-714.
Although it is a decision on a different statute, there is some analogy
with the decision of the English Divisional Court in DPP v Lennon [2006] EWHC
1201 (Admin) on the question of whether the owner of a computer consented to
receive the equivalent of a DDoS attack in the form of a torrent of e-mails. The
court said that his general consent to receiving emails “plainly does not cover emails which are not sent for the purpose of
communication with the owner, but are sent for the purpose of interrupting
the proper operation and use of his system.”
15.
In my view, a DDoS attack is very appropriately described as a
misuse of the bank’s computer. Mr Shek said that it was wrong to have regard to
the use of the term “misuse of a computer” in construing the meaning of
paragraph (a). “Misuse of a computer” is a defined expression. It means, and
means only, what is stated in paragraphs (a), (b) and (c). I agree that the defined
term cannot be used to enlarge the meanings of paragraphs (a), (b) and (c) but
there is no reason why it cannot be considered when construing them. A defined
expression is not usually an arbitrarily chosen word but intended as a broad
description of a concept more precisely defined in the ensuing paragraphs. (See
Chartbrook v Persimmon [2009] 1 AC 1101, 1112-1113). In such case, it may be
used to elucidate any ambiguities in those paragraphs. Furthermore, paragraph (a)
itself describes the offence as a “misuse” of the computer.
16.
Mr Shek suggested that so broad a definition of the offence could
cause injustice. But one must take into account the general defences to a charge
of criminal damage and in particular the requirement that the “damage” must have
been caused “without lawful excuse”. In particular, section 64(2)(a) of the Crimes
Ordinance provides that it is a lawful excuse honestly to believe (whether
reasonably or not) that the owner had consented or, if he had known, would have