Trail of Exposure

First published: 30^th April 2009

The trial of a computer technician in Hong Kong's highest profile data-leakage case, the Edison Chen sex photos scandal, is proceeding with witnesses describing the chain of sharing that led to the photos being splashed across the internet. Sze Ho-chun is accused of three counts of obtaining access to a computer with a view to dishonest gain for himself or others. The prosecution alleges that Sze copied the photos and uploaded them to a server on the internet while Edison's laptop was being repaired at the shop where he worked. Witnesses Fanny Choi and Janet Leung say that Sze mentioned the photos when he was repairing a computer at their office, and showed them the photos online. He then downloaded them to a CD, which he gave to Ms Leung. She later lent the CD to a Ms Mak for one or two days.

The case clearly illustrates the difficulty of keeping interesting information secret, and also dispels the myth that only men share erotic images.

Updated: 10^th April 2009

Police Officer Ho Ming-yin has given evidence at the trial that, on 28th January 2008, the day the photos were first circulated on the internet, Sze searched for a secure delete program, downloaded it at 18:08, used it up to 18:23 and uninstalled it at 18:28. Only 11 fragments of the pictures were found on his machine, five with hash values that matched those on the CD he gave to Ms Leung. Ms Ho said that she could not be certain what types of files were deleted by the Secure Delete program.

Updated: 15^th April 2009

Acting Superintendent Paul Jackson has given evidence that a CD marked "X", containing 1321 files, 660 of them non-duplicated photos was burned at 1.20pm on June 8, 2006 - the day, according to prosecutors, when Sze gave a disc marked "X" to Ms Leung. The first directory on the disc was created the previous day at either 13.54 or 21.54pm, depending on the time zone setting of the computer. Jackson said there was "99.9%" compatibility between fragments of deleted files retrieved from Sze's home computer and the pictures on the CD.

Sze has chosen not to give evidence, and the prosecution and defence will give their final submissions on 21st April 2009.

Updated: 30^th April 2009

Kowloon City chief magistrate Tong Man found Sze Ho-chun guilty of three counts of obtaining access to a computer for dishonest gain for himself or another. In his two-hour ruling, Tong said that the offences Sze committed were very serious because he took advantage of his profession. He breached not only the trust his employer had in him but also the trust a client had in his employer. Sze will be sentenced on 13th May, the maximum sentence for the offences is 5 years, but a magistrate's court is limited to 3 years.

The magistrate said that most of the prosecution witnesses were credible and honest, but cast doubt on some parts of the evidence of Edison Chen, questioning why Chen would suddenly change his usual practice by permanently deleting the pictures from the notebook he sent for repair. He suggested that Chen might be playing down his own responsibility for negligence in securing the photos.

Privacy Commissioner Roderick Woo Bun spoke for a review of the Personal Data Privacy Ordinance (PDPO) to provide a deterrent to prevent leaks of sensitive data. At the moment, the Commissioner has very limited powers: he can issue an enforcement notice, in essence saying, "don't do it again", and on a repeat offence refer the case to law enforcement.

Yui Kee's Chief Consultant commented, "Some people might dismiss this case as a celebrity sex scandal, but it highlights important, but generally boring, issues for everyone. Computer technicians are reminded that they have a duty of trust to their employer and clients when handling data. Users are reminded that they must plan in advance how they protect their sensitive data (whether that is personal photos, financial information, or anything else). It is too late to think you should have encrypted certain files when your laptop has broken down, and you are handing it to a technician you hope is honest and trustworthy. The Government must consider how to improve the PDPO to address the fact that disclosure is one-way: no-one can un-disclose Edison's photos, they can still be found easily on the internet. Damage inflicted by disclosing sensitive personal data cannot be undone. An enforcement notice is sometimes an appropriate way of improving the handling of personal data, before an incident. Something stronger is required after an incident."