Wikileaked? Singapore Court upholds privilege over hacked documents

In the recent decision of Wee Shuo Woon v HT S.R.L [2017] SGCA 23, the Court of Appeal considered whether evidence which had been made available on WikiLeaks as a result of the Respondent's ("HT S.R.L."') computer systems being hacked had lost its confidential and legally privileged status. 

The decision, which has taken on added significance in the wake of recent global cyber-attacks, indicates that the Singapore courts will be slow to admit evidence obtained as a result of such incidents.  In particular, the Court held that the equity in favour of restraining the use of privileged documents was even stronger in the case of documents obtained in a cyber-attack than in the case of those obtained by virtue of a party's innocent mistake.  The order to exclude such evidence was upheld.

Background

In 2015, HT S.R.L. commenced proceedings against its former employee Wee Shuo Woon ("Wee") for breaches of his employment contract and/or his fiduciary duties. In his defence and counterclaim, Wee denied breaching his employment contract and counterclaimed for unpaid salary.

Subsequently, HT S.R.L.'s computer systems were hacked and certain emails between HT S.R.L. and its lawyers were published on the WikiLeaks website, including emails relating to the proceedings against Wee.

It was not disputed that the emails were originally confidential in nature and that, prior to being uploaded to the internet, they attracted legal professional privilege. There was no suggestion that Wee was involved in the hacking.

Following the leaks, Wee took out a summons to strike out the bulk of HT S.R.L's statement of claim on the ground of abuse of process and to enter judgment on his counterclaim for unpaid salary. In support of this application, Wee filed an affidavit which made reference to and exhibited the hacked emails. It was alleged that the emails revealed HT S.R.L. admitting to owing Wee his unpaid salary, and that it had intentionally withheld payment of the same in an abuse of the court process.

In response, HT S.R.L. sought an order to expunge all references to the emails in Wee's affidavit and an injunction against Wee's further use of the emails (the claim for an injunction was subsequently dropped). An assistant registrar allowed that application. After a judicial commissioner upheld that decision, Wee appealed to the Court of Appeal.

The Court's decision

The Court upheld the decision of the court below and dismissed the appeal.  

As a preliminary point, the Court noted that its equitable jurisdiction to restrain the use of privileged or confidential material could only be exercised before the evidence in question had entered into evidence or otherwise been relied upon at trial. As the striking out application for which Wee's affidavit was filed had not been heard, HT S.R.L. was not too late to make the application.

The effect of online publication on privilege and confidence  

It was undisputed that the emails were privileged and confidential by their nature and by reason of express provisos emphasising the same.  The Court affirmed the recognised principle that equity imposes a duty of confidence on a person who receives information which he knows or ought to know to be fairly and reasonably regarded as confidential.

The primary issue before the Court was whether the emails had lost their confidential and privileged character by reason of their publication on the internet. Singapore law follows the position laid down by the English House of Lords in Attorney-General v Guardian Newspapers (No 2) [1990] 1 AC 109 (Spycatcher), whereby information which enters the "public domain" will no longer be protected by the law of confidence.

The Court held firstly that the "public domain" principle is a general rather than an absolute rule to be applied mechanistically. The key issue is whether the degree of accessibility of the information is such that in all the circumstances it would not be just to require the party against whom a duty of confidentiality is alleged to treat the information as confidential. The Court will therefore consider factors including the likelihood of the information being accessed by the public, the degree to which the information has in fact been accessed, and the extent to which the information may be appreciated and/or understood only with specialised skill or expertise.

Whilst the emails had become potentially accessible by the public carrying out an "intense search" by virtue of them being uploaded on Wikileaks, the Court noted that they constituted a "minute fraction" of approximately 500GB of data that had been pilfered from HT S.R.L.'s systems. Wee would have had to "search and sieve through the mass of hacked material in order to locate the emails". "Potential, abstract accessibility is vastly different from access in fact … Merely making confidential information technically available to the public at large does not necessarily destroy its confidential character".  In all the circumstances of this case, it could not be said that the emails and their contents were public knowledge or in the public domain.  They were therefore still entitled to claim protection of the law of confidence.

Whether any grounds existed for the Court to decline the exercise of its equitable jurisdiction

Nevertheless, it was open to the Court in exercise of its equitable jurisdiction to refuse relief on the general principles affecting the grant of a discretionary remedy, for example inordinate delay, lack of clean hands or "general iniquity".  On the other hand, public policy requires that a litigant should not generally be permitted to make use of privileged documents which had been obtained by stealth, trickery or by otherwise improperly.

Citing Derby v Weldon (No 8) [1991] 1 WLR 73, in which the English Court of Appeal intervened to prevent a party from using privileged documents that it had seen only because of the other party's mistake, the Court considered that "the equity in favour of restraining the use of privileged documents is even stronger in the case of a party who had its privileged documents accessed and taken through stealth and unlawful means".  As there could be little doubt that Wee knew that the emails were privileged, it was therefore just that he should be restrained from using them.

The Court also examined Wee's allegations of iniquitous conduct by HT S.R.L. that should influence the Court's discretion. Whilst the Court agreed that the allegations, if borne out, might justify the Court refusing to grant the relief sought, it disagreed by reference to the particular facts that HT S.R.L had acted dishonestly in this case.

Inherent jurisdiction as a further basis to exclude evidence

The final issue concerned the court's jurisdiction to exclude evidence. The Court expressed a tentative view that discretion to exclude evidence should be exercised in a "robust manner" in civil proceedings, but declined to address this point in detail; it had been raised only as a further ground to support HT's position and had not been fully argued.

Comment

The main theme of the decision is that privileged and confidential information will not lose that status merely because it becomes technically available to the public, for example by unauthorised publication on the internet, if in fact it has not been accessed and is unlikely to be widely accessible or (if accessed) easily identified and understood; all the more so if the information had been obtained by stealth, trickery or by otherwise improperly. 

Whilst there was no suggestion that Wee was behind the attack, the decision suggests disapproval by the Court of Wee's attempt to exploit the fact that HT had been victim to a cyber-attack. A litigant will not be allowed to take advantage of an opponent who has been the victim of a cyber-attack, regardless of whether the litigant was involved in that attack.

The decision is particularly relevant and important in light of recent cyber attacks on political parties and others, resulting in mass releases of confidential information on the internet.

On a practical level, the decision also underscores the importance of taking action to restrain the use of privileged or confidential material as soon as practicable.  Delay in bringing the applications will be a relevant factor for the Court's equitable jurisdiction to prevent use of the material in question, and inordinate delay is likely to be fatal.