The leaking of Singapore’s HIV registry records and the hunt for Mikhy Farrera Brochez: A timeline
SINGAPORE: Mikhy Farrera Brochez, the US citizen who is suspected to have leaked records of 14,200 people from Singapore’s HIV registry online, has been arrested and charged with trespass in the US state of Kentucky.
Even before allegations that he had leaked information from the registry emerged, Brochez had already made headlines after being convicted for numerous fraud and drug offences.
He was found to have used fake degree certificates to get hired as a lecturer in two local polytechnics.
Brochez, who is HIV-positive, also used blood samples from his partner, Singaporean doctor Ler Teck Siang, to pass blood tests so he could gain and retain his employment pass.
He is believed to have obtained the HIV registry records from Ler, who was head of the Ministry of Health’s (MOH) National Public Health Unit and had access to the registry.
MOH has said that the incident “is believed to have arisen from the mishandling of information by Ler".
This is a timeline of what we know so far about how the records were leaked.
Jan 2008: Mikhy Farrera Brochez moves to Singapore and uses falsified blood tests to get an employment pass.
Mar 2012 to May 2013: Ler serves as head of the National Public Health Unit, a position that gives him access to the national HIV registry.
Jan 2014: Ler resigns from the National Public Health Unit.
May 2016: MOH lodges a police report against Brochez after receiving information that he had confidential information that appeared to be from the HIV registry.
Ler’s Craig Road apartment and Brochez’s Telok Kurau apartment were searched.
“All relevant material found were seized and secured by the police,” MOH said.
No public announcements were made about the HIV registry records at that time.
That same month, Ler and Brochez were arrested over the falsified blood test.
Jun 2016: Brochez is remanded in prison.
Jun 24, 2016: Ler is charged under the Official Secrets Act for “failing to retain possession of a thumb drive” containing data from the HIV registry.
The charge under the OSA has been stood down, and MOH says that it is pending before the courts.
Mar 28, 2017: Brochez is convicted of fraud and drug offences, and sentenced to 28 months’ jail.
Apr 2018: Brochez is released from prison. According to MOH, he was deported from Singapore.
May 2018: MOH receives information that Brochez still has part of the records he had in 2016. The information did not appear to have been made public at the time, MOH said.
MOH lodges a police report and contacts affected individuals to notify them. This appears to be the first time that individuals were informed of the case.
No public announcements were made on the case at this time.
Jan 22, 2019: MOH is informed that Brochez could still have more data from the HIV registry and that he has leaked the information online.
Jan 24, 2019: MOH confirms that the leaked information was the HIV registry records up to Jan 2013.
Jan 24 to 25, 2019: MOH works with “relevant parties” to disable access to the information. The ministry does not disclose who these parties are.
MOH added that Brochez still has the data and could still publicly disclose it in the future.
Jan 26, 2019: MOH begins notifying those affected.
Jan 28, 2019: MOH informs the public that the said HIV registry records of 14,200 people “is in the possession of an unauthorised person”, and that “the information has been illegally disclosed online".
Health Minister Gan Kim Yong apologises.
"I am sorry that one of our former staff who was authorised to have access to confidential information in our HIV registry appears to not have complied with our security guidelines," Mr Gan told reporters. "We will not hesitate to take stern action against staff who violate security guidelines, abuse their authority or abuse access to information."
MOH says Brochez is currently under police investigation for various offences and the authorities are seeking assistance from their foreign counterparts.
Jan 30, 2019: Channel NewsAsia learns that Brochez was arrested in the United States in Dec 2018 for trying to trespass into his mother's house.
He is due to appear before the district court in Clark County, Kentucky on Feb 18.