1. This was an appeal against the Appellant’s conviction for criminal damage, contrary to section 60(1) of the Crimes Ordinance (Cap. 200) (“CO”). 2. In October 2014, the Appellant took part in a Distributed Denial of Service (“DDoS”) attack on the website of the Shanghai Commercial Bank (the “Bank”). During the DDoS attack, the website server of the Bank received a total of 504,592 “requests”, of which 6,652 came from the Appellant’s computer over 16 seconds. The DDoS attack was a failure because the server had enough surplus capacity to prevent the attack from affecting its other operations. 3. The Appellant was charged with criminal damage, contrary to section 60(1) of the CO. Under section 59(1A) of the CO, damage to property included “misuse of a computer”. “Misuse of a computer” was defined to include (1) causing the computer to function other than as it has been established to function by its owner (“paragraph (a)”), and (2) adding data to the contents of a computer (“paragraph (c)”). 4. The central questions before the magistrate were whether the Appellant was the user of the computer at the time, and whether the Appellant participated in the DDoS attack intentionally or by accident. It was found that he was the user of the computer and his participation was intentional. The magistrate therefore found that the Appellant had misused the Bank’s computer as defined under section 59(1A), and convicted the Appellant. The conviction was upheld upon appeal to the Court of First Instance. 5. The principal issue in this appeal was whether the Appellant had caused the computer “to function other than as it has been established to function by or on behalf of its owner”. The Appellant argued that the Bank’s computer was established to receive and respond to “requests”. As the computer responded to such “requests” exactly as it had been programmed to do during the DDoS attack, the Appellant contended that the attack caused no difference to the way the computer functioned. 6. The Court rejected the Appellant’s submissions. The Court held that paragraph (a) of section 59(1A) is not concerned with the way that the computer is programmed to work, but what the owner has set it up to do. 7. On the facts, the website and the Bank’s server were established to provide banking service, not to deal with a multitude of “requests” made in order to inconvenience the Bank and generate publicity for the attackers. The Appellant had therefore caused the computer to function other than how the Bank has established it to function. The Appellant’s conviction is therefore upheld on the basis of paragraph (a) of section 59(1A). 8. Had it been necessary to consider paragraph (c) of section 59(1A), the Court would have held that the conviction in reliance upon paragraph (c) was unjust to the Appellant. This is because the prosecution based its case before the magistrate solely upon paragraph (a), and the Appellant therefore adduced no evidence in relation to paragraph (c). However, given this Court’s decision in regards paragraph (a), the magistrate’s wrongful reliance on paragraph (c) was immaterial in this appeal. DISPOSITION 9. Accordingly, the appeal was unanimously dismissed and the Appellant’s conviction was upheld.