Liew Cheong Wee Leslie v Public Prosecutor
[2013] SGHC 141

Case Number	:	Magistrate's Appeal No 91 of 2012
Decision Date	:	25 July 2013
Tribunal/Court	:	High Court
Coram	:	Choo Han Teck J
Counsel Name(s)	:	Wee Pan Lee (Wee Tay & Lim LLP) for Leslie Liew Cheong Wee; Christopher Ong and Terence Chua (Attorney-General's Chambers) for the Public Prosecutor.
Parties	:	Liew Cheong Wee Leslie — Public Prosecutor

25 July 2013

Choo Han Teck J:

1       The appellant was a 35-year-old engineer who was employed by Power Automation Pte Ltd (“PA”) from 17 January 2010. He left the company on 13 May 2010. At the time he was assigned to work in the Marina Bay Sands Integrated Resort in which PA was a sub-contractor for the setting up and installation of a “Power Monitoring Control System” or “PMCS”. It was a sophisticated computer system for managing and controlling all digitally controlled equipment in the resort including the casino. The trial judge summarised the description of the PMCS as –

8    The PMCS is a client/server system that collects status from field devices such as meters, circuit breakers, earth switches, battery chargers, UPS, network switches etc. The main supply system draws electricity from the national grid at 22kV. It is then distributed to all the sections of the site and stepped down to 400volts. The Circuit Control Switch Box to the casino is located in the gear room. The switch controls the supply of electricity to the casino.

9    There are also 5 generators on site for the stand-by system which is rated at 6.6kV individually. The power generated by each generator goes into an individual transformer which stepped it up to 22kV. It is then distributed to all the sections of the site and it is stepped down to 400 volts by many transformers. This provides as an emergency backup power supply from the generator. These generators will operate in the event of power failure from the national grid. In the generator room, there is also a Switch Box which handles the power output.

10    All power will be supplied through a circuit-breaker. There are different circuit breakers for different circuits. Electricity will only flow if the circuit break is in the “closed” position. The circuit-breaker cuts off supply of electricity if it is in the “open” position. The breakers are installed with a local remote switch. If the switch was turned to local, the PMCS would not be able to control the breakers. If it was put on remote mode, the PMCS would be able [to] open or close the breakers.

11    The PMCS continuously monitors the status of the 22kV and 6.6kV electric distribution systems and automatically react to any power failure conditions. It allows the operator to use the Human Machine Interface (“HMI”) in any of the workstations to monitor and control the High Tension (“HT”) system. It also allows the monitoring of the Low Voltage Main Switchboards.

12    The PMCS also maintain many records, known as logs. There is an entry log, and an alarm log. The entry log records the time, identity and action each time the PMCS is accessed. The alarm log records the alarms each time there is a malfunction. Access to the PMCS is by way of either the viewing account of Vicky or operator level OP1 with their respective passwords.

2       On 12 May 2010 there was a massive blackout at the casino around 12.20am. All levels from the basement to level 3 of the northern section of the casino were affected. The police were called because the security supervisor suspected that the blackout occurred because someone had wilfully tampered with the electrical system. After investigations, the appellant was charged on five counts under s 3(1) of the Computer Misuse Act (Cap 50A, 1998 Rev Ed) (“the Act”) and one count under s 3(2) of the Act. Sections 3(1) and (2) of the Act provide as follows –

3(1)  Subject to subsection (2), any person who knowingly causes a computer to perform any function for the purpose of securing access without authority to any program or data held in any computer shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a second or subsequent conviction, to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 3 years or to both.

(2)    If any damage is caused as a result of an offence under this section, a person convicted of the offence shall be liable to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 7 years or to both.

He claimed trial and was eventually convicted by the court below on all six charges and was sentenced to a fine of $3,000 each for the first to fifth charges and two weeks imprisonment and $15,000 fine in respect of the sixth charge. He appealed against convictions and sentences before me. The prosecution cross-appealed against the sentences passed.

3       It was not disputed that access to the sensitive and vital controls required special access codes. Mr Wee, counsel for the appellant, submitted that this was not a case of computer hacking because the appellant was working on a project for his employers at the MBS and was authorised to access the system. Counsel submitted at length as to the chain of command from the MBS to the main contractor, to PA and argued that the appellant had not misunderstood or overstepped his authority. What was being overlooked however, was that the appellant went through an elaborate process to give himself remote access through his personal computer, and further, he added the email address ‘ernie.masih@gmail.com’ (which was his but not used since 2009 and was not an address known to his employers) to the system administrator in order to gain access to the system. The unanswerable evidence was that the appellant completed the layers of security commands in order to execute the instruction causing the blackout. The procedure required for such an instruction to be executed ruled out an accidental activation of the command. The inescapable conclusion that must be drawn from all these acts is that the appellant deliberately intended to cause the blackout. When there were no instructions or reasons for doing so, the natural inference must be that he did so with mischief in mind. It might be that the appellant was angry with MBS or his employer (we do not know), but his actions were clearly an offence under s 3 of the Act. He had no authority to access the computer, let alone use it to create a blackout at MBS. The trial judge noted the inconsistent statements of the appellant as to whether he committed the act under the sixth charge deliberately, and found the appellant’s explanation to be without merit. The appeal against conviction is accordingly dismissed. Although the appellant appealed against the sentences imposed, counsel did not address me as to why he thought the sentences were manifestly harsh. In my view (with the exception of the sentence in respect of the sixth charge which I shall discuss shortly), they were not. I shall now address the Public Prosecutor’s appeal against the sentences, as well as the sixth charge in respect of the appeal by the appellant.

4       Mr Ong, the DPP submitted that the sentences were inadequate and that a substantial fine be imposed on the first five charges and a higher term of imprisonment in respect of the sixth charge. Instead of the term of two weeks’ imprisonment, the learned DPP submitted that the sentence should be enhanced to eight weeks. Mr Ong submitted that the act under the sixth charge amounted to ‘an intentional sabotage’. The sixth charge is basically an enhanced version of a charge under s 3(1), and because damage is caused, the sentencing court has the power to impose an enhanced sentence of up to $50,000 fine or to imprisonment of a term not exceeding seven years or to both fine and imprisonment. In contrast, a conviction under s 3(1) attracts the punishment of a fine not exceeding $10,000 or imprisonment not exceeding three years or to both fine and imprisonment. The key to the enhancement under s 3(2) lies in the phrase ‘If any damage is caused’. Damage is not any damage but damage as defined in s 2 of the Act. Section 2 defines damage as follows:

‘damage’ means, except for the purposes of section 13, any impairment to a computer or the integrity or availability of data, a program or system, or information, that –

(a)causes loss aggregating at least $10,000 in value, or such other amount as the Minister may, by notification in the Gazette, prescribe except that any loss incurred or accrued more than a year after the date of the offence in question shall not be taken into account;

(b)modifies or impairs, or potentially modifies or impairs, the medical examination, diagnosis, or treatment or care of one or more persons;

(c)causes or threatens physical injury or death to any person; or (d) threatens public health or public safety.

5       It will be seen that the four instances of damage are very specific. In the case of (d), there may also a distinction between ‘public health’ and ‘public safety’. It is the duty of the prosecution to ensure that all the particulars that constitute a charge are given so that the accused knows exactly what he needs to defend himself against. In the instance case, the original sixth charge appears to specify that the damage was under s 3(2)(a) because it contained the phrase ‘of at least $10,000’ immediately after the words ‘causing damage’ in the charge. However, the charge was then amended with the words ‘of at least $10,000’ struck out. That indicated that the prosecution was not going to allege and prove that the accused caused damage of at least $10,000. But what then was the damage caused? That the charge did not say, nor was any evidence led detailing so. The defence did not point it out, and the trial judge assumed that damage was proved. He held that ‘Financial losses would also have been sustained through a stop in the operations of the casino business. Inevitably, the reputation of the MBS would also have been marred as it would have ruined the experience for their patrons.’ With respect, that was not the damage that the prosecution had particularised and a loss of reputation is not defined as damage under the Act. Before me the DPP submitted that the trial judge failed to take into account that the blackout was caused in ‘one of Singapore’s integrated resorts, whose development and opening were widely publicised worldwide and attracted overwhelming media attention and scrutiny.' The DPP went on to submit that the ‘MBS was also the pinnacle of Singapore’s tourism industry at the time, and both its recent launch and its unique contribution to the Singapore skyline drew international attention.’ These are clearly not matters that are within the definition of ‘damage’ in s 2 of the Act. Private practice lawyers and the civil court might be interested in the reputation and standing of a private institution, but those are not matters that are the concern of the public prosecution service and the criminal court generally, and in this offence specifically.

6       It was only on appeal that the DPP submitted that a blackout might be a threat to public safety. That might be a common sense proposition but it was not particularized in the charge and was thus not the prosecution’s case at trial. Neither was evidence led to support it. Since damage was not particularised or proved and since the trial judge did not make any findings on such damage based on any evidence (since such evidence was not presented before the court), the sixth charge was only a charge under s 3(1), and though properly convicted as such, the sentence ought be neither more or less than the sentences of the five other similar charges. I will amend the sixth charge by deleting the words ‘Section 3(2) read with’, and vary the sentence to a fine of $3,000, and in default, three weeks imprisonment. Conduct constituting an offence under s 3 of the Act can vary widely in scope and nature. An offence under s 3(2) will very likely attract custodial sentence, and an offence under s 3(1) may similarly attract a custodial sentence if sufficiently grave and serious even though no damage was caused.