CSIRO IT contractor spared jail for mining Monero on supercomputer

A former CSIRO IT contractor has escaped jail time for using the peak science and research organisation’s supercomputer to mine cryptocurrency.

Jonathan Khoo, 34, was sentenced to a 15-month intensive correction order at Sydney’s Downing Centre Local Court on Friday after pleading guilty to the charges.

Khoo was charged by the Australian Federal Police in May 2019 for modifying the computer systems of CSIRO without authorisation to access the processing power.

The charges included unauthorised modification of data to cause impairment and unauthorised modification of restricted data.

Magistrate Erin Kennedy on Friday said Khoo had installed and run 2903 command scripts into CSIRO’s two high performance computers (HPC) and the Claymore Dual Miner software.

In doing so, he generated $9422 worth of cryptocurrency mining proceeds in the form of Ethereum and Monero over just over a month in early 2018.

While there was no “permanent impairment to the CSIROs” operations, Kennedy said the mining reduced the performance of the HPCs, and ultimately caused a "loss of productivity".

Apart from the CSIRO, the HPCs were also used by a number of other government and research organisations, including the Royal Australian Navy and Victor Chang Cardiac Research Institute.

CSIRO put the total cost of the reduced capacity to run other legitimate jobs on the HPCs at $76,668, including hardware and software.

Kennedy said it was "very significant that this organisations was targeted in this way", labelling Khoo's actions as "reckless" for such a complex system.

"Who knows what could have happened as a result of this conduct," she said.

Kennedy said Khoo had broken the CSIRO's trust in mining the cryptocurrency, but acknowledged that he was "incredibly remorseful".

She also noted that Khoo had admitted his guilt to police almost immediately after a search warrant was executed in March 2018.

Khoo was handed a 15-month intensive correction order - a custodial sentence served in the community - with 300 hours of community service.

The maximum penalty for the charge of unauthorised modification of data to cause impairment is 10 years imprisonment.