Criminal law - Appeals against sentence - Appellants convicted after trial of conspiracy to cause an unauthorised modification of data held on a computer, contrary to s 11.5(1) and s 477.2(1) of the Criminal Code (Cth) - One appellant sentenced to 2 years 6 months' immediate imprisonment to be released on a recognizance release order after serving 10 months and the other appellant sentenced to 3 years' immediate imprisonment to be released on a recognizance release order after serving 12 months - Whether trial judge's findings as to aggravating factors in error - Whether the trial judge erred by failing properly to consider the imposition of an order that the appellants be released forthwith pursuant to s 20(1)(b) of the Crimes Act 1914 (Cth) - Whether the sentences were manifestly excessive

Crimes Act 1914 (Cth), s 16A, s 17A, s 19AC, s 20

Judiciary Act 1903 (Cth), s 68

Leave to appeal refused on grounds 1, 2 and 3 of each appeal

Bugmy v The Queen [1990] HCA 18; (1990) 169 CLR 525

De Hollander v The Queen [2012] WASCA 127

Deakin v The Queen [1984] HCA 31; (1984) 58 ALJR 367

Hili v The Queen [2010] HCA 45; (2010) 242 CLR 520

Hull v The State of Western Australia [2005] WASCA 194; (2005) 156 A Crim R 414

Law v The State of Western Australia [2009] WASCA 193

Power v The Queen [1974] HCA 26; (1974) 131 CLR 623

R v Olbrich [1999] HCA 54; (1999) 199 CLR 270

R v Stevens [1999] NSWCCA 69

R v Stockdale [1995] VSC 181

R v Storey [1998] 1 VR 359

The State of Western Australia v JWRL (a child) [2010] WASCA 179

1 MARTIN CJ: Leave to appeal on grounds 1, 2 and 3 of each of these appeals should be refused and the appeals should be dismissed for the reasons given by Buss JA, with which I agree.

2 BUSS JA: The appellant in CACR 115 of 2012 (Mr Larkin) and the appellant in CACR 116 of 2012 (Mr Shee) appeal to this court against sentence.

3 The sole count in an indictment alleged that, from on or about 12 October 2010 to on or about 4 November 2010, the appellants conspired to cause an unauthorised modification of data held in a computer, knowing that the modification would be unauthorised, and being reckless as to whether the modification would impair access to that or any other data held in any computer and/or the reliability, security or operation of any such data, and the modification of the data would impair access to, or the reliability, security or operation of other data by means of a carriage service, contrary to s 11.5(1) and s 477.2(1) of the Criminal Code (Cth) (the Code).

4 On 21 March 2012, after an 8 day trial in the District Court before Staude DCJ and a jury, the appellants were convicted.

(a) Mr Larkin: 2 years 6 months' immediate imprisonment, to be released on a recognizance release order after serving 10 months; and

(b) Mr Shee: 3 years' immediate imprisonment, to be released on a recognizance release order after serving 12 months.

Overview of the facts and circumstances of the offending

6 As at October 2010, Mr Larkin, who was then aged 37, and Mr Shee, who was then aged 28, had known each other for about 2 years. They met while studying for a Master of Business Administration degree at Curtin University.

7 At all material times, Mr Larkin had a professional association with the Department of Health (the Department). This relationship commenced in 2001 when he was employed by ISA Technologies, who acted as a consultant to the Department. Initially, Mr Larkin was a network consultant. In 2004 or 2005, he was appointed as a communications manager with responsibility for the Department's communications network.

8 Mr Larkin's role, as a communications manager, included managing the Department's telephone and data communications systems. These systems comprised about 22,000 end user devices and about 15,000 users. He had access to the Department's computer network.

9 Mr Larkin resigned from this position in 2006 to travel and work overseas. However, upon returning to Perth in March 2008, he resumed his former employment with ISA Technologies.

10 The Department, through ISA Technologies, engaged Mr Larkin's services as a project manager. Once again, he had access to the Department's computer network. He was responsible for managing a project which involved upgrading the Department's communications systems.

11 Within 6 months, Mr Larkin was requested to manage the Department's PABX replacement project. The estimated cost of this project was $27 million over a period of 8 years.

12 In July or August 2010, Mr Larkin was instructed to prepare documents calling for tenders to prepare a business case for the PABX replacement project.

13 Mr Larkin prepared the tender documents and sent them to selected consultants. Peter Farr Consulting was awarded the contract. At this stage, Mr Larkin's friend, Mr Shee, became involved.

14 Mr Larkin recommended to Mr Shee that he seek employment with Peter Farr Consulting. Mr Shee acted on this recommendation. He was engaged by Peter Farr Consulting to work on the business case for the PABX replacement project.

15 Mr Larkin had prepared a table of contents for the business case as part of the tender documentation. Mr Shee's role was to complete the necessary information. To assist him in this task, Mr Shee wanted to obtain details from Fremantle Hospital, Royal Perth Hospital and Royal Perth Hospital Shenton Park as to their experience with PABX systems.

16 In mid-October 2010, police obtained warrants to intercept communications between Mr Larkin and Mr Shee. These communications, which formed the foundation of the Crown's case at trial, revealed an agreement between Mr Larkin and Mr Shee to hack into the Department's computer network by installing an item of malicious software on a computer which would enable them to have undetected remote access to the network.

17 Mr Larkin and Mr Shee agreed that Mr Shee would write the malicious software. It was referred to by Mr Shee, in his communications with Mr Larkin, as a 'Trojan'. A 'Trojan', in the context of computer technology, is a program which appears innocuous but, when opened, permits a connection to a remote user.

18 The intercepted communications showed that over a period of about 3 weeks Mr Shee wrote the computer program, incorporated the program on a USB device and delivered the device to Mr Larkin, ready for installation on a Department computer.

19 However, at this point, being early November 2010, Mr Larkin told Mr Shee that 'the risk was too high' and he was not willing to proceed with their agreement.

The pursuit of the conspiracy before its abandonment

22 The trial judge summarised, in his sentencing remarks, the manner in which the conspiracy was pursued before its abandonment:

On 12 October 2010, you, Shee, sent an email to Larkin giving directions as to the use of encoding software which you wanted Larkin to use to protect your email communications. You sent him another email that day, the subject of which was what to do, which gave directions to him to use a bootable USB to get into a Department computer without having to enter any user credentials, in order to then copy secure administration files, specifically described as Sam Security and System files.

On 20 October 2010, you, Larkin, telephoned Shee and advised that you had copied the files and you discussed how the passwords contained in those files could be cracked using rainbow tables. You then encoded the files you had copied and then sent them to Shee by means of a compressed file called AC.rah.

On 21 October, you, Shee, sent Larkin a password to decrypt a subsequent encrypted file called 00.txt.gpg. This file, when decoded, revealed the network administration password, Doctor Who, and set out what were called 'next steps'.

These described what needed to be done to configure a connect-backed Trojan and test outward connectivity to what was ... described as a hacked Linux box which you could listen on as your server. It would be necessary to test the Trojan to ensure that anti-virus software did not detect it and to test the intrusion detection system of the Department's network.

On 25 October, you, Shee, sent Larkin an email containing a list of commands to execute tests of network security controls to determine available exit points from the network, and you requested that he capture and email to you the results. On 27 October, you, Larkin, sent another email to Shee containing administration files copied from a computer within the Department which had been encrypted and compressed.

That file was called PCSams.zip.gpg. This was done because you, Larkin, could not get access to the network with the Doctor Who password. You thought that it was incorrect, but it appears that you entered it incorrectly, as the same password was detected when the PCSams file passwords were obtained by Mr Shee.

You requested Shee to decode the files to obtain the user names and passwords, and on the same day you, Larkin, sent Shee an SMS containing the password to the encrypted file which you had previously emailed. Still later that day, you communicated by MSN Chat, discussing how you planned to obtain unauthorised access to the Department's network.

You, Larkin, indicated that you would not use your own work computer for this purpose, but would carry out actions directed by Shee from a computer in another building.

Shee told you that to execute the commands would not be suspicious, but that you should be careful what you logged on to, observing that the PCSams file had your ID inside as a cached credential. You went on to discuss the advantage of using a new computer, this being the one I find that you had previously ordered through the Help Desk for a subordinate who was yet to start work.

You, Shee, queried whether the Health Department system was linked to DTF, referring to the Department of Treasury and Finance. You said in the chat:

You, Larkin, replied that it was outside the firewall and confirmed to Mr Shee that it was segregated from the Department of Health network. After a 'by the way' reference by Mr Shee to Mr Farr, you, Larkin, remarked with heavy irony:

I will see if I can get a contract or at least to do security penetration testing. Then you can fully assess our situation. It looks like we have poor practices in place.

In another online chat that day you, Shee, indicated that you had finished writing the malicious software and were awaiting the results of connectivity tests to be done by Larkin.

On 29 October you, Shee, sent an SMS to Larkin which stated:

Managed to go on site yet? Would be good to explore them on the weekend.

You, Larkin, later sent an SMS to Shee which stated:

Running commands now. Someone behind me eating lunch.

This was consistent with other statements in your communication at that time which indicated your concern that you should not be observed running the commands that Mr Shee had given you.

You later had a telephone conversation in which you, Shee, provided to Larkin an Internet protocol address of a computer with which to test non-standard Internet connectivity from within the Department. At the start of the conversation you [Shee] inquired:

Is there anyone around you? Convenient to talk?

- but continued to receive your instructions. At one point Larkin said:

There's someone here, so I have to go. I have to go.

The conversation continued for a while and then you, Larkin, said:

I've left. There's someone there. I'm not hanging around.

In an informal MSN chat that day you, Shee, remarked:

Damn. I wish I was hexin the Health networks today already. Ha ha.

In the context of what was going on, I have no difficulty finding that you meant to say 'haxin', which on the evidence means 'hacking'.

On 1 [November] 2010 you, Shee, sent a text message to Larkin requesting to meet him to deliver the software you had written. In a later telephone conversation with Larkin that day you said you would deliver the file containing the malicious software to him at his home. The next day you sent an SMS to Larkin which stated:

The next day, which was 3 November 2010, you [Shee] sent an SMS to Larkin which stated:

Yet again on 4 November 2010 you, Shee, sent an SMS to Larkin which stated in part:

Hey, you free to deploy that file? We better get it done before you leave.

That day you, Larkin, responded by SMS to Shee stating:

LOL. Okay. Will do it myself, then (ts 630 - 633).

23 The trial judge recounted the facts and circumstances of the offence in his sentencing remarks.

24 His Honour noted that Mr Larkin had informed the police, when interviewed in relation to the offence, that his dealings with Mr Shee were not sinister and that he was merely intending to obtain informal remote access to the Department's computer network to assist Mr Shee in acquiring information relevant to the business plan he was preparing. Mr Larkin gave evidence to similar effect at trial. He maintained that nothing he did in relation to the Department's computer network was beyond his authority and that his purpose was legitimate. Further, Mr Larkin said that he would not have installed any software on the Department's computer network without approval. Plainly, the jury by its verdict rejected this exculpatory evidence.

25 The trial judge said that the only mitigating circumstance in relation to Mr Larkin's offending was that he ultimately declined to install the Trojan as he and Mr Shee had planned. His Honour was satisfied that when Mr Larkin communicated to Mr Shee that the risk was too high, he was aware of the criminality of his actions and was concerned about the consequences if his actions were detected.

26 Mr Shee declined to be interviewed by the police. He did not give evidence at trial. His defence was based on Mr Larkin's evidence and was to the effect that his activities were innocuous and legitimate. His actions were allegedly for reasons of expediency in completing his professional work for the Department. The jury by its verdict necessarily rejected this defence.

27 The trial judge characterised the conspiracy as an attempt by Mr Larkin and Mr Shee to penetrate the Department's computer network 'so as to obtain unauthorised access to documents to which you were not entitled and which would give you valuable commercial advantage in dealing with the Department' (ts 636). Their actions involved a high degree of premeditation, were sophisticated, and were done or intended to be done covertly.

28 His Honour found that Mr Larkin was in a position of trust with the Department as a result of his position as a project manager and his association with the Department for many years. Mr Larkin could see, as well or better than Mr Shee, the advantages of establishing a 'backdoor' to the computer network. His Honour said that Mr Larkin saw the potential opportunities for commercial advantage from the Department's infrastructure replacement programs. He took no steps to dissuade Mr Shee from his expressed intention to proceed with the installation of the Trojan after Mr Larkin had indicated his unwillingness to proceed. Mr Larkin did nothing to protect the Department for which he continued to work as a project manager.

29 The trial judge decided that although Mr Shee indicated, when Mr Larkin withdrew from the conspiracy, that he would proceed with the plan alone, there was no evidence that Mr Shee would have had the opportunity to install the Trojan himself. The plan could not be carried through to completion without Mr Larkin's participation.

30 His Honour noted that Mr Larkin had informed the police, when interviewed, that he and Mr Shee had discussed setting up a company to tender for government contracts.

31 The trial judge found that the joint intention of Mr Larkin and Mr Shee 'was not merely to obtain, via the backdoor access afforded by the Trojan, information relating to the telephone system replacement project, but in due course to obtain other information which would advantage the two of you commercially in obtaining and doing consultancy work for the Department of Health' (ts 635).

I observe, however, that your ambitions did not stop there. In one MSN chat to which I have already referred, you, Shee, suggested an attempt to hack the computer system of the Department of Treasury and Finance. You, Larkin, in your police interview indicated that you and Shee had in mind work not just for the Department of Health but for other government departments and agencies. I am satisfied that you acted out personal interests for eventual pecuniary gain (ts 635).

33 The malicious software written by Mr Shee was never found. As I have mentioned, Mr Shee incorporated the program on a USB device and delivered the device to Mr Larkin. Later, Mr Larkin deleted the program from his home computer. Mr Shee's computers were seized by the police and analysed, but some of the data on his desktop computer was encrypted and attempts to decode that data were unsuccessful. It is unknown whether the program would have been successful in enabling Mr Larkin and Mr Shee to access the computer network (ts 635).

34 As to Mr Larkin's personal circumstances, he was a single man when he committed the offence, but at the time of sentencing he had been married for 15 months and had a 5 month old child. He was the sole breadwinner for his family. He was unemployed for about 10 months after being charged, but when sentenced was employed and in receipt of a salary of $120,000 per annum. Mr Larkin was in good health. He had no prior convictions, was otherwise of good character and was well regarded by friends and associates. His Honour said that Mr Larkin had not demonstrated remorse. It was not manifested at trial. He falsely maintained in evidence that his conduct was legitimate and harmless.

35 As to Mr Shee's personal circumstances, he was a single man in good health. He was born in Singapore. Mr Shee resided in Australia pursuant to a bridging visa. He had applied for permanent residency. This application was likely to be compromised by his conviction. At the time of sentencing Mr Shee was unemployed and was being supported financially by his parents. He had no prior convictions and was otherwise of good character. The authors of written references spoke well of him.

36 The trial judge found that neither Mr Larkin nor Mr Shee was likely to reoffend and that their prospects of rehabilitation were very good. Personal deterrence was not a significant sentencing consideration.

37 His Honour noted that no loss or damage resulted from the offence in that the conspiracy was not pursued to completion. However, the offending was 'particularly grave given the importance and value of the great volume of data capable of being stored on a computer or in a computer system' (ts 643).

38 The data contained on the Department's computer network is, at least in part, valuable and confidential. The Department is one of the largest organisations in the public sector. It has a large annual budget. Consulting work for the Department is lucrative. The trial judge found that commercial advantage would be obtained by anyone who was able unlawfully to penetrate the defences of the Department's computer network in order to access confidential information.

39 His Honour said that each of Mr Larkin and Mr Shee was equally complicit in the conspiracy. However, it was necessary to differentiate between the sentences to reflect the mitigatory force of Mr Larkin's withdrawal from the conspiracy and his cooperation with the police.

40 Each of Mr Larkin and Mr Shee relies on four grounds of appeal. The grounds are identical.

41 Ground 1 alleges that the trial judge erred by finding, as an aggravating factor, that Mr Larkin's and Mr Shee's intention was not restricted to obtaining information relating to the PABX replacement project.

42 Ground 2 alleges that his Honour erred by concluding that it would be an exceptional case only of this kind in which immediate imprisonment was not imposed.

43 Ground 3 alleges that his Honour erred by failing properly to consider the imposition of an order that each of Mr Larkin and Mr Shee be released forthwith, upon giving security, from the term of imprisonment imposed, pursuant to s 20(1)(b) of the Crimes Act 1914 (Cth).

44 Ground 4 alleges that his Honour erred in the exercise of his discretion by imposing a sentence that was manifestly excessive.

45 On 14 May 2012, Mazza JA granted leave to appeal on ground 4 and referred the application for leave to appeal on the other grounds to the hearing of the appeal.

46 Ground 1 alleges in essence that the trial judge erred in finding that Mr Larkin's and Mr Shee's intention was not restricted to obtaining information relating to the PABX replacement project.

47 The appellants do not challenge his Honour's finding that they committed the offence in pursuit of their personal interests and for commercial advantage with a view to monetary gain.

48 Counsel for the appellants explained at the hearing:

The complaint really is whether his Honour was entitled to go beyond that and find that although the appellants had to be sentenced on the basis that there was personal gain, did it go beyond the business plan, and in particular did [it] have the flavour of criminality that was not simply confined to the Department of Health (appeal ts 3).

49 A trial judge must make findings of fact, for the purposes of sentencing, on the evidence adduced at trial and any additional information received during the sentencing process. See, generally, s 15 of the Sentencing Act 1995 (WA), which provides that, to decide on the proper sentence to be imposed, or on imposing an order in addition to sentence, a court sentencing an offender may inform itself in any way it thinks fit.

50 In The State of Western Australia v JWRL (a child) [2010] WASCA 179, Martin CJ (Buss JA relevantly agreeing) referred to some of the established principles of law governing the fact-finding process for the purposes of passing sentence [9]:

Where the offender to be sentenced has been found guilty following trial by jury, the judge must determine the facts relevant to the sentencing process: see Cheung v The Queen [2001] HCA 67; (2001) 209 CLR 1 [5] and [36]. Although the facts found by the sentencing judge must be consistent with the verdict of the jury, it is the trial judge who must find those facts, rather than speculate about the facts that may or may not have been found by the jury: Cheung [9] - [11]. '[P]rovided the facts found by a sentencing judge are not inconsistent with the jury's verdict, a sentencing judge may well make an assessment of an offender's degree of culpability which would not be supported by all, or perhaps any, members of the jury': Cheung [36].

51 An aggravating circumstance is a fact or other circumstance likely to result in a more severe sentence than would otherwise be the case. A mitigating circumstance is a fact or other circumstance likely to result in a less severe sentence than would otherwise be the case. It is a well-established principle of sentencing at common law that the prosecution must establish an aggravating circumstance beyond reasonable doubt, and the offender must establish a mitigating circumstance on the balance of probabilities. See R v Storey [1998] 1 VR 359, 369, 371 (Winneke P, Brooking & Hayne JJA and Southwell AJA); R v Olbrich [1999] HCA 54; (1999) 199 CLR 270 [24], [25], [27] (Gleeson CJ, Gaudron, Hayne & Callinan JJ); Law v The State of Western Australia [2009] WASCA 193 [25] - [34] (Buss JA, McLure & Pullin JJA agreeing).

52 In the present case, the trial judge rejected Mr Larkin's evidence at trial (which was also admissible against his co-conspirator, Mr Shee) to the effect that there was an innocent explanation for their behaviour. The rejection of this explanation was consistent with the jury's verdict of guilty.

53 His Honour found that the joint intention of Mr Larkin and Mr Shee was not merely to obtain information relating to the PABX replacement project, but 'in due course to obtain other information which would advantage the two of you commercially in obtaining and doing consultancy work for the Department of Health' (ts 635). His Honour added that their ambitions 'did not stop there' (ts 635), and he concluded that Mr Larkin and Mr Shee 'acted out [of] personal interests for eventual pecuniary gain' (ts 635).

54 The findings and conclusion which I have recounted were reasonably open on the evidence and to the criminal standard of proof. I refer, in particular, to the following:

(a) Mr Larkin told the police in his interview that he and Mr Shee had discussed setting up a company so that they could tender for government contracts;

(b) Mr Shee suggested to Mr Larkin, in a MSN chat, that an attempt be made to hack into the computer system of the Department of Treasury and Finance. Mr Larkin did not dismiss the suggestion. He pointed out to Mr Shee that 'it was outside the firewall' and 'segregated from the Department of Health network' (ts 631). His Honour noted that, shortly afterwards, Mr Larkin remarked to Mr Shee 'with heavy irony':

I will see if I can get a contract or at least to do security penetration testing. Then you can fully assess our situation. It looks like we have poor practices in place (ts 631).

(c) Mr Larkin told the police that he and Mr Shee had in mind working not just for the Department (that is, the Department of Health), but for other government departments and agencies;

(d) his Honour made an unchallenged finding that consulting work for the Department was lucrative; and

(e) his Honour also made an unchallenged finding that commercial advantage would be obtained by anyone who was able unlawfully to penetrate the defences of the Department's computer network in order to access confidential information.

56 Ground 2 alleges in essence that his Honour erred in concluding that it would be an exceptional case only of this kind in which immediate imprisonment was not imposed.

A person is guilty of an offence if:

(a) the person causes any unauthorised modification of data held in a computer; and

(b) the person knows the modification is unauthorised; and

(c) the person is reckless as to whether the modification impairs or will impair:

(i) access to that or any other data held in any computer; or

(ii) the reliability, security or operation, of any such data; and

(i) the data that is modified is held in a Commonwealth computer;

(ii) the data that is modified is held on behalf of the Commonwealth in a computer;

(iii) the modification of the data is caused by means of a carriage service;

(iv) the modification of the data is caused by means of a Commonwealth computer;

(v) the modification of the data impairs access to, or the reliability, security or operation of, other data held in a Commonwealth computer;

(vi) the modification of the data impairs access to, or the reliability, security or operation of, other data held on behalf of the Commonwealth in a computer;

(vii) the modification of the data impairs access to, or the reliability, security or operation of, other data by means of a carriage service.

58 By s 11.5(1) of the Code, a person who conspires with another person to commit an offence punishable by imprisonment for more than 12 months, or by a fine of 200 penalty units or more, is guilty of the offence of conspiracy to commit that offence, and is punishable as if the offence to which the conspiracy relates had been committed.

59 The sentencing of offenders for federal offences is, in general, governed by pt IB of the Crimes Act. See Hili v The Queen [2010] HCA 45; (2010) 242 CLR 520 [23] (French CJ, Gummow, Hayne, Crennan, Kiefel & Bell JJ).

60 By s 68 of the Judiciary Act 1903 (Cth), some State or Territory laws in relation to the sentencing of federal offenders are picked up and applied when a State or Territory court, exercising federal jurisdiction conferred by s 68, sentences a federal offender. However, to the extent that pt IB of the Crimes Act makes other provision, State and Territory laws in relation to the sentencing of offenders are not picked up. See Hili [21].

61 Section 16A(1) of the Crimes Act provides that, in determining the sentence to be passed, or the order to be made, in respect of any person for a federal offence, a sentencing court must impose a sentence or make an order that is of a severity appropriate in all the circumstances of the offence.

62 By s 16A(2), in addition to any other matters, the court must take into account such of the matters listed in s 16A(2) as are relevant and known to the court.

63 Section 16A(3) states that, without limiting the generality of s 16A(1) and s 16A(2), in determining whether a sentence or order under, relevantly, s 20(1) is the appropriate sentence or order to be passed or made in respect of a federal offence, the court must have regard to the nature and severity of the conditions that may be imposed on, or may apply to, the offender, under that sentence or order.

64 By s 17A(1), relevantly, a court shall not pass a sentence of imprisonment on any person for a federal offence unless the court, after having considered all other available sentences, is satisfied that no other sentence is appropriate in all the circumstances of the case.

65 Section 19AC(1) provides, relevantly, that subject to s 19AC(3) and s 19AC(4), where a person is convicted of a federal offence, and a court imposes on the person a federal sentence of imprisonment that does not exceed 3 years, and at the time the sentence is imposed, the person is not already serving or subject to a federal sentence, the court must make a recognizance release order in respect of that sentence and must not fix a non-parole period. By s 19AC(4):

Where, but for this subsection, a court would be required by this section to make a recognizance release order in respect of a person, the court may decline to do so if, having regard to the nature and circumstances of the offence or offences concerned and to the antecedents of the person, the court is satisfied that such an order is not appropriate.

66 Section 20 is concerned with the conditional release of federal offenders after conviction.

67 By s 20(1)(a), where a person is convicted of a federal offence or federal offences, the sentencing court may, if it thinks fit, by order, release the person, without passing sentence on him or her, upon his or her giving security, with or without sureties, by recognizance or otherwise, to the satisfaction of the court, that he or she will comply with the conditions listed in s 20(1)(a).

68 Section 20(1)(b) provides that where a person is convicted of a federal offence or federal offences, the sentencing court may, if it thinks fit, sentence the person to imprisonment in respect of the offence or each offence, but direct, by order, that the person be released, upon giving security of the kind referred to in s 20(1)(a), either forthwith or after he or she has served a specified period of imprisonment in respect of that offence or those offences, that is calculated in accordance with s 19AF(1).

69 Although the Crimes Act does not authorise a sentencing court to 'suspend', wholly or partly, a term of imprisonment, the provisions with respect to recognizance release orders (in particular, s 19AC(1) read with s 20(1)(b)) are designed to achieve a similar sentencing outcome.

70 In the present case, the trial judge's comments that 'offences of this kind are very serious and will, by their nature, generally warrant imprisonment' (ts 643) and that 'it would be an exceptional case only of this kind in which imprisonment [was] not imposed' (ts 643), were made in the course of his Honour's determination that general deterrence was an important sentencing factor and after he had decided that 'no other disposition than one of immediate imprisonment would be appropriate' for Mr Larkin and Mr Shee (ts 643).

71 I am satisfied that when his Honour's comments are assessed, in the context of his sentencing remarks as a whole, it is apparent that his Honour was referring to very serious offending against s 477.2(1) of the Code, or against s 11.5(1) read with s 477.2(1), which is comparable to Mr Larkin's and Mr Shee's offending. That is, his Honour's remarks were confined to cases where the offending is, objectively, very serious and the offender does not have the mitigation of a plea of guilty, evinces no remorse and is motivated by the pursuit of commercial advantage with a view to monetary gain. So understood, his Honour's comments are not objectionable and do not reveal any error.

73 Ground 3 alleges in essence that his Honour erred in failing properly to consider the imposition of an order that each of Mr Larkin and Mr Shee be released forthwith in accordance with s 20(1)(b) of the Crimes Act.

74 As I noted (McLure P and Mazza JA agreeing) in De Hollander v The Queen [2012] WASCA 127 [86], the question whether to release a federal offender forthwith under s 20(1)(b) of the Crimes Act is part of a process which may involve three steps.

75 First, all relevant sentencing factors (notably, those referred to in s 16A) must be taken into account in deciding whether to impose a term of imprisonment and, if so, the length of the term. Secondly, it may be necessary for the court to consider whether, pursuant to s 19AC(4), it should decline to make a recognizance release order in respect of the offender. Ordinarily, s 19AC(1) requires a court to make a recognizance release order where a person is convicted of a federal offence and the court imposes a term of imprisonment not exceeding 3 years, but that provision is subject to, relevantly, s 19AC(4). Thirdly, the court must take into account, in deciding whether to release the offender forthwith under s 20(1)(b), the same factors as those applicable to the imposition and fixing of the term of imprisonment (notably, those referred to in s 16A). However, the weight to be given to these factors, and the manner in which they are relevant, will differ as a result of the different purposes underlying each function.

76 The statements of principle by the High Court in Power v The Queen [1974] HCA 26; (1974) 131 CLR 623, 628 - 629, Deakin v The Queen [1984] HCA 31; (1984) 58 ALJR 367, 367 and Bugmy v The Queen [1990] HCA 18; (1990) 169 CLR 525, 531 in relation to determining a non-parole period for a federal offence apply by analogy in determining whether a person who has been sentenced to a term of imprisonment for a federal offence should be released under s 20(1)(b), either forthwith or after he or she has served a specified period of imprisonment in respect of that offence. See De Hollander [80] - [83].

77 The trial judge made these observations in his sentencing remarks:

(a) s 17A of the Crimes Act provides that the court 'shall not impose a sentence of imprisonment unless, after having considered all other available sentences, the court is satisfied that no other sentence is appropriate in all the circumstances of the case' (ts 628);

(b) Mr Larkin's and Mr Shee's criminality was of 'a high level' (ts 636) and computer hacking is 'a most serious property offence' (ts 636);

(c) the provisions of the Code relating to computer crime recognise the public interest in 'protecting the integrity of computer systems so as to prevent unauthorised access to information which may be wrongfully used and to prevent damage to such systems' (ts 636);

(d) Mr Larkin's and Mr Shee's actions involved 'a high degree of premeditation, they were sophisticated, they were done or intended to be done covertly' (ts 636);

(e) the offence was so serious that 'the only appropriate sentence is one of imprisonment' (ts 643); and

(f) no fine of any amount would be 'a suitable punishment for a conspiracy to commit an offence which was pursued by sophisticated means almost to its completion, in circumstances which involved an egregious abuse of trust in the overt acts committed by you, Larkin, which you, Shee, encouraged' (ts 643), and 'no other disposition than one of immediate imprisonment would be appropriate' (ts 643).

78 His Honour had regard to the various factors relied on by counsel for the appellants in his submissions to this court. In particular:

(a) his Honour noted that the Department had not sustained any loss or damage (ts 641 - 642);

(b) his Honour referred to Mr Larkin's and Mr Shee's prior good character and excellent antecedents (ts 639 - 641);

(c) his Honour considered the issues of personal deterrence and rehabilitation, and found that Mr Larkin and Mr Shee were unlikely to reoffend and that their prospects of rehabilitation were very good (ts 642);

(d) his Honour mentioned the absence of any actual improper disclosure of confidential material (ts 636), although his Honour also noted, appropriately, the serious consequences of an actual breach of the computer network security (ts 643); and

(e) his Honour was cognisant of the adverse impact of the convictions upon Mr Larkin's and Mr Shee's careers and their ability to obtain employment (ts 639 - 641).

79 I am satisfied that the trial judge gave proper consideration to whether an order should be made under s 20(1)(b) that each of Mr Larkin and Mr Shee be released forthwith. The decision not to make such an order was not vitiated by any express error. For the reasons I give in deciding ground 4, the existence of error should not be inferred from the sentencing outcome.

81 Ground 4 alleges in essence that the sentences imposed by his Honour were manifestly excessive.

82 A ground of appeal which asserts that a sentence is manifestly excessive asserts the existence of an inferred error. It is necessary, in determining whether a sentence is manifestly excessive, to examine it from the perspective of the maximum sentence prescribed by law for the relevant offence, the standards of sentencing customarily observed with respect to that offence, the place which the criminal conduct occupies on the scale of seriousness of offences of the kind in question, and the personal circumstances of the offender.

83 The guidance afforded by comparable cases is flexible rather than rigid. They do not fix an upper or lower limit. The mere fact that a sentence is within the range of other sentences imposed for similar offences does not necessarily establish that there was an appropriate exercise of the sentencing discretion in the particular case. Similarly, the mere fact that a sentence is outside that range does not necessarily establish that the exercise of the sentencing discretion in the particular case miscarried.

84 The maximum penalty for an offence against s 11.5(1) read with s 477.2(1) of the Code is 10 years' imprisonment.

85 Neither counsel for the appellants nor counsel for the respondent was able to refer the court to any comparable cases of offending against s 477.2(1) or s 11.5(1) read with s 477.2(1). My research has not revealed any such cases.

86 It is apparent therefore that sentencing patterns have not been established for the offence in question.

87 Counsel for the appellants cited R v Stockdale [1995] VSC 181, R v Stevens [1999] NSWCCA 69 and Hull v The State of Western Australia [2005] WASCA 194; (2005) 156 A Crim R 414.

88 In Stockdale, the respondent pleaded guilty to four counts in an indictment alleging that he knowingly obtained protected information contrary to s 1312A of the Social Security Act 1991 (Cth); he directly disclosed to another person protected information contrary to s 1312B of that Act; he attempted to knowingly obtain protected information contrary to s 1312A of the Act; and, being a Commonwealth officer, he received a benefit, namely money, for himself on the understanding that his duty or authority as a Commonwealth officer would be influenced or affected contrary to s 73(2) of the Crimes Act.

89 Hayne JA (Charles JA and Crockett AJA agreeing) recounted the facts and circumstances of the offending in Stockdale:

The respondent, who is now aged 49, was employed at the Department of Social Security from April 1986. During the period in which he committed the offences with which he was charged, he was employed in the Teleservice Centre of the Geelong branch of the department. His primary duty was to supervise staff employed to answer telephone enquiries from the whole of country Victoria and several metropolitan social security offices. For the purposes of his duties he was able to gain direct access to the department's records of its clients held in the department's computer. These records are confidential ...

When interviewed by officers of the Australian Federal Police in May 1994, the respondent made full admissions of what he had done. He admitted that he had sought client information stored in the department's computer and said that he had done so at the request of a man called Belden, who was the principal of a private investigation business called Asset Recovery and Investigation. The respondent said that he had provided information to Belden up to 'a couple of times a week' and that he had been paid $5 or $10 for each name which he investigated, usually in cash. He said to the police that he had been doing this for twelve or thirteen months.

The respondent made two later statements to the Australian Federal Police and it emerged from those statements, coupled with other investigations that were made, that Belden had deposited a total of more that $4,400 to bank accounts of the respondent and that the respondent had retained 14 lists of names which Belden had asked him to search. Those lists contained over 300 names. The respondent said in his record of interview with police that he agreed to provide confidential information to Belden because he needed the money since 'travelling down to the Geelong Teleservice Centre was sending [him] broke'.

In the course of the hearing of the appeal before us it was put on behalf of the Crown (and not disputed on behalf of the respondent) that in truth the respondent may have received more than $4,500 - somewhere between $4,500 and $10,000, representing his gaining access without authority to records relating to as many as 1300 or 1400 people (pages 2 - 3).

90 The respondent entered an early plea of guilty, cooperated with the police, was of prior good character (with no prior convictions) and was willing to give evidence against Belden.

91 The respondent in Stockdale was sentenced to 12 months' imprisonment on each charge and, pursuant to s 20(1)(b) of the Crimes Act, it was ordered that he be released forthwith upon his entering into a recognizance in the sum of $500 on condition that he be of good behaviour for 12 months. The maximum penalty for each offence was no more than 2 years' imprisonment. The Court of Appeal of Victoria dismissed the Crown's appeal against sentence.

92 In Stevens, the appellant pleaded guilty to a count in an indictment which alleged that he intentionally, by means of a facility provided by a carrier, namely Telstra Corporation, inserted data into a computer owned and operated by AUSNet Services Pty Ltd, contrary to s 76E(a) of the Crimes Act. The maximum penalty for the offence was 10 years' imprisonment. The appellant also pleaded guilty to a number of other offences brought into account pursuant to s 16BA of the Crimes Act. He was sentenced to a total term of 3 years' imprisonment, but the sentencing judge directed his release on recognizance for a term of 18 months at the expiration of 18 months in custody. The Court of Criminal Appeal of New South Wales dismissed the appellant's appeal against sentence.

93 The objective facts of the count in the indictment in Stevens were stated by Studdert J (Stein JA and Smart AJ agreeing):

Her Honour found that the applicant regarded himself at relevant times as an Internet consultant. AUSNet Services Pty Ltd conducted a business for which it had a computer network with computer sites in Sydney and Melbourne, and its technical director, who gave evidence before her Honour, was Mr Ernst Van Oeveren.

...

On 17 April 1995 the applicant utilised Mr Van Oeveren's user account and password details to gain access to the file that controlled the appearance and content of AUSNet's home page on the World Wide Web. He proceeded then to alter the information on that file to display in a permanent fashion the following message:

'Did you know that AUSNETS clients credit cards details are all sitting readable on their system?!?!?! We have the file of card numbers, and it has already been distributed to many hackers and carders around the world. so don't be surprised if all you [sic] cards have millions of dollars of shit on them AUSNET is a disgusting network ... and should be shut down and sued by all their users! hehe REMEMBER ... TOO MANY SECRETS!!!!!!!!!' [7], [9]

94 The appellant in Stevens suffered from a personality disorder which required supportive psychotherapy [27]. He had an earlier conviction for a computer offence. This involved obtaining access to a Commonwealth computer which he broke into at a university. The earlier offence occurred in 1993 and the appellant was punished by a fine [28].

95 Studdert J, in rejecting the appellant's submission that his sentence was manifestly excessive, said:

It is to be observed that the maximum penalty provided for the type of offence charged in the indictment was imprisonment for ten years. That reflects the seriousness with which the legislature intended that the offences created by s 76E(a) were to be regarded.

What the applicant did he did maliciously, as her Honour found and what the applicant did was causative of significant harm. Moreover the offence was not an isolated incident and her Honour was called upon to take into account a course of conduct reflected in the eight other offences that involved computer abuse.

...

The applicant's offences must be regarded as grave. Computer technology plays an important role in modern society. The potential for harm by computer abuse of the type that occurred in this case, in a society which is becoming increasingly dependent upon computers, requires that considerations of deterrence, not only of the offender but of others who might be tempted to offend in a similar way, should be adequately reflected when it comes to sentence [48] - [49], [54].

96 In Hull, the appellant was convicted, on her pleas of guilty, of two offences. The first was a count of corruption, contrary to s 83(c) of the Criminal Code (WA), for which a sentence of 12 months' immediate imprisonment was imposed. The second was a count of unlawful use of a computer contrary to s 440A of the Criminal Code (WA), for which a sentence of 3 months' immediate imprisonment was imposed. The sentences were ordered to be served cumulatively. The total effective sentence was therefore 15 months' imprisonment. A parole eligibility order was made. The maximum penalty for the offence against s 440A was 2 years' imprisonment.

97 The appellant in Hull was the manager of licensing services at the Albany Licensing Centre. She had been a State public servant for 18 years. The appellant corruptly issued a false driver's licence for her de facto husband (which he did not use). After a complaint was made, the appellant went on leave while an investigation was undertaken. During this time she saw a motor vehicle, the driver of which matched the description of the person who had made the complaint. She arranged for an employee at the Albany Licensing Centre to make an unlawful 'vehicle registered owner check'. The appellant's personal circumstances were difficult. The sentencing judge took into account the breach of trust involved in the offence, the early plea of guilty and the appellant's good antecedents, but decided that general deterrence required the imposition of a term of immediate imprisonment. This court, by a majority, allowed the appeal and ordered that the sentences of imprisonment be suspended for two years.

98 In the present case, neither Stockdale nor Hull is of any assistance. The maximum penalty for the offences in those cases was only 2 years' imprisonment and the offenders pleaded guilty. Also, the objective seriousness of their offending was materially less egregious than that of Mr Larkin and Mr Shee.

99 Stevens is of limited utility. On the one hand, the offender committed multiple offences which caused significant harm, and he had a prior criminal record. On the other, he pleaded guilty and suffered from a personality disorder which required supportive psychotherapy. The importance of the decision in Stevens, for present purposes, lies in the Court of Criminal Appeal's emphasis on the importance of general deterrence in sentencing for serious computer offences.

100 In the present case, the offending by Mr Larkin and Mr Shee was serious. As the trial judge found, their actions involved a high degree of premeditation. The plan they agreed and embarked upon was sophisticated. It was implemented or intended to be implemented covertly. Mr Larkin and Mr Shee were intelligent. Mr Larkin had a position of trust within the Department and Mr Shee had significant knowledge and skills as a computer technician. Each of them was highly educated. The motive for their offending was the obtaining of commercial advantage and monetary gain. They knew that their conduct was wrong. Neither Mr Larkin nor Mr Shee had the benefit of the mitigation that a plea of guilty would have brought. They were not remorseful.

101 The dominant sentencing factors were appropriate punishment and general deterrence. The maximum penalty of 10 years' imprisonment is indicative of the seriousness of the offence. Computer networks and technology are fundamental to the proper functioning of government departments and instrumentalities. Offences of this kind, if carried to completion, have the potential to inflict serious harm directly on government entities and indirectly on the community. Potential computer hackers who might be tempted, either out of malice or with a view to profit, to commit offences of the kind proscribed by s 477.2 of the Code must be deterred.

102 I am satisfied that the sentences imposed on Mr Larkin and Mr Shee were not manifestly excessive. In particular, I am satisfied that the trial judge did not err in failing to release Mr Larkin and Mr Shee forthwith under s 20(1)(b) of the Crimes Act. My assessment of the length of each head sentence and the length of each pre-release period, in the context of

the maximum penalty, the objective seriousness of Mr Larkin's and Mr Shee's offending, their personal circumstances and all mitigating and aggravating factors, does not indicate that the sentencing dispositions were in any respect plainly unreasonable or unjust. The sentences were of a severity that was appropriate in all the circumstances of the case. Error should not be inferred from the outcome of the sentencing process.

104 I would refuse leave to appeal on grounds 1, 2 and 3 of each appeal. The appeals should be dismissed.