On Friday, magistrate Erin Kennedy sentenced Khoo to a 15-month intensive corrections order, meaning he will serve out his custodial sentence in the community. He was ordered to complete 300 hours of community service and continue counselling.
Khoo’s actions were discovered in February 2018, causing his dismissal from the CSIRO. The Australian Federal Police executed a search warrant the following month and he was charged a year later.
Speaking after sentencing, Federal Police cybercrime operations commander Chris Goldsmid said the conduct breached the public’s trust in government and impaired the important and legitimate activities of the CSIRO supercomputers.
“This man’s activities diverted these supercomputer resources away from performing
significant scientific research for the nation, including pulsar data array analysis, medical research and climate modelling work,” he said.
Khoo’s lawyer, Avni Djemal, told the court his client had no prior offences, admitted the wrongdoing when confronted by police, showed remorse and was already facing serious consequences for his actions, having lost work subsequently when the employer became aware of his charges.
Handing down the sentence at the Downing Centre Local Court, Ms Kennedy acknowledged Khoo’s guilty plea and other mitigating factors but said the sentence had to reflect the importance of general deterrence.
While noting the conduct was less severe than other cases where offenders had breached secure government systems, she said it was very significant that an agency like the CSIRO had been targeted.
The maximum penalty for the offence – unauthorised modification of data to cause impairment – is 10 years imprisonment.
Commander Goldsmid said malicious cyber activity, including by people on the inside of organisations, was increasing in scale and severity. He urged companies and government agencies to have a strong culture of cyber security and to strengthen their ability to detect breaches.