Forum: Protect all digital IC data with Singpass passcode

In replying to my earlier letter expressing dismay at the unprotected display of my personal data (name and digital IC) on the home page of the Singpass app, the Smart Nation and Digital Government Office (SNDGO) said that users of the app should safeguard their devices instead (Safeguard phones, devices used to access Singpass, Nov 13).

SNDGO explained that the digital IC was moved to the app's home page "to improve usability". It added: "To safeguard users' privacy, full details are masked, and can be viewed only after fingerprint, face or passcode authentication."

The digital IC displayed on the home page includes a barcode that requires only a tap of the finger, and no further authentication, to access.

This can be captured on the phone camera of any miscreant who chances upon an unlocked device temporarily left unattended.

A cheap barcode reader will yield the full IC number, thus overcoming the masking SNDGO referred to.

A lot of damage can be wreaked online with my name, full IC number and photo.

Interestingly, in a separate letter published on the same day, the Infocomm Media Development Authority warned that "the risk of data breaches must be taken seriously… Organisations must also establish a level of cyber security appropriate for the types of data they have collected. When national identifiers like NRIC numbers need to be collected, organisations must protect them well" (Government uses only personal data it needs to carry out public functions, Nov 13).

I would argue that leaving my national identifier on the Singpass app home page, protected only by the phone's password, falls short of that standard.

Once again, I ask the authorities to remove my name, digital IC and barcode from the Singpass app's home page.

The advantage of "improved usability" simply cannot justify the terrible disruption from unauthorised use of this personal data if stolen.

If removal is impossible, I ask that this personal data be placed behind the protection of the existing Singpass passcode, instead of being left exposed as at present.

Tan Yia Swam (Dr)

Join ST's Telegram channel and get the latest breaking news delivered to you.