Charged with a computer offence in NSW.

The legislative source.

The structure of Part 6 is layered. The 2-year offences in sections 308H and 308I are the entry-level offences and capture conduct where the access or modification is unauthorised but not directed at any further criminal purpose. The 3-year offences in sections 308F and 308G capture preparatory conduct, the possession or supply of data with the intent to commit a serious computer offence. The 10-year offences in sections 308C, 308D and 308E capture the more serious conduct where the unauthorised access, modification or impairment was directed at impairment or at the commission of a separate serious indictable offence (fraud, identity theft, child abuse material, blackmail).

"Unauthorised" is the central concept and is defined in section 308 by reference to the person's authority to cause that access, modification or impairment. Authority is conferred by the owner or operator of the system; an employee's authority is limited to the use authorised by the employer's policies. An employee who uses legitimate credentials to access data they were not authorised to see for non-work purposes commits an unauthorised access offence under section 308H, even though the credentials were valid.

The federal overlap matters. Where the conduct involves a Commonwealth network (Centrelink, the ATO, Defence), a telecommunications carrier, or a Commonwealth public office, the Commonwealth scheme in Part 10.7 of the Criminal Code is usually charged. The NSW and Commonwealth schemes are similar in structure but the maxima and the prosecution arrangements differ. Many matters are charged under both regimes and resolved on one or the other.

Penalties and likely outcomes.

The 2-year offences (ss 308H and 308I).

For a first offence finalised in the Local Court, a section 10(1)(b) Conditional Release Order without conviction is achievable where the conduct was opportunistic and the subjective case is strong (the employee who looked up a celebrity's record on a database, the curious user who accessed a family member's account). Where the conduct involved a deliberate breach of trust or repeated access over time, a CRO with conviction or a small fine is the realistic outcome.

The 3-year offences (ss 308F and 308G).

These are preparatory offences. The realistic range is a CRO with conviction or a community correction order, occasionally an intensive correction order where the data was prepared for a serious purpose and the conduct was sustained.

The 10-year offences (ss 308C, 308D and 308E).

The 10-year offences are usually charged where there is a substantive secondary offence (fraud, identity theft, child abuse material) or where the impairment caused significant disruption. The realistic range is full-time custody or an intensive correction order, with the head sentence reflecting the scale of the conduct, the value or volume of data affected, and the nature of the secondary offence.

Defences and arguments worth running.

Authority.

The central element across Part 6 is that the access, modification or impairment was unauthorised. Where the accused had authority (express, implied, or by virtue of their position), the offence is not made out. The authority defence is often available in employment matters where the employee was using their own credentials within an unclear policy framework.

Knowledge that the access was unauthorised.

The offences require knowledge that the conduct was unauthorised. Where the accused honestly believed they were authorised (because of an unclear policy, a verbal authorisation, or a misunderstood role), knowledge is contestable. The defence is supported by employment contracts, IT policies and any communications about the scope of authority.

Identification.

Cybercrime prosecutions rely heavily on attribution evidence (IP addresses, MAC addresses, login records, device fingerprints). Where the brief establishes only that an account was used, but not that the accused was the person using it, identification is contestable. Shared devices, compromised accounts and household network attribution are all defended on this ground.

Intent to commit a serious offence (s 308C only).

The 10-year offence under s 308C requires the intent to commit a serious indictable offence in addition to the unauthorised conduct. Where the brief establishes only the unauthorised conduct without the secondary intent, the proper charge is one of the lower offences. Negotiating the charge down from s 308C to s 308H preserves the trial-ready position with a much lower sentencing exposure.

What we do for clients facing this charge.

The first step is the brief, which in computer-offence matters is technically dense. The forensic report (the prosecution expert's analysis of the device, the network traffic, and the account activity) is the central document. We engage a defence computer-forensic expert where the prosecution evidence is challenged on attribution, on the scope of unauthorised conduct, or on the date and time of access.

The second step is the federal-state question. Where the conduct touches a Commonwealth network or a Commonwealth public office, the matter may be charged under Part 10.7 of the Commonwealth Criminal Code in addition to or instead of the Part 6 NSW offences. The election between NSW and Commonwealth proceedings has procedural consequences (committal pathway, brief service rules, sentencing court) that we work through with the prosecution.

The third step is the subjective case. Computer-offence accused persons are often first offenders with strong employment and family histories. The subjective case is usually the strongest part of the matter. References, treatment for any underlying compulsion (gambling, addictive online behaviour), restitution, and a clear account of why the conduct occurred set up the section 10 or community-based sentence.

What we tell clients on the first call.

The practical detail below is not legal advice for your matter. It is the version of the conversation the firm typically has with a client charged with a computer offence in the first hour.

What evidence police usually rely on.

Forensic images of the relevant device or account, log files, and the digital trail compiled by the investigator. Section 308 to 308I matters often turn on the access definition.

What to bring to the first consultation.

• The Court Attendance Notice (or charge sheet) and any bail papers.
• Anything police gave you in writing — fact sheet, certificate of analysis, search warrant copy, property seizure record.
• A short written timeline of the day, in your own words.
• A written timeline of the access said to have been made; any account credentials, work-related authorities, or scope-of-employment material relevant to the access.

Common mistakes in the first twenty-four hours.

• Talking to anyone other than your lawyer about the matter. Friends, family, co-accused and social media are not privileged.
• Deleting messages, photographs, posts or browser history. The trail left by deletion is often more damaging than what was there.
• Contacting the complainant or any prosecution witness, even through a third party.
• Logging in to the relevant accounts or systems. Each post-charge access can be charged separately.

What not to say to police without advice.

You must give your name and address. You do not have to answer anything else, and in most cases you should not. The standard answer is: “I do not wish to answer questions. I want to speak to my lawyer.” Section 89 of the Evidence Act 1995 (NSW) protects silence; the narrow section 89A exception applies only on indictable matters and only where a special caution has been given in the presence of an Australian lawyer.

The timeline you can expect.

From charge to first court appearance is typically two to six weeks in the Local Court and longer where the matter is indictable. The brief of evidence is served by the prosecutor on a date set at the first mention. From service of the brief to first reply is typically twenty-eight days. Defended hearings and committals are then listed weeks or months out depending on the court list.

When an early plea may or may not be appropriate.

An early plea attracts a sentencing discount of up to twenty-five per cent if entered at the first available opportunity, but it locks in a conviction. The firm does not advise an early plea before the brief is served and read. The access definition under section 308 to 308I is contested on the facts. An early plea is rarely appropriate before the scope-of-employment evidence is reviewed.

Court-specific notes.

If the matter is listed at the Downing Centre, Parramatta, Penrith, Burwood, Manly, Newtown, Waverley, Hornsby or Sutherland Local Court, the firm appears in person. Wollongong Local Court matters are run from the firm's Wollongong office. ACT Magistrates Court and ACT Supreme Court matters are run from chambers; the firm appears in person at all ACT mentions.

Recent outcomes · a computer offence matters.

Anonymised outcomes from the firm's matter set. Names, dates beyond the year, and identifying details have been altered or omitted to preserve client confidentiality. Each result was determined on the particular facts and is not a guarantee of any future outcome.

Frequently asked.