Octopus cards have become a key weapon in the war against crime in Hong Kong, helping detectives crack a number of high-profile cases. But are people compromising their privacy by relying so heavily on the ubiquitous smart cards? Simon Parry reports.

As he sits in his prison cell serving out the first months of his 13-year jail term, acid attacker Lo Ching-ho might well rue the day he bought an Octopus card. Without one, he could have evaded justice and might still be a free man today.

In the weeks after he threw a bottle of drain cleaner from the top of a building onto Christmas shoppers in Causeway Bay in December 2009, seriously injuring a young couple and leaving other pedestrians with burn injuries, Lo must have thought he had escaped undetected.

Lo made one fatal mistake. At the scene of his cowardly attack, he left behind a black paper bag. Police studied dozens of CCTV tapes from the nearby MTR station until they found footage of a man carrying the same bag out of the station shortly before the attack.

Then, by obtaining a warrant to access the Octopus card records linked to that MTR exit, officers were able to track down and arrest Lo. "If he had used loose change rather than his Octopus card to pay for his journey, he might never have been caught," said one senior officer familiar with the case.

As it was, the body of data on his Octopus card led police to his front door, and almost exactly a year after his random act of malice, Lo was convicted of throwing corrosive fluid with intent to do grievous bodily harm and jailed.

He was not the first to be condemned by the "smart card" which is so ubiquitous that there are 21 million in circulation in Hong Kong, accounting for 11 million transactions every day - more than 1.5 daily purchases or journeys for every man, woman and child in the city.

When the body of a newborn baby girl as dumped in a supermarket in North Point last year, police tracked down and arrested a suspect by checking the Octopus transactions of the customers who went through the check-outs in the minutes after the body was abandoned.

In May 2010, Hong Tsz-yin, 25, was jailed for life for the murder of two prostitutes. A crucial part of the testimony against him was the discovery of Octopus cards belonging to his victims which Hong stole and used to pay for bus rides and groceries after the killings.

And in the very last week of 2010, a man was charged with robbing and murdering a 44-year-old ballet teacher in Sau Mau Ping five months earlier after being tracked down by data from the victim's Octopus card. The suspect allegedly threw away the card in a bin near his home where it was picked up and used by a neighbour - leading police directly to his apartment block.

Because almost everyone in Hong Kong has one and uses one on a daily basis, Octopus cards have become an exceptionally useful tool for police, not just in major cases like murders and kidnappings but in establishing crucial trails of evidence in hundreds of smaller cases too.

Nowhere in the world has such a developed and widely-used smart card system, giving Hong Kong police a unique tool of detection. But as one senior CID officer, speaking on condition of anonymity, pointed out, it can sometimes be an expensive means of inquiry.

A court order to access customer records must first be obtained and police have to pay HK$100 to Octopus each time they request a print-out of card use data, the officer said. In inquiries where multiple print-outs are required, the amount charged by Octopus can be considerable, he said.

Another drawback, the officer said, was the time it took Octopus to respond to some requests for help. "If there's an urgent case - a kidnapping or murder for instance - the assistance is forthcoming straight away," he said. "But on more routine inquiries, the information is fairly slow to come through and that can be frustrating.

"They aren't always very fast replying to us. They have their limitations of course. They are a private company and their duty is to their shareholders of course, and not to the police.

"This is a case where senior force management should be doing a bit more to persuade Octopus to cooperate with us more closely on the less serious cases so that we get help fast on the less serious cases as well as the more serious ones."

Octopus card records are useful to police in many small and less obvious ways in the course of complex criminal investigations, another senior CID officer pointed out. They can, for instance, stand up or knock down a suspect's alibi or account of his or her movements on a particular date.

"They also often lead us to victims who haven't reported thefts," the officer said. "We may find a personalized Octopus card in a suspect's possession and when we trace the owner, they tell us they didn't report the crime because the loss wasn't so great or because they thought they had simply misplaced their Octopus card or wallet."

Even Octopus cards have their limitations as an aid to detective work, however, he pointed out. "It isn't much help when we deal with organized crime and gangsters," he said. "Those people don't use Octopus cards - they operate in a purely cash economy. But when the crime is committed by non-professional criminals, the data on the cards can be a great help."

Neither the police nor Octopus Cards Ltd would comment directly on the extent of the use of card data in criminal investigations, indicating that operational details had to be kept secret for fear of divulging too much information to would-be criminals.

However, a spokesperson for Octopus insisted information was only given to police when warrants or court orders were produced. There was no question of police having unfettered access to card data, in other words - a development which would trigger alarm in the city's civil rights lobby.

"If law enforcement authorities seek help from Octopus to assist in investigation, we, as a law-abiding company, will provide customer data to law enforcement authorities such as the police upon provision of an original copy of a search warrant or court order as well as a valid staff identity card," the spokesperson said.

"In general, law enforcement authorities may still require the assistance of other merchants and additional information to get the full picture for their investigation."

What Hong Kong police have discovered to their advantage, however, is that a personalized Octopus card - one registered to the holder through the card's rewards points system - is a great deal more useful than one which is not.

An unregistered card can only yield useful information when it is found on a person or in a person's possession after they are detained by police. A registered card can yield a wealth of information about a person's movements which is accessible by court order even if a suspect destroys or hides his card.

"It's an amazingly useful tool," one of the senior CID officers said. "It's like having someone micro-chipped or tagged so that you can check back to see where they went and when - and even which shop or fast food restaurant they went to - at any time on any given day."

There are 2.4 million people signed up to the Octopus Rewards scheme in Hong Kong - and the information their personalized Octopus cards contain is useful not only to police but to commercial organizations who want to profile customers or potential customers.

Controversially, Octopus sold the personal data of more than one million Rewards members to business partners for HK$57.9 million over a period of eight years, leading to a suspension of the scheme and an investigation by the Privacy Commissioner last year.

The case resulted in a public apology, the resignation of the chief executive and non-executive chairman of Octopus, the deletion under supervision of customers' personal data that went beyond the scope of information allowed to the collected under the law and the donation of all revenue from the sale of personal data to the Community Chest.

Since then, the Octopus spokesperson said, all Octopus Rewards members had been given the option of opting out of receiving any marketing or promotional information after signing up and 30,000 members had done so.

"Octopus believes strongly in the importance of protecting our customers' personal data," the spokesperson said. "We have set up a Task Force to oversee the implementation of the data protection enhancement initiatives. The company has already stopped the transfer of personal data to third parties for their marketing initiatives since July 2010."

Legislator Wong Kwok-hing, who championed consumer complaints about the sale of personal data by Octopus, said he was satisfied with the response to the controversy by Octopus through its parent company the MTRC.

Initially, Wong said, he wanted to seek action against the MTRC and Octopus for privacy breaches through the Legislative Council. But he said: "I withdrew the request because the MTRC accepted responsibility and made undertakings through negotiation."

However, he said the case highlighted important issues over the protection of personal privacy that the government needed to address. "The government should complete its review of the Personal Data (Privacy) Ordinance as soon as practicable," he said.

"The government was expected to complete its review by the end of the year and I would urge it to submit its legislative proposals to the LegCo as soon as possible."

That review could see fines of up to HK$1 million and prison terms of up to five years introduced for the unauthorized sale of private information, making Hong Kong one of the world leaders in legislation over data privacy.

(HK Edition 01/06/2011 page4)