HKSAR v. YIM YU HANG AND OTHERS

HCCC 149/2018

[2020] HKCFI 2570

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CRIMINAL CASE NO 149 OF 2018

________________________

________________________

_____________________________________

REASONS FOR RULING ON ADMISSIBILITY OF

WHATSAPP MESSAGES

_____________________________________

1.  On 3 April 2019, I gave my ruling on the admissibility of WhatsApp messages extracted from the iPhone of Lee Kang-yiu (“Lee”) and the HTC mobile phone of Wong Wai-ho (“D3”). I indicated then that I would give my reasons in writing. This I now do.

A.  APPLICATION BY THE PROSECUTION

2.  There are 4 groups of WhatsApp messages that the prosecution, represented by Mr Mark Wei and Mr Anson Tso, sought to adduce into evidence:

(1)  WhatsApp messages of the group “Midnight Countryside-touring Group” (“the Group”) extracted from the mobile phone of Lee;

(2)  WhatsApp messages of the Group extracted from the mobile phone of D3;

(3)  WhatsApp messages between Chow Ching-yin (“D2”) and D3 extracted from the mobile phone of D3; and

(4)  WhatsApp messages between Yim Yu-hang (“D1”) and D3 extracted from D3’s mobile phone.

3.  It should be noted that there is no computer certificate pursuant to section 22A of the Evidence Ordinance (Cap. 8) to cover these WhatsApp messages.

4.  The admissibility of these WhatsApp messages was originally challenged by all three defendants on the basis that they were out-of-court statements and inadmissible if the prosecution was relying on the truth of these statements.

5.  I said originally because the prosecution’s original position was that the truthfulness of the contents of these statements would not be relied upon, only that such statements were made.  It was submitted that in that way, the statements did not offend the hearsay rule and they were relevant to the issues of the state of mind, intent or knowledge about the joint enterprise.  The prosecution cited the case of Oei Hengky Wiryo v HKSAR (no. 2)[1]in support.

6.  As the prosecution was not relying on the truthfulness of these statements, it is further submitted that s.22A of the Evidence Ordinance, Cap. 8 was not engaged. The case of HKSAR v Lau Shing Chung Simon[2] was cited in support.

7.  However, the stance of the prosecution subsequently changed upon invitation from this Court to consider whether the WhatsApp messages on a mobile phone can be classified as “real evidence” and whether the principle of “declaration against interest” and “co-conspirator’s rule” apply.

8.  The proceedings then took a rather protracted and meandering course, with parties submitting written submissions to cover different points at different stages, culminating in this Court deciding to hold a voir dire before a ruling is made.

9.  I will first set out what transpired before a voir dire was held.

10.  The prosecution submitted that the WhatsApp messages contained in a mobile phone themselves amount to real evidence.  Daily life experience tells one that WhatsApp messages send to a user would be stored in the recipient’s mobile phone, a situation akin to the recording of sound / images by a recorder.

As against Yim Yu Hang (D1)

11.  The prosecution seeks to rely on the contents of some of the WhatsApp messages as declaration against interest / admission by D1, which is an exception to the hearsay rule.

12.  The prosecution further submitted that, in any event, it is entitled to rely on the fact that those statements were made by D1 without going into the truth or falsity of the matters stated therein, to invite the jury to draw inferences on the intent, state of mind and knowledge of D1, relying on their original submission regarding the “non-hearsay use” of those statements.

13.  The prosecution listed out those parts of the WhatsApp messages relied upon as Declaration against interest / admissions, and those parts the prosecution relied upon for non-hearsay use in their written submission dated 4 March 2019.

14.  At the request of this Court, the prosecution also prepared a list in their written submission dated 12 March 2019 showing what non-hearsay use those messages under the category of Declaration against Interest / admission would be used should this Court rule that the prosecution cannot rely on the truthfulness of the WhatsApp messages.

15.  As this Court expressed concern in relation to the rather large number of messages to be relied upon for non-hearsay use (should this Court rule that the prosecution cannot rely on the truthfulness of some of the messages), the prosecution prepared yet another list in their written submission dated 15 March 2019 showing the absolute minimum messages the prosecution will rely on against D1.

16.  In relation to the proof of the authenticity or reliability of the WhatsApp messages, the prosecution relied on the evidence of Lee (in his latest statement dated 13 March 2019) that he had taken measures from unauthorized use or interference of his mobile phone, that his mobile phone, including WhatsApp and the calendar have been functioning properly at all material time and that he had not deleted any contents of his WhatsApp to show that the computer (ie Lee’s mobile phone) was working properly.

17.  As to whether a particular WhatsApp message has been accurately transmitted from its maker to the end receiver, the prosecution submitted that a comparison of the relevant WhatsApp messages respectively extracted from the mobile phones of Lee and D3 would assist the jury to determine the authenticity of a particular WhatsApp message.

18.  As to the proof that D1 was the author of those WhatsApp messages attributed to him, the prosecution relied on the evidence of (1) Lee (who will give evidence that he had entered “Boss” to represent D1 on his mobile phone, that he had never deleted any messages from the Group and that he had past dealings with D1 to confirm that the telephone he said belonged to D1 was indeed D1’s mobile phone number); and (2) PC3137 Fung Hon-Yung (“Fung”) who had extracted files from Lee’s mobile phone, who will explain the relevance of a particular mobile number used in registering a WhatsApp account with a particular WhatsApp identity to show that the number (61805275) shown as “Boss” on Lee’s mobile phone, when compared with the WhatsApp identity (85261805275@s,whatsapp.net), must have been used to register the WhatsApp account.  The prosecution will also rely on the computer certificate showing D1 as the subscriber of the relevant mobile phone number (61805275).

As against Chow Ching-yin (D2)

19.  The prosecution relied on the evidence of Lee and a comparison between the relevant messages extracted from Lee’s iPhone and D3’s mobile phone for the issue of authenticity and reliability.

20.  As for the identity of D2, the prosecution also relied on the evidence of Lee to say, from past experience, that D2 was the person whose mobile phone number (51079651) was recorded in Lee’s iPhone.  There would be evidence that the same phone number was used to registered for a WhatsApp account (85251079651@s.whatsapp.net).  (The computer certificate shows that the subscriber of that mobile phone number was a certain Tong Fung King Anky who resides at the same address as D2 (from the evidence of the police officer bringing D2 back home for a home search)).

21.  The prosecution relied on the “co-conspirator’s rule” to adduce the utterance between D1 and Wong Long-ki (“WLK”) (as shown in Lee’s and D3’s respective mobile phones) to prove (1) the nature and extent of the common enterprise, namely, to inflict serious bodily harm to Bosco (“the deceased”) during the hike held in the late evening of 27 May 2017 at Black Hill, with WLK, D1 and D2 participating with the requisite knowledge; and (2) the extent and degree of participation of D2 in the common enterprise, where WLK was responsible for segregating the deceased’s friend “05” from the deceased and D1 and D2 were responsible for inflicting serious bodily harm to the deceased.

22.  The utterances / declarations / statements relied upon by the prosecution were listed in the prosecution’s written submission dated 4 March 2019.

23.  The prosecution also submitted that there are independent, reasonable evidence to prove that D2 was party to the common enterprise in question, namely:

(1)  D2’s verbal admission (and the post-record thereof) that he had killed the deceased and that he had hidden the deceased’s mobile phone in his rucksack, after he was arrested and cautioned for the murder of the deceased together with D1 and WLK;

(2)  The deceased’s mobile phone was found from a rucksack at D2’s home, boots which were likely to be the deceased’s were also found;

(3)  DNA of bloodstains found from D2’s jeans and boots are very likely to have originated from the deceased;

(4)  The Octopus card of D2 revealed that D2 had gone to Yau Tong at about 11 pm on 27 May 2017, the time and place bore close proximity to the incident in question;

(5)  D1 and WLK were identified by Lee to be the persons being captured by the CCTV of Domain Mall, Yau Tong (at about 2230 hours on 27 May 2017);

(6)  The Octopus cards of D2, D1 and WLK reveal that they had embarked on the same bus (route no N293 travelling from Sheung Tak, Tseung Kwan O) at 4:50 am; and

(7)  The telephone records of D1 and D2 reveal there were telephone communications between D2 and D1 at 2354 hours on 27 May 2017, and between D2 and WLK at 0337 hours on 28 May 2017.

24.  Further, the prosecution submitted that its reliance on the co-conspirator’s rule does not detract from the fact that the prosecution is entitled to rely on these statements for a non-hearsay use.

25.  The prosecution also prepared a list showing what non-hearsay use, if any, the WhatsApp messages can be used against D2 should this Court rule the prosecution cannot rely on the truthfulness of the messages.

26.  As for those messages allegedly from D2 which were only stored and retrieved from D3’s mobile phone, the prosecution accepts that, unlike in the case of Lee, they do not have any evidence that D3’s mobile phone was working properly at all material times.

As against Wong Wai-ho (D3)

27.  The prosecution will also rely on the evidence of Lee to identify D3 as the person whose phone number (51350856) appears on Lee’s mobile phone.  In any event, from D3’s Video-recorded Interviews, there cannot be any dispute that D3 was one of the participants of the WhatsApp chat group in question.

28.  The prosecution intended to adduce the WhatsApp messages contained in the Group, as well as WhatsApp messages between D3 and D1 individually, and the WhatsApp messages between D3 and D2 (as listed in the written submission dated 4 March 2019), not for the purpose of relying on the truth of the contents of the messages, but for the purpose of showing D3’s state of knowledge, when they are read in conjunction with each other about the incident relating to the killing of the deceased (by reason of D3’s admission that he was a participant of the Group who had access to the Group messages and, occasionally, responding to the messages).

29.  In respect of Charge 2 (the joint charge of Perverting the Course of Public Justice with D1), the jury will be asked to infer from such knowledge that D3 knew the iPhone he was asked by D1 to have the data erased contained information relating to the deceased’s killing, and in relation to Charge 3 (Handling Stolen Goods), the jury will be asked to infer from such knowledge that D3 knew the properties he received from D1 were indeed stolen properties.

30.  I would add here that in their latest written submission dated 18 March 2019 (before the voir dire), the prosecution submitted that Lee, who is the end user of his own phone, would be in a position to testify that his mobile phone was working properly.  It is also the prosecution’s submission that while many computers might be used for the transmission of messages between computers, the prosecution would only need to prove, by way of a computer certificate (if there is to be one), the computer that was used to receive and store the information was in proper working order for the information to be admissible.  There is no need to prove all the transmission involved.  The case of R v Graham Waddon[3], was cited in support.

Response by D1 (Supported by D2 and D3)

31.  Mr Grounds (together with Mr Paulinus Lo) opposed the admissibility of these WhatsApp messages.  Principally, Mr Grounds submitted that a mobile phone and SIM card are computers and the messages are passed between mobile phones via the computer of the phone service companies.  Computer records are properly admissible under s.22A of Cap. 8 as evidence of their truth (testimonial use) provided compliance is effected under the said Ordinance.  S.22A (11) permits the use of such records without such compliance where the “document (is) produced by a computer where the document is tendered otherwise than for the purpose of proving a fact stated in it”.

32.  Mr Grounds submitted that clearly the Legislature were concerned about the accuracy / provenance of any record if relied upon for testimonial use as opposed to original evidence.  The catch-all phrase that engages s.22A is “a statement contained in a document produced by a computer”.  At the time of the enactment of s.22A the Legislature could not have imagined the massive development of computers including their miniaturization, portability and use of screens and monitors.  Clearly the Legislature had in mind that the information within a computer had to be reliable.

33.  It was contended that a photograph of a computer monitor is “a statement contained in a document produced by a computer” since the document (ie the photo) is in effect produced by the computer.  Mr Grounds submitted that to permit admissibility of the photo (for testimonial use) would be to avoid the spirit and intent of the legislation.  Mr Grounds reminded this Court of its reliance on the intent and spirit of the legislation when dealing with the s.16 application earlier.

34.  Mr Grounds further submitted the production of a phone in court would again by-pass the whole spirit and intent of the legislation.  (It should be noted that the prosecution does not intend to produce Lee’s iPhone in evidence in any event.)

35.  Further, Mr Grounds submitted that if either the photos or the phone are admissible, given the Legislature’s specific reservations as to the reliability of computer information, this Court should exercise its inherent jurisdiction to exclude the evidence on the basis that its prejudicial effect is out of proportion with its probative value: citing Kissel v HKSAR[4] at paras 95-96 and 117-121, and HKSAR v Lam Tat Ming[5] in support.

36.  The prejudice, according to Mr Grounds, is that if a document produced by a computer itself is not admissible unless there is a s.22A compliance, then it is scarcely fit and safe for a computer monitor or photograph thereof to be used in its place.  Mr Grounds drew an analogy of someone breaking into an unlocked backdoor when the front door is securely fastened to suggest that to allow such an approach can be thought as “the worst evidence rule”.

37.  Mr Grounds submitted this Court should also consider whether it can be properly established that D1 was indeed the maker of the records in the WhatsApp as alleged by the prosecution.  They relied on the case of HKSAR v Yan Sin Man[6]and the ruling of the trial judge during the subsequent re-trial (HCCC 19/2018) and submitted that in the present case, there is insufficient evidential basis to show that D1 was the maker.

38.  Mr Grounds challenged the reliance by the prosecution on the case of Oei Hengky Wiryo in relation to the WhatsApp messages as original evidence, submitting that that decision relates to cases where kindred exhibits are found and where a certain piece of evidence has particular relevance when taken with other evidence.

39.  Mr Grounds submitted that to use the WhatsApp as original evidence, the prosecution needs to prove that a significant and substantial factual matrix exists.  Vital questions include who made the WhatsApp messages.  The evidence to be relied on by the prosecution does not provide the Court with such a factual matrix.  The prejudicial effect is, according to Mr Grounds, huge, and this Court should exercise its discretion to exclude these WhatsApp messages.

40.  Mr Grounds submitted that the evidence of Lee and Fung do not resolve the fundamental problems of:

(1)  who was in possession of the respective mobile phones over many days;

(2)  who used the respective mobile phones;

(3)  who were the makers of the relevant WhatsApp messages; and

(4)  whether all computers involved in transmitting the messages had in force at all material time appropriate measures for preventing unauthorised interference and were operating properly, and if not, that such improper functioning did not affect the accuracy of any documentary contents / records.

41.  Mr Grounds submitted that there are conceptual difficulties concerning the jury’s handling and processing of the WhatsApp messages.  This is due to the advanced level understanding of the hearsay rule required, which was also compounded by the substantial amount of WhatsApp messages to be presented to the jury.  The law of hearsay and the rules and exceptions are difficult to understand for many.  Evidence relied upon by the prosecution for the non-hearsay use may, despite directions from this Court, be considered by the jury on its truthfulness.  The difficult nature of any directions on the WhatsApp messages would further obscure the mental tasks required of the jury.  Mr Grounds asked this Court to take a decisive action and exclude from the evidence of these WhatsApp messages.

42.  I should add that in an earlier written submission (dated 27 February 2019), Mr Grounds submitted that if only the WhatsApp messages in D3’s own mobile phone are admissible in a limited non-hearsay use against D3 to prove guilt of D3, and not those on Lee’s iPhone, and there is no evidence that D3 ever saw or possessed Lee’s iPhone, a case for severance is enhanced and this Court should re-visit that issue.

43.  Basically, the stance of D1 is that the WhatsApp messages the prosecution wishes to place in evidence are inadmissible in law for testimonial or as original evidence.  Even if the messages are admissible as non-hearsay evidence, the prejudicial effect far outweighs the probative value so that this Court should exercise its inherent jurisdiction to exclude the evidence.

44.  Mr Grounds submitted that even if the WhatsApp messages are admissible, the directions that would have to be given to the jury would be so complicated that realistically, the prospects for the jury to understand and correctly apply the directions are limited in the extreme, citing the judgment of Bokhary PJ in the Kissel Case (at para 200) in support.

45.  In their later submissions dated 15 and 18 March 2019, after they were provided with a further statement from Lee, Mr Grounds submitted that this Court cannot rely on the evidence of Lee as a daily user of a mobile phone to come to the conclusion that the computer in question (Lee’s iPhone 6) was functioning properly as Lee cannot give authoritative evidence as to the reliability of the information contained on his phone, citing in support the cases of R v Shepard [7]and R v Cochrane[8].

46.  In their final submission dated 18 March 2019 (before the voir dire), Mr Grounds pointed out the inconsistencies in Lee’s assertions in his various witness statements and submitted that this Court should not place any reliance on Lee’s evidence.  Counsel also reminded this Court of the strictness of the hearsay rule, citing the famous case of Myers v DPP [9] in support.

Response by D2

47.  Mr McNamara on behalf of D2 adopted the submissions made by Mr Grounds and Mr Lo on the general principles and their application to this case.

48.  As for the co-conspirator’s rule, Mr McNamara referred me to Archbold Hong Kong 2019 para 11-19 and submitted that all those evidence relied upon by the prosecution related to events on 27 May 2017 (Octopus card records, CCTV and phone records) and the events subsequent (ie D2’s verbal admission on arrest and the finding of the deceased’s phone and the bloodstains), and submitted there is no independent evidence to support D2’s participation in the common enterprise (ie to inflict serious harm on the deceased in the late evening of 27 May 2017 at Black Hill together with D1 and WLK, and with the requisite knowledge) before 27 May 2017.  All the messages relied upon which were sent before 27 May 2017 do not meet the test and cannot be used as evidence against D2.

49.  Mr McNamara further submitted that the only WhatsApp messages attributed to D2 were sent on 26 May 2017 and they were the sort of messages one would expect a participant in an innocent war game being arranged would in fact send.

Response by D3

50.  D3 was originally represented by Mr Chan Siu Ming alone. Mr Chan was later assisted by Mr Michael Lam.  In his submission dated 27 February 2019 Mr Chan referred to the general principle concerning the hearsay rule adopted by the Court of Final Appeal in HKSAR v Lau Shing Chung[10]:

“…any oral or written assertion, express or implied, other than the one made by a person in giving evidence in court proceedings is inadmissible as evidence of fact or opinion so asserted”,

and conceded that there are cases in which hearsay evidence can be admissible if the purpose is to illustrate that the assertions or statement are made but not on the truth.

51.  Mr Chan submitted that in the present case, to prove that D3 had knowledge of an intent, or a plan whatsoever to kill, by a WhatsApp message sender, the prosecution is meant to prove that the sender had in fact such an intention or plan to kill, and that such sender had communicated the intention or plan to other people by using the WhatsApp.  Mr Chan submitted that prosecution cannot bypass this hurdle by saying the messages were to be admitted for a non-hearsay use.

52.  Mr Chan also submitted that the prosecution cannot rely on the telephone numbers or the icons appearing on the messages to prove who in fact had sent the message.

53.  It was Mr Chan’s submission that the WhatsApp messages could not be admitted without the corresponding computer certificate under s.22A.

54.  After the prosecution’s change of stance, Mr Chan, together with Mr Michael Lam, made two further submissions.

55.  Mr Chan reiterated that the WhatsApp messages cannot be admitted to prove their truthfulness without the s.22A computer certificate.  Without such a certificate, the prosecution cannot establish prima facie case as to who in fact had sent what.  The prosecution cannot rely on the evidence of Lee to identify the telephone number either on his phone or from a photo of his phone as the number is per se hearsay evidence.  The situation is not the same as one being present and overheard another person saying something when the identify of that other person is not subject to the hearsay rule.

56.  Further, Mr Chan submitted that the WhatsApp messages cannot be regarded as real evidence, citing Archbold Hong Kong 2019 (paras 9-11 to 9-13).  Reference is made to three categories of information from a computer:

(1)  computer used simply as a calculator;

(2)  computer programmed to record information without human intervention; and

(3)  information recorded and processed by computer entered by a person directly or indirectly.

57.  Information from the first two categories are not hearsay (and can be referred to as “real evidence”) whereas the third is hearsay.  Since the WhatsApp messages involve human input, proof that the computer is working properly is a requirement (citing in support the cases of Cochrane and Shepard).

58.  Mr Chan submitted that to rely on the principle of Declaration against Interest, the prosecution has to prove the true identity of the sender of the messages.  In the present case, Mr Chan submitted the messages sent by D1 are not clear cut admissions of guilty, but assertion of certain intentions.  Mr Chan submitted that the prosecution cannot invite the jury to draw inferences without relying on the truth of those assertion, but the prosecution is prohibited from doing so because of the hearsay nature of the messages.

59.  Mr Chan also pointed out the difficulty in reconciling the dual characteristics of a particular message, ie that message can be regarded as assertion of fact against D1 but at the same time only admissible for a non-hearsay use against other defendants.  Such dual characteristics would cause tremendous confusion to the jury and the jury will be inclined to rely on the messages as assertion of fact against D3 as well.  Grave prejudice will be caused to D3.

60.  Mr Chan submitted that not all WhatsApp messages are relevant to the case of D3.  D3 is charged with Perverting Course of Public Justice and Handling Stolen Goods.  D3 is not a party to the count of Murder.  D3’s knowledge that D1 and others had an idea to kill the deceased is not relevant to the offences he is facing.  What is relevant, it is submitted, is whether D3 had knowledge that D1 and D2 would kill the deceased on 28 May 2017.  The messages before 25 May 2017 only showed that D1 had the intent to create troubles to the deceased or to kill him, and that D1 took some steps to liaise with the deceased.  These events were independent of what took place on 28 May 2017.  Should the messages be ruled admissible, those messages sent before 25 May 2017 should be excluded.

61.  In their latest written submission, Mr Chan (together with Mr Lam) submitted that the admissibility of the WhatsApp messages cannot be proved by Lee’s evidence alone because the transmission of WhatsApp messages did not depend on the single iPhone possessed by Lee, but depend on the computers of other service providers.  It is therefore a multi-computer operation even on a single WhatsApp message and to depend on the non-malfunctioning of the end-computer (the iPhone of Lee) cannot ensure the accuracy of the message during transmission.  The case of R v Harper[11] was relied on in support.

B.HOLDING OF A VOIR DIRE

62.  In view of the heavy reliance on the evidence to be called by the prosecution on this issue, this Court decided, at the suggestion of Mr Chan and with the support of all other defence counsel, to hold a voir dire before a ruling is made.

63.  The prosecution called three live witnesses: Lee, WPC 7185 Law Pui-chi (“Law”) and Fung to give evidence.  Fung was tendered as an expert witness on digital forensics.  The prosecution also relied on statements tendered under section 65B of the Criminal Procedure Ordinance, Cap. 221 for 4 other witnesses (DPC7304 Lam Yat-sing, DPC 50023 Hui Man-kit, DPC11297 Hui Chun-chiu and DPC2808 Lai Po-leung).  The prosecution adduced exhibits including optical discs containing WhatsApp messages extracted from Lee’s iPhone and D3’s HTC phone, printouts of WhatsApp messages extracted from D3’s HTC phone and a number of photo albums.

Evidence of Lee Kang Yiu

64.  Lee gave evidence that he is studying Information Security with the SPACE programme run by the University of Hong Kong.  His mother gave him the iPhone 6 in question in 2017 to use.  He reset the passcode so that he could use that phone.  He has not told anyone of his own passcode.  He set up a WhatsApp ID using the name of “Daniel Lee” with that iPhone.

65.  He was a member of the WhatsApp Group in question.  He joined the Group in May 2017.  He used the name “Boss” to represent D1 with the mobile number 61805275 in his phone contact list.  He had used that phone number to contact D1 to meet up with D1 for dinner and to do war game transactions on more than one occasion so he knew that number was indeed D1’s number.

66.  As for D2, Lee used the name “Benard Chow” to describe D2 with the mobile number of 51079651 in his phone contact list.  Again Lee has used this number to contact D2 to come out and D2 did come out, so he knew it was indeed D2’s mobile phone number.

67.  As for D3, Lee used the description “Jack Wong” for D3’s number 51350856 on his contact list.  He has also used that number to contact D3, asking D3 to come out and D3 did meet up with him.

68.  Lee pointed out various photographs in an album (Album 10), showing his iPhone 6, and the screen of his iPhone showing the number of D1, D2 and D3.

69.  Lee also pointed out the number 91346270 shown on the screen as the number of “Mou Chai”.  Lee said he knew the number was Mou Chai’s because Mou Chai had mentioned about going out for meals in the Group and Mou Chai did turn up.

70.  Lee also identified the sound of two audio messages played to him being the voice of D1.

71.  Lee admitted that in his statement to the police dated 30 May 2017, he mentioned that on 28 May 2017 when he and others were taking a break from playing war games at a place in Tai Kok Tsui, he overheard someone near him saying words to the effect “twenty slashes and eight blows”, he knew that was said by one of the group of Martin (D1), Benard Chow (D2) or Ah Mou Chai (WLK), but he was not sure which one.  Lee later supplemented the following in the same statement: while he was with Martin, Ah Mou and Benard Chow on 28 May 2017, he also heard one of them talking about “throwing a knife as long as a finger and a metal pipe down the hill ” but again he could not be sure who had said that.

72.  Lee was asked by the police to hand over his iPhone so he deactivated the passcode and handed it over.

73.  When Lee was asked by the police on 30 May 2017 the meaning of a message in the Group, ie on 28 May 2017 at 20:46 hours from “Boss”, the message being “Say goodnight to Bosco”, Lee replied that he had too many WhatsApp groups and he did not pay much attention to these messages and sometimes he did not even “tai” (Chinese character “睇”) (read or look at) them.

74.  On 12 June 2017, Lee gave another statement to the police. Lee made an amendment that the said message “Say goodnight to Bosco” should have been sent on 27 May 2017 at 20:46 hours instead of on 28 May 2017.  Lee confirmed that on 27 May 2017 he also focused on playing games and did not pay attention the messages from this Group.

75.  Lee testified that when he saw photos in the messages, he would read them.  He would also read personal messages to him, whether the message was in a group chat or not.

76.  As to WhatsApp messages in the Group from 11 to 15 May 2017, and from 25 to 28 May 2017, in a later statement (dated 4 March 2019) Lee said he had “tai” (Chinese character “睇”) (read or look at) the messages at the time.

77.  When Lee was asked about the apparent inconsistency: having read or seen something as opposed to not having read or seen something and not having paid attention to something, Lee explained when he used the Chinese expression “睇” (“tai”) he meant to convey the meaning of having a look, not reading the contents.  Since he did not read the contents, so he did not notice the contents.

78.  Lee accepted that he did not pay attention to those messages unless they are directed to him personally.  Lee disagreed that he was embellishing his evidence, saying that he was trying his best to tell the truth.  He further said that when a message came through there will be a sound signal.  If he was doing something at the time he would not look at his phone right away, but would look at it later.  If the message did not relate to him, he would simply ignore it.  He said he had told Law who took the statement from him about his but he had no say whether Law wrote that down or not.

79.  Lee agreed that since he did not pay attention at the time the messages came through, he only assumed that all of the messages came through in the selfsame form when he read them with the police later.

80.  Lee accepted his memory was not good relating to date and time.  He would only remember big milestones. When he gave his statement on 30 May 2017, he could not even remember he only joined the Group a few weeks earlier, saying that he joined at a time much earlier than May.

81.  Lee did not know if his iPhone can be accessed by a computer.

82.  Lee did not know how long his mother had the iPhone before passing it on to him.  He has not installed any additional security or anti-virus software on the iPhone.  The iPhone worked properly as far as he is concerned.  The date and time are correct.  He, being the end-user, would not know how many check-points a WhatsApp message will go through before reaching his phone.  He believed his phone was working properly but he could not tell if the information was accurate.  Lee knew about “bugs” in a computer operating system.  He would not know if there was any bug in the iOS in his iPhone.  He had used his iPhone to browse websites and he knew some pornographic sites contained viruses.

83.  Lee was referred to some printouts which indicated message from the same sender, emoji sent were shown on the HTC phone (ie D3’s mobile phone) but not on the iPhone (Lee’s iPhone).  Lee said from his knowledge, HTC uses an android system whereas iPhone uses iOS.  Different codes are used by these two systems to represent texts and emoji so they would be shown differently.

Evidence of Law

84.  This officer’s evidence is not controversial.  She basically described how she seized the iPhone from Lee and later delivered it to Fung to extract the conversation record of the WhatsApp chat group and how she received both a Master and working discs afterwards.  She confirmed that she had not tampered with the contents of the discs.

85.  She also gave evidence in relation to the circumstances of taking a statement from Lee on 30 May 2017 and having an amendment made by Lee on 12 June 2017 (ie changing of the date from 28 May to 27 May).  She could not recall if she had spotted the error when looking at Lee’s iPhone.  She confirmed that if anything needed to be corrected she would have helped Lee to do so.

Evidence of Fung

86.  Fung is attached to Digital Forensics Team C, Technology Crime Division, Cyber Security and Technology Crime Bureau (“DFRN C TCD CSTCB”) and he is responsible for computer and mobile device forensic examinations.

87.  Fung gave evidence as to his qualification, which included, among others, a Professional Diploma programme in Criminal Investigation and Forensic Science awarded by the Chinese University of Hong Kong in 2010, having completed a Computer Forensics Basic Course and a Mobile Device Forensics Course ran by the Hong Kong Police College in 2016, completed a CASA Forensics Course ran by Cellebrite also in 2016 and an Advanced Mobile Forensics Training awarded by the Interpol in 2017.

88.  Fung said CASA stands for Cellebrite Advanced Smart Phone Analysis Forensics Course.  During the course, experienced forensics trainers came from overseas to teach participants about mobile phones and to analysis data.  Participants including himself were taught how to use the Cellebrite tool, a software called “physical analyser” with mobile devices.

89.  Earlier this year in March, he attended a refreshment course ran by CASA.

90.  Fung said he had dealt with over 3000 mobile devices in over 400 cases, including tablets, iPads, SIM, memory cards, and mobile phones using Android and the iOS systems.

91.  He was aware of the Code of Conduct for experts and he was willing to comply with the requirement.

92.  Before appearing in this Court, he has only given evidence as an expert, and was accepted as such, once before, in a case involving robbery.

93.  Fung was accepted by this Court to give expert evidence on digital forensics.

94.  Fung described the handover procedure when Law handed the iPhone in question to him.  He took the mobile phone into his laboratory, where he has a computer used for digital forensic examination.  This computer was not connected to the internet but connected via intranet to the Police server.  This computer has anti-virus software which is updated frequently.

95.  After logging in his computer, to which only he had the password, he opened the physical analyser.  He then switched on the iPhone after taking it out of the bag.  The iPhone was powered on and there was no signal of anything wrong.  The touch screen functioned normally.  Fung then connected the iPhone to his computer and extracted all the data from the iPhone into a digital forensic image file (“DFIF”).  This file was then saved onto the Police server, to which only he and his superior can have access.

96.  After he extracted all the data from the iPhone into a DFIF, he used a tool called Malware scan and the computer then conducted a run to see if there are any viruses in the DFIF.  After running this scan, there was no indication of any malfunctioning.  Since the data had been extracted from the iPhone into the DFIF, and there was no indication that the file had been contaminated, that no virus including the Trojan Horse was found, the iPhone was also not contaminated.

97.  Fung then extracted the WhatsApp chat group in question as instructed by Law and exported it in the form of spreadsheets.  The data exported was burnt into a DVD, the Master disc.  He then made a copy of it as a Working disc.  The discs are read-only discs, meaning one cannot make any amendment to the data already saved on the file.

98.  Fung also testified that the physical analyser he used was functioning properly and there was no abnormal interference during the extraction of the data from the iPhone.

99.  Fung gave evidence as to the mechanism of establishing a unique WhatsApp ID to use the WhatsApp application by opening a WhatsApp account, using both his own experience and from information he obtained in the official website of WhatsApp.  Unique WhatsApp IDs with the respective mobile phone number of D1, D2 and D3 were identified.

100.  Fung also gave evidence of having received a HTC phone from DPC7304 for examination.  He described a similar procedure of extracting data from the HTC phone, using a touch tool of Cellebrite.  The tool was functioning properly.  All the data were extracted from the HTC phone onto his forensic computer in a DFIF.  Again he ran the Malware scan and there was no error message.  He was requested by DPC7304 to extract messages in the WhatsApp chat group in question from the DFIF.  He exported the messages in the form of spreadsheets and burnt them into a read-only disc as the Master Disc and made a copy as the Working copy.

101.  Subsequent to that, he was asked by the officer-in-charge of the case to re-examine the images extracted from the HTC phone.  He understood that was as the result of a JR (Judicial Review) proceedings concerning search warrants.  Fung did as requested and he opened the DFIF and examined it.  He found no abnormality and he exported the messages in the WhatsApp Group and burnt them into a read-only Master disc and made a copy as the Working disc.

102.  Under Cross-examination by Mr Grounds, Fung said he did not know what the “i” in iOS stands for, only that it is related to the Apple Company.

103.  He testified that without the passcode, he would not have been able to access the iPhone in question had its passcode not been deactivated.  He had heard of a tool called IP Box which functioned by repeatedly using different passcodes to try to unlock an iPhone.  He heard the tool being used on iPhone 4 or iPhone 4S, with a lower iOS version and only requiring a 4-digit passcode.  With the advance of time, the version of iPhone has gone up to 12.  With other modes of identification such as face ID, it is very difficult to unlock new versions of iPhone with an IP Box.

104.  Fung was questioned about his witness statements, given before the prosecution asked him to give evidence as an expert.  He agreed that in his statements he did not mentioned certain aspects of the evidence which he gave in court.  For example, there was no mention of the use of Malware Scan, or that the iPhone had not been “Jailbroken”.  His explanation was that he did not include these as there was nothing abnormal after he did the scan.  He had also not mentioned the fact that he had checked the MD5 which is a digital fingerprint or footprint, to ensure that no alteration had been made to the file.

105.  Fung said the forensic computer he used is connected to the intranet.  He is of the view that the chance of contamination is very negligible.  Fung had not heard of the term “extranet”.

106.  Fung described the way a person can use a computer to access and use the WhatsApp application installed on a mobile phone, by accessing the WhatsApp web and scanning the QR code with the mobile phone so that both the computer and the mobile phone have the same interface.

107.  Fung had accessed the WhatsApp’s official website to get information.  He used his own experience and he made reference to the information on the official website to prepare his statement, he therefore consolidated what he read with his own experience.

108.  Fung testified that he had taken photographs of the phones he had examined but he did not mention about this in his statements.

109.  Fung was taken to the spreadsheets and he agreed that there was no column for “delete” on it, he explained that was because no information had been deleted.

110.  Fung was asked whether a hacker can use the footprint left behind, after a mobile phone had been connected to a computer to access the WhatsApp account, to hack into the WhatsApp account, Fung said if the hacking was done while the phone was connected to the computer, but he did not know whether such was possible afterwards, when the phone was not connected to the computer.

111.  Fung was aware that with an iPhone, under certain circumstances, it will erase all data.

112.  Fung also testified that he was not part of the team investigating this case.

Final submission by prosecution

113.  Mr Wei submitted, in the absence of a s.22A certificate, oral evidence can be adduced as to the proper functioning of Lee’s iPhone and hence the WhatsApp messages extracted therefrom, citing Shephard. Mr Wei submitted the testimony of Lee and Fung, when taken together, are capable of proving the reliability of the information (including all the WhatsApp messages the prosecution sought to rely on) contained in Lee’s iPhone.

114.  Mr Wei highlighted the evidence of Lee and Fung and submitted that Lee was familiar with the operation of his own phone and he is the most suitable candidate to give such information.  Lee said his mobile phone and the WhatsApp function had been working properly, the test in Shephard is satisfied.

115.  Fung’s evidence also showed that the WhatsApp messages from Lee’s iPhone are reliable.  Fung had run the Malware Scan and ascertained that there was no virus.

116.  In short, Mr Wei submitted that the prosecution has shown by evidence that the WhatsApp messages are reliable and admissible.

Final Submission by the defence

117.  I will first make a comment on the submission of Mr Chan (together with Mr Lam).  Mr Chan accepted that the WhatsApp messages extracted from Lee’s iPhone has no relevance to D3 as the prosecution will rely on the WhatsApp messages extracted from D3’s own phone, for a non-hearsay use, to ask the jury or fact-finder to infer D3’s knowledge in relation to the two charges D3 faced.

118.  Mr Chan explained that he felt he should address this Court in the interest of justice.  Whilst I appreciate Mr Chan’s good intention, it remains a fact that the WhatsApp messages extracted from Lee’s iPhone are only relevant to D1 and D2, who are ably represented by their counsel.  I will therefore concentrate on the final submission by Mr Grounds and Mr Lo submitted after the voir dire, and to which Mr McNamara prayed in aid.  I will add here that when I consider the general applicable principles, I will take into consideration Mr Chan’s submissions.

119.  There is one aspect mentioned by Mr Chan in his final written submission which merits a mention though, that is the issue of emoji not appearing on Lee’s iPhone 6 but on D3’s HTC phone (as shown on the spreadsheet printouts).  I have carefully compared the photographs showing all the relevant messages on Lee’s iPhone and on D3’s HTC phone and found the contents being the same, including emoji.

120.  Mr Wei also arranged for images burnt onto the read-on disc to be shown in court, to show this Court that the contents are indeed the same, including emoji.

121.  I find nothing turns on this issue raised by Mr Chan.

122.  I will now turn to the submission of Mr Grounds.

123.  Mr Grounds basically repeated what he and Mr Lo had already submitted before in their written submissions.  They iterated that the prosecution cannot rely on the evidence of Lee and Fung to have the WhatsApp messages admitted into evidence.

124.  Mr Grounds pointed out the apparent inconsistencies between Lee’s evidence in court and what Lee asserted in his witness statements, in particular as to whether Lee “read” the WhatsApp messages appears in the Group chat on 27 May 2017 or not.

125.  Mr Grounds also criticized Lee’s claim to have recognised D1’s voice from the two audio messages when Lee could not tell who of the three (ie D1, D2 or WLK) uttered those words about “twenty lashes and eight blows” etc.

126.  Mr Grounds pointed out the lack of evidence in relation to any service providers’ computer, any relevant phones apart from Lee’s and D3’s, who was using the D1’s mobile phone at any particular time, and so on.  There was also a lack of evidence regarding the chain of computers used.

127.  Mr Grounds submitted that the position after the voir dire is the same.  The prosecution could not prove those matters necessary to properly admit into evidence for whatever purpose the WhatsApp messages as the relevant chair of computers still remain unknown and the operating safety and proper functioning of most computers in the chain was not the subject of any proof.

128.  Lee could only state that he was the end-user and his iPhone appeared to be functioning normally.  Mr Grounds compared Lee’s evidence about his iPhone with a driver who drives his car.  The driver can say the car is working properly even though he has no knowledge that something has gone wrong in the engine and has been malfunctioning for some time.

129.  Lee knew nothing about security relating to any intermediary server.  He did not know where the WhatsApp server was physically located.  He would not know if the phone used by the person sending him messages was corrupted.

130.  Mr Grounds submitted that Fung was not independent from the investigation.  Further, it was submitted that Fung was effectively not an expert and he could not be relied upon by this Court.  Mr Grounds criticized Fung’s failure to mention procedures he said he had performed in his statements.  Mr Grounds asked this Court to reconsider the position and to decline to accept Fung’s evidence as an expert.

C.   MY CONSIDERATION OF THE SUBMISSIONS

131.  Most of the WhatsApp messages the prosecution intended to rely on, both for testimonial use and non-hearsay use against D1 and D2, were messages in the WhatsApp Group extracted from Lee’s iPhone and D3’s HTC phone, and a few messages extracted from D3’s HTC phone which were not made in the Group.

132.  It is common for people in Hong Kong (and indeed in many parts of the world) to use WhatsApp as a form of communication.  The messages stored on one’s mobile phone amount to a “record” of those communications.

133.  S.22A of the Evidence Ordinance makes provision for the production of documentary evidence from computer records in criminal proceedings.

134.  Under this subsection, a statement contained in a document produced by a computer shall be admitted in any criminal proceedings as prima facie evidence of any fact stated therein provided certain criteria stipulated in the same subsection are fulfilled.  In other words, if those criteria are met, then any fact stated in that statement is prima facie true.

135.  The criteria stipulated are as follows (s.22A (2)):

“(a) that the computer was used to store, process or retrieve information for the purposes of any activities carried on by any body or individual;

(b) that the information contained in the statement reproduces or is derived from information supplied to the computer in the course of those activities; and

(c) that while the computer was so used in the course of those activities—

(i)  appropriate measures were in force for preventing unauthorized interference with the computer; and

(ii) the computer was operating properly or, if not, that any respect in which it was not operating properly or was out of operation was not such as to affect the production of the document or the accuracy of its contents.”

136.  There is no dispute that the mobile phone of Lee (and of D3) are computers as the mobile phone is a device for storing, processing or retrieving information (as defined in s.22A).

137.  I will add here that though I asked parties to consider whether the WhatsApp messages could be said to constitute “real evidence”, after considering the submissions put forward by counsel for the defendants, I am satisfied that they are not.

138.  In my view, s.22A provides for a sensible and efficient way to have statements contained in documents produced by computers admitted as prima facie evidence of any facts stated in the statements.

139.  As the evidence in relation to Lee’s iPhone and D3’s HTC phone are not the same, I will deal with the admissibility of the records extracted from Lee’s iPhone first.

140.  Mr Wei summarised the challenge by the defence as follows:

(a)  The absence of s.22A computer certificate in respect of each and every computer (or set / combination of computers) involved in the transmission and / or reception of those messages;

(b)  The reliability of the records contained / extracted from Lee’s iPhone; and

(c)  The authorship of the WhatsApp messages extracted from Lee’s iPhone.

141.  Grounds (a) and (b) are interrelated so can be dealt with together.

Grounds (a) and (b)

142.  As submitted by Mr Grounds, when s.22A was enacted, the Legislature could not have imagined the massive development of computers including their miniaturization, portability and use of screens and monitors.  I would add that the Legislature could not have envisaged the use of a “virtual chat room” via internet for people to chat, which involved the use of many computers and service providers.

143.  The defence submitted that Lee’s iPhone is not a simple computer like a calculator or a till (as in the case of Shepard), Lee, as the user of the iPhone, cannot give authoritative evidence that his iPhone was working properly, particularly when he has not installed any security or anti-virus software.

144.  Apart from submitting that the prosecution needs to prove that all the computers used in the chain which resulted in the records store in Lee’s iPhone, the defence also challenged the evidence of Fung, submitting that his evidence could not be relied upon.

145.  The prosecution relied on the case of Waddon and submitted that the prosecution does not need to prove all the computers along the chain worked properly, and on the case of Shepard that oral evidence can be adduced to prove that the computer was working properly.

146.  In the case of Waddon,the Court of Appeal in England considered the question whether, having regard to the requirements of section 69 of the Police & Criminal Evidence Act 1984, a certificate in relation to the proper working of a computer was needed not only in relation to the computer used by the police officer who would have given evidence for the prosecution, but also in relation to all intervening computers which had resulted in the images reaching the officer’s screen and there being downloaded and printed out.  The Court of Appeal rejected the argument advanced by counsel for the appellant in that case (ie that all the computers transmitting images along the chain must be certified for the purpose of section 69), drawing a difference between “production” and “transmission”.

147.  Although the requirement under s.69(1)(b) of the said Act was similar to the requirement under s.22A (2)(c)(ii), the scheme under s.69 of the Act and s.22A of our Ordinance are quite different.

148.  In the English Act, the operative words are “… a statement in a document produced by a computer shall NOT be admissible as evidence of any fact stated therein unless [certain conditions stipulated are complied with]”, where under s.22A of the Ordinance, the operative words are “... a statement contained in a document produced by a computer shall be admitted in any criminal proceedings as prima facie evidence of any fact stated therein if [certain conditions are stipulated are satisfied]”.  

149.  In the English Act, under Part II containing provisions supplementary to Section 69, Paragraph 8 provides for the requirement for the production of a certificate for the purpose of s.69.  Further, under Paragraph 9 of these provisions, a court may require oral evidence to be given of anything of which evidence could be given by a certificate under that paragraph.

150.  One can see the requirement under the English Act is more stringent.  A statement produced by a computer shall NOT be admissible as evidence of any fact stated therein unless conditions stipulated are met.  In Hong Kong, the Ordinance provides for the means of having a statement produced by a computer admitted as prima facie evidence of any fact stated therein if certain stipulated conditions are met.

151.  In the case of Shephard, which deals with oral evidence given by a store detective as to the operation of the till and the central computer it was connected to, stating that there was no evidence of malfunction, the English Court of Appeal held that under s.69 and Paragraph 8, proof of a computer was reliable could be proved by either calling oral evidence or tendering a certificate.

152.  As the English scheme is quite different from the Hong Kong one, I do not find the English cases decided on s.69 of the English Act particularly helpful, in particular the case of Shepard in relation to the oral evidence given pursuant to Paragraph 8.  Nevertheless, as the wordings in relation to the proper working of the computer are the same in both the English Act and the Ordinance, I am of the view that the decision in Waddon is of value.

153.  In the present case, the prosecution is not relying on s.22A at all as no certificate was tendered under that section.  In my consideration of whether the records stored in Lee’s iPhone are admissible, I do bear in mind the conditions stipulated under s.22A, namely, appropriate measures were in force for preventing unauthorized interference with the computer; and the computer was operating properly or, if not, that any respect in which it was not operating properly or was out of operation was not such as to affect the production of the document or the accuracy of its contents.

154.  I am satisfied that the prosecution can rely on the oral evidence of the user of the computer (Lee who used the iPhone) together with the evidence of an expert on digital forensics to prove that the records extracted from Lee’s iPhone are reliable.  I will deal in greater details the evidence of Lee and Fung at a later stage.

155.  I appreciate an iPhone is not a simple computer as in the case of a calculator or a till.  On the evidence of Lee alone, I would not have found that the prosecution has proved that the iPhone was working properly at the time.  However, with the expert evidence that there was no virus found, the prosecution has satisfied me that the WhatsApp messages relied upon by the prosecution had been stored and extracted from a computer that was working properly at the material time.

156.  As to whether the prosecution has to prove not just that Lee’s iPhone was working properly, but all the intervening computers along the chain were also working properly, I find that it is not necessary for the prosecution to do so.

157.  I accept the prosecution’s submission on this issue, with reliance on the case of Waddon. I rule that under s.22A, the prosecution only needs to prove the very computer used to store and retrieve the information in order to “produce” the document was working properly, not all the other computers used along the chain.  Though the prosecution is not relying on s.22A, the prosecution is still trying to “produce” the record of WhatsApp messages stored in and retrieved from Lee’s iPhone.

158.  Further, by comparing the WhatsApp messages stored and retrieved from D3’s HTC phone, which I found admissible, the contents in both phones in relation to date, time, and context are identical.  This is another piece of evidence in support of the prosecution’s submission that the records are reliable.  I will deal with the evidence in relation to D3’s HTC phone later.

159.  I will now deal with ground (c).

Ground (c)

160.  In my view, Lee is in a perfect position to say that the phone number he stored in his contact list under the name of “Boss” was D1’s phone.  The same applies to the mobile phone number of D2 in the name of “Benard” and D3 in the name of “Jack Wong.”  Lee testified that he had used the mobile phone numbers of D1, D2 and D3 for contact and they either turned up for meals or to do some transactions.

161.  Mr Grounds submitted that there was no evidence that D1 was using his mobile phone at the time when the messages attributed to him were sent.  I will just say that it is only logical that, generally speaking, one would use one’s mobile phone to send messages.  After all, it is only common sense that a person sending a message would want the recipient to know the message was sent by him or her.  One can also gauge the contents of some of the messages sent from D1’s phone with evidence to be adduced from live witnesses, such as 05 as to what took place on the night in question.

162.  Although Lee did not enter the name “Mou Chai” or “Ah Mou” for WLK, I accept his evidence that he knew the number was Mou Chai’s because Mou Chai had mentioned about going out for meals in the Group and Mou Chai did turn up.

163.  I will now deal in greater detail the evidence.

The evidence

164.  As submitted by Mr Wei (together with Mr Tso) in their final submission dated 2 April 2019, there is no serious dispute as to the chain of evidence of Lee’s iPhone (from the time it was handed over by Lee to Law, who brought it to Fung and had all data from it extracted and the WhatsApp messages in the Group exported into spreadsheet form and burnt onto a DVD, then 42 photographs were taken of these WhatsApp messages before the iPhone was returned to Lee).

165.  I am satisfied there was no unlawful or improper interference with Lee’s iPhone from the time it was seized by Law to the time it was returned to Lee.

166.  I accept Lee’s testimony that after he changed the passcode for his iPhone (after it was given to him by his mother), he did not divulge the passcode to anyone.  At all material times he did not notice anything wrong with his iPhone, it was functioning properly.

167.  I accept that Lee was trying his best to give evidence according to what he could remember, and he did not have a great memory.  I do not think he was embellishing his evidence as suggested by Mr Grounds.  When he gave his statement on 30 May and later on 12 June 2017, the message he wanted to get across was that he did not pay attention to the messages in the Group at the time it was sent.  It is true that in Chinese, the character “睇” (“tai”) can mean either “look” or “read”.  In this case, it matters not whether he had looked at the messages, as he claimed, or not, his evidence was that he did not pay attention so he could not testify as to what was the contents of those messages.  However, when Lee was asked about those messages at a later stage, in March this year in fact, it is only natural for him to refer to those messages (with the date and time shown) and confirmed that they were sent at the time (though it was only his belief that they were indeed sent at that time).  In my view, it matters not that he did not pay attention to those messages at the time.  The fact that identical WhatsApp messages appear in Lee’s iPhone and D3’s HTC phone is evidence to support that the messages were indeed sent at the time stated.

168.  Mr Grounds challenged Lee’s evidence of identifying D1’s voice by reference to Lee’s failure to tell who of the three (D1, D2 or WLK) uttered the words about “Twenty slashes and eight blows”.  I do not agree.  When Lee heard those words, he was having a break from playing war games.  His attention was not drawn to any utterance.  It was only afterwards, when he was questioned by the police that he recalled having heard those words, but he could not tell who had said them.  On the contrary, the audio messages were played specifically to Lee, whose attention was drawn to the voice.  Having known D1 for some time and having met up with D1 for war games, for business transactions and for meals, Lee is in a position to recognize D1’s voice.  Of course there is always the danger of a mistaken identification, but that is a matter for the jury.

169.  Now, the evidence of Fung.

Evidence of Fung

170.  I accept that while Fung is employed by the DFRN C TCD CSTCB, he is not part of the investigating team.  His role originally was to extract all the data from Lee’s iPhone and D3’s HTC phone and to export all the WhatsApp messages.  He was not expected to be called as an expert at that time.  Fung was later called as an expert on digital forensics and I re-confirm that he can give evidence as an expert on digital forensics in this case.

171.  I appreciate the criticism Mr Grounds made against Fung, however, after careful consideration, I do not find them substantiated.

172.  Fung knew that the operating system for the iPhone is iOS and for the HTC is Android.  The fact that he did not know what the “i” in iOS stands for is of no importance in this case.  I find that with his experience, he has the capability of differentiating whether a mobile device has been contaminated with viruses by using special tools.  In the present case, he used the Malware Scan to do the testing.  I accept his evidence that no virus was found, and indeed, no malfunction of any kind was found, including that the iPhone was not “jailbroken”.

173.  Fung has only given evidence as an expert once before and he is clearly not very experienced with the requirement of an expert, Hence his failure to mention in any of his witness statements that he had performed various tests such as the Malware Scan, or having done the MD5 and so on.  I find nothing sinister in his failure to do so and I accept that he did performed those tests as he testified.

174.  I accept that he can give evidence as to the working of WhatsApp from his own experience and with reference to information provided by the official website of WhatsApp.  I find nothing wrong with his reliance on this hearsay material.  Fung is not an expert of everything to do with computer, his expertise is confined to digital forensics.  It is proper for him, in my view, to cross-reference with the material from the official source to verify his own understanding.

175.  I would add that anyone using the WhatsApp application would know from his / her own experience that a particular mobile phone number has to be used.  After all, the user would need to send and / or receive WhatsApp messages using that particular number.  It would be ridiculous to say that the same number would be used by two or more different account-holders.  That is just common sense.  From Lee’s evidence, the phone number of D1, D2 and D3 became known.  The WhatsApp ID with their respective phone number has to be their account.  To say otherwise will defy common sense.

176.  Fung was asked about the procedure of using a computer to access a mobile phone so that one could use the computer instead.  That is all very interesting information but it has no bearing on this case.  There is no evidence from the defence (although I must stress that D1 and D2 are perfectly entitled, as is their right, not to give or call evidence) that either D1 or D2’s phone has been connected to a computer to access the WhatsApp application.  As far as Lee is concerned, he did not even know if his iPhone could be connected to a computer.  Cleary Lee had not access WhatsApp with a computer.  The suggestion (I stress the word “suggestion”, as there is no evidence from the defence to substantiate and Fung was not in a position to comment) that after a mobile phone has been connected to a computer, a hacker can use the footprint left behind to hack into the WhatsApp account, is of no relevance.

177.  Further, whether under certain circumstances an iPhone will delete all its data is of no importance here.  It is certainly not the case that ALL data has been erased, on the contrary, Fung’s evidence was that he extracted all the data.  He also testified that after performing the Malware Scan, he exported all the WhatsApp messages and there was no deletion.  I add here that I accept his explanation why there was no column for deletion on the spread sheets.

178.  As to the use of something called an IP Box to try to break into an iPhone, again that is of no relevance in this case.  Lee deactivated his iPhone.  There was no question of breaking into Lee’s iPhone in any event.

179.  Fung was asked about something called “extranet”.  Fung did not know what it was, neither do I.  There is no evidence from the defence to show what extranet was and how the lack of knowledge about extranet impact on Fung’s evidence on digital forensics.

180.  I have already indicated that the evidence of Lee, coupled with the evidence of Fung, satisfies me that the WhatsApp messages extracted from Lee’s iPhone are admissible.

181.  I will now deal with the admissibility of the WhatsApp messages stored and extracted from D3’s HTC phone.

The admissibility of the WhatsApp messages stored and extracted from D3’s HTC phone

182.  Again there is no issue regarding the chain of evidence from the time D3’s HTC phone was seized by the police to the time when the mobile phone reached Fung for handling, after how the mobile phone was kept by the police afterward.

183.  There is of course no evidence from D3 that his HTC phone was working properly at all material time.

184.  On the evidence of Fung, which I accept, there was no malfunctioning or any viruses detected on D3’s HTC phone after he performed the scanning with the Malware Scan, coupled with the comparison of identical WhatsApp messages stored and extracted from Lee’s iPhone, I am satisfied that D3’s HTC phone was working properly at all material time.

185.  All the comments and findings I made concerning Lee’s iPhone (paras 156 - 158, 160 - 161, 167) and regarding Fung’s evidence (paras 170 - 179) are applicable in the case of D3’s HTC phone.

186.  I am satisfied that the prosecution has satisfied me of the admissibility of the WhatsApp messages stored and retrieved in D3’s HTC phone.

187.  Having made this ruling, I will now turn to particular messages the prosecution wishes to rely on as against each defendant.

188.  As there is no computer certificate pursuant to s.22A, whilst these WhatsApp messages are admissible, they are none the less hearsay evidence unless any particular message fits into a category of an exception to the hearsay rule.

189.  Declaration against interest is an exception to the hearsay rule, so is the co-conspirator’s rule.

190.  The prosecution has set out, in their written submission dated 4 March 2019, in table form, the WhatsApp messages they intended to use against each defendant, and on what basis.  I will use the same tables in giving my ruling.

Against D1

Messages extracted from Lee’s iPhone

(1)  Messages nos. 1369-1373, 1385, [1388], 1386, 1392-1394, 1396, 1397, 1399, 1400, 1406-1410

(a)  Messages nos. 1369-1373 – not admissible as they are too vague as to being relevant.

(b)  Messages nos. 1385, 1386, 1388, 1392, 1393, 1394, 1396, 1397, 1399, 1400, 1406-1410 – admissible as declaration against interest.

(2)  Messages nos. 1761-1763, 1793

•  All messages admissible for non-hearsay use.

(3)  Messages nos. 1795, 1800, 1801, 1806-1808

•  All messages admissible for non-hearsay use.

(4)  Messages nos. 3709-3711, 3714

•  All messages admissible for non-hearsay use.

(5)  Message no. 3715

•  Admissible as declaration against interest.

(6)  Messages nos. 3742-3744

•  All admissible for non-hearsay use.

(7)  Messages nos. 3754, 3755, 3757

•  Message no. 3754 shows a screen shot with the deceased’s audio.  Note that immediately after message 3755 (Guys plz prepare for tomorrow) there is a message from Boss “@[sword], @Benard Chow and @Mou Chai” before message 3757 (I take him down when I isolate him with 06).  All are admissible as declaration against interest.

(8)  Messages nos. 3789-3791

•  All admissible as declaration against interest.

(9)  Messages nos. 3951, 3952, 3956, 3957, 3959, 3960

•  All admissible as declaration against interest.

(10)  Messages nos. 4006-4008, 4010-4014

•  All admissible as declaration against interest.

(11)  Messages nos. 4015-4016

•  All admissible for non-hearsay use.

(12)  Messages nos. 4148, 4156

•  All admissible for non-hearsay use.

(13)  Messages nos. 4185, 4186, 4189, 4191, 4192

•  All admissible for non-hearsay use.

(14)  Messages nos. 4195-4197

•  All admissible as declaration against interest.

(15)  Messages nos. 4198-4201

•  All admissible for non-hearsay use.

(16)  Message no. 4205

•  Message no. 4205 (audio message: Hey Benard, if on the hill you see anyone hiking, jogging and such, you report over here), is admissible as declaration against interest.

(17)  Message no. 4206

•  Admissible for non-hearsay use.

(18)  Message no. 4210

•  Admissible for non-hearsay use.

(19)  Message no. 4215

•  This audio message: (Meow, wait a bit longer, we are still packing stuff, cleaning stuff), admissible as declaration against interest.

(20)  Message no. 4222

•  The prosecution did not refer to this message, which might be an oversight (This is an audio message from D1: you tell him we are still doing testing, there is a problem with the equipment). This is admissible as declaration against interest.

Messages extracted from D3’s HTC phone only

(1)  Messages nos. 327, 328

•  All admissible as declaration against interest.

(2)  Messages nos. 314, 315, 321, 322, 327, 328, 330, 332, 333, 335

•  All admissible as declaration against interest.

(3)  Messages nos. 652, 653

•  All admissible as declaration against interest.

(4)  Messages nos. 1303, 1304

•  All admissible as declaration against interest.

(5)  Messages nos. 3666, 3668, 3697, 3712, 3714

•  All admissible as declaration against interest.

191.  For all those WhatsApp messages I ruled admissible as declaration against interest, I am satisfied, after reading the contents, that they amount to such declarations.

Against D2

192.  The prosecution listed out those WhatsApp messages they intend to rely on against D2 as declaration against interest and those admissible under the co-conspirator’s rule.

193.  I will first deal with the co-conspirator’s rule.  As submitted by Mr McNamara, the law is clear.  In deciding whether there is foundation for admitting the evidence, trial judges look to see if there is independent and reasonable evidence of the alleged conspiracy, which includes the defendant, and whether the acts and declarations in question were made in furtherance of the common purpose (see Archbold Hong Kong 2019 para 11-19).

194.  I only agree with the analysis of Mr McNamara that the messages intended to be relied upon by the prosecution against D2 under the co-conspirator’s rule do not meet the test required in relation to those messages between D1 and WLK made before D2 made his utterance on 26 May 2017 for the reason I give shortly.

Messages extracted from Lee’s iphone

195.  As against D2, all those messages listed by the prosecution in the written submission dated 4 March 2019 under headings (1) (2) (3) (4) and (5) are not admissible against D2 as D2’s position was no different from other members of the same WhatsApp chat group who are not charged with any offence.  However, D2’s position changed when he indicated his participation to the joint enterprise at message no. 3759.

(6)  Messages nos. 3754, 3755, 3757, [3759]

•  D2’s message at 3759 is admissible against him as declaration against interest, when read together with the other messages under this heading, in particular, bearing in mind the reference to @Benard and @Mou Chai between message nos. 3755 and 3757.

(7)  Messages nos. 3789-3791

•  All admissible under co-conspirator’s rule.

(8)  Messages nos. 3951, 3952, 3956, 3957, 3959, 3960

•  All admissible under co-conspirator’s rule.

(9)  Messages nos. 4006-4008, 4010-4014

•  All admissible under co-conspirator’s rule.

(10)  Messages nos. 4015-4016

•  All admissible under co-conspirator’s rule.

(11)  Messages nos. 4148, 4156

•  All admissible under co-conspirator’s rule.

(12)  Messages nos. 4185, 4186, 4189, 4191, 4192

•  All admissible under co-conspirator’s rule.

(13)  Messages nos. 4195 – 4197

•  All admissible under co-conspirator’s rule.

(14)  Messages nos. 4198-4201, 4203

•  All admissible under the co-conspirator’s rule. Further, note that at 4203 D2, in response to D1’s description of what was happening to the deceased, at 23:06:16, said “KT now” which the jury can infer to mean D2 was at Kwun Tong at 23:06:16, which is an admission by D2 and another piece of independent evidence as to D2’s participation in the joint enterprise.

(15)  Message no. 4205

•  This is an audio message from D1: hey Benard, if on the hill you see anyone hiking, jogging and such, you report over here. This is admissible against D2 as D1 was instructing D2 to act in pursuance of the joint enterprise.

(16)  Messages no. 4206

•  Admissible under co-conspirator’s rule.

(17)  Messages nos. 4210-4214

•  Admissible under co-conspirator’s rule, in particular when D2 messaged “Ok” and “k” indicating his acknowledgment of what had been said by D1 and WLK.

(18)  Message no. 4215

•  This is an audio message from D1 to WLK: Meow, wait a bit longer we are still packing stuff, cleaning stuff. The contents of this message indicated that the joint enterprise had completed and they were tidying up.  The co-conspirator’s rule is no longer applicable so this is not admissible.

Messages between D2 and D3 extracted from D3’s HTC phone

(1)  Messages nos. 49, 52

•  All admissible against D2 as declaration against interest, in particular with reference to his assertion that he would take part in the joint enterprise (at message no. 3759 on Lee’s iPhone).

(2)  Message no. 62

•  Admissible against D2 as declaration against interest, in particular with reference to his assertion that he would take part in the joint enterprise (at message no. 3759 on Lee’s iPhone).

196.  As to the messages extracted from the WhatsApp Group from D3’s HTC phone between March and April 2017 (ie before Lee became a member of the Group in May 2017, so not shown on Lee’s iPhone) listed by the prosecution under headings (1) (2) and (3), I rule these inadmissible against D2.

197.  Even though D2 responded by messaging “yay” at message no. 654 after D1 messaged “so we can fuck him whatever we like in night game”, such an expression is not clear enough to bring these messages under any exception to the hearsay rule, nor can they be used for non-hearsay purpose against D2, as I have already ruled that prior to D2 indicating his willingness to participate in the joint enterprise, D2’s position was the same as other members of the Group and the co-conspirator’s rule does not apply.

198.  I would add here that I agree with the prosecution’s submission regarding the available independent evidence apart from those WhatsApp messages that falls under the principle of co-conspirator’s rule, with the added independent evidence as shown in some of the messages themselves, which I have identified.

Against D3

199.  I will again use the tables prepared by the prosecution in their written submission dated 4 March 2019.  As far as D3 is concerned, the prosecution only needs to rely on the WhatsApp messages extracted from D3’s own phone, whether such messages were in the Group or not.

200.  Save for the messages nos. 8679 - 8685 (which correspond with messages nos. 1369-1375 on Lee’s iPhone which I already ruled inadmissible) I rule all the messages listed by the prosecution admissible against D3 for non-hearsay use.

201.  In coming to my decision, apart from considering Kissel and Lam Tat Ming, I have also considered other cases relied upon by Mr Grounds and Mr Lo.  I don’t think there is a need to go into details of those cases.  The facts of each case differ and I need to consider the circumstances of the present case and apply the relevant principles.  The scenario of the WhatsApp messages made by D1 in a WhatsApp chat group in this case is very different from those cases cited to me: such as betting records on soccer events in a bookmaking case (Oei Hengky Wiryo), or photographs of drugs on a mobile phone in a drug case (Yan Sin Man).  In any event, in Oei Hengky Wiryo, the prosecution did not rely on the truth of the facts contained in those documents.

202.  Mr Grounds, in his oral submission, placed emphasis on the case of Yan Sin Man and submitted that possession of the mobile phone, together with photographs found in the mobile phone showed the same kinds of drugs found at the scene and the evidence showing that the defendant Yan was the subscriber of the mobile phone were not enough to ask the Jury to draw inference that Yan was involved in the drug trafficking activities. It was submitted that the same applies in this case.

203.  I do not agree with the analysis of Mr Grounds.  One very different, and important, factor in this case is that not only there is evidence that D1 was the subscriber of the very number which Lee says was D1’s, there were messages from that very number which Lee identifies as those from D1, with reference to past experience to show that it was indeed D1 who had sent various messages.  The situation is not like that in Yan’s case ‒ possession of a mobile phone with her as a subscriber but only photographs showing drugs without more.

204.  In coming to my decision, I have also considered the submission of Mr Chan and Mr Lam in this respect.  The case of Harper is quite different from the present case.  In that case the appellant was suspected to have travelled on a bus with a stolen Capital Card.  The information that the card had been stolen was entered into the “Lost book” at a local station (which was missing at the time of trial) and that information had been transferred to the computer at the main line station. Evidence was adduced of the printout from the regional computer and an official gave evidence that she had no reason to doubt the reliability of the regional computer.  The trial judge ruled the print-out satisfied the requirement of section 69 of the Police and Criminal Evidence Act 1984 and was admissible.  On appeal the court ruled that that official could not from her own knowledge testify as to the reliability of the computer.  We of course do not have the equivalent of section 68 or 69 of the said Act in Hong Kong.

205.  I have also considered the issue of prejudice.  In my view, WhatsApp messages indicating one’s intention and giving a running account of one’s action and movement are highly probative in this case.  No doubt my directions to the jury as to how to deal with the WhatsApp messages under this two different categories: testimonial and non-hearsay use, is not going to be easy.  However, I do not agree with the defence that the prejudice effect far outweighs the probative value.  I expect, and no doubt I will, receive helpful assistance from counsel when the time comes.

206.  Now, the question of severance.

Severance of trial of D1 and D2 from D3

207.  History of this case showed that this Court was reluctant, at first, to sever the trial of D1 and D2 from D3.  However, this case has evolved dramatically, and totally unexpectedly, from the time this Court made the earlier ruling.  Then, there was no issue in relation to the WhatsApp messages.  The only issue was in relation to the Video-recorded Interviews admissible against D3, which required careful redaction so as not to be prejudicial to D1 and D2.

208.  Now, with my ruling on the WhatsApp messages, it is clear that the amount or quantity of WhatsApp messages the prosecution can adduce against D3 is more than those the prosecution can adduce against D1 and / or D2, with the added complication that the jury will be asked to consider the truth of some of the messages in relation to D1 and D2, but not in the case of D3.  This issue in relation to the WhatsApp messages, together with the additional problem the prosecution will have to face regarding redaction (which may put D3 in a disadvantageous position, if redaction is done), convinced me that the most proper and fairest way forward is to sever the trial of D1 and D2 from D3.

209.  I therefore ordered that the trial of D1 and D2 be severed from the trial of D3.

210.  Having regard to the need to avoid a substantial risk of prejudice to the administration of justice in the present on-going trial, it is ordered that the publication (in any form) of any report of the proceeding concerning the admissibility of the WhatsApp messages and the reason for severance of the trial of D1 and D2 from D3 be prohibited until the conclusion of this trial or until further order.

[1]  Oei Hengky Wiryo v HKSAR (no. 2) [2007] 10 HKCFAR 98

[2]  HKSAR v Lau Shing Chung Simon (2015) 18 HKCFAR 50

[3]  R v Graham Waddon (2000) WL 491456, 6^th April 2000, Westlaw Transcript

[4]  Kissel v HKSAR (2010) 13 HKCFAR 27

[5]  HKSAR v Lam Tat Ming [2000] 2 HKLRD 431

[6]  HKSAR v Yan Sin Man, CACC 367 of 2015

[7]  R v Shepard (1993) 96 Cr App R 345

[8]  R v Cochrane [1993] Crim L R 48 (CA (Crim Div))

[9]  Myers v DPP (1964) 48 Cr App R 348

[10]  HKSAR v Lau Shing Chung, FACC No. 6 of 2014

[11]  R v Harper 1989 1 WLR 441