Singapore's HIV data leak: A recap of what we know so far
The HIV-positive status of 14,200 people, along with their names, identification numbers and contact details, had been leaked online by American fraudster Mikhy K Farrera Brochez, Singapore’s Ministry of Health (MOH) said in a press release on Monday (28 January).
The medical records belonged to 5,400 Singaporeans diagnosed with HIV since 1985 up to January 2013 as well as 8,800 foreigners – including work and visit pass applicants and holders – diagnosed with the disease up to December 2011.
Brochez, 34, was sentenced to 28 months’ jail in 2017 for fraud and drug-related crimes. He was deported after serving sentence.
The conman was a partner of Ler Teck Siang, 37, who was the Head of MOH’s National Public Health Unit (NPHU) from March 2012 to May 2013 with access to the HIV Registry. The male Singaporean doctor resigned from MOH in January 2014.
Ler was sentenced to two years’ jail last year for abetting Brochez to commit cheating, and also of providing false information to the police and the health ministry. His appeal against conviction and sentence is expected to be heard in March. The prosecution is also appealing for a higher sentence.
Ler has also been charged under the Official Secrets Act for failing to take reasonable care of confidential information regarding HIV-positive patients. His case under the OSA is pending.
Here’s a timeline of what we know so far of the HIV data scandal:
2008
January: American Mikhy K Farrera Brochez begins residing in Singapore, after getting into a romantic relationship a year earlier with Singaporean doctor Ler Teck Siang, whom he met online. Both men are in their early 20s.
March: Brochez takes a HIV test using a fake passport under the name of Malatesta da Farrera-Brochez and the results come back positive. The couple know that foreigners with HIV are not allowed to work in Singapore and hence hatch a plan to dupe the authorities. Brochez visits a clinic where Ler works as a locum general practitioner. Ler, who had drawn his own blood, labels the sample with his partner’s particulars. Brochez then applies to the Ministry of Manpower (MOM) for an employment pass, submitting the false HIV-negative test result. MOM is deceived into issuing Brochez with the pass, and he works as a lecturer in early childhood studies and psychology at Temasek Polytechnic.
2012
February: Ler starts working at MOH’s Communicable Diseases Division.
March: Ler is head of MOH’s National Public Health Unit from March 2012 to May 2013, with authority to access information in the HIV Registry as required for his work. At some point during his tenure, he reportedly downloads the data onto a USB flash drive.
2013
October: MOM informs Brochez that his employment pass will have to be cancelled, after being informed by MOH that it had traced the 2008 HIV-positive test result to him.
November: Brochez repeats the same ruse in cahoots with Ler as before to pass off as HIV-negative. Brochez also submits forged educational certificates to MOM. He retains his employment pass.
December: Ler lies to an investigator from MOH’s surveillance and enforcement branch, saying he did not take Brochez’s HIV blood test the previous month.
2014
January: Ler lies to a police investigator that he had tested Brochez’s blood during the HIV test in November 2013. Ler resigns from MOH the same month.
April: Ler and Brochez get married in New York City.
May: Brochez is stopped from trying to leave Singapore. He lies to a police investigator, saying he had submitted his own blood sample for HIV testing in November the previous year.
2016
April: Brochez is arrested for repeatedly refusing to comply with MOH’s order to take a blood test. He provides the police and government authorities with 75 names and particulars from the HIV registry.
May: MOH makes a police report after getting to know that Brochez had confidential data which appeared to have come from its HIV Registry. Officers search both Brochez’s and Ler’s properties simultaneously. They find and secure what the authorities term as “relevant material”. The material include computers, storage devices and e-mails. Police also find Brochez’s forged academic certificates. Brochez is found guilty of ketamine and cannabis possession the same month. Ler admits to police that he had swapped his blood sample with his partner’s. He will later claim during his court trial that he had made the confession under duress.
June: Brochez is remanded in Changi Prison. Ler is charged in court for crimes under the Penal Code and the Official Secrets Act (OSA). He is accused of failing to take reasonable care of the information in the HIV Registry, by failing to retain possession of a thumb drive on which he had saved the data.
2017
March: Brochez is convicted of numerous fraud and drug-related crimes, and sentenced to 28 months’ jail in total. He pleaded guilty to 6 out of 23 charges with the remaining counts taken into consideration for his sentencing. The fraud offences included using forged degree certificates in job applications. The jail term is backdated to the date of his remand.
2018
April: Brochez is deported after serving sentence.
May: MOH gets to know that Brochez still has data from its HIV Registry. He sends several government authorities a screenshot containing 31 records from the HIV Registry. The records are a sub-set of the 75 which he had earlier provided to the authorities in 2016. MOH makes another police report and notifies the affected individuals.
September: Ler is convicted after a trial of two charges of abetting Brochez to cheat, and two counts of providing false information to MOH and the police. He is sentenced to two years’ jail, but files an appeal against conviction and sentence. The prosecution also files an appeal against sentence. The appeal is set to be heard in March 2019. Ler’s charge under the OSA, for failing to take reasonable care of confidential information regarding HIV-positive patients, is pending before the courts.
December: Ler’s certificate to practice medicine expires.
2019
January: MOH gets to know that data from its HIV Registry – of 5,400 Singaporeans diagnosed with HIV up to January 2013 and 8,800 foreigners diagnosed with HIV up to December 2011 – has been disclosed online. The data includes their name, identification numbers, contact details, HIV test results and related medical information. The details of 2,400 people identified through contact tracing up to May 2007 were also included. Police seek assistance from foreign counterparts on Brochez’ whereabouts. Health Minister Gan Kim Yong apologises for the data breach.
12 February: Gan makes a ministerial statement in Parliament on the issue. He talks about the background of the case; why Brochez was not charged under the OSA; MOH’s decision not to inform affected individuals and make a public announcement about the breach earlier; safeguards to ensure security of health data; help for HIV patients and steps to reduce stigma faced by them.
13 February: A Facebook user claiming to be Brochez denies stealing the database containing the personal details of thousands of HIV patients from the HIV Registry and leaking them to the public. “Brochez” alleges that two people stole the data in 2012, and that one of them had harassed Brochez and Ler, broken into their house multiple times, and stolen the latter’s work laptop. “Brochez” further alleges that he contracted HIV in 2016 after he was sexually assaulted while in prison in Singapore and did not contract the disease in 2008 as the government claimed.
13 February: The police and prison service rebut the allegations, calling them “baseless” and made by “a pathological liar”. They say that during his time in prison, Brochez also committed institutional offences including assaulting a fellow inmate. The health ministry separately rebuts the claims on the same day, describing them as “false or unsubstantiated with any evidence”.
22 February: Following an investigation by the Federal Bureau of Investigation, Brochez is charged in Kentucky by the United States Department of Justice with the unlawful transfer of stolen identification documents and possession with intent to distribute these documents in violation of federal law. The stolen documents he is accused of possessing include the medical records of 14,200 people with HIV. He is held in remand.
27 February: Brochez is charged in a federal court in Kentucky with threatening to extort the Singapore government, for allegedly threatening to release data from the HIV registry if his Singaporean partner Ler Teck Siang was not released.
4 March: Brochez is ordered by a United States court to hand over all copies of any confidential data from the Singapore government immediately. He is also given until 29 March to permanently delete all sensitive or private information obtained from the authorities in Singapore, whether it is saved on any computer or uploaded onto any platform. Should he fail to comply with the injunction, he can be held in contempt of court and fined or jailed.
Related stories:
HIV-positive status of 14,200 people leaked online by American fraudster: Singapore MOH
Action for AIDS: ‘Deeply troubled’ by HIV data leak, potential damage to lives of affected persons
HIV data leak: MOH has plenty of explaining to do
COMMENT: HIV data leak – What is your excuse now, MOH?
Government should enact anti-discrimination legislation to support people living with HIV: Pink Dot
