OVERVIEW
Cyber-extortion occurs when criminals use digital technology to threaten individuals or businesses with financial ruin, operational disruption or severe reputational damage unless a ransom is paid.
It may include ransomware demands, threats to publish confidential material, threats to disable systems, or demands backed by threatened online harm. Where a person makes an unwarranted demand with menaces with a view to gain or intent to cause loss, the conduct may amount to blackmail under section 23 of the Theft Ordinance (Cap. 210).
STATUTORY PROVISIONS
section 23 of the Theft Ordinance (Cap. 210)
The relevant part of the current statutory provision states:
Section 23 — Blackmail
A person commits blackmail if, with a view to gain for himself or another or with intent to cause loss to another, he makes any unwarranted demand with menaces; and for this purpose a demand with menaces is unwarranted unless the person making it does so in the belief that he has reasonable grounds for making the demand and that the use of the menaces is a proper means of reinforcing the demand.
COMMON FORMS
Three Main Forms of Cyber-extortion
Cyber-extortion commonly manifests in three main formats in Hong Kong:
- Ransomware and double extortion: Attackers breach a company's network, encrypt critical databases using malware, and demand payment—often in cryptocurrency such as Bitcoin—in exchange for a decryption key. In a double-extortion attack, the criminals also remove sensitive customer or business records and threaten to publish them on the dark web if the ransom is not paid.
- Sextortion scams: A perpetrator induces a victim to send explicit or intimate photographs or videos during an online interaction. The perpetrator then threatens to distribute the material to the victim's family, friends or employer through social media or other channels unless money is paid.
- Distributed denial-of-service (DDoS) extortion: Attackers overwhelm an e-commerce platform, banking portal, cryptocurrency exchange or other online service with internet traffic in order to disrupt or disable it. They then demand payment to halt the attack and restore normal access to the service.
Maximum Penalty
- Maximum imprisonment: 14 years on conviction upon indictment.
HOW MCS CAN ASSIST
Advice and representation
MCS can assess the charge, the statutory elements and the prosecution evidence; advise on interview, plea, trial and sentence; and identify any defence or evidential issue available on the facts.