HIV data leak: Brochez’s cat-and-mouse affair with the authorities

Mikhy K. Farerra-Brochez leaked the data of 14,200 HIV sufferers from Singapore's HIV registry.  — Clark County Detention Centre/ pic via TODAY
Mikhy K. Farerra-Brochez leaked the data of 14,200 HIV sufferers from Singapore's HIV registry. — Clark County Detention Centre/ pic via TODAY

SINGAPORE, Feb 13 — While American Mikhy K. Farrera Brochez initially came to the authorities’ attention in 2012, it was only four years later that the Ministry of Health (MOH) first discovered that he might have access to confidential data from Singapore’s human immunodeficiency virus (HIV) registry.

Brochez, who was the boyfriend of then-head of MOH’s National Public Health Unit Ler Teck Siang, had complained to the ministry in May 2012 that Ler had given information about him to other people, including sharing screenshots of his HIV status.

But after making the complaint, Brochez, who did not provide any evidence to support his allegations, was “uncooperative and evasive” despite multiple attempts by MOH to engage him, Health Minister Gan Kim Yong told the House on yesterday.

As a result, the authorities could not proceed much further with their investigations.

“(Brochez) rejected or postponed meetings with MOH on several occasions. At one point, he even informed MOH officers that he was leaving Singapore and did not want to continue with the investigation into his allegation,” said Gan, who laid out a detailed timeline surrounding the leak of HIV data in a ministerial statement following a public outcry about MOH’s handling of the case.

MOH had said last month that Brochez had leaked the confidential records of 14,200 HIV-positive individuals, along with 2,400 of their contacts, with information spanning almost three decades from 1985 up to January 2013.

A total of 10 questions about the incident were filed by several Members of Parliament. Nominated MP Walter Theseira, for example, wanted to know the reasons why the breach was not publicly disclosed when the first police report was made in May 2016; and whether public disclosure standards will be reviewed in light of this incident.

In his statement, Gan said the ministry first discovered that Brochez could have access to confidential HIV-related data, after he was arrested in late April 2016 for repeatedly refusing to take a blood test.

Following his arrest, Brochez gave the authorities 75 names and particulars from the HIV registry. “This was the first time MOH had evidence that Brochez may have access to confidential HIV data,” said Gan, who added that a police report was made on May 16, 2016.

Gan said the police simultaneously raided the homes of Brochez and Ler, “and seized and secured all relevant materials”.

These included their computers and electronic storage devices containing files with information from the HIV registry, files related to hospital services and to other infectious diseases, as well as other information likely used by Ler for his work such as emails, HIV studies and reports.

The police searched through Brochez’s email account and found that he had sent some confidential info from the HIV registry to his mother. After she was contacted by the police, she agreed to let the police access her email account and delete those records.

Gan stressed that at that point, the police seized everything they found in Ler’s and Brochez’s possession, and did their best to ensure that no further confidential information remained with Ler and Brochez, including in their known online accounts.

“Unfortunately, as recent events showed, Brochez did manage to retain at least some data which he has recently disclosed, and we cannot rule out the possibility that he has more,” Gan said.

Why Brochez was not charged under OSA

Ler and Brochez were both charged in court in June 2016.

Ler was charged under the Penal Code and the Official Secrets Act (OSA).

Brochez was charged under the Misuse of Drugs Act, Penal Code and Infectious Diseases Act.

Gan reiterated that the Attorney-General’s Chambers (AGC) decide on the charges.

“AGC decided not to charge him under the OSA because they assessed that he would likely be sentenced to a fine only, or at most a few weeks in jail,” said Gan.

This was because there had been no wide dissemination of the confidential information at that stage, and he had primarily used the information to “complain to the government agencies”, said Gan, who also noted that Brochez was already facing numerous fraud and drug-related charges which carried far heavier penalties.

AGC also assessed that any jail term under the OSA was likely to be concurrent with incarceration under the other offences.

In 2017, Brochez was sentenced to 28 months’ imprisonment on numerous fraud and drug-related charges.

Ler was convicted in September last year of abetting Brochez to commit cheating, and providing false information to the police and MOH. He was sentenced to two years’ jail.

Ler is appealing against the sentence, with the hearing set for next month.

While the OSA charge against Ler had been stood down as the authorities went after him for the more serious offences first, Gan stressed that the AGC will decide on the OSA charge after proceedings on his other charges have concluded. “This is the usual course,” he noted.

Decision to go public

After serving his sentence, Brochez was deported from Singapore in April last year.

A month later, he sent a screenshot containing 31 records from the HIV registry to several government agencies. All these records were not new, and were part of the 75 records which he had given the authorities in 2016, said Gan.

Nevertheless, MOH filed another police report.

However, this time, the authorities were unable to retrieve the screenshot of the 31 records in Brochez’s possession.

“We considered again whether to tell the affected individuals and the public. The relevant factors were similar to those in 2016. But there was one difference,” said Gan.

In the end, the authorities decided to contact the 31 affected individuals but opted against making public the leak, as there was still “no specific evidence” that Brochez had more information beyond these 31 records.

“A public announcement would create anxiety and distress not just among the 31 persons but also other HIV patients whose names are in the registry,” said Gan.

On Jan 22 this year, MOH found out that Brochez had put the entire HIV registry online, as well as provided the link to a non-government party.

This was when MOH decided to make a public announcement. Following its move, the ministry was informed by a few parties that Brochez tried to make contact with them and wanted to provide links to the confidential information. The links have since been disabled.

How Brochez came to the authorities’ attention

  • In November 2012, Brochez first made a complaint to MOH that Ler had disclosed information about him to other people. He also later claimed that Ler shared screenshots of his HIV status to others.
  • Ler was then reassigned to another role in May 2013, and his access to the HIV registry terminated.
  • In December, MOH discovered that Brochez may have submitted fake HIV blood tests to the Ministry of Manpower in order to retain his employment pass.
  • Ler resigned the following month.
  • Between 2014 and 2016, the police and MOH investigated whether Brochez had submitted fake blood tests, and whether Ler abetted the process and gave false information to investigators.
  • In May 2014, Brochez, who had been uncooperative, finally gave a statement to the police after he was stopped trying to leave Singapore. However, he lied to the police then that it was his blood that was tested during a HIV test in November 2013.
  • The MOH ordered him to take a fresh blood test to verify his test, but Brochez refused to co-operate. He was arrested in late-April 2016 for repeatedly refusing to take a blood test. — TODAY