Factual and Procedural Background
The Applicant, aged 26, pleaded guilty on 13th December 2011 at the Crown Court at Southwark to four counts of offences under the Computer Misuse Act 1990: three counts of securing unauthorised access to computer material with intent, and one count of unauthorised modification of computer material. A fifth count concerning making, supplying or obtaining articles for use under the Act was left on the file. The Applicant was sentenced on 17th February to 8 months' imprisonment concurrent on each count. Additionally, a serious crime prevention order was imposed for five years commencing upon release or sentencing, imposing various restrictions on the Applicant's computer and internet use.
The offending involved hacking into Facebook's computer systems between April and May 2011. The Applicant accessed protected servers, exploited vulnerabilities, infiltrated employee email accounts, and copied intellectual property including Facebook's source code onto a portable hard drive. Facebook estimated direct costs of approximately $200,000 relating to investigation and remediation. The FBI and United States Department of Justice had also invested significant resources in identifying the Applicant.
At sentencing, submissions were made on behalf of both the Applicant and the Crown. The Applicant had previously exposed vulnerabilities at Yahoo and was paid for assistance. Psychological reports indicated the Applicant suffered from multiple conditions including Asperger's syndrome and personality disorder. The Applicant claimed his intention was to identify weaknesses and notify Facebook, though the court found this was not the case. The probation officer assessed a low risk of reoffending and harm to others.
Legal Issues Presented
- Whether the sentence of 8 months' imprisonment was manifestly excessive given the circumstances and mitigating factors.
- Whether the imposition of the serious crime prevention order was proportionate and justified based on the risk of reoffending.
Arguments of the Parties
Appellant's Arguments
- The custodial sentence, while justifiable, was manifestly excessive considering the Applicant's personal mitigation and full cooperation during police interviews.
- The Applicant had to abandon an Open University course, evidencing personal disruption caused by the sentence.
- The risk of reoffending was low, especially since the Applicant was effectively barred from internet use, making the serious crime prevention order disproportionate.
Respondent's Arguments
- Reference to authorities concerning offences under the Computer Misuse Act 1990 supported the sentence imposed.
- Highlighted aggravating factors such as the persistence, planning, and sophistication of the offence, and the damage caused to the victim company.
- Maintained that the serious crime prevention order was appropriate given the seriousness of the offence and the risk of further offences.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| R v Lindesay [2001] EWCA Crim 1720, [2002] 1 Cr App R(S) 370 |
Sentencing for unauthorised access with intent and deletion of data; factors including use of confidential passwords, motive, and breach of trust |
Used to illustrate aggravating factors such as revenge motive and breach of trust justifying custodial sentence |
| R v Vallor [2003] EWCA Crim 2288, [2004] 1 Cr App R(S) 319 |
Sentencing for planned, calculated computer disruptions causing widespread inconvenience |
Referenced to show seriousness of planned and widespread disruption as aggravating factor |
| R v Baker [2011] EWCA Crim 928 |
Sentencing for unauthorised access to government computer systems; relevance of offender's good character and motive |
Supported the principle that revenge motive is an aggravating factor and good character may mitigate sentence |
| R v Batcherlor [2010] EWCA Crim 102 |
Criteria for imposing serious crime prevention orders under the Serious Crime Act 2007 |
Used to explain legal threshold for serious crime prevention orders and their preventive, not punitive, nature |
| R v Hancox [2010] EWCA Crim 102 |
Requirement of reasonable grounds for risk of further serious offences; proportionality and Article 8 ECHR considerations |
Applied to assess appropriateness and proportionality of the serious crime prevention order in this case |
Court's Reasoning and Analysis
The court acknowledged the complexity of the sentencing exercise, carefully weighing aggravating and mitigating factors. It emphasized the persistence, sophistication, and deliberateness of the Applicant's hacking activities, which penetrated deeply into a major international company's systems and posed a significant potential risk to its operations. The court accepted the Applicant's personal mitigation, including psychological conditions and lack of financial motive, and noted that the Applicant had not passed on the stolen information.
However, the court found that the Applicant's motive was not to act as an ethical hacker informing the company, but rather to prove his capability, which diminished the mitigating effect of his intentions. The court considered the potential damage significant but noted that actual financial loss was limited to investigation costs and that all compromised material was recovered.
Regarding the serious crime prevention order, the court found that although the sentencing judge was entitled to assess a risk of reoffending, the proportionality of the order had not been properly considered in the full context of the Applicant's circumstances. The court emphasized that such orders are preventive and must be supported by reasonable grounds indicating a real risk of further serious offences.
Holding and Implications
The court allowed the appeal, substituting the custodial sentence with one of 4 months' imprisonment concurrent on each count, reduced from 8 months. The sentences were to run concurrently. The court also quashed the serious crime prevention order.
The direct effect of this decision is a reduction in the Applicant's custodial sentence and removal of the restrictive serious crime prevention order. The court did not set new precedent but clarified the importance of proportionality in imposing serious crime prevention orders and the need to balance aggravating and mitigating factors carefully in sentencing computer misuse offences.