How the HIV data leak was handled

In Parliament yesterday, Health Minister Gan Kim Yong explained how information from Singapore's HIV Registry had fallen into the wrong hands and was disclosed online, and what action the authorities took.

Above: The National Public Health Unit, which was headed by Ler Teck Siang when MOH received a complaint about him from his boyfriend. LIANHE ZAOBAO FILE PHOTO
Health Minister Gan Kim Yong gave details about the HIV Registry data leak in Parliament yesterday. PHOTO: GOV.SG
In May 2016, police raided the premises of Ler Teck Siang (left) and his American lecturer boyfriend Mikhy Farrera Brochez (right), seizing computers, electronic storage devices and other materials. They discovered Brochez had sent a further 46 records from the registry to his mother by e-mail. PHOTOS: ST FILE, FAITH MEDICAL GROUP

Nov 2012

American lecturer Mikhy Farrera Brochez complains to the Ministry of Health (MOH) that his Singaporean boyfriend Ler Teck Siang, then head of the National Public Health Unit, had disclosed to others information about Brochez's HIV status.

Brochez also claims that Ler had shared screenshots of his HIV status with others.

MOH attempts to engage Brochez, but he is uncooperative and evasive, and postpones meetings. At one point, he says he does not want to continue with the investigations into his allegations. MOH keeps up the investigation nonetheless.

May 2013

Ler is reassigned to another role. His access to the live HIV Registry is terminated.

Dec 2013

MOH discovers that Brochez may have submitted fake HIV blood tests to the Ministry of Manpower (MOM) to retain his Employment Pass.

MOH informs MOM and makes a police report.

Jan 2014

Ler resigns from MOH.

The police and MOH begin investigating whether Brochez had submitted fake blood tests and whether Ler had abetted him and provided false information to investigators.

May 2014

Brochez continues to be uncooperative with the police, and at first refuses to provide a statement to the police.

That month, he is stopped from leaving Singapore, and gives a police statement. In it, he lies to the police that it was his blood that was tested during a HIV test conducted in November 2013.

MOH orders Brochez to undergo a new blood test, but he refuses.

April 2016

Brochez is arrested for repeatedly refusing to take a blood test. He provides police and other government authorities with a list of 75 names and particulars from the HIV Registry.

This is the first time MOH has evidence that Brochez may have access to the confidential data, said Mr Gan.

May 2016

MOH makes another police report on May 16.

Police raid Ler's and Brochez's premises, seizing computers, electronic storage devices and other materials.

Police discover that Brochez had sent a further 46 records from the registry to his mother by e-mail. She agrees to let police access her account and delete the records. MOH says the police, at this point, have seized everything found in the duo's possession and have done their best to ensure no confidential information remained with them.

A decision is taken not to make a public announcement as it "would not serve the interests of the affected individuals", said Mr Gan.

June 2016

Ler and Brochez are charged in court.

Ler is charged under the Penal Code and the Official Secrets Act (OSA). His charge sheet, which is public information, states he had access to the HIV Registry as part of his position at MOH, and that he had failed to take reasonable care of the information in the registry by failing to retain possession of a thumb drive on which he had saved the registry.

Brochez is charged under the Misuse of Drugs Act, Penal Code and the Infectious Diseases Act.

The Attorney-General's Chambers decides not to charge him under the OSA. It assesses that he would likely be sentenced to a fine only or at most a few weeks in jail as there had been no wide dissemination of the information at that stage, and he had primarily used the information to complain to government agencies. His other charges are more serious and carry "far heavier penalties".

Brochez is issued a stern warning under the OSA.

March 2017

Brochez is convicted and jailed for 28 months, inclusive of time he had served in remand since June 2016.

April 2018

Brochez is released from jail and deported.

May 2018

Brochez sends a screenshot to several government authorities containing the details of 31 persons. They are found to be among the original 75 names he disclosed in 2016.

MOH makes another police report.

It also decides to contact the 31 individuals to inform them. This was because unlike before, it could not retrieve the screenshot of the 31 records in Brochez's possession.

MOH did not make a public announcement as there was still no specific evidence Brochez had more information beyond these 31 records. Also, he had shared it only with the government authorities and not with any wider audience. "A public announcement would create anxiety and distress not just among the 31 persons, but also other HIV patients whose names were in the registry," said Mr Gan.

Sept 2018

Ler is convicted and sentenced to 24 months in jail. He appeals and is scheduled to appear in court in March 2019. His OSA charge is currently stood down, but will be dealt with after proceedings on his other charges have concluded.

Jan 2019

MOH becomes aware that Brochez probably still possessed the entire HIV Registry beyond the 31 records. He had also put the information online and provided the link to a non-government party.

This means the likelihood of him making public the identities of affected persons rises significantly. MOH decides to make a public announcement. It also contacts affected persons and works with the police and other parties to disable access to the information quickly.

Join ST's WhatsApp Channel and get the latest news and must-reads.

A version of this article appeared in the print edition of The Straits Times on February 13, 2019, with the headline How the HIV data leak was handled. Subscribe