On 22 January 2019, the Ministry of Health was notified of the wrongful online disclosure by an American, Mikhy K Farrera Brochez (“Brochez”), of confidential medical information in Singapore’s HIV Registry, affecting 14,200 individuals diagnosed with HIV, and 2,400 of their contacts into the public domain.
Since the incident broke on 28 January 2019, the Ministry of Health of Singapore (“MOH”) and the Singapore Police Force (“SPF”) and Singapore Prison Services (“SPS”) have come forward with a full account of how Brochez came to obtain possession of such confidential information. These are set out in the following public statements made in Parliament or released online by the Minister for Health and the SPF.
The version of facts contained in the statements, read together, are consistent and logical. We are also cognisant of the fact that Brochez had been convicted in March 2017 on the basis of his own plea of guilt in respect of all the offences brought against him (including cheating, lying to a public servant, possessing drugs and using forged educational certificates).
Brochez has not kept silent. He has given interviews with Vice News, an alternative news website, and also released his own version of facts on a self-penned post on his Facebook page (the Facebook post appears to have been deleted later, and now the entire Facebook page is gone).
Please note the above links are not exhaustive in respect of this matter. In the last 10 hours, several news outlets have published further information in respect of Brochez’s latest allegations. Having carefully examined the various allegations, we note that Brochez is simply unbelievable. We point out these allegations and their contradictions as follows.
Zachary Levine was the original party responsible for the leak of HIV Registry information (see the Vice news article and the Joint SPF-SPS Statement addressing this).
This allegation is inconsistent with Brochez’s Facebook post (as reproduced on Reddit) which identifies not just Zachary Levine but also “an Indonesian named Fairuz Widjat”. Brochez alleges that Levine had stolen Ler Teck Siang’s laptop and obtained access to the HIV Registry. This is unbelievable. Vice News has pointed out the following in its article:
“Farrera-Brochez has changed his story about when, exactly, this alleged break-in happened. In interviews with VICE News, Farrera-Brochez said that it took place in 2011; in a 2016 police statement he sent to VICE News, he claimed it was in 2012.”
This is an important slip up in Brochez’s lies, because Ler was only head of the MOH National Public Health Unit from March 2012 to May 2013.
Please note also that the Joint SPF-SPS Statement makes clear that:-
“Brochez has said that a Zachary Levine was the one who leaked the HIV registry. In 2016, Police had investigated Levine following similar allegations levelled by Brochez. Police’s investigation, which included an interview and examination of Levine’s electronic devices seized from his residence, did not reveal any evidence to suggest that Zachary was either in possession of any MOH-related files, or had shared any HIV registry data.
Prior to 2016, Brochez also claimed in correspondences with MOH that Dr Ler and Levine had shared screenshots of Brochez’s own record in the HIV registry, but Brochez was never able to produce verifiable evidence to support this claim.”
Levine had posted information from the HIV Registry in 2012 and Brochez had sent screenshots of Levine’s actions to Dr Jeffery Cutter of the Ministry of Health (see his Facebook post).
This is completely unbelievable. Brochez has performed a complete change of position against his own complaint made in 2012. As Vice reports about the interview:-
“Farrera-Brochez said that he told Ministry of Health officials on multiple occasions that the registry had been compromised, but they didn’t act. When asked about the 2012 complaint he’d made about Ler, for purportedly revealing his HIV status, Farrera-Brochez said he wasn’t referring to his own status but rather calling attention to the breach of the registry writ large”
In the criminal proceedings against Ler in 2018, Ler gave evidence only that the complaint made by Brochez against him was for sending screenshots of Brochez’s HIV status (which we deal with below). There is no mention of any “breach of the registry writ large”. Neither is this in Dr Cutter’s statement to the police, or his testimony during the trial.
The only credible version of events here is that MOH was suspicious of screenshots being taken of the HIV Registry in 2012. The only time that MOH could have been seised of a disclosure of the registry itself would be in 2016, when Brochez sent out various e-mails.
Brochez contracted HIV while in police custody in 2012 and was abused while in police custody (see his FB post and the Vice article)Brochez claimed, in his interviews with Vice, that:
“Farrera-Brochez told VICE News that he had tested negative for HIV in 2008 and again in 2013, and that he only contracted the virus after he was beaten and sexually assaulted in Singaporean prison.”
This cannot be true.
Keep in mind that Brochez had pleaded guilty and accepted the Court’s findings against him for lying about his HIV status in 2008. It is beyond reasonable doubt that he had lied about his HIV status, and that he was in fact infected with the HIV virus well before 2008. In addition, Brochez himself had complained to the Ministry of Health in 2012 that Ler had disclosed his HIV status – This is a blatant admission that he had HIV before being in jail.
We also refer to the Joint SPF-SPS Statement:
“Brochez has said that he had contracted HIV when he was sexually assaulted while in Prisons. This allegation of being sexually assaulted in Prison was investigated by CID and found to be untrue. On the contrary, during Brochez’s imprisonment, he committed a litany of institutional offences, including assaulting a fellow inmate. It is a matter of record that Brochez had contracted HIV, years before he was admitted into Prison in 2016.”
We agree, as demonstrated above.
Brochez has much more than just the HIV Registry records.
According to the Vice report:-
““It wasn’t just the registry; it was a lot more files,” Farrera-Brochez said, before ticking off the other records he said he found, like lists of people who’d contracted dengue and people who’d contracted swine flu. He recalled thinking, “What the fuck is this?””
There has been no evidence of this furnished to date. All that Brochez has shown so far are names from the HIV Registry alone. We also note that the comment made in the Vice article was a follow-on from his original lie regarding Levine.
Is the HIV Registry designed to target homosexual men?
In the Vice article, Brochez states:
“Giving that to the press, I was hoping that somebody would get a look at what has been going on in Singapore and how they are using that registry to track individuals with HIV and men who have sex with men,” he went on. “There’s no need to have that registry.”
Brochez is wrong.
HIV is a life-threatening infectious disease, and the policy in Singapore is to have the Registry to enable contact tracing, disease surveillance, and assessing disease prevention and management measures. The fuller reasons behind this policy and the support of the Singapore medical community for the registry are set out in this CNA article.
We should highlight that Brochez has made this comment in the Vice article:-
“This corrupt government biased this court and falsely accused us of cheating on an HIV test to cover up the fact they have your confidential medical info without encryption, without password protection, which caused it to be leaked,” he told VICE News.”
First, Brochez himself pleaded guilty to cheating on the HIV test. Second, there was no cover-up.
Did MOH “cover up” the 2016 breach from the public until 2019?
For there to have been a cover-up, there must be active concealment of the fact of the breach. In other words, MOH would have to scrub out records and deny any knowledge of Brochez’s actions. However, do note that:-
(a) Upon his arrest in April 2016 for failing to comply with MOH requests for performing a blood test, Brochez provided the Police and government authorities 75 names and particulars from the HIV Registry – This was a matter that had already gone beyond MOH alone and MOH could not conceivably keep this information to itself.
(b) The Police had also successfully contacted Brochez’s mother in 2016, post-April, to delete further information from the HIV Registry wrongly disseminated by Brochez.
(c) The public criminal charges brought against Ler and Brochez in 2016 indicated clearly, in public space, that the charges concerned improper handling of personal information in the HIV Registry, classed as Official Secrets under the Official Secrets Act. None of the proceedings were held in-camera.
These factors were simply out of the control of MOH.
Where the MOH may possible by faulted is in the fact that the affected 75 individuals were not contacted. As stated by Minister Gan Kim Yong in his parliamentary speech of 13 February 2019:-
Weighing Whether to Inform Affected Individuals and Making Public Announcement
21. Mr Speaker Sir, let me now address questions as to whether MOH should have informed the public earlier. In 2016 MOH had to decide whether to inform the affected persons and whether to make a public announcement about the incident.
22. These were not straightforward decisions. On the one hand, there is the need to be transparent. On the other hand, we need to consider the impact of an announcement on the affected persons with HIV – would it serve their interest, or harm them instead?
23. I discussed this with my medical colleagues in MOH. They emphasised the need to pay particular attention to the concerns and needs of HIV patients. A person’s HIV status is a deeply emotional and personal matter. Some patients will experience high anxiety and distress from a disclosure or announcement. Some will feel compelled to reveal their HIV status to family members or friends. Relationships can be disrupted; lives can be changed. We had to exercise care and judgement in making our decision, and the wellbeing of the affected persons weighed heavily in our considerations.
24. One key factor was that there was then still no evidence that the confidential information had been disseminated to the public. Brochez had sent the information to Government authorities. The Police search was extensive and all relevant material found had been seized or deleted. While there could be no guarantee, MOH had good reason to believe that the information had been secured and the risk of future exposure significantly mitigated.
25. Ultimately, it was a judgement call – to be made based on the information we had, the considerations for and against an announcement, and the assessed risk of future public exposure of the information. MOH judged that on balance, an announcement then would not serve the interests of the affected individuals, when weighed against the inevitable anxiety and distress they would experience.”
When we weigh the decision of MOH not to inform the 75 affected individuals in 2016 against the factors that were out of their control in 2016, we see that MOH could not be said to be “covering up”, because they simply couldn’t.
Hence, with the MOH, the breach and HIV Registry information relating to the breach was arguably already in the public domain.
At best, they could be accused of being passive – But to say that they sought to cover up the incident is not made out, since they were actually only doing nothing to further the spread of the information concerning the breach.