Hong Kong Immigration Department ex-clerk pleads guilty to misconduct for ‘al-Qaeda-style’ doxxing attack on 215 people
- Hung Wing-sum admits she actively divulged details stolen from database to doxxing groups on messaging app Telegram over span of 11 months
- Information leaked targeted government officials, judges, politicians, police officers and celebrities
A former clerical assistant of the Hong Kong Immigration Department has pleaded guilty to misconduct in public office for leaking the private data of 215 individuals in a move termed by a judge as an “al-Qaeda-style cyberterrorist” doxxing campaign.
The information leaked by Hung targeted government officials, judges, politicians, police officers and celebrities.
Judge Stanley Chan Kwong-chi said the defendant’s act was “detested by both men and God”, and that she had betrayed her schoolteachers, her oath of office, the trust of her employer, and the “basic moral standards of the Hong Kong people”.
“It was a large-scale conspiracy,” the judge said. “Theoretically, digital footprints can exist for eternity. Even if the data was deleted by the internet service provider, it could be backed up and viewed again, even in Afghanistan.
“This is an outright al-Qaeda-style cyberterrorist act.”
The judge also challenged prosecutors’ decision to try Hung in the District Court, where sentencing is capped at seven years in jail, saying she could have been charged with more serious offences such as perverting the course of public justice for the doxxing attacks against judicial officers.
Clubhouse says reports of data breach, which prompted security warning in Hong Kong, are false
The District Court heard the 26-year-old civil servant joined the department in 2018, and was responsible for verifying the personal particulars of foreign domestic helpers in immigration-related applications.
Still in her probationary period, she was one of the few people in the department to be granted access to private personal data stored in the government branch, a power which was necessary to facilitate her job duties.
Hung first approached a Telegram user on a channel “dad finds boy” on October 18, 2019, describing herself as a credible source who could provide meaningful assistance to the group’s doxxing attacks on police force members.
She had disclosed the personal details of her targets, including their contact information, home addresses, dates of birth and identity card numbers, to the channel and another called “boy finds dad and mum” until her arrest on August 20 last year. An investigation showed she first sought illegal access to the department’s computer system in September 2019.
Privacy watchdog demands Facebook tell Hong Kong users personal data was leaked
Prosecutors said the victims included 25 government officials and their family members, five judges, 37 politicians, 70 police officers and their family members, and 78 public figures. No individual can be identified pursuant to a court order.
In each case, the private data concerned would be posted on either of the two channels soon after Hung obtained access to the relevant information on the government database.
In conversations with the doxxing groups, Hung described her targets as “toys” and likened her acts to “playing games”. She also used the derogative expression “dogs” to refer to police officers.
The judge questioned why it took almost a year for police to identify the culprit, suggesting there could be a major security loophole.
Prosecutor Andy Lo Tin-wai said the Immigration Department had strengthened its security measures following Hung’s arrest.
Hung will be sentenced on September 27, pending a background report. She faces up to seven years in jail.
