Wright v Ryan & Anor

Craig Wright (Appellant) Michael Ryan (First Respondent) PARTIES: DeMorgan Information Security Systems Pty Ltd (Second Respondent)

G K Burton SC (Appellant) Dr J G Renwick (First Respondent) COUNSEL: Submitting appearance (Second Respondent)

Michie Shehadie & Co (Appellant) SOLICITORS: McArdle Legal (First Respondent) Toomey Pegg Drevikovsky (Second Respondent)

LOWER COURT JURISDICTION: Supreme Court - Equity Division

IN THE SUPREME COURT OF NEW SOUTH WALES COURT OF APPEAL CA 40819 of 2004

HANDLEY JA HODGSON JA HUNT AJA

27 OCTOBER 2005 CRAIG WRIGHT v MICHAEL RYAN & ANOR CATCHWORDS

APPEAL - fresh evidence - additional evidence - requirements for in appeal from conviction for contempt of Court

EVIDENCE - fresh evidence - additional evidence - requirements for in appeal from conviction for contempt of Court FACTS

The Supreme Court found the appellant guilty of contempt of Court by breaching undertakings given to the Court involving the carrying on of business in competition with and approaching customers of the second respondent. The appellant argued that the undertakings were too ambiguous and uncertain to be enforced, that certain companies were not customers of the second respondent and that he had not breached the undertakings. The appellant also sought to adduce fresh evidence in the appeal. HELD: (1) The appellant had breached the undertakings given to the Court. Circumstantial evidence established repetitive and continuous conduct of a kind that excluded as unreasonable any explanation other than the carrying on of a business: Martin v Osborne (1936) 55 CLR 367, 375-6 and Hope v Bathurst City Council (1980) 140 CLR 1, 8-9; (2) Acceptance of a business proposition from one of the second respondent's customers was sufficient to breach the undertaking not to approach the second respondent's customers; (3) The reception of the fresh evidence in this appeal from a conviction for a criminal offence was governed by s 75A(8) of the Supreme Court Act, but semble it may be appropriate in such an appeal for the Court to apply the less stringent tests applicable in appeals to the Court of Criminal Appeal: Ratten v The Queen (1974) 131 CLR 510 and Gallagher v The Queen (1986) 160 CLR 392 referred to; (4) The fresh evidence was not capable of giving rise to a reasonable doubt as to the appellant's guilt. ORDERS Appeal dismissed with costs.

IN THE SUPREME COURT OF NEW SOUTH WALES COURT OF APPEAL CA 40819 of 2004

HANDLEY JA HODGSON JA HUNT AJA

27 OCTOBER 2005 CRAIG WRIGHT v MICHAEL RYAN & ANOR Judgment 1 HANDLEY JA: On 31 August 2004 Gzell J found the appellant guilty of contempt of Court by breaching undertakings given to the Court on 4 September 2003. The breaches involved carrying on business in competition with DeMorgan Information Security Systems Pty Ltd (the company) and directly or indirectly approaching "any company, business, entity or person who is or was, as at 8 August 2003 a customer of [the company]". On 15 November Gzell J sentenced him to imprisonment for 28 days suspended on condition that he perform 250 hours of community service, and he was ordered to pay the costs of the proceedings. 2 His appeal, which lay as of right under the Supreme Court Act s 101(3), relevantly asserted (grounds 1-10) that the undertakings were too ambiguous and uncertain to be enforced, and challenged the Judge's findings that News Ltd, Australian Stock Exchange Ltd (ASX) and Rail Infrastructure Corporation (RIC) were customers of the company (ground 11) and that he had committed breaches of the undertakings (grounds 12-14). 3 The appellant did not give evidence at his trial, but relied on an affidavit in the proceedings on sentence when he was cross-examined. The affidavit sought to challenge the Judge's findings on guilt, and was successfully objected to on this ground. The Judge admitted the affidavit on a limited basis, as relevant to the appellant's state of mind, and his cross-examination was limited on the same basis. 4 The appeal was initially fixed for 19 May 2005 but the appellant sought, at a late stage, to rely on an affidavit, said to be fresh evidence of a highly technical nature, relating to an email which the Judge found he had sent to RIC at 11.23 am on 10 September 2003. The hearing was adjourned and Hodgson JA ordered the appellant to pay a lump sum for the costs of the respondent thrown away and he was directed to file any further evidence within 14 days. His affidavit of 9 June was filed a few days late. Directions had also been given for the filing of evidence by the respondent in answer, but not for the filing of evidence in reply. The appeal was later fixed for 30 and 31 August. 5 The respondent filed an affidavit by himself of 11 July and an affidavit by Mr Taylor from Charles Sturt University (CSU) of 13 July. 6 The appellant filed a further affidavit dealing with technical issues relevant to the authenticity of the disputed email on 23 August, and on the morning of 30 August he sought to rely on yet another technical affidavit he had sworn that day that counsel for the respondent only received that morning. 7 The Court upheld the respondent's objection to the affidavit of 30 August because of its late service and the prejudice to the respondent which would have necessitated a further adjournment. Counsel for the respondent also objected to the affidavit of 23 August but frankly conceded that he was in a position to deal with it in cross-examination and address. That affidavit contained what, in substance, was evidence in chief, which should have been included in an affidavit filed within the time fixed by Hodgson JA, but the Court decided not to reject it on procedural grounds. 8 Mr Burton SC, appearing for the appellant, then sought an adjournment to enable the affidavit of 30 August to be read at the adjourned date but, following lengthy argument, this application was refused. During the argument it became clear that the affidavit of 30 August contained extensive material which properly formed part of the appellant's case on the fresh evidence application and strictly did not arise in reply to the affidavits of Mr Ryan and Mr Taylor. This should have been included in an affidavit filed within the time fixed by Hodgson JA. The appellant had already received the indulgence of one adjournment based on the late filing and service of a technical affidavit shortly before the hearing date on 19 May and we considered that there was no proper basis for granting a further indulgence, particularly as the delay was not explained. 9 The Court then heard the appellant's application for leave to adduce further evidence in the appeal. This comprised his affidavits of 9 June and 23 August and certain exhibits, and possibly his affidavit of 14 October 2004 filed in the sentence proceedings. 10 The further evidence was essentially directed to an email apparently sent by the appellant to Mr David Spencer of RIC at 11.23 am on 10 September 2003 (the disputed email). The appellant did not give evidence at his trial, but the respondent tendered that part of his affidavit of 24 October 2003 (blue 113) where he denied sending that email. 11 A copy of the disputed email was found on the hard drive of the appellant's computer when an Anton Pillar order was executed at his home at Bagno near Mt White on 16 September 2003. The email purported to come from "Craig S Wright [cwrigh20@postoffice.csu.edu.au]", and was sent to "Spencer, Dave; Wright_c@demorgan.com.au; Spencer, Dave". It stated: "More details to follow (ie proposal)

But to monitor patching etc and provide documents for updates etc for 3 linux check point hosts

3. Support on updates inc procedures where necessary.

4. Help with upgrades $450 per month ex GST ($150 per system)

Craig S Wright" 12 The disputed email was received by RIC and at Mr Wright's email address at the company. The Judge drew the inference that it was sent using Mr Wright's email address to RIC and to his email address at the company and a copy was retained on his computer. This email formed the basis of the Anton Pillar order obtained by the plaintiffs which was executed on 16 September. The appellant in his affidavit of 14 October 2004 filed in the proceedings on sentence again denied sending this email and gave reasons (blue 148) why he could not have offered to do the work at the rate quoted. He also said (blue 148-9): "I have recently obtained copies of the access logs from [CSU] on-line servers for my user account to access email (being the account from which it is alleged that I sent the email of 10 September 2003 to RIC). I have perused those logs and say that they disclose access to my account from proxy01.demorgan.com.au from August 2003 until November 2003. Proxy01.demorgan.com.au is a secured server inside [the company's] network and to which I have not had access since my resignation on 10 August 2003. The logs disclose access to the account from IP address 144.135.38.125 which is my IP address at the farm at Port Macquarie … The email dated 10 September 2003 … was sent from IP address 144.135.104.27 which is not my IP address and which I have traced to an address in Melbourne." 13 In his affidavit of 9 June 2005 (orange 3) the appellant said that between 8 August and 23 October 2003 he maintained two email addresses, one at CSU and the other at the company, being his private address and his work address. He said that access to email at CSU was linked to the server email address my.csu.edu.au. To access that server and create a record in the logs at CSU (orange 4) he must log into CSU through the server auth.csu.edu.au, and access the system my.csu.edu.au by using cwrigh20 and a password. Once one had validly logged into CSU one can access and use one's private email system and folders. 14 He said that on 12 August he was excluded from the company's premises and could no longer access its computer system. 15 Before the trial he made inquiries at CSU for records of emails sent from his private email address, but was told there were no such records. A relevant subpoena was served on CSU without result. He continued his inquiries after the trial and in December 2004 obtained an extract copy of the logs from CSU for August to October 2003 comprising about 60,000 pages. 16 He searched those logs which disclosed that secure CSU systems including my.scu.edu.au were accessed from proxy01.demorgan.com.au on 2549 occasions between August and October, an average of 21 times a day and he said that during that period he did not have access to nor did he access the address proxy01.demorgan.com.au. 17 He said that the only persons who could have accessed that address were persons working within the premises of the company and that if such persons had been accessing his private address during that period "they could have created email messages purporting to come from me on that private address". 18 Mr Ryan said in his affidavit that the appellant still had in his possession after 12 August 2003 laptop and work-station computers owned by the company which were configured to access proxy01.demorgan.com.au (orange 9). This repeated a statement in his affidavit of 2 September 2003 (blue 7) which identified three of the computers by make and serial number and referred to another two not so identified. 19 Mr Taylor said that the information sought by the appellant from CSU before and after the trial was freely available on its website with no requirement for a login or password, and the relevant webpage was not hard to locate from its home page. It could have been accessed by an appropriate search at any time during 2004. 20 In his further affidavit of 23 August the appellant said: "I was never issued with a notebook/laptop at any time from [the company]. No computers owned by [the company] are, or have ever been, at my premises. The Dell host servers at my residence, which was searched pursuant to the Anton Pillar order on 16 September 2003, had different configurations from and were different makes from those used at [the company]. Further the serial numbers on the hosts were not those of the [the company] host's." 21 He said (orange 15-16) that proxy01.demorgan.com.au was the Host name of the unix server used by the company to access clients' sites and the Internet. It had a fixed and permanent IP address 203.34.22.195. The source of an email is the IP address of the system used to construct it and it appears on the header. The IP address of the proxy server within the disputed email dated 10 September 2003 is 203.34.22.195 which was the source of the email internal to the company. 22 The IP address 144.135.104.27 is a Telstra account in Melbourne and was not the sending IP of the disputed email. He said that it is an internal Telstra address and could not have been used to send the email as it is a secure dial in server at Telstra and does not run "a web client" (orange 16). The disputed email was sent from a web client. He said that the IP address for the Telstra server 144.135.104.27 listed in the header as the sending host of the email never had been his personal IP address. He had had the IP address 144.135.38.125 since 2002 on the Telstra two-way satellite link from his home until he had it changed in August 2005. He had an IP address on the Telstra 2-way satellite link from his home (orange 16). He also had a wireless network there during 2003 which the company was able to access (orange 17). 23 On 10 September 2003 he made calls on his mobile phone at about the time the disputed email was sent which, according to his mobile phone accounts, were sent through Berowra (10.36 am), Cowan (11.09 am) and Berowra (11.48 am) (sup blue 2/467). He said therefore he could not have been at home at Bagno or able to access his home computer at 11.23 on 10 September when the disputed email was sent (orange 17). He disputed parts of Mr Taylor's affidavit. Admissibility of further evidence 24 Section 75A(8) of the Supreme Court Act provides that on an appeal from a judgment after a trial or hearing on the merits "the Court shall not receive further evidence except on special grounds". The Court has not attempted to exhaustively define what are special grounds for this purpose but the core concepts are those on which common law courts received fresh evidence on a motion for a new trial following the verdict of a jury. These were considered in Parsons v McCann (1954) 93 CLR 418, Wollongong Corporation v Cowan (1955) 93 CLR 435 and McDonald v McDonald (1965) 113 CLR 529. The evidence must be admissible and credible, and such that it could not have been discovered by the exercise of reasonable diligence before the trial. It must be of such probative value and significance that, taken with the evidence given at the trial, it will in all probability be decisive of the issues between the parties and result in a different verdict: McDonald v McDonald at 532 per Barwick CJ. 25 Although this is an appeal from a conviction for a criminal offence the procedure is that which applies under the Supreme Court Act to appeals in civil cases. Under the Criminal Appeal Act 1912 the discovery of fresh evidence may lead the Court of Criminal Appeal to enter a verdict of acquittal in a sufficiently strong case, and in other cases to order a new trial. The focus in the Court of Criminal Appeal is on whether there has been a miscarriage of justice. As Barwick CJ said in Ratten v The Queen (1974) 131 CLR 510, 517: "Great latitude must of course be extended to an accused in determining what evidence by reasonable diligence in his own interest he could have had available at his trial, and it will probably be only in an exceptional case that evidence which was not actually available to him will be denied the quality of fresh evidence." 26 At 520 he discussed the way in which the Court of Criminal Appeal can use further evidence: "… if the new material, whether or not it is fresh evidence, convinces the court upon its own view of that material that there has been a miscarriage in the sense that a verdict of guilty could not be allowed to stand, the verdict will be quashed without more. But if the new material does not so convince the court, and the only basis put forward for a new trial is the production of new material, no miscarriage will be found if that new material is not fresh evidence. But if there is fresh evidence which in the court's view is properly capable of acceptance and likely to be accepted by a jury, and which is so cogent in the opinion of the court that, being believed, it is likely to produce a different verdict, a new trial will be ordered as a remedy for the miscarriage which has occurred because of the absence at the trial of the fresh evidence." 27 The High Court affirmed these principles in Gallagher v The Queen (1986) 160 CLR 392, subject to some adjustments. The Court held (399, 402) that there will be a miscarriage of justice where "there is a significant possibility that the jury, acting reasonably, would have acquitted the applicant of the charge if the new evidence had been before it in the trial". The Court also referred (396, 401) to the judgment of Rich and Dixon JJ in Craig v The King (1933) 49 CLR 429, 439 where their Honours said of fresh evidence in criminal cases: "Such evidence should be calculated at least to remove the certainty of the prisoner's guilt which the former evidence produced." 28 Gibbs CJ discussed the requirements for due diligence (396): "… the conviction will not be usually set aside if the evidence relied on could with reasonable diligence have been produced by the accused at the trial … [but] this is not a universal and inflexible requirement: the strength of the fresh evidence may in some cases be such as to justify interference with the verdict, even though that evidence might have been discovered before the trial." 29 This Court has not decided whether the tests applied under s 75A(8) in civil cases apply to appeals from criminal convictions for contempt of court or whether the Court should adopt the less stringent tests applied in the Court of Criminal Appeal. This question was not fully argued and, without expressing any view on that question, we should apply the less stringent tests. 30 It is strongly arguable that the appellant has not discharged the onus of establishing that CSU's records of emails sent through its server could not have been discovered before the trial by the exercise of reasonable diligence. The affidavit evidence of Mr Taylor appears to establish that it would have been a simple matter to discover their existence by searching CSU's home page on its website. 31 The appellant was cross-examined but Mr Taylor was not. He lives at Bathurst and notice for him to attend for cross-examination was not given until a day or so before the hearing. 32 Since I have reached the firm conclusion that the appellant has not discharged the onus of proving that the further evidence is credible and would probably have been decisive, I am content to base my decision on those grounds without expressing a final opinion on the question of due diligence. 33 The case against the appellant was based on circumstantial and documentary evidence. This included emails recovered on the Anton Pillar raid, or produced by third parties on subpoena. The plaintiffs also tendered the appellant's mobile phone records and parts of his affidavits of 11 September and 24 October 2003. Finally they tendered the security records of the ASX showing visits by the appellant to its premises on 4, 8, 9, 11, and 30 September and 15 and 24 October 2003. 34 There were emails to and from RIC on 9 (two), 10 (five), 11 (two) and 30 September and to News Ltd on 22 and 23 October. The appellant's mobile phone records disclosed calls to RIC on 8 (three), 9 (four), 10, 15, 16 (four), 17 (two), 18 (five) and 29 September and 1, 2 (eight), 9 (three), 10, 14 (three), 20 (two) and 23 October. The appellant's affidavit of 11 September disclosed a further telephone call to RIC on 5 September. 35 The records disclosed telephone calls to the ASX on 4 (two), 9, 11, 23, 26 and 29 September and 1 and 9 October. There were also telephone calls to News Ltd on 15, 23, 24, 26 September and 1, 9 (four) and 23 October, to the Human Rights and Equal Opportunity Commission on 18 October and four calls to Val Morgan on 30 September. There were also emails to News Ltd on 22 and 23 October. 36 These facts, other than the authenticity of the emails of 11.23 am [para 11] and 11.16 am to RIC on 10 September 2003 (sup blue 2/354) were not in dispute. 37 In his affidavit of 14 October 2004 the appellant explained the background to the email of 11.16 am (blue 148 para 22), and denied sending the disputed email (para 23). In his affidavit of 9 June 2005 (orange 7) the appellant denied sending "emails" to RIC on 10 September 2003, and he repeated this denial in his affidavit of 23 August 2005 (orange 18 para 14). The denial in the plural was said by Mr Burton to refer to the emails of 11.16 am and 11.23 am, and not the earlier emails that day. 38 Subject to the submissions on legal questions which will be considered later, the circumstantial case against the appellant was overwhelming, even if the disputed email or emails are ignored. The relevant principles are those stated in Martin v Osborne (1936) 55 CLR 367, 375-6 per Dixon J: "If an issue is to be proved by circumstantial evidence, facts subsidiary to or connected with the main fact must be established from which the conclusion follows as a rational inference … The circumstances which may be taken into account in this process of reasoning include all facts and matters which … make intelligible the course of conduct pursued … the acts of a party are admissible against him whenever they form a component in a combination of circumstances which is unlikely to occur without the fact in issue also occurring. The repetition of acts or occurrences is often the very thing which makes it probable that they are accompanied by some further fact. The frequency with which a set of circumstances recurs or the regularity with which a course of conduct is pursued may exclude, as unreasonable, any other explanation or hypothesis than the truth of the fact to be proved." 39 It was not suggested that the further evidence actually established that the disputed emails were forged by the company. The submission was that they had not been sent by the appellant, but had been fabricated by an unknown person who was able to access the company's computers as well as those of the appellant. Even if this had been established the conviction would probably not have been quashed having regard to the strength of the general circumstantial case. 40 The disputed email was found on a computer at the appellant's home during the Anton Pillar raid on 16 September 2003 (blue 109). It was found on a temporary Internet file opened and viewed during the raid when a copy to self folder used to store email messages online was accessed (blue 107, 108, 109). It had not originated on that computer, but had been sent from a remote location. However its presence in a "copy to self" file supported an inference that it had been sent by the appellant. 41 Mr Ryan said that a copy of the disputed email was received on the screen of his personal computer at the company's premises (blue 51). After the appellant left the company Mr Ryan reprogrammed his computer to ensure that incoming emails directed to the appellant were sent to his computer (orange pp 8-9). 42 The appellant said that after he left the company's premises on 12 August 2003 he could no longer access its secured server as it was protected by a security system known as a firewall for which he needed a password, a user name and an access token. He said he had surrendered his token (orange 4). Mr Ryan said that an access token was not required for this purpose (T 109). 43 The appellant said that he could not have sent the disputed email because he did not have access to computers which were configured to access proxy01.demorgan.com.au [para 18], but Mr Ryan said the appellant retained five computers belonging to the company which had this capacity. The appellant denied this. The appellant also said that proxy01.demorgan.com.au could only have been accessed by persons working within the company's premises (orange 6(20)) but Mr Ryan said it could have been accessed from any computer anywhere in the world with the appropriate configuration (orange 9(10)). 44 The appellant said that a third party could have accessed his secure email address at CSU to create and send the disputed email. Such a person would have needed to use the appellant's username and a password (orange 4(5)), or else to successfully hack into the system. It was not established that anyone at the company had the appellant's password or that his system had been penetrated. 45 The appellant established that during September 2003 secure accounts at CSU had been accessed through its secure server, server online, from proxy01.demorgan.com.au, another secure server (T 96) 58 times (exs C, D) and from the Telstra IP address 144.135.104.27 170 times. The former established very little because it was not known which secure accounts at CSU had been accessed and it was not established that the appellant's account had ever been accessed through proxy01.demorgan.com.au. There are probably thousands of such accounts which can be accessed through CSU's server online for the University, its staff, and the students (T 84, 96), and the access obtained on the 58 occasions could have been to any account at CSU (T 96). 46 The appellant said that the Telstra IP address 144.135.104.27 could not have been used to send the disputed email (orange 16). Mr Ryan said that it was an IP address allocated to Telstra under a portable allocation (T 98) for satellite usage (T 99). Authorised persons could use that IP address if they had access including portable access or could make use of satellite mechanisms (T 99). There was nothing on the copy search of 144.135.104.27 (ex E) to link that IP address to a satellite account or any particular satellite account (T 117). 47 According to the appellant the disputed email was sourced from a proxy server within the company with the IP address 203.34.22.195 (orange 16). He said in his oral evidence that it did not originate from this IP address but from somewhere in the company's network that was connected to that machine (T 127). He said that the IP address 144.135.104.27, the Telstra account, which was the "supposed" sending IP of the email, could not have been used to send it (orange 16). Mr Ryan said that it could have been sent through the Telstra IP address by any one who had appropriate access (T 99). 48 Mr Ryan called a colleague, Mr Dornbrack, to view the disputed email on the server of his personal computer (black 81). Mr Dornbrack went to the "properties" of the email "to determine how the email got sent to us" (93). In computer language he cut and pasted the properties on to a notepad which produced a header text file which he saved (black 82). A hard copy became part of ex C (sup blue 1/168). Using the information on this document he prepared a flow chart which traced the movements of the email which also became part of ex C (1/167). Material is added to the header of an email at each stage as it moves from server to server (91). 49 He said it was a web email "composed on the CSU post office" (83), the mail server at CSU (84). His flow chart traced the disputed email from the mail server postoffice.csu.edu.au to Telstra's Bigpond satellite service 144.135.104.27 (83) and also directly through an intermediate site at CSU to a computer designated firewall - ns.demorgan.com.au which was the company's firewall or security gateway designed to prevent its network being attacked from the Internet (85-6). The disputed email then passed to the company's proxy server proxy01.demorgan.com.au where email coming from the Internet is scanned (86) from where it passed to the company's email server and then to Mr Ryan's desktop PC (87). 50 If Mr Dornbrack's evidence was correct the disputed email originated from c_wright20@postoffice.csu.edu.au (92), a computer linked to CSU, and it was dispatched by the sender to the Telstra IP address and by different routes to the company and Mr Spencer. It did not originate at the company's IP address 203.34.22.195 allocated to proxy01. That was its destination on this track. He said that the timing differences at the different stages within the company's network were normal because the clocks on different pieces of computer hardware drift (88-9, 91). The appellant said in this Court when recalled that the company's computers operated on synchronised time (T 128). This was not put to Mr Dornbrack during his cross-examination at the trial. 51 The appellant said (orange 17-8) that if he had sent the disputed email it would have increased in size as it passed through each mail server until it reached the company. He said a comparison of the message source details for this email obtained from the company's exchange server produced to the Court on 19 September 2003 (orange 57-8) and the print out from the temporary Internet file downloaded from his computer during the Anton Pillar raid (blue 109) showed that its logical size had grown from 1687 to 4054. The appellant said that this indicated that it had originated at the company. The document at orange 57-8 contains more information about the source and movement of the email than the document produced by Mr Dornbrack (sup blue 1/168) already considered [para 50]. 52 Mr Ryan said the document at orange 57 showed that the email did not originate from the company's IP address 203.34.22.195 but came through cwright20@postoffice.csu.edu.au (T 115-6). It did not show where it actually originated but it did not originate from 203.34.22.195 because that is where it went (T 116). He said that the letters and figures "3f5e7d03" in the header sheets (orange 57-9) for the company's exchange and mail servers constituted a unique message that indicated that the email was established by a computer outside the company (T 123). This was not denied by the appellant in his later evidence. Mr Ryan described how the documents at orange 57-9 were produced and agreed that data could be changed during this process (T 118). He did not prepare the documents himself. The appellant said that "it was a text edited record" and not a log and had no relevance (T 127). Mr Dornbrack probably prepared these documents [para 48] but he was not cross-examined at the trial to suggest that he had changed the data. 53 In answer to a question from a member of the Court the appellant said (T 127) that "this", the document at orange 57-8, showed that the disputed email "actually originated somewhere in their network. It originated within their network that connect to that machine (203.34.22.195)". When asked by another member of the Court what there was within the document that showed that the disputed email originated in the company's building (T 127) the appellant gave a long answer by instalments based on the earliest times and smallest size being recorded at the exchange server, increasing at the mail server, and again at the firewall (T 127-9). He said that the document did not contain all the necessary information (T 128, 129). The significance of the time sequences depended on his evidence that the company's system was synchronised (T 128). This was contrary to the evidence given at the trial by Mr Dornbrack (black 88-9, 91). The appellant said that the email could have been sent by any of the machines in the company's network (T 128(15), 129(50)). 54 In his affidavit of 23 August the appellant said that the calls from his mobile phone on 10 September (sup blue 1/132) at 11.09 am and 11.48 am were shown as sent from Cowan and Berowra respectively so that at the time the disputed email was sent he must have been in his car approximately 20 minutes away from his home and could not have sent it (orange 17). 55 The mobile phone records for 16 September show that this inference cannot be drawn. Times on the copy of the disputed email found on the appellant's hard drive (blue 109) showed that the raid was in progress at 11.47 am on 16 September. The appellant said that at that time he was outside his home using his mobile telephone (orange 17). His mobile phone records (sup blue 1/132) show that he made phone calls at 11.33 am, 11.46 am, and 11.59 am. These too are shown to have been made from Berowra, as was one of those calls said to have been made by the appellant from his car 20 minutes drive from his home on 10 September. It is therefore clear that the mobile phone records for 10 September do not establish that the appellant was not at his home at 11.23 am when the disputed email was sent. 56 The relevant emails to and from Mr Spencer of RIC of 10 September appear to start with one from the appellant at 12.40 am, although the text is not in evidence (sup blue 2/355-6). This produced a reply from Mr Spencer at 8.41 (356) and a response from the appellant at 8.44 (355). He said that he was then at Vodafone Chatswood and followed up this last email with a phone call to Mr Spencer (blue 148(21)). 57 The email at 11.16 am (354) was acknowledged by the appellant as genuine in his affidavit of 14 October 2004 (blue 148(22)). It was sent seven minutes after the appellant is recorded as making a call on his mobile phone from Cowan at 11.09 am. The disputed email followed at 11.23 am. The subject of both was described as "Re: specs". The next email from the appellant at 12.27 pm that day showed as its subject "RE: Review Document". It was sent in response to an earlier email from Mr Spencer recorded there but not shown independently (352). This seems to have been a response to an email sent by the appellant to Mr Spencer the day before (359) which referred to servers and was headed "Review Document". On 30 September Mr Spencer sent a memorandum to the appellant (sup blue 2/318) which relevantly stated: "Thank you for submitting a quotation for block of security consultancy hours based around our current check point implementation.

Unfortunately we will not be taking up your offer of services opting for a proposal supplied by another organisation." 58 This may have been a response to the disputed email (T 37). 59 The disputed email was produced on subpoena by RIC along with the other emails passing between the appellant and Mr Spencer. It was apparently received without provoking any email response from Mr Spencer asking what it was all about. The parties were again in communication by email the following day (sup blue 2/325, 347). 60 It would have been extremely difficult for an outsider to fabricate the disputed email containing the details it did [para 11]. Mr Spencer and the appellant communicated with each other many times on 9, 10 and 11 September by email, telephone, and in person. Somehow this email managed to make sense and fit in with these other communications. The fabrication of such an email by an outsider without this being immediately detected by the recipient is glaringly improbable. A copy of the email reached the appellant. He replied to his emails without delay and if the disputed email had been sent to him by a third party he would have become aware of its existence almost immediately. 61 The arguably fresh evidence of the email records from CSU is credible but completely neutral. It establishes that the company could have accessed the appellant's email address at CSU in order to sent the disputed email, but does not prove that it did so or establish that as a matter of probability. This evidence leads nowhere. It is not capable of giving rise to a reasonable doubt about the appellant's guilt and could not have produced a different result if it had been admitted at the trial. 62 The other new evidence by the appellant relating to the disputed email was based on his interpretation and explanation of the header text file produced by Mr Dornbrack (sup blue 1/168) and the message source details for that email produced to the Court under notice to produce on 19 September 2003 (orange 57-8). These documents were in evidence or available at the trial and the affidavit and oral evidence given by the appellant could have been given at the trial, and is manifestly not fresh evidence. 63 The probative force of the new evidence depends in large measure on the appellant's credibility and reliability. His explanations and interpretations of these and related documents are contradicted at critical points, on which there is no independent evidence to support him. The appellant's contradictory evidence about the email of 11.16 am on 10 September 2003 raises doubts about his credibility, as does his evidence based on the calls from his mobile phone that day. 64 Even if the new evidence about the disputed email was truly fresh it has not been positively shown to be credible and the appellant has failed to establish that its reception at the trial would probably have produced a different result. The additional evidence should therefore be rejected and the appeal should be determined on the evidence before the trial Judge. 65 The appellant's challenges to the Judge's findings of guilt can be grouped as follows:

(i) The construction of the undertakings to the Court, and the plaintiffs conduct of the trial in relation thereto.

(ii) The findings that the appellant was carrying on business in competition with the company and approaching its customers.

(iii) The finding that News Ltd was a customer of the company. 66 The undertakings are summarised in para 1. The appellant argued that they were too ambiguous to be enforced because they incorporated or arguably incorporated the definition of business and the covenant not to approach customers of the company contained in the shareholder's agreement between the company, Mr and Mrs Wright, and Mr Ryan. The contractual definition of associates was incorporated in the undertakings but they were otherwise self-contained, clear and unambiguous. The Judge's decision to that effect was correct. 67 The appellant relied before us, as he had relied below, on the opening by counsel for the plaintiffs before Gzell J (black 3) where he said that the undertakings were based on the shareholder's agreement and in the event of ambiguity the relevant factual matrix would include that agreement. This was not a concession that the undertakings incorporated other terms of the agreement or that they were ambiguous. Since the undertakings were clear and unambiguous the argument based on the opening of counsel for the plaintiffs is without substance. 68 The appellant's activities summarised above [paras 33-5] establish repetitive and continuous conduct of a kind which excludes as unreasonable any explanation other than the carrying on of a business: Martin v Osborne (1936) 55 CLR 367, 375-6 para 38, and Hope v Bathurst City Council (1980) 140 CLR 1, 8-9. 69 The same activities also establish a breach of the undertaking not to approach customers. The appellant submitted that this would only be breached if he initiated the approach. While accidental or casual contact in the street or at a social function would not be a breach without more the appellant's activities proved in evidence went far beyond this. 70 An approach to the appellant initiated by a customer would not permit him to respond by approaching that customer either then or later in the course of continuing the association. In my judgment the undertaking did not even permit him to respond positively to a business approach from such a customer as that itself would be an approach within the meaning of this undertaking. The relevant principles which govern the construction of a restraint of trade clause, or undertaking in such terms are those applied in Barrett v Echo Personnel Pty Ltd (24 November 1998, Court of Appeal, unreported) where Stein JA, delivering the principal judgment of the Court, said: "The appellant's submission amounts to this. One should construe 'solicit' in the agreement in a highly mechanical fashion. You simply ask, who made the first approach? If an old customer made the first approach to a former employee, then whatever the facts thereafter which might lead to business being done, there cannot be solicitation. This cannot be correct. One may acknowledge that in most instances the first approach will be made by the ex-employee to the former customer. Commonsense however demands that this not be the exclusive means by which a solicitation may occur. A simple illustration will suffice as to why this is so. Assume a customer finds out, quite accidentally, that a former employee with whom it dealt had left his principal and established a business of his own and says 'let us have a proposal'. The ex-employee then submits a proposal in very favourable terms and makes a presentation to the client which convinces it to award the contract to him. Should the fact of the first approach negative any solicitation or enticing away? I think not." 71 One of the meanings of approach in the Macquarie Dictionary is "to make a proposal to". The appellant certainly did this in relation to RIC in the emails of 10 September 2003 and by necessary inference he did so to the other customers with whom he had the contacts proved in evidence. The challenge to the conviction for breach of the second undertaking also fails. 72 The submission that News Ltd was not a customer of the company was without substance. This was a pure question of fact and the Judge accepted the evidence of Mr Ryan on the point and was entitled to do so. 73 The appeal therefore fails on all grounds and must be dismissed with costs. 74 HODGSON JA: I agree with the orders proposed by Handley JA and with his reasons. I would add some short comments. 75 Had the appellant wished to make out a substantial case that the disputed email, alone of the emails purportedly sent by him on 10 September 2003, was not and indeed could not have been sent by him, one would have expected evidence that the disputed email was sent by a different path from the admitted emails. There was no such evidence. 76 In his affidavit of 14 October 2004, the appellant said that the email purportedly sent at 11.16am on 10 September 2003 was a response to a question from its recipient: he did not deny sending it on that day, and he did not explicitly deny doing so in the affidavits read before this Court. That email itself was a plain breach of the undertaking not to approach customers, and neither the proposed fresh evidence nor the other arguments on appeal make out any case to the contrary. 77 I agree with Handley JA that the proposed fresh evidence lacked the necessary credibility and materiality, particularly in circumstances where it depended in essential respects on the appellant's own credibility, which was strongly under challenge. 78 HUNT AJA: I agree with Handley JA. **********

DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.