Craig S Wright"
12 The disputed email was received by RIC and at Mr Wright's email address at the company. The Judge drew the inference that it was sent using Mr Wright's email address to RIC and to his email address at the company and a copy was retained on his computer. This email formed the basis of the Anton Pillar order obtained by the plaintiffs which was executed on 16 September. The appellant in his affidavit of 14 October 2004 filed in the proceedings on sentence again denied sending this email and gave reasons (blue 148) why he could not have offered to do the work at the rate quoted. He also said (blue 148-9):
"I have recently obtained copies of the access logs from [CSU] on-line servers for my user account to access email (being the account from which it is alleged that I sent the email of 10 September 2003 to RIC). I have perused those logs and say that they disclose access to my account from proxy01.demorgan.com.au from August 2003 until November 2003. Proxy01.demorgan.com.au is a secured server inside [the company's] network and to which I have not had access since my resignation on 10 August 2003. The logs disclose access to the account from IP address 144.135.38.125 which is my IP address at the farm at Port Macquarie … The email dated 10 September 2003 … was sent from IP address 144.135.104.27 which is not my IP address and which I have traced to an address in Melbourne."
13 In his affidavit of 9 June 2005 (orange 3) the appellant said that between 8 August and 23 October 2003 he maintained two email addresses, one at CSU and the other at the company, being his private address and his work address. He said that access to email at CSU was linked to the server email address my.csu.edu.au. To access that server and create a record in the logs at CSU (orange 4) he must log into CSU through the server auth.csu.edu.au, and access the system my.csu.edu.au by using cwrigh20 and a password. Once one had validly logged into CSU one can access and use one's private email system and folders.
14 He said that on 12 August he was excluded from the company's premises and could no longer access its computer system.
15 Before the trial he made inquiries at CSU for records of emails sent from his private email address, but was told there were no such records. A relevant subpoena was served on CSU without result. He continued his inquiries after the trial and in December 2004 obtained an extract copy of the logs from CSU for August to October 2003 comprising about 60,000 pages.
16 He searched those logs which disclosed that secure CSU systems including my.scu.edu.au were accessed from proxy01.demorgan.com.au on 2549 occasions between August and October, an average of 21 times a day and he said that during that period he did not have access to nor did he access the address proxy01.demorgan.com.au.
17 He said that the only persons who could have accessed that address were persons working within the premises of the company and that if such persons had been accessing his private address during that period "they could have created email messages purporting to come from me on that private address".
18 Mr Ryan said in his affidavit that the appellant still had in his possession after 12 August 2003 laptop and work-station computers owned by the company which were configured to access proxy01.demorgan.com.au (orange 9). This repeated a statement in his affidavit of 2 September 2003 (blue 7) which identified three of the computers by make and serial number and referred to another two not so identified.
19 Mr Taylor said that the information sought by the appellant from CSU before and after the trial was freely available on its website with no requirement for a login or password, and the relevant webpage was not hard to locate from its home page. It could have been accessed by an appropriate search at any time during 2004.
20 In his further affidavit of 23 August the appellant said:
"I was never issued with a notebook/laptop at any time from [the company]. No computers owned by [the company] are, or have ever been, at my premises. The Dell host servers at my residence, which was searched pursuant to the Anton Pillar order on 16 September 2003, had different configurations from and were different makes from those used at [the company]. Further the serial numbers on the hosts were not those of the [the company] host's."
21 He said (orange 15-16) that proxy01.demorgan.com.au was the Host name of the unix server used by the company to access clients' sites and the Internet. It had a fixed and permanent IP address 203.34.22.195. The source of an email is the IP address of the system used to construct it and it appears on the header. The IP address of the proxy server within the disputed email dated 10 September 2003 is 203.34.22.195 which was the source of the email internal to the company.
22 The IP address 144.135.104.27 is a Telstra account in Melbourne and was not the sending IP of the disputed email. He said that it is an internal Telstra address and could not have been used to send the email as it is a secure dial in server at Telstra and does not run "a web client" (orange 16). The disputed email was sent from a web client. He said that the IP address for the Telstra server 144.135.104.27 listed in the header as the sending host of the email never had been his personal IP address. He had had the IP address 144.135.38.125 since 2002 on the Telstra two-way satellite link from his home until he had it changed in August 2005. He had an IP address on the Telstra 2-way satellite link from his home (orange 16). He also had a wireless network there during 2003 which the company was able to access (orange 17).
23 On 10 September 2003 he made calls on his mobile phone at about the time the disputed email was sent which, according to his mobile phone accounts, were sent through Berowra (10.36 am), Cowan (11.09 am) and Berowra (11.48 am) (sup blue 2/467). He said therefore he could not have been at home at Bagno or able to access his home computer at 11.23 on 10 September when the disputed email was sent (orange 17). He disputed parts of Mr Taylor's affidavit.
Admissibility of further evidence
24 Section 75A(8) of the Supreme Court Act provides that on an appeal from a judgment after a trial or hearing on the merits "the Court shall not receive further evidence except on special grounds". The Court has not attempted to exhaustively define what are special grounds for this purpose but the core concepts are those on which common law courts received fresh evidence on a motion for a new trial following the verdict of a jury. These were considered in Parsons v McCann (1954) 93 CLR 418, Wollongong Corporation v Cowan (1955) 93 CLR 435 and McDonald v McDonald (1965) 113 CLR 529. The evidence must be admissible and credible, and such that it could not have been discovered by the exercise of reasonable diligence before the trial. It must be of such probative value and significance that, taken with the evidence given at the trial, it will in all probability be decisive of the issues between the parties and result in a different verdict: McDonald v McDonald at 532 per Barwick CJ.
25 Although this is an appeal from a conviction for a criminal offence the procedure is that which applies under the Supreme Court Act to appeals in civil cases. Under the Criminal Appeal Act 1912 the discovery of fresh evidence may lead the Court of Criminal Appeal to enter a verdict of acquittal in a sufficiently strong case, and in other cases to order a new trial. The focus in the Court of Criminal Appeal is on whether there has been a miscarriage of justice. As Barwick CJ said in Ratten v The Queen (1974) 131 CLR 510, 517:
"Great latitude must of course be extended to an accused in determining what evidence by reasonable diligence in his own interest he could have had available at his trial, and it will probably be only in an exceptional case that evidence which was not actually available to him will be denied the quality of fresh evidence."
26 At 520 he discussed the way in which the Court of Criminal Appeal can use further evidence:
"… if the new material, whether or not it is fresh evidence, convinces the court upon its own view of that material that there has been a miscarriage in the sense that a verdict of guilty could not be allowed to stand, the verdict will be quashed without more. But if the new material does not so convince the court, and the only basis put forward for a new trial is the production of new material, no miscarriage will be found if that new material is not fresh evidence. But if there is fresh evidence which in the court's view is properly capable of acceptance and likely to be accepted by a jury, and which is so cogent in the opinion of the court that, being believed, it is likely to produce a different verdict, a new trial will be ordered as a remedy for the miscarriage which has occurred because of the absence at the trial of the fresh evidence."
27 The High Court affirmed these principles in Gallagher v The Queen (1986) 160 CLR 392, subject to some adjustments. The Court held (399, 402) that there will be a miscarriage of justice where "there is a significant possibility that the jury, acting reasonably, would have acquitted the applicant of the charge if the new evidence had been before it in the trial". The Court also referred (396, 401) to the judgment of Rich and Dixon JJ in Craig v The King (1933) 49 CLR 429, 439 where their Honours said of fresh evidence in criminal cases:
"Such evidence should be calculated at least to remove the certainty of the prisoner's guilt which the former evidence produced."
28 Gibbs CJ discussed the requirements for due diligence (396):
"… the conviction will not be usually set aside if the evidence relied on could with reasonable diligence have been produced by the accused at the trial … [but] this is not a universal and inflexible requirement: the strength of the fresh evidence may in some cases be such as to justify interference with the verdict, even though that evidence might have been discovered before the trial."
29 This Court has not decided whether the tests applied under s 75A(8) in civil cases apply to appeals from criminal convictions for contempt of court or whether the Court should adopt the less stringent tests applied in the Court of Criminal Appeal. This question was not fully argued and, without expressing any view on that question, we should apply the less stringent tests.
30 It is strongly arguable that the appellant has not discharged the onus of establishing that CSU's records of emails sent through its server could not have been discovered before the trial by the exercise of reasonable diligence. The affidavit evidence of Mr Taylor appears to establish that it would have been a simple matter to discover their existence by searching CSU's home page on its website.
31 The appellant was cross-examined but Mr Taylor was not. He lives at Bathurst and notice for him to attend for cross-examination was not given until a day or so before the hearing.
32 Since I have reached the firm conclusion that the appellant has not discharged the onus of proving that the further evidence is credible and would probably have been decisive, I am content to base my decision on those grounds without expressing a final opinion on the question of due diligence.
33 The case against the appellant was based on circumstantial and documentary evidence. This included emails recovered on the Anton Pillar raid, or produced by third parties on subpoena. The plaintiffs also tendered the appellant's mobile phone records and parts of his affidavits of 11 September and 24 October 2003. Finally they tendered the security records of the ASX showing visits by the appellant to its premises on 4, 8, 9, 11, and 30 September and 15 and 24 October 2003.
34 There were emails to and from RIC on 9 (two), 10 (five), 11 (two) and 30 September and to News Ltd on 22 and 23 October. The appellant's mobile phone records disclosed calls to RIC on 8 (three), 9 (four), 10, 15, 16 (four), 17 (two), 18 (five) and 29 September and 1, 2 (eight), 9 (three), 10, 14 (three), 20 (two) and 23 October. The appellant's affidavit of 11 September disclosed a further telephone call to RIC on 5 September.
35 The records disclosed telephone calls to the ASX on 4 (two), 9, 11, 23, 26 and 29 September and 1 and 9 October. There were also telephone calls to News Ltd on 15, 23, 24, 26 September and 1, 9 (four) and 23 October, to the Human Rights and Equal Opportunity Commission on 18 October and four calls to Val Morgan on 30 September. There were also emails to News Ltd on 22 and 23 October.
36 These facts, other than the authenticity of the emails of 11.23 am [para 11] and 11.16 am to RIC on 10 September 2003 (sup blue 2/354) were not in dispute.
37 In his affidavit of 14 October 2004 the appellant explained the background to the email of 11.16 am (blue 148 para 22), and denied sending the disputed email (para 23). In his affidavit of 9 June 2005 (orange 7) the appellant denied sending "emails" to RIC on 10 September 2003, and he repeated this denial in his affidavit of 23 August 2005 (orange 18 para 14). The denial in the plural was said by Mr Burton to refer to the emails of 11.16 am and 11.23 am, and not the earlier emails that day.
38 Subject to the submissions on legal questions which will be considered later, the circumstantial case against the appellant was overwhelming, even if the disputed email or emails are ignored. The relevant principles are those stated in Martin v Osborne (1936) 55 CLR 367, 375-6 per Dixon J:
"If an issue is to be proved by circumstantial evidence, facts subsidiary to or connected with the main fact must be established from which the conclusion follows as a rational inference … The circumstances which may be taken into account in this process of reasoning include all facts and matters which … make intelligible the course of conduct pursued … the acts of a party are admissible against him whenever they form a component in a combination of circumstances which is unlikely to occur without the fact in issue also occurring. The repetition of acts or occurrences is often the very thing which makes it probable that they are accompanied by some further fact. The frequency with which a set of circumstances recurs or the regularity with which a course of conduct is pursued may exclude, as unreasonable, any other explanation or hypothesis than the truth of the fact to be proved."
39 It was not suggested that the further evidence actually established that the disputed emails were forged by the company. The submission was that they had not been sent by the appellant, but had been fabricated by an unknown person who was able to access the company's computers as well as those of the appellant. Even if this had been established the conviction would probably not have been quashed having regard to the strength of the general circumstantial case.
40 The disputed email was found on a computer at the appellant's home during the Anton Pillar raid on 16 September 2003 (blue 109). It was found on a temporary Internet file opened and viewed during the raid when a copy to self folder used to store email messages online was accessed (blue 107, 108, 109). It had not originated on that computer, but had been sent from a remote location. However its presence in a "copy to self" file supported an inference that it had been sent by the appellant.
41 Mr Ryan said that a copy of the disputed email was received on the screen of his personal computer at the company's premises (blue 51). After the appellant left the company Mr Ryan reprogrammed his computer to ensure that incoming emails directed to the appellant were sent to his computer (orange pp 8-9).
42 The appellant said that after he left the company's premises on 12 August 2003 he could no longer access its secured server as it was protected by a security system known as a firewall for which he needed a password, a user name and an access token. He said he had surrendered his token (orange 4). Mr Ryan said that an access token was not required for this purpose (T 109).
43 The appellant said that he could not have sent the disputed email because he did not have access to computers which were configured to access proxy01.demorgan.com.au [para 18], but Mr Ryan said the appellant retained five computers belonging to the company which had this capacity. The appellant denied this. The appellant also said that proxy01.demorgan.com.au could only have been accessed by persons working within the company's premises (orange 6(20)) but Mr Ryan said it could have been accessed from any computer anywhere in the world with the appropriate configuration (orange 9(10)).
44 The appellant said that a third party could have accessed his secure email address at CSU to create and send the disputed email. Such a person would have needed to use the appellant's username and a password (orange 4(5)), or else to successfully hack into the system. It was not established that anyone at the company had the appellant's password or that his system had been penetrated.
45 The appellant established that during September 2003 secure accounts at CSU had been accessed through its secure server, server online, from proxy01.demorgan.com.au, another secure server (T 96) 58 times (exs C, D) and from the Telstra IP address 144.135.104.27 170 times. The former established very little because it was not known which secure accounts at CSU had been accessed and it was not established that the appellant's account had ever been accessed through proxy01.demorgan.com.au. There are probably thousands of such accounts which can be accessed through CSU's server online for the University, its staff, and the students (T 84, 96), and the access obtained on the 58 occasions could have been to any account at CSU (T 96).
46 The appellant said that the Telstra IP address 144.135.104.27 could not have been used to send the disputed email (orange 16). Mr Ryan said that it was an IP address allocated to Telstra under a portable allocation (T 98) for satellite usage (T 99). Authorised persons could use that IP address if they had access including portable access or could make use of satellite mechanisms (T 99). There was nothing on the copy search of 144.135.104.27 (ex E) to link that IP address to a satellite account or any particular satellite account (T 117).
47 According to the appellant the disputed email was sourced from a proxy server within the company with the IP address 203.34.22.195 (orange 16). He said in his oral evidence that it did not originate from this IP address but from somewhere in the company's network that was connected to that machine (T 127). He said that the IP address 144.135.104.27, the Telstra account, which was the "supposed" sending IP of the email, could not have been used to send it (orange 16). Mr Ryan said that it could have been sent through the Telstra IP address by any one who had appropriate access (T 99).
48 Mr Ryan called a colleague, Mr Dornbrack, to view the disputed email on the server of his personal computer (black 81). Mr Dornbrack went to the "properties" of the email "to determine how the email got sent to us" (93). In computer language he cut and pasted the properties on to a notepad which produced a header text file which he saved (black 82). A hard copy became part of ex C (sup blue 1/168). Using the information on this document he prepared a flow chart which traced the movements of the email which also became part of ex C (1/167). Material is added to the header of an email at each stage as it moves from server to server (91).
49 He said it was a web email "composed on the CSU post office" (83), the mail server at CSU (84). His flow chart traced the disputed email from the mail server postoffice.csu.edu.au to Telstra's Bigpond satellite service 144.135.104.27 (83) and also directly through an intermediate site at CSU to a computer designated firewall - ns.demorgan.com.au which was the company's firewall or security gateway designed to prevent its network being attacked from the Internet (85-6). The disputed email then passed to the company's proxy server proxy01.demorgan.com.au where email coming from the Internet is scanned (86) from where it passed to the company's email server and then to Mr Ryan's desktop PC (87).
50 If Mr Dornbrack's evidence was correct the disputed email originated from c_wright20@postoffice.csu.edu.au (92), a computer linked to CSU, and it was dispatched by the sender to the Telstra IP address and by different routes to the company and Mr Spencer. It did not originate at the company's IP address 203.34.22.195 allocated to proxy01. That was its destination on this track. He said that the timing differences at the different stages within the company's network were normal because the clocks on different pieces of computer hardware drift (88-9, 91). The appellant said in this Court when recalled that the company's computers operated on synchronised time (T 128). This was not put to Mr Dornbrack during his cross-examination at the trial.
51 The appellant said (orange 17-8) that if he had sent the disputed email it would have increased in size as it passed through each mail server until it reached the company. He said a comparison of the message source details for this email obtained from the company's exchange server produced to the Court on 19 September 2003 (orange 57-8) and the print out from the temporary Internet file downloaded from his computer during the Anton Pillar raid (blue 109) showed that its logical size had grown from 1687 to 4054. The appellant said that this indicated that it had originated at the company. The document at orange 57-8 contains more information about the source and movement of the email than the document produced by Mr Dornbrack (sup blue 1/168) already considered [para 50].
52 Mr Ryan said the document at orange 57 showed that the email did not originate from the company's IP address 203.34.22.195 but came through cwright20@postoffice.csu.edu.au (T 115-6). It did not show where it actually originated but it did not originate from 203.34.22.195 because that is where it went (T 116). He said that the letters and figures "3f5e7d03" in the header sheets (orange 57-9) for the company's exchange and mail servers constituted a unique message that indicated that the email was established by a computer outside the company (T 123). This was not denied by the appellant in his later evidence. Mr Ryan described how the documents at orange 57-9 were produced and agreed that data could be changed during this process (T 118). He did not prepare the documents himself. The appellant said that "it was a text edited record" and not a log and had no relevance (T 127). Mr Dornbrack probably prepared these documents [para 48] but he was not cross-examined at the trial to suggest that he had changed the data.
53 In answer to a question from a member of the Court the appellant said (T 127) that "this", the document at orange 57-8, showed that the disputed email "actually originated somewhere in their network. It originated within their network that connect to that machine (203.34.22.195)". When asked by another member of the Court what there was within the document that showed that the disputed email originated in the company's building (T 127) the appellant gave a long answer by instalments based on the earliest times and smallest size being recorded at the exchange server, increasing at the mail server, and again at the firewall (T 127-9). He said that the document did not contain all the necessary information (T 128, 129). The significance of the time sequences depended on his evidence that the company's system was synchronised (T 128). This was contrary to the evidence given at the trial by Mr Dornbrack (black 88-9, 91). The appellant said that the email could have been sent by any of the machines in the company's network (T 128(15), 129(50)).
54 In his affidavit of 23 August the appellant said that the calls from his mobile phone on 10 September (sup blue 1/132) at 11.09 am and 11.48 am were shown as sent from Cowan and Berowra respectively so that at the time the disputed email was sent he must have been in his car approximately 20 minutes away from his home and could not have sent it (orange 17).
55 The mobile phone records for 16 September show that this inference cannot be drawn. Times on the copy of the disputed email found on the appellant's hard drive (blue 109) showed that the raid was in progress at 11.47 am on 16 September. The appellant said that at that time he was outside his home using his mobile telephone (orange 17). His mobile phone records (sup blue 1/132) show that he made phone calls at 11.33 am, 11.46 am, and 11.59 am. These too are shown to have been made from Berowra, as was one of those calls said to have been made by the appellant from his car 20 minutes drive from his home on 10 September. It is therefore clear that the mobile phone records for 10 September do not establish that the appellant was not at his home at 11.23 am when the disputed email was sent.
56 The relevant emails to and from Mr Spencer of RIC of 10 September appear to start with one from the appellant at 12.40 am, although the text is not in evidence (sup blue 2/355-6). This produced a reply from Mr Spencer at 8.41 (356) and a response from the appellant at 8.44 (355). He said that he was then at Vodafone Chatswood and followed up this last email with a phone call to Mr Spencer (blue 148(21)).
57 The email at 11.16 am (354) was acknowledged by the appellant as genuine in his affidavit of 14 October 2004 (blue 148(22)). It was sent seven minutes after the appellant is recorded as making a call on his mobile phone from Cowan at 11.09 am. The disputed email followed at 11.23 am. The subject of both was described as "Re: specs". The next email from the appellant at 12.27 pm that day showed as its subject "RE: Review Document". It was sent in response to an earlier email from Mr Spencer recorded there but not shown independently (352). This seems to have been a response to an email sent by the appellant to Mr Spencer the day before (359) which referred to servers and was headed "Review Document". On 30 September Mr Spencer sent a memorandum to the appellant (sup blue 2/318) which relevantly stated:
"Thank you for submitting a quotation for block of security consultancy hours based around our current check point implementation.