OVERVIEW
Enacted in 1993, long before the arrival of modern smartphones, cloud networks or apps, section 161 of the Crimes Ordinance (Cap. 200) criminalises obtaining access to a computer with one of four specified purposes: intending to commit an offence, dishonestly intending to deceive, seeking dishonest gain, or dishonestly intending to cause loss.
For over two decades, section 161 was famously nicknamed the "Swiss Army knife" or "catch-all" weapon of Hong Kong prosecutors. Because Hong Kong lacked bespoke laws for modern internet phenomena, the Department of Justice applied the expression "obtaining access to a computer" to prosecute a broad range of alleged misconduct involving digital devices.
Following Secretary for Justice v Cheng Ka Yee (2019) 22 HKCFAR 97, section 161 does not extend to a person merely using their own computer for an otherwise wrongful purpose. The prosecution must prove the legally relevant obtaining of access and the specified intent.
Below are some examples of offences under this section:
- Stolen credentials: Using stolen credentials to enter an employer's server and obtain payroll or customer data for dishonest gain.
- Email impersonation: Accessing another person's email account to impersonate them and deceive clients.
- Operational disruption: Entering a competitor's booking or inventory system intending to disrupt its operations and cause loss.
- Malicious software: Obtaining access to another computer to install malicious software or facilitate a separate offence.
STATUTORY PROVISIONS
section 161 of the Crimes Ordinance (Cap. 200)
The relevant part of the current statutory provision states:
Section 161 — Access to computer with criminal or dishonest intent
Any person who obtains access to a computer with intent to commit an offence; with a dishonest intent to deceive; with a view to dishonest gain for himself or another; or with a dishonest intent to cause loss to another, whether on the same occasion as he obtains such access or on any future occasion, commits an offence.
ELEMENTS OF THE OFFENCE
Obtaining Access To a Computer Belonging to or Controlled by Another
The prosecution must prove that the accused obtained access to a computer belonging to or controlled by another person. This requires legally relevant entry into or access to that other computer; merely operating, viewing, storing information on, or otherwise using the accused's own smartphone or computer does not satisfy this element. The particular program or data accessed, the means by which access was obtained, and the person entitled to control that access must be identified from the evidence. Following Cheng Ka Yee (see below), this offence cannot be applied to defendants who used their own devices without obtaining access to another person's computer.
The Mental Elements (Mens Rea)
Section 161 does not expressly require the prosecution to prove that the access was unauthorized. It must, however, prove beyond reasonable doubt that, when obtaining access, the accused possessed at least one of the four specific criminal or dishonest intents listed in section 161(1):
- Intent (a)—To commit an offence: The accused obtained access intending to commit a separate offence, such as entering a corporate server to steal protected material or introduce malicious software.
- Intent (b)—With a dishonest intent to deceive: The accused obtained access with a dishonest intention to mislead another person, such as entering a colleague's email account to send a message falsely appearing to come from that colleague.
- Intent (c)—With a view to dishonest gain for themselves or another: The accused intended a dishonest gain in money or other property for themselves or another. Under section 161(2), gain includes keeping what one has as well as obtaining what one does not have, and may be temporary or permanent.
- Intent (d)—With a dishonest intent to cause loss to another: The accused intended dishonest loss to another in money or other property. Loss includes not obtaining what one might obtain as well as parting with what one has, and may be temporary or permanent.
- Please see our page on Dishonesty.
LANDMARK COURT OF FINAL APPEAL CASE
Secretary for Justice v Cheng Ka Yee FACC 22/2018
In Secretary for Justice v Cheng Ka Yee & 3 Others, FACC 22/2018; [2019] HKCFA 9, the Court of Final Appeal considered whether section 161(1)(c) applied when a person used their own computer without obtaining access to another person's computer.
The Facts
The case arose from the disclosure of confidential primary-school admission interview questions. The respondents used digital devices, including their own smartphones, to photograph or handle the questions, and were prosecuted under section 161(1)(c) on the basis of illegal access to a computer with a view to dishonest gain.
The Court of Final Appeal's Ruling
The Court unanimously dismissed the Secretary for Justice's appeal. Having considered the text, context and legislative purpose of section 161, it held that section 161(1)(c) does not extend to a person's use of their own computer where that use does not involve obtaining access to another person's computer.
The ruling therefore drew an important boundary around the expression "obtains access to a computer". Merely using one's own smartphone or computer to carry out otherwise wrongful conduct is not, without access to another person's computer, the act prohibited by section 161(1)(c). The judgment did not abolish section 161: it remains applicable to conduct falling within its language, including illegal intrusion into another computer with the specified criminal or dishonest intent.
The Impact
The judgment required existing and pending section 161 cases to be reassessed according to the Court's construction. In a Legislative Council reply, the Government stated that the Police had eight section 161 cases pending handling as at 30 April 2019 and would consider whether section 161 or alternative charges remained appropriate on the facts of each case.
The decision also exposed gaps where conduct involving a person's own device was harmful but did not fall within another offence. The Government subsequently introduced specific voyeurism and intimate-image offences through the Crimes (Amendment) Ordinance 2021, while broader reform of cyber-dependent offences has continued through the Law Reform Commission's cybercrime project.
Maximum Penalty
- Maximum imprisonment: 5 years on conviction upon indictment.
HOW MCS CAN ASSIST
Advice and representation
MCS can assess the charge, the statutory elements and the prosecution evidence; advise on interview, plea, trial and sentence; and identify any defence or evidential issue available on the facts.