Agnes Chow applies for judicial review of search warrant that allowed police to obtain data of Facebook page’s subscribers

(16 Apr) Demosisto members including Joshua Wong and Agnes Chow were arrested on suspicion of “inciting others to participate in an unauthorized assembly” outside Legislative Council on 12 June 2019. In February 2020, they were informed that the police had obtained 3 court warrants to inspect the data in their phones now kept in the police headquarters. Subsequently, the police had even obtained a warrant to inspect data of Agnes Chow’s Facebook page subscribers at the Facebook headquarters. Joshua Wong and Agnes Chow applied for judicial review in High Court yesterday to overturn these warrants. A Facebook spokesperson said that Facebook had not passed any details of Agnes Chow to the police, and that the police had not been to Facebook’s Hong Kong offices.

Agnes Chow said that she received a call from Facebook’s Hong Kong offices earlier in the evening, informing her that at the beginning of this year, the police had requested numerous times for data from her Facebook page, but since the data of those users are held by Facebook’s American company and protected by American law, outside of the jurisdiction of Hong Kong courts, Facebook had denied such requests and not handed over anything.

Pointing out that Facebook had on many occasions provided users’ information upon Hong Kong government’s requests, Chow urged Facebook to clarify which user data are protected by American law and which user data would come under the jurisdiction of Hong Kong law.

Chow posted on Facebook that many friends had unliked her page in the light of this incident, “I feel deeply for the fear many people are facing in this police state in Hong Kong”, and hoped that one day all will be free from fear.

Facebook : We did not provide the police with any information, and the police did not visit our Hong Kong office

The spokesperson of Facebook claimed that Facebook had not given any of Agnes Chow’s data to the police, “as far as we understand, Hong Kong police have not visited our Hong Kong office for this matter, and our Hong Kong office is not located in the place given in the testimony.” Head of Public Policy (Hong Kong & Taiwan) at Facebook George Chen also clarified in a post that Facebook Hong Kong office has never held or stored any user data.

According to a warrant issued by court in November 2019, police had applied to search Facebook’s office located at “66th Floor, One Island East, 18 Westlands Road, Taikoo Place”. However, Facebook had actually moved its Hong Kong office to 47th floor of One Taikoo Place, 979 Kings Road in Quarry Bay, which was widely reported at the time by media.

Apparently, Facebook Hong Kong has no rights to process, hold, store, use or disclose the data of any Hong Kong or overseas users. When the government requests user data, Facebook will carefully assess such request to ensure it is in compliance with the legal process, and can turn down such request if it is not justified.

Apple Daily enquired after whether the police had indeed carried out a search at Facebook’s office, and if they have obtained the user data in question. Police declined to comment citing that the case is now undergoing its legal process.

Agnes Chow: Problem is with the police, not Facebook

Earlier today (16 April), Chow criticized that the police had manipulated the legal process to crack down on protesters, even gone so far as to demand Facebook to hand over user data. The problem, Chow claimed, lies with the police and not Facebook. She will not be threatened by this incident and will continue to express her political views on social media.

In a Facebook post today, Chow revealed that the police had demanded Facebook to hand over data of a post she made on the 21 June 2019 rally, including its IP address, user registration details and related records, as evidence that she had “incited” masses to participate in the assembly. The post in question is as follows: “You have the police, and I have the people. We are surrounding the Police Headquarters, please come support us! #AntiExtradition.” Chow urged citizens to pay attention to information security and privacy, as the police is unscrupulous in their quest to “gather evidence” and prosecute protesters.

Subsequently in an online live broadcast, Joshua Wong and Agnes Chow pointed out that Hong Kong police now has excessive power. “They will resort to any means,” and since the people have no power, they have become the oppressed. They called for citizens to be vigilant. Wong urged citizens to install VPN on their mobiles and get an extra phone.

“The police wants to obtain all information first, whether they are useful or not, then they will use them selectively. But a lot of the user data they are after are not pertinent to the collection of evidence,” said Chow. Wong said that “[they] don’t know whether Facebook did hand over data to the police, only Facebook knows.”

Police searching for subscriber’s data including IP address and log record

Joshua Wong and Agnes Chow were arrested on the eve of 31 August 2019. The first warrant issued regarding their case was from a magistrate in Kwun Tong Magistrates’ Court on 3 September 2019, giving police one month’s permission to inspect digital data in the Cyber Security and Technology Crime Bureau on the 22nd floor of the police headquarters. Another Kwun Tong magistrate and an Eastern district magistrate issued similar warrants on 2nd and 31st of October 2019respectively.

On 6 November 2019, the Eastern district magistrate issued a different warrant permitting the police to search and investigate into users data in Facebook’s Hong Kong office in Taikoo, regarding Agnew Chow’s post on her Facebook page calling upon citizens to surround the police headquarters, including subscriber’s details, IP address and log record.

In Chow’s judicial review application, the warrant issued by the magistrate did set limitations to police’s exercise of power, yet the warrant only vaguely referred to an investigation related to a case involving the “incitement of others to participate in an unauthorized assembly”. It did not state any other particulars such as the suspect’s name, date, time and place. Therefore, there is reason to doubt whether the investigated digital content is related to the case at all. According to the Secretary of Security, the police had obtained 3,712 mobile phones in the period of protests between June and November. The applicant, Chow, iterated that it is impossible to believe all of them are of use to police’s investigation.

There should be an individual warrant for each mobile phone 

Since the warrant did not specify the ways and frequency with which police can search these mobiles, they would have had unlimited access to the mobile data. Chow’s application also pointed out that with today’s cloud storage, new data could have been sent to these devices, the warrant would have given the police room to continue its surveillance on emails and text messages without the applicant being any wiser. The gives rise to doubts whether the police could have been phishing for information.

According to her application, after breaking Joshua Wong’s 4-digit mobile PIN, the police searched his mobile 7 times in a span of 21 hours. Regarding Chow’s mobile, the police had no means to obtain any data from within. 

It was further noted that in a physical search of a residence, the police must produce their warrant before entering, and leave the a copy of the warrant if the resident is absent.

However, as the location of this search is within the police headquarters, the owner of these mobile devices will not be informed of the searches, their rights during the searches are thus stripped as they cannot prevent the police from inspecting and collecting confidential data and data unrelated to their case.

Citing precedents, the applicants pointed out that the “digital space” should be seen as an independent place similar to ships and buildings, hence the warrant ought to be issued in relation to a specific device and not the 22nd floor of the police headquarters. A specific warrant should be issued regarding each specific device. Hence, the warrant permitting the police’s search of its own headquarters is a misapplication of the law. 

The proposed defendants of the judicial review are the three magistrates who issued these warrants and the Commissioner of Police. Wong and Chow demanded a verdict that it is illegal to issue and execute the four warrants in question, as their right to privacy and freedom to communicate should have been protected by the Bill of Rights and the Basic Law. They also demanded their mobiles be returned by the police.

Hong Kong government obtained information from 180 Facebook accounts last year

According to Facebook’s report, the Hong Kong government requested information from Facebook 143 times in the first half of 2019, involving 180 accounts, and Facebook complied with 66% of the government’s request. Whereas in the first half of 2018, the government had requested data from Facebook 174 times, involving 234 accounts with a 56% compliance rate; in the second half of 2018, data was requested 212 times, involving 230 accounts and a 48% compliance rate.

Facebook said that they follow the due process strictly and assess such requests carefully to ensure that each request is fully legally justified and in accordance with Facebook’s terms and conditions of service. If the requests are too broad in scale or too vague, they would ask for further explanation from the government or reject them.

Source: Apple Daily

https://s.nextmedia.com/realtime/a.php?i=20200416&s=6996647&a=60837874