complete disaster. Prime Suspect certainly hadn't gone in hard. He
could have raised a number of matters, but didn't. Mendax had already
admitted to most of the acts which formed the basis of his 31 charges
in his police interview. And he had already told the police a good
deal about his adventures in Telecom's telephone exchanges.
However, Prime Suspect had elaborated on the Telecom break-ins in his
statement. Telecom was owned by the government, meaning the court
would view phreaking from their exchanges not as defrauding a company
but as defrauding the Commonwealth. Had the DPP decided to lay those
new charges--the Telecom charges--in February 1995 because Prime
Suspect had given the AFP a draft Crown witness statement back then?
Mendax began to suspect so. Nothing seemed beyond doubt any more.
The immediate crisis was the committal hearing in the Melbourne
Magistrates Court. There was no way Boris Kayser was now going to
decimate their star witness, a NorTel information systems
manager. Galbally would have to run a cross-examination himself--no easy
task at short notice, given the highly complex technical aspects of the
Inside the courtroom, as Mendax got settled, he saw Prime Suspect. He
Suspect responded with a blank wall, then he looked away. In fact,
even if Mendax had wanted to say something, he couldn't. As a Crown
witness, Prime Suspect was off-limits until the case was over.
The lawyers began to file into the courtroom. The DPP representative,
Andrea Pavleka, breezed in, momentarily lifting the tension in the
She had that effect on people. Tall, slender and long-legged, with a
bob of sandy blonde curls, booky spectacles resting on a cute button
nose and an infectious laugh, Pavleka didn't so much walk into a
courtroom as waft into it. She radiated happiness from her sunny face.
It's a great shame, Mendax thought, that she is on the other side.
The court was called into session. Prime Suspect stood in the dock and
pleaded guilty to 26 counts of computer crimes.
In the course of the proceedings his barrister, Boris Kayser, told the
court that his client had cooperated with the police, including
telling the AFP that the hackers had penetrated Telecom's exchanges.
He also said that Telecom didn't believe--or didn't want to
believe--that their exchanges had been compromised. When Kayser
professed loudly what a model citizen his client had been, Ken Day,
sitting in the public benches, quietly rolled his eyes.
The magistrate, John Tobin, extended Prime Suspect's bail. The hacker
would be sentenced at a later date.
That matter dealt with, the focus of the courtroom shifted to Mendax's
case. Geoff Chettle, for the prosecution, stood up, put the NorTel
manager, who had flown in from Sydney, on the stand and asked him some
Chettle could put people at ease--or rattle them--at will. Topped by a
minute stubble of hair, his weathered 40-something face provided a
good match to his deep, gravelly voice. With quick eyes and a hard,
no-nonsense manner, he lacked the pretentiousness of many barristers.
Perhaps because he didn't seem to give a fig about nineteenth century
protocols, he always managed to looked out of place in a barrister's
wig and robe. Every time he stood up, the black cape slid off his lean
shoulders. The barrister's wig went crooked. He continually adjusted
it--tugging the wig back into the correct spot like some wayward
child. In court, Chettle looked as if he wanted to tear off the crusty
trappings of his profession and roll up his sleeves before sinking
into a hearty debate. And he looked as if he would rather do it at a
pub or the footy.
The NorTel manager took the stand. Chettle asked him some questions
designed to show the court the witness was credible, in support of the
company's $160000 hacker-clean-up claim. His task accomplished,
Chettle sat down.
A little nervous, Paul Galbally stood up to his full height--more than
six feet--and straightened his jacket. Dressed in a moss green suit so
dark it was almost black, with thin lapels and a thin, 1960s style
tie, he looked about as understated hip as a lawyer could--and still
show his face in court.
Halting at first, Galbally appeared unsure of himself. Perhaps he had
lost his nerve because of the technical issues. WMTP files. UTMP
files. PACCT audits. Network architecture. IP addresses. He had been
expected to become an expert in the basics literally overnight. A
worried Mendax began passing him notes--questions to ask,
explanations, definitions. Slowly, Galbally started working up a
rhythm to the cross-examination.
During the questioning someone from the back of the court sidled up to
Mendax, in the front row of seats, and handed a note over his
shoulder. Mendax unfolded the note, read it and then turned around to
smile at the messenger. It was Electron.
By the time Galbally had finished, he had pulled apart much of the
NorTel manager's evidence. As he built up a head of steam quizzing the
witness, he forced the NorTel manager to admit he didn't know all that
much about the alleged hacking incidents. In fact, he wasn't even
employed by the company when they occurred. He had largely thrown
together an affidavit based on second-hand information--and it was
this affidavit which supposedly proved the hackers had cost the
company $160000. Worse, it seemed to an observer at court that the
NorTel manager had little Unix security technical expertise and
probably would not have been able to conduct a detailed technical
analysis of the incident even if he had been with the company in 1991.
By the end of the defence's cross-examination, it appeared that
Galbally knew more about Unix than the NorTel manager.
When Geoff Chettle stood up to re-examine the witness, the situation
was hopeless. The manager soon stood down. In Mendax's view, the
credibility of the NorTel Manager's statement was shot.
The court was then adjourned until 12 May.
After court, Mendax heard Geoff Chettle talking about the NorTel
witness. `That guy is OFF the team,' he said emphatically.
It was a mixed victory for Mendax. His solicitor had knocked off one
NorTel witness, but there were more where he came from. At a full
trial, the prosecution would likely fly in some real NorTel
fire-power, from Canada, where the 676-page security incident report
had been prepared by Clark Ferguson and other members of the NorTel
security team. Those witnesses would understand how a Unix system
operated, and would have first-hand knowledge of the hackers'
intrusions. It could make things much more difficult.
When Mendax returned to court a week later, he was committed to stand
trial in the County Court of Victoria, as expected.
Later, Mendax asked Galbally about his options. Take the case to full
trial, or plead guilty like the other two IS hackers. He wanted to
know where the DPP stood on his case. Would they go in hard if he
pleaded guilty? Had the NorTel manager disaster at the committal
hearing forced them to back down a little?
Paul sighed and shook his head. The DPP were standing firm. They
wanted to see Mendax go to prison.
Andrea Pavleka, the DPP's sunny-faced girl who radiated happiness, was
baying for blood.
One month later, on 21 July 1995, Prime Suspect arrived at the County
Court for sentencing.
Rising early that morning to make sure his court suit was in order,
Prime Suspect had been tense. His mother cooked him a big breakfast.
Toast, bacon and eggs the way he liked it. In fact, his favourite
breakfast was an Egg McMuffin from McDonald's, but he never told his
The courtroom was already crowded. Reporters from newspapers, the wire
services, a few TV channels. There were also other people, perhaps
waiting for another case.
Dressed in a dark pin-stripe suit, Ken Day stood tapping on a laptop
on the prosecution's side of the courtroom. Geoff Chettle sat near
him. Prime Suspect's barrister, Boris Kayser, sifted through some
papers on the other side.
Mendax lingered at the back of the room, watching his former friend.
He wanted to hear Prime Suspect's sentence because, under the rules of
parity sentencing, Mendax's own sentence would have to be similar to
that of his fellow hackers. However, Prime Suspect might get some
dispensation for having helped the prosecution.
A handful of Prime Suspect's friends--none of them from the computer
underground--trickled in. The hacker's mother chatted nervously with
Court was called into session and everyone settled into their seats.
silver-haired man in his mid-fifties, with eyes so blue they were
almost demonic, stepped into the dock. As the reporters began taking
notes, Prime Suspect tried to imagine what crime the polished,
well-dressed man had committed.
The man had not just molested children, he had molested
his own son. In the parents' bedroom. Repeatedly. On Easter Sunday.
His son was less than ten years old at the time. The whole family had
collapsed. Psychologically scarred, his son had been too traumatised
even to give a victim impact statement.
For all of this, Judge Russell Lewis told the court, the man had shown
no remorse. Grave-faced, the judge sentenced him to a minimum prison
term of five years and nine months.
The court clerk then called Prime Suspect's case.
At the back of the courtroom, Mendax wondered at the strange
situation. How could the criminal justice system put a child molester
in the same category as a hacker? Yet, here they both were being
sentenced side by side in the same County Court room.
Boris Kayser had called a collection of witnesses, all of whom
attested to Prime Suspect's difficult life. One of these, the
well-regarded psychologist Tim Watson-Munro, described Prime Suspect's
treatments at the Austin Hospital and raised the issue of reduced
free-will. He had written a report for the court.
Judge Lewis was quick to respond to the suggestion that hacking was an
addiction. At one point, he wondered aloud to the courtroom whether
some of Prime Suspect's hacking activities were `like a shot of
address. First, he criticised the AFP for waiting so long to charge
`This fellow should have been dealt with six to twelve months after
being apprehended. It is a bit like the US, where a man can commit a
murder at twenty, have his appeal be knocked back by the Supreme Court
at 30 and be executed at 40--all for something he did when he was only
twenty years old.
Thoroughly warmed up, Kayser observed that 20 per cent of Prime
Suspect's life had gone by since being raided. Then he began hitting
his high notes.
`This young man received no assistance in the maturation process. He
didn't grow up, he drifted up.
`His world was so horrible that he withdrew into a fantasy world. He
knew no other way to interact with human beings. Hacking was like a
physical addiction to him.
`If he hadn't withdrawn into the cybernetic highway, what would he
have done instead? Set fires? Robbed houses? Look at the name he gave
himself. Prime Suspect. It has implied power--a threat. This kid
didn't have any power in his life other than when he sat down at a
Not only did Kayser want the judge to dismiss the idea of prison or
community service, he was asking him to order no recorded conviction.
The prosecution lawyers looked at Kayser as if he was telling a good
joke. The AFP had spent months tracking these hackers and almost three
years preparing the case against them. And now this barrister was
seriously suggesting that one of the key players should get off
virtually scot-free, with not so much as a conviction recorded against
him? It was too much.
The judge retired to consider the sentence. When he returned, he was
brief and to the point. No prison. No community service. The recording
of 26 convictions. A $500 three-year good behaviour bond. Forfeiture
of the now ancient Apple computer seized by police in the raid. And a
reparation payment to the Australian National University of $2100.
Relief passed over Prime Suspect's face, pink and sweaty from the
tension. His friends and family smiled at each other.
Chettle then asked the judge to rule on what he called `the
cooperation point'. He wanted the judge to say that Prime Suspect's
sentence was less than it would have been because the hacker had
turned Crown witness. The DPP was shoring up its position with regard
to its remaining target--Mendax.
Judge Lewis told the court that the cooperation in this case made no
difference. At the back of the court, Mendax felt suddenly sad. It was
good news for him, but somehow it felt like a hollow victory.
Prime Suspect has destroyed our friendship, he thought, and all for
County Court room to receive his sentence after pleading guilty to six
counts of hacking and phreaking. Despite taking medication to keep his
anxiety under control while in the city, he was still very nervous in
Since he faced the least number of charges of any of the IS hackers,
Trax believed he had a shot at no recorded conviction. Whether or not
his lawyer could successfully argue the case was another matter.
Bumbling through papers he could never seem to organise, Trax's lawyer
rambled to the court, repeated the same points over and over again,
jumping all over the place in his arguments. His voice was a
half-whispered rasp--a fact which so annoyed the judge that he sternly
instructed the lawyer to speak up.
Talking informally before court, Geoff Chettle had told Mendax that in
his view there was no way Judge Mervyn Kimm would let Trax off with no
recorded conviction. Judge Kimm was considered to be one tough nut to
crack. If you were a bookmaker running bets on his court at a
sentencing hearing, the good money would be on the prosecution's side.
But on 20 September 1995, the judge showed he couldn't be predicted
quite so easily. Taking everything into account, including Prime
Suspect's sentence and Trax's history of mental illness, he ordered no
conviction be recorded against Trax. He also ordered a $500 three-year
good behaviour bond.
In passing sentence, Judge Kimm said something startlingly insightful
for a judge with little intimate knowledge of the hacker psyche. While
sternly stating that he did not intend to make light of the gravity of
the offences, he told the court that `the factors of specific
deterrence and general deterrence have little importance in the
determination of the sentence to be imposed'. It was perhaps the first
time an Australian judge had recognised that deterrence had little
relevance at the point of collision between hacking and mental
29 August 1995 pleaded guilty to eight counts of computer crime, and
not guilty to all the other charges. Almost a year later, on 9 May
1996, he pleaded guilty to an additional eleven charges, and not
guilty to six. The prosecution dropped all the other charges.
Mendax wanted to fight those six outstanding charges, which involved
ANU, RMIT, NorTel and Telecom, because he felt that the law was on his
side in these instances. In fact, the law was fundamentally unclear
when it came to those charges. So much so that the DPP and the defence
agreed to take issues relating to those charges in a case stated to
the Supreme Court of Victoria.
In a case stated, both sides ask the Supreme Court to make a ruling
not on the court case itself, but on a point of law. The defence and
the prosecution hammer out an agreed statement about the facts of the
case and, in essence, ask the Supreme Court judges to use that
statement as a sort of case study. The resulting ruling is meant to
clarify the finer points of the law not only for the specific case,
but for similar cases which appear in future.
Presenting a case stated to the Supreme Court is somewhat uncommon. It
is unusual to find a court case where both sides can agree on enough
of the facts, but Mendax's hacking charges presented the perfect case
and the questions which would be put to the Victorian Supreme Court in
late 1996 were crucial for all future hacking cases in Australia. What
did it mean `to obtain access' to a computer? Did someone obtain
access if he or she got in without using a password? What if he or she
used the username `guest' and the password `guest'?
Perhaps the most crucial question of all was this: does a person
`obtain access' to data stored in a computer if he or she has the
ability to view the data, but does not in fact view or even attempt to
view that data?
A good example of this applied to the aggravated versions of the
offence of hacking: viewing commercial information. If, for example,
Mendax logged into a NorTel computer, which contained commercially
sensitive information, but he didn't actually read any of those files,
would he be guilty of `obtaining access' or `obtaining access to
The chief judge of the County Court agreed to the case stated and sent
it up to the full bench of the Supreme Court. The lawyers from both
sides were pleased with the bench--Justices Frank Vincent, Kenneth
Hayne and John Coldrey.
On 30 September 1996, Mendax arrived at the Supreme Court and found
all the lawyers assembled at the court--all except for his barrister.
Paul Galbally kept checking his watch as the prosecution lawyers began
unpacking their mountains of paper--the fruit of months of
preparation. Galbally paced the plush carpet of the Supreme Court
anteroom. Still no barrister.
Mendax's barrister had worked tirelessly, preparing for the case
stated as if it was a million dollar case. Combing through legal
precedents from not only Australia, the UK and the US, but from all
the world's Western-style democracies, he had attained a great
understanding of the law in the area of computer crime. He had finally
arrived at that nexus of understanding between law, philosophy and
linguistics which many lesser lawyers spent their entire careers
trying to reach.
But where was he? Galbally pulled out his mobile and checked in with
his office for what seemed like the fifth time in as many minutes. The
news he received was bad. He was told, through second-hand sources,
that the barrister had collapsed in a state of nervous exhaustion. He
wouldn't be making it to court.
Galbally could feel his hairs turning grey.
When court opened, Galbally had to stand up and explain to three of
the most senior judges in Australia why the defence would like a
two-day adjournment. A consummate professional, Geoff Chettle
supported the submission. Still, it was a difficult request. Time in
the Supreme Court is a scarce and valuable thing. Fortunately, the
adjournment was granted.
This gave Galbally exactly two days in which to find a barrister who
was good, available and smart enough to assimilate a massive amount of
technical information in a short time. He found Andrew Tinney.
Tinney worked around the clock and by Wednesday, 2 October, he was
ready. Once again, all the lawyers, and the hacker, gathered at the
works. They asked both sides to spend the first hour or so explaining
exactly why the Supreme Court should hear the case stated at all. The
lawyers looked at each other in surprise. What was this all about?
After hearing some brief arguments from both sides, the judges retired
to consider their position. When they returned, Justice Hayne read a
detailed judgment saying, in essence, that the judges refused to hear
As the judge spoke, it became clear that the Supreme Court judges
weren't just refusing to hear this case stated; they were virtually
refusing to hear any case stated in future. Not for computer crimes.
Not for murder. Not for fraud. Not for anything. They were sending a
message to the County Court judges: don't send us a case stated except
in exceptional circumstances.
Geoff Chettle slumped in his chair, his hands shielding his face. Paul
Galbally looked stunned. Andrew Tinney looked as if he wanted to leap
from his chair shouting, `I just killed myself for the past two days
on this case! You have to hear it!' Even Lesley Taylor, the quiet,
unflappable and inscrutable DPP solicitor who had replaced Andrea
Pavleka on the case, looked amazed.
The ruling had enormous implications. Judges from the lower courts
would be loath to ever send cases to the Supreme Court for
clarification on points of law again. Mendax had made legal history,
but not in the way he had hoped.
Mendax's case passed back down to the County Court.
He had considered taking his case to trial, but with recently
announced budget cuts to Legal Aid, he knew there was little hope of
receiving funding to fight the charges. The cuts were forcing the poor
to plead guilty, leaving justice available only for the wealthy.
Worse, he felt the weight of pleading guilty, not only as a sense of
injustice in his own case, but for future hacking cases which would
follow. Without clarity on the meaning of the law--which the judges
had refused to provide--or a message from a jury in a landmark case,
such as Wandii's trial, Mendax believed that hackers could expect
little justice from either the police or the courts in the future.
On 5 December 1996, Mendax pleaded guilty to the remaining six charges
and was sentenced on all counts.
Court Two was quiet that day. Geoff Chettle, for the prosecution,