Home | Databases | WorldLII | Search | Feedback National Court of Papua New Guinea

State v Ampalavio [2024] PGNC 394; N11066 (1 November 2024)

N11066

PAPUA NEW GUINEA
[IN THE NATIONAL COURT OF JUSTICE]

CR (FC) 15 OF 2024

THE STATE

V

FRANCIS AMPALAVIO

Bomana: Berrigan, J
2024: 1^st November

CRIMINAL LAW – SENTENCE – UNLAWFUL DISCLOSURE – Section 25(1), Cybercrime Code Act, 2016 – Guilty plea - 4 years of imprisonment without hard labour, partially suspended.

The offender, whilst employed as a Lending Sales Officer with BSP Financial Group Ltd, used an electronic device to unlawfully disclose on four separate occasions between 5 August and 10 September 2021 the customer file information, card number and expiry date of four bank customers to another person, who used the information to create duplicate bank cards and withdraw monies totalling almost K145,000 from the accounts. The offender admitted the offences immediately upon investigation and pleaded guilty at the earliest opportunity before the Court. But for K1000 the offender did not benefit from the monies taken.

Held

(1) Given the broad nature of s 21, Cybercrime Code Act and the very severe maximum penalties that are available pursuant to s 21(1) and (2), sentencing for unlawful disclosure requires a careful assessment of the objective seriousness of the offending under consideration.

(2) The following non-exhaustive list of factors may be relevant when considering the objective seriousness of an unlawful disclosure: a) the source or nature of the data disclosed, including the degree to which it is confidential or sensitive; b) the purpose for which it is disclosed, including the extent to which the offender personally benefitted or the disclosure was intended to cause harm to a particular individual or group, the community or the State; c) the period over which the offence was perpetrated; d) the sophisticated nature of the offence and the extent of planning involved; e) the role of the offender and the extent to which the offence involved a breach of trust; and f) the impact of the offence on the public or the public confidence.

(3) The offender was sentenced to an effective sentence of four years of imprisonment, one year of which was suspended on conditions.

Cases Cited:
Wellington Belawa v The State [1988-1989] PNGLR 496
Lawrence Simbe v The State [1994] PNGLR 38
Goli Golu v The State [1979] PNGLR 653
State v Bae (2019) N8029
Tremellan v The Queen [1973] PNGLR 116
Public Prosecutor v Kerua [1985] PNGLR 85
The State v Tardrew [1986] PNGLR 91
The State v Frank Kagai [1987] PNGLR 320

References Cited:
Section 19, Criminal Code
Section 25(1), Cybercrime Code Act, 2016

Counsel
J Batil, for the State
J Kolowe, for the Offender

DECISION ON SENTENCE

1^st November 2024

1. BERRIGAN J: The offender pleaded guilty to four counts of unlawful disclosure, contrary to s 25(1), Cybercrime Code Act, 2016 for which the maximum penalty is, in the case of a natural person, a fine not exceeding K20,000 or imprisonment for a term not exceeding 15 years, or both.
   
2. The offender was employed as a Lending Sales Officer with BSP Financial Group Ltd based at the Harbour City Branch in Port Moresby. On four separate occasions between 5 August and 10 September 2021 he used the computer at his workstation to log into the Bank’s Integrated Comprehensive Banking System (ICBS) to view the account details of four BPS customers, namely Xiana Trading Limited, Jerry Agus, Pape Accountants & Business Advisors, and Hannah’s 18 Construction. In each case the offender sent the customer information file number, card expiry date and the card number of the accounts to another person, called Elizah or Eko, via text message, using his mobile phone. Eko used the data to duplicate the customer’s bank card using a skimming device following which the card was used to withdraw money at several eftpos machines and ATMs in Port Moresby in each case.
   
3. On allocutus the offender apologised to the Court, his employer and the victims who had suffered as a result of his conduct. He thanked his family for their support. He had lost his job of eight years and damaged his relationship with his family. He was very sorry for what he had done. He asked the Court to show mercy and allow him to serve his sentence outside of custody to be with his family.
   

Submissions

4. The State submit that the Court should have regard to the following factors identified in Wellington Belawa v The State [1988-1989] PNGLR 496, putting aside the amount taken and restitution:
   
   1. the amount taken;
   2. the quality and degree of trust reposed in the offender;
   100. the period over which the offence was perpetrated;
   4. the impact of the offence on the public and public confidence;
   5. the use to which the money was put;
   6. the effect upon the victim;
   7. whether any restitution has been made;
   8. remorse;
   9. the nature of the plea;
   10. any prior record;
   11. the effect on the offender; and
   50. any matters of mitigation special to the accused such as ill health, young or old age, being placed under great strain, or perhaps a long delay in being brought to trial.
       
5. It submits in aggravation that there was more than one victim, the offences were perpetrated over a period of two months, involved a serious breach of trust and breached the victim’s right to privacy. Whilst the offender did not benefit from the monies that were withdrawn from the customer’s accounts his actions enabled others to do so, resulting in a loss to the bank which had to reimburse more than K100,000. The offence may also have impacted on the public and customers’ confidence in the bank. A range of 5 to 7 years in each case was appropriate, to be served concurrently. It does not oppose suspension.
   
6. Defence counsel submits that having regard to the offender’s lack of prior convictions, early guilty plea, cooperation, expression of remorse and the fact that he did not benefit from the offence, an effective sentence of five years together with a fine in each case is appropriate, to be served concurrently, and wholly suspended.
   

Consideration

7. Section 19 of the Criminal Code, which applies pursuant to s3, Cybercrime Code Act, provides the Court with broad discretion on sentence. Whilst guidelines and comparative cases are relevant considerations, every sentence must be determined according to its own facts and circumstances: Lawrence Simbe v The State [1994] PNGLR 38. This is not a case warranting the maximum penalty: Goli Golu v The State [1979] PNGLR 653 applied.
   
8. It appears that this is the first time an offender is being sentenced for the offence of unlawful disclosure contrary to s 25(1), Cybercrime Code Act. It is useful therefore to consider the purpose of the offence.
   
9. The use, collection and sharing of data in electronic form is essential to many aspects of modern life. But with the advantage of electronic data also comes risk. The offence of unlawful disclosure is designed to protect against the potential for harm caused to individuals, the community and in some cases, the State, when confidential communication or sensitive data is disclosed unlawfully.
   

“As the world becomes more digitized, data has become an asset and is fundamental to the economic, social, and political development of the country. However, with the increased use of data comes the risk of data breaches and misuse, which can have significant consequences for individuals and society”: National Data Governance and Protection Policy, 2023, (3^rd Draft).

10. The offence of unlawful disclosure pursuant to s 25, Cybercrime Code Act is broadly defined.
    

11. It is possible to envisage that the unlawful disclosure of confidential or classified communication or sensitive data may take place in many different circumstances and for many different purposes.
    
12. Given the broad nature of s 21, Cybercrime Code Act and the very severe maximum penalties applying pursuant to s 21(1) and (2), it is my view that sentencing requires a careful assessment of the objective seriousness of the offending under consideration.
    
13. Accordingly, I would suggest that the following non-exhaustive list of factors may be relevant when considering the objective seriousness of an unlawful disclosure: a) the source or nature of the data disclosed, including the degree to which it is confidential or sensitive; b) the purpose for which it is disclosed, including the extent to which the offender personally benefitted or the disclosure was intended to cause harm to a particular individual or group, the community or the State; c) the period over which the offence was perpetrated; d) the sophisticated nature of the offence and the extent of planning involved; e) the role of the offender and the extent to which the offence involved a breach of trust; and f) the impact of the offence on the public or the public confidence.
    
14. In considering these factors I have to some extent drawn on those identified in Wellington Belawa and in State v Bae (2019) N8029 but it must be emphasised that unlike dishonesty and money laundering offences, which usually take the amount of monies involved as the starting point for determining seriousness, it appears to me that the source and nature of the confidential information or sensitive data disclosed will provide a useful starting point for considering the objective seriousness of an unlawful disclosure.
    
15. The list proposed is not intended to be exhaustive. It is likely to develop as more matters come before the Court and it does not include those subjective matters taken into account in the normal course of sentencing, for instance the nature of the plea, remorse, the impact on the offender and so forth.
    
16. Returning to the present case, the source and nature of the data disclosed was highly confidential private bank account details held by the account holder’s own bank in each case.
    
17. The purpose of the disclosure was obvious. It was not alleged and the offender denies that he personally benefitted as a result of the disclosure, other than that he received K500 on two occasions from Eko, about which he made admissions. Nevertheless, the offender admitted that he provided the data to Eko and that he was aware that Eko would use it to create duplicate bank cards. Given his age and education, not to mention his experience and position within the bank there can be no doubt he fully understood that it would be used by Eko or others for the purpose of accessing the funds contained in each of the customer’s bank accounts.
    
18. In this regard the impact on the victims has been significant. The customers concerned have suffered the initial stress of losing their funds – K53,897.50, K45,928, K25,784, and K19,069.50, respectively - and the inconvenience of reporting the lost monies and obtaining new cards and the Bank has had to bear the cost of reimbursing its customers the lost monies (totalling K144,679). The bank is obviously very concerned about the potential harm to be caused by such offences.
    
19. The offender admitted in his record of interview that he was aware of the account balances at the time he provided the information and he must have appreciated the potential for the loss of those monies as a result of his conduct. Whilst I am not suggesting that this applies as a general rule, I do not think it is appropriate, in the circumstances of this case for the offender to face a significantly different penalty from those who could be prosecuted for misappropriating the monies themselves. In this regard it should also be noted that the State could have indicted the offender as an aider in this regard pursuant to s 7(1)(b) or (c), Criminal Code. Having regard to the guidelines proposed in Wellington Belawa such offences would attract, at their starting point, sentences of between three and five years, and two and three years of imprisonment, with respect to Counts 1 and 2 and 3 and 4, respectively.
    
20. The offences were not particularly sophisticated. The offender used his access to the bank’s system to obtain the details and then share them with Eko via his mobile phone. It is clear, however, that the offending in each case took some planning.
    
21. Whilst not particularly senior, the offender nevertheless abused a position of trust as an employee of the bank for many years with access to confidential customer information to commit the offences.
    
22. There has been no impact on the public and whilst the offending in this case has not impacted on public confidence in the financial sector generally, I do think that there is the potential for such impact in the event that such offences become prevalent. In this regard I must commend the investigators at BSP for the quality and comprehensiveness of the brief of evidence.
    
23. It follows that whilst the offence cannot be described as prevalent, the offending in this case is serious and calls for both specific and general deterrence.
    
24. The offender is 43 years of age. He is from Uvol Village, Pomio District, East New Britain Province. He is married with five children, all of whom appear to be young, with two attending school and three others still at home with their mother. He and his family live with his father and the extended family in Port Moresby.
    
25. The offender is relatively well educated. He obtained a Diploma in Accounting from Port Moresby Business College in 2003.
    
26. In mitigation this is the offender’s first offence. He is of prior good character. As mentioned, he held a trusted position within the bank. Mr Koupa Kila, a member of the offender’s community, says that the offender has been a Church leader at Erima United Church for 14 years and three years as a Chairman of the Congregation. He is well respected in the community. He observes that he has changed a lot since losing his employment. His father cannot believe what his son has done. He has always been an honest and faithful person.
    
27. Whilst his prior good character is a matter in his favour, its weight is diminished somewhat by the fact that the offender took advantage of the position of trust he occupied within the bank as a result of that prior good character.
    
28. It is very much in the offender’s favour that he cooperated with his employer and authorities and pleaded guilty before this Court at the earliest opportunity. I take this into account as a reflection of his true remorse, which he expressed on allocutus. I also take it into account on the basis that it has saved the State and its witnesses the cost and inconvenience of a trial.
    
29. I have no doubt that the impact of the offending on the offender has been and will continue to be grave. The offender has thrown away his good reputation, his standing in the community and a secure position in one of the leading banks in the country. He is not a man of means and he has a young family. Any time spent in custody will be difficult for him and his family. Given his age and the nature of the offence there can be no doubt that he will struggle to obtain formal employment in the future, particularly in the area of his training and experience.
    
30. There are no matters of mitigation special to the offender.
    
31. I have had regard to the offender’s personal circumstances, and the matters in mitigation, his lack of previous conviction and prior good character, together with his early plea and ongoing cooperation. These factors must be considered against the aggravating factors, including the source and nature of the data, the purpose of the disclosure, the breach of trust, the level of planning involved, and the impact on the victim, in each case. The unlawful disclosure of confidential and sensitive data has the potential to cause great harm and this case calls for both general and specific deterrence.
    
32. Having considered all of the above matters, I sentence the offender to four years, four years, two years and two years of imprisonment without hard labour on Counts 1 to 4, respectively. The offender has no capacity to pay a fine and an additional penalty in that regard is not appropriate.
    
33. The offences in this case were committed in the prosecution of a single purpose and arise out of the same or closely related facts. Whilst concerning different customer accounts and occurring on different dates, the offences took place within a period of about a month and it is my view that the sentences should be served concurrently: Tremellan v The Queen [1973] PNGLR 116; Public Prosecutor v Kerua [1985] PNGLR 85 considered.
    
34. I exercise my discretion to deduct time spent in custody, namely four months.
    
35. The offender pleads for the sentence to be suspended. Probation Services has no real objection. This is not a case where the offender will suffer excessively in prison nor where restitution is feasible. The offender has nevertheless shown good prospects for rehabilitation and he has been ready to plead guilty and accept his punishment since 2021.
    
36. Accordingly, I intend to suspend one year of the sentence. This is not an exercise in leniency but an order made in the interest of the community: The State v Tardrew [1986] PNGLR 91; The State v Frank Kagai [1987] PNGLR 320.
    
37. I make the following orders.
    

Orders

(1) On Count 1, the offender is sentenced to four years of imprisonment without hard labour.
(2) On Count 2, the offender is sentenced to four years of imprisonment without hard labour.
(3) On Count 3, the offender is sentenced to two years of imprisonment without hard labour.
(4) On Count 4, the offender is sentenced to two years of imprisonment without hard labour.
(5) The sentences are to be served concurrently.
(6) Time spent in custody to date, 4 months, is deducted.
(7) One year of the sentence shall be suspended upon the offender entering into his own recognisance to keep the peace and be of good behaviour.
(8) Any bail monies are to be immediately refunded.

Sentence accordingly.

_______________________________________________________________
Public Prosecutor: Lawyer for the State
Public Solicitor: Lawyer for the Accused