A judge has urged the Hong Kong government to hold internet service providers liable for failing to remove leaked personal data from their platforms, as he sentenced a former government clerk to nearly four years behind bars for doxxing 215 individuals.

Hung Wing-sum, a former clerical assistant of the Immigration Department, was jailed for 45 months at the District Court on Monday on a count of misconduct in public office, to which she pleaded guilty earlier this month.

The sentence marked the heaviest penalty to date handed down in a case involving doxxing, which became more prevalent during the city’s 2019 social unrest.

Judge Stanley Chan Kwong-chi said the case underscored the need for authorities to step up internet security and identify the civil servants who had played a part in doxxing campaigns against government and law enforcement personnel.

He named three government departments – inland revenue, transport, and rating and valuation – and the police force’s traffic divisions as potential sources from which doxxers could obtain the personal information of their targets.

Chan further maintained that some internet service providers had “assisted others to abet cyberterrorism” by enabling the circulation of personal information divulged by doxxers.

Without identifying the organisations concerned, he said they had turned a blind eye to cyberbullying, internet fraud, false information and “sensational political beliefs”.

Judge Stanley Chan has called on the government to consider revising the law to make it easier to hold internet service providers liable.

While prosecution could be impeded by the lack of jurisdiction, the judge called on the government to consider revising the law to make it easier for internet service providers to be held liable.

“The government can, for example, simplify the way prosecutors adduce evidence in order to penalise the persons involved, and have the messages removed and accounts deleted,” the judge added.

Hung, 26, admitted she had actively divulged personal details stolen from the Immigration Department database to two doxxing groups on the messaging app Telegram between September 2019 and August last year.

Prosecutors said the victims included 25 government officials and their family members, five judges, 37 politicians, 70 police officers and their family members, and 78 public figures. No individual can be identified pursuant to a court order.

Police tracked down Hung after going through the search records in the department’s computer system. She was sacked in December last year after her probationary period expired.

In his sentencing remarks, Chan said the defendant had to be given a severe sentence for threatening judges and law enforcement officers in her doxxing attacks, adding that the present offence was not enough to reflect her culpability.

The judge set a starting point of sentencing at six years in prison and reduced it by 27 months to reflect Hung’s guilty plea, low chance of reoffending and strong family support.

The District Court passed sentence in November 2020 on the first person to be found guilty of doxxing during the social unrest, jailing 33-year-old telecoms worker Chan King-hei for two years on three counts of obtaining access to a computer with a view to dishonest gain for himself or another, and one count of disclosing personal data obtained without consent.

In April this year, waitress Hui Pui-yee was sentenced to three years behind bars on a count of conspiracy to commit a seditious act, whereby she admitted spreading hate speech and encouraging doxxing and assault against people supporting the government and police on Telegram.