the offender in order to complete an offence. I am of the view that a course of conduct is revealed and that adds to the seriousness of these offences as I have described.”

59. On appeal it was argued that in the absence of harm caused to the victims, the finding that the offending was serious, or particularly serious, was not open.

60. That may not be accepted. In reaching the conclusion that this offending was serious, her Honour had proper regard to the number of attacks involved in the applicant’s offending; the time over which it was pursued; the potential harm that the applicant was prepared to facilitate, by facilitating access to the confidential data bases he targeted to at least one other like-minded person. Her Honour also took into account that while, unlike his earlier offending, there was no evidence that he had defaced the sites he had accessed, she did not accept that this offending had been pursued in order to appeal to prospective employers, as he had claimed when interviewed by the author of the pre-sentence report. That was because this would require the applicant to reveal both his identity and his criminal conduct, after having taken various steps to hide his real identity. In the result she concluded that as a matter of common sense, his offending was pursued to give him notoriety in the hacking world, that is, amongst like-minded and criminally intended people.

61. These were all proper matters to take into account and left the conclusion that this was serious offending well open. The unauthorised introduction of programs into the various targeted websites the subject of charges 1 and 3 involved modifications which impaired their security, making them more vulnerable to attack, by giving access to information and privileges otherwise restricted. During the Heartbleed attacks it was such vulnerability which the applicant was attempting to exploit. That was all serious offending. No error has been made shown in her Honour’s conclusion, notwithstanding that actual further damage did not result and that he did not obtain financial advantage. The substantial risks of damage which his actions gave rise to, may not be overlooked.

62. With respect to the specific sentence for charge 6, two factors were important and sufficient to justify the higher sentence imposed. First, the attack resulted in 1,500 responses that involved downloading (“exfiltration”) of data to the applicant’s computer. Secondly, the sentence reflected the fact that 17 other offences listed on the s 16BA schedule were taken into account. Several involved attempts to gain access to multiple servers.

63. This ground must be dismissed.

Ground 2- the sentence was manifestly excessive

64. Culver DCJ observed at p3-4:

“The Court, when sentencing an offender for Commonwealth offences, must take into account and consider the features of s 16A of the Crimes Act. The parties have each provided written submissions which have been taken into account as have their oral submissions in that regard. It is the Crown's position in these proceedings that the offender should be sentenced to a sentence of imprisonment insofar as it is a sentence which is required to appropriately reflect the severity of all the circumstances arising in this case. Therefore, it is the Crown's submission that s 16A(1) is triggered by these circumstances.

Turning to a consideration of the matters in s 16 A(1), the Crown urges the Court to consider that this is a matter deserving of emphasis on general deterrence. I am in agreement with that position. These type of computer hacking offences have the capacity to remain undetected until the risk of extensive damage eventuates. Whilst it may be the case that extensive damage was not actually caused by the offences in this case, when one considers the risk of extensive damage, or extensive disclosure of confidential information, then general deterrence is a vehicle by which such a risk can be minimised in the future.

Let me be very clear, the offender will only be sentenced for the offences he has committed, but those offences clearly involved considerable risk of damage to the reputation of the organizations whose systems were hacked into and a considerable risk of disclosure of sensitive and confidential information. It is that risk that can and ought to be reflected in the emphasis upon general deterrence. As stated by the Crown, it is clear that hacking offences of this kind which target computer networks fundamental to the proper functioning of government departments are very serious and must attract a significant component of general deterrence. The Crown in that regard has provided the court with a number of authorities which in my view are consistent in urging consideration of general deterrence in cases of this nature. I do not see any controversy in that proposition.”

65. The applicant was sentenced to 3 years imprisonment with an order that he be released on recognisance of $5,000 to be of good behaviour, after serving 12 months. The individual sentences were (at p14 - 15):

“In respect of sequence 1, the sentence is the sentence of imprisonment of 18 months. It commences today's date being 15 October 2015 and expires at the end of 14 April 2017.

In respect of sequence 3, that is a 12-month sentence of imprisonment. As that offending occurred in the same time frame as sequence 1, I am of the view it is appropriate that sentence commence on the same date, today's date being 15 October 2015 with that matter expiring at the end of 14 October 2016.

For sequence number 6, for which I have taken into account the offences on the certificate, I am of the view that that matter is so serious that it is deserving of a sentence of two and a half years imprisonment. Because it occurred in a different time frame, it will commence six months from now, on 15 April 2016, meaning that it will expire at the end of 14 October 2018.

For sequence number 7, that is a sentence of imprisonment of 18 months, it will commence in ten months time, on 15 August 2016, meaning that that matter will expire at the end of 14 February 2018.”

66. The applicant’s case was that the sentence imposed was unreasonable and plainly unjust, given the low level of objective seriousness of his offending, his age, prospects of rehabilitation and early plea, and the assessment that he was at low/medium risk of reoffending. It was also submitted that the indicative sentence for count 6, of two and a half years was itself suggestive of excess, given the sentences indicated for the other three principal offences, even though that offence involved both unauthorised access and the taking of data.

67. It was relevant on this sentence that at the time of his offending, the applicant was on 12 months’ probation for other similar offences under ss 477.2, 478.1 and 478.3 of the Criminal Code. Further, because the applicant asked that 17 other offences be taken into account under s 16BA, the sentence otherwise imposed upon him also had to be increased. As observed in R v Lamella [2014] NSWCCA 122 at [48]:

“Section 16BA Crimes Act (Cth) permits the court, with the consent of the prosecutor, to take into account other Federal offences to which an offender has pleaded guilty. There is, in my view, no reason to think that Spigelman CJ's approach in Attorney General's Application under s 37 of the Crimes (Sentencing Procedure) Act 1999 No 1 of 2002 (2002) 56 NSWLR 146 to New South Wales offences included on a Form 1 does not apply to Federal offences included on a schedule. Spigelman CJ considered at [42] that offences included on a Form 1 are to be taken into account to increase the penalty otherwise appropriate by giving greater weight to the need for personal deterrence and the community's entitlement to extract retribution for serious offences.”

68. That being so, it is not open to conclude that a lower sentence ought to have been imposed on the applicant for his offences. Her Honour took proper account of his plea, which she accepted demonstrated that he had taken responsibility for his offences, his evident immaturity, despite the absence of any evidence of psychological impairment, his references, his assessed risk of reoffending, and his prospects of rehabilitation, given his youth. Her Honour also took account, as she was obliged to do, of the need to have regard to general and specific deterrence, particularly given that the applicant was on a bond at the time of this offending.

69. Her Honour’s conclusion that a custodial sentence was required, given the totality of the applicant’s offending, that he was on a bond for similar offending and because of the course of conduct which he had pursued over a period of time, against a number of victims, was correct.

70. There was no error in either the sentences imposed for the individual offences, in circumstances where each offence attracted a maximum sentence of 10 years imprisonment or in her Honour’s approach to questions of concurrence and accumulation.

71. In the result, this ground of appeal must also be dismissed.

Orders

72. The orders I would propose are:

1. Notice of motion dismissed.

2. Leave to appeal granted.

3. Appeal dismissed.

73. WILSON J: I agree with Schmidt J.

**********

Decision last updated: 04 April 2018