Is change to PDPA act tied to problem faced with SingPass ID?

This is just my speculation. If it is true, we do have a big problem about the way that decisions are made by people in charge.

Let me explain the issue.

SingPass uses the NRIC as the ID to login. This is a practical approach. There is nothing wrong with using NRIC as the ID.

Somebody must have taken another person's NRIC and tried to hack the password many times.

GovTech decides to block the SingPass account after six attempts, based on the reason - for security.

I suspect that there are many cases of this nature. I do not have any statistics about it. It is just a gut feel.

It must have caused a lot of work to their staff in helping the owners to unblock their blocked account.

This is where my speculation comes in.

To solve this problem, they asked the Privacy and Data Protection Agency (PDPA) to make NRIC a secret and not a publicly used ID.

In my view, and if my speculation is correct, this is the wrong way to solve the problem.

Making NRIC private will cause a lot of problem and cost to the businesses and the economy.

The NRIC should be a public ID. It is an advantage that a few countries have, over those that do not have a national ID. Why throw away this advantage?

What can GovTech do about the unauthorised persons using another person's NRIC to log into SingPass?

They can try to catch the culprit and charge them under the Misuse of Computers Act.

If the offenders know that they are breaking the law, they will not continue it. There are ways to catch the culprits. GovTech can find their IP address and locate them.

I know that it may not be easy. It is not easy to catch a person who has committed a crime either.

If GovTech does not block the SingPass account, they will not face the problem of helping the owners to unblock them.

Is there any risk if GovTech does not block the SingPass account?

No there is no risk. The hacker has failed to break the password after 6 attempts. Even if the hacker tries 1,000 times, he will probably still not get the right password.

Even if he gets the right password, he will not be able to access the account, because there is a 2FA layer that is quite strong.

Of course, GovTech does not want the hacker to try 1,000 times as it will create a lot of load on their website.  But this is a separate issue.

I am sure that they have experts to prevent this kind of abuse. GovTech should just block the access from that device, and find a way to catch the culprit as it is an offense under the Misuse of Computer Law.

I believe that GovTech already has this means to stop this abuse.

For example, it is possible for a mischievous actor to create a bot and just keep trying with random NRIC and password to try to login.

We do not hear of this problem, because GovTech must be able to stop it.

There is no need to block the SingPass account. There is no need to change the PDPA law to stop the use of NRIC as a public ID.

As I said earlier, this is just my speculation.

Tan Kin Lian
Tan Kin Lian

Act against the offender

I publicise my NRIC and somebody misused it. In fact, that mischievous person is committing an offence under the misuse of computer law.

Several people blamed me for publishing my NRIC. They said that I should keep it a secret.

I do not agree. The NRIC should be a public ID to identify a person. It is used in many places. It is accessible to other people.

The correct way is to stop the offense, and to enforce the law.

Let me quote you an analogy.

A wealthy person wears an expensive watch. Someone robs him of the watch.

What do the other people say - oh, the wealthy person deserves to be robbed, because he wants to show off his wealth.

Another analogy.

Someone buys an expensive car. Another person felt jealous and scratches the car.

What do the other people say - oh, he deserves to have his car scratched , because he wants to show off his wealth.

This is the distorted logic of the people who commented that I allowed my NRIC to be known.

I hope that these people think about this issue, instead of launching another personal attack on me.

Tan Kin Lian

Offence to misuse another person's NRIC or email address

Some people think that it is fun to create mischief by misusing another person's NRIC to log into SingPass or to use the other person's email address to register into a mailing list.

They may not be aware that they are committing an offense under the Computer Misuse Act:

It is a crime for the mischievous person to try to access my account.

https://sso.agc.gov.sg/Act/CMA1993

Quote:
Unauthorised access to computer material
3.—(1) Subject to subsection (2), any person who knowingly causes a computer to perform any function for the purpose of securing access without authority to any program or data held in any computer shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a second or subsequent conviction, to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 3 years or to both.
(2) If any damage is caused as a result of an offence under this section, a person convicted of the offence shall be liable to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 7 years or to both.
[21/98]
(3) For the purposes of this section, it is immaterial that the act in question is not directed at —
(a)any particular program or data;
(b)a program or data of any kind; or
(c)a program or data held in any particular computer.

Unquote

This is similar to vandalism. The actor may think that he (or she) will not be caught by vandalising another person's property. But when he is caught and sent to jail, he will regret it.

The best way to stop this misuse and mischief is for the authority to catch the mischievous act and charge the person in court.

We need our law to be enforced, so that people will pay attention to it. If not, it becomes a useless law.

Tan Kin Lian

Tan Kin Lian

Stupid to block the SingPass account after six failed attempts

I want to share the latest information about my NRIC.

One mischievous person took my NRIC and tried to log into my SingPass. He tried six times but could not get through.

What happened?

GovTech, which is the agency responsible for SingPass, blocked my SingPass account and asked me to change my password.

I sent an email to GovTech to tell them that after I change my password, this mischievous person can try to log into my account again and make another six failed attempts to block my account.

It happened to me because I publicized my NRIC.

But this can also happen to anybody who uses the NRIC to apply for a lucky draw, or to visit a public building.

All it needs is for someone to have the NRIC No and make six attempts to get the SingPass account blocked.

There goes our Smart Nation. It is run by people who are not so smart.

I told GovTech - do not block my SingPass account if somebody tries it six times. Let him try 100 times or maybe 1,000 times. Why not just block his attempt using the same device?

If he manages to get the correct password, he still needs to go through my 2FA, which is now converted into my thumb print. This is already secure.

If GovTech is really smart, they will set up a sting operation to find out who is the person who is using another person's NRIC to enter a computer system. It is a crime to impersonate another person under the law.

Anyway, I told GovTech to review their process. The current procedure of blocking the account after six failed attempts is clearly, may I say, "stupid".

Govtech justify their action with this common excuse - for security. I do not see how they can make SingPass by secure by locking out people unnecessarily.

Tan Kin Lian

Retain the passport number on renewal

Someone said that the Singapore's passport number changes every five years with each renewal. This creates headache for many especially those working overseas.

https://tklcloud.com/Feedback/feedback2.aspx?id=1537

Accountant confused with 3M system

An accountant asked for my help. He was hospitalized for 7 days for a fractured ankle in a public hospital. He had to give his credit card.

On discharge, he was told to collect his medicine. He was not told about how much will be deducted from his credit card.

Someone told him that the bill can be paid by insurance and medisave. But he was not told by the hospital how to go about the process.
https://tklcloud.com/Feedback/feedback2.aspx?id=1536

NRIC identify but does not authenticate a person

Someone is worried that a third party who knows my NRIC, email address and mobile No can use my identity for online purchase and for signing petitions.

I replied that the third party will need to make payment for online purchase and to verify an online petition with the email link.

Anyway, the petition will probably be ignored by the party that it is addressed to.

A person's identity needs to be authenticated to have legal effect. A legal document will need to be duly witnessed, usually by a lawyer.

I consider the NRIC to be a unique number to identify a person as a supplement to the name, but it does not authenticate that person on its own.

I prefer the NRIC to be used in public to identify a person and not to be kept as a secret identity.

NRIC is not private

My NRIC is S0579729B. My email address in kinlian@gmail.com. My mobile is 81685845. My date of birth is 9 March 1948 (don't forget to send birthday greetings).

If you use my NRIC to access my SingPass, you need my password and 2FA. If you manage to hack into my account, you can check my health, education and tax record.

But you cannot access my bank account, as it does not use my NRIC.

Don't get caught - you can go to jail.

Why am I posting this? I find that the paranoia about the privacy of NRIC and contact details to be over-blown.

Whenever there is a data breach and the NRIC or contact details are stolen, it seemed to be a big issue. I do not think so.

Democratic systems are falling apart

Many countries with democratic constitutions follow the American or the UK system.

Both systems seem to be falling apart.

Here are my views.
https://tklcloud.com/Feedback/feedback2.aspx?id=1535

WOTC - Complaint over LKY's will

I asked this question in the Wisdom of the Crowd:

Should LHL ask the AG to drop the complaint against LHY's wife over LKY's will?

Here are the responses: (64 Votes)

83 % - The AG should not take up this complaint in the first place, as it is a private matter
16 % - It will be wise for LHL to ask AG to drop the complaint now, to avoid further damage.
2 % - He can't ask the AG to drop the case, as the AG acts independently of LHL.
0 % - LHL should ask the AG to continue the case to show that he is not fickle minded. 

See the pie chart at: 
http://www.wisdomofthecrowd.sg/chart.aspx?ID=1351

WOTC - Reduce inflow of foreign workers

I asked this question in the Wisdom of the Crowd:

Should the govt reduce the inflow of foreign workers?

Here are the responses: (69 Votes)

48 % - We should allow inflow only for a small number of jobs that locals do not want to do.
42 % - The inflow should be reduced to make sure that locals can find jobs that pay adequately.
9 % - With the reduced inflow, employers have to pay higher wages to attract locals to do the work.
1 % - We should continue to allow the inflow of foreign workers to reduce the cost of doing business.

See the pie chart at: 
http://www.wisdomofthecrowd.sg/chart.aspx?ID=1350

Serious flaws in POFMA law

Do you agree that the POFMA law has the following flaws?

a) The Act allows the government to exempt certain people from the law. The government has already taken the decision to exempt ministers. Our law should apply to everybody and nobody, including the ministers, should be exempted.

b) Under the Act, any appeal against the decision of the minister has to be made to the minister in the first place, before it can be sent to the court. There is no time limit required by the minister to reply. The minister can sit on the matter forever, and prevent the appeal from going to court.


c) In other countries, a similar law is passed to address specific problems, such as terrorism and hate news against a racial or religious group. In Singapore, this law is targeted against "falsehoods". We fear that it can be used to restrict criticism of government policies and actions and create obstacles against people who hold different political views.

d) Under this law, any ministers (and there are 20 ministers in Singapore) can make a determination that a news is false and require the news item to be corrected or taken down. We suggest that this determination should be made by the court, rather than a minister. This will ensure that there is consistency in making the determination.

Appoint ministers from outside of Parliament

If we change the constitution to require the prime minister and ministers to be appointed outside of Parliament, it will achieve a significant impact.

Here are the benefits:
https://tklcloud.com/Feedback/feedback2.aspx?id=1534

A bad approach to create a retail electricity market

An elderly woman who lived near me met me at the bus stop.

She said - Mr. Tan, I agree with what you wrote about the retail electricity supply. As an elderly person, I do not know what to do choose my electricity supplier. Why don't the government just get Singapore Power to reduce the electricity price, instead of asking us to look for our supplier. I find life to be very complicated.

I assumed that she referred to my letter published in the Straits Times. I agreed with her.
https://tklcloud.com/Feedback/feedback2.aspx?id=1533

Abuse of power

Someone sent to me a list of happenings that he described as abuse of power in Singapore. He said that the abuse is as bad as what happened during the Najib government in Malaysia.

Here are the abuses:
https://tklcloud.com/Feedback/feedback2.aspx?id=1532

Do not overreach to data privacy issue

Someone said that many people are paranoid about data privacy and over-react to data breaches.

He is not suggested that the data should be freely exposed.

However, if there are hackers who took the trouble and risk to hack into a database and can get access to email address, contact number or NRIC, so what?

What can the hacker do?

https://tklcloud.com/Feedback/feedback2.aspx?id=1531

Wisdom of the Crowd

Vote on these issues
https://wisdomofthecrowd.sg/active_issue.aspx

How to improve the democratic process

I wish to give my views about how to improve the democratic process around the world. I carried out several polls on different questions regarding this process, and wish to give my comments on the results of these polls.

I also like to make special reference to how my suggestions should be implemented in Singapore.
https://tklcloud.com/Feedback/feedback2.aspx?id=1530

WOTC - Is HDB flat a good investment?

I asked this question in the Wisdom of the Crowd:

Is a HDB flat a good investment?

Here are the responses: (61 Votes)

52 % - It should be treated as paying rental in advance, and not an investment.
44 % - It is a bad investment for the long term, as it will eventually have no value.
2 % - It is a good investment for the long term. 
2 % - It is a good investment for the first 30 years only.

See the pie chart at: 
http://www.wisdomofthecrowd.sg/chart.aspx?ID=1349

WOTC - President Halimah's visit to China

I asked this question in the Wisdom of the Crowd:

What are your views about President's Halimah's visit to China?

Here are the responses: (64 Votes)

77 % - It is a wasteful visit as she does not hold any decision making power. 
11 % - It is nice that she has received a good reception from President Xi.
8 % - She should be accompanied by senior ministers of the cabinet. 
5 % - She plays an important role in rebuilding relations with China.

See the pie chart at: 
http://www.wisdomofthecrowd.sg/chart.aspx?ID=1348