OVERVIEW
Sections 59 and 60 of Hong Kong's Crimes Ordinance (Cap. 200) criminalise the intentional or reckless destruction, alteration or impairment of data and computer systems, treating digital disruption as criminal damage to property. The offence covers conduct such as erasing data, installing malware or disrupting systems, including through a distributed denial-of-service (DDoS) attack, provided that the act lacks lawful excuse, damages property belonging to another, and involves either an intention to cause damage or recklessness as to whether damage would be caused.
A conviction can result in imprisonment for up to 10 years for ordinary criminal damage. The maximum is life imprisonment for the aggravated offence under section 60(2), where the additional statutory requirements concerning intent or recklessness as to endangering another person's life by the damage are proved.
STATUTORY PROVISIONS
sections 59 and 60 of the Crimes Ordinance (Cap. 200)
The relevant part of the current statutory provision states:
Section 59 — Meaning of computer misuse and damage
Misuse of a computer includes causing it to function other than as established by or on behalf of its owner, altering or erasing any program or data, or adding any program or data. Misuse resulting in impairment of a computer, storage medium, program, data or the reliability of data is damage to property.
Section 60 — Destroying or damaging property
A person who without lawful excuse destroys or damages property belonging to another, intending to destroy or damage such property or being reckless as to whether it would be destroyed or damaged, commits an offence.
ELEMENTS OF THE OFFENCE
Destroying or Damaging "Property"
The target of the attack must constitute property for the purposes of sections 59 and 60. Section 59 gives property a broad meaning and expressly addresses damage resulting from computer misuse. Relevant property may include:
- Any program or data stored in a computer or on a storage medium, including a hard drive, USB device or remotely hosted server.
- The physical computer hardware or storage medium itself.
The Act of Destruction
Under section 59(1A), damage caused through misuse of a computer does not require physical breakage. Computer misuse may result in legally recognised damage where the defendant's actions:
- Alter or erase programs or data—for example, deploying ransomware that encrypts files, wiping a hard drive or changing website code.
- Add unauthorized programs or data—for example, introducing malware, spyware or trojans into a system.
- Impair the operation of a computer, storage medium, program or data—for example, launching a distributed denial-of-service (DDoS) attack that floods a server and renders it inaccessible.
Belonging to Another
The data, program or computer network must belong to someone else.
Absence of Lawful Excuse
Section 64 provides statutory lawful excuses. A defendant may have a lawful excuse if they honestly believed that the person entitled to consent to the destruction or damage had consented, or would have consented had they known of the circumstances. A lawful excuse may also arise where the defendant acted to protect property belonging to themselves or another person, honestly believed that the property was in immediate need of protection, and honestly believed that the means adopted were reasonable having regard to all the circumstances.
Maximum Penalty
- Ordinary criminal damage: Up to 10 years' imprisonment.
- Aggravated criminal damage under section 60(2): Up to life imprisonment.
HOW MCS CAN ASSIST
Advice and representation
MCS can assess the charge, the statutory elements and the prosecution evidence; advise on interview, plea, trial and sentence; and identify any defence or evidential issue available on the facts.