SingPass' Facial Verification (PQ Reply by Minister Vivian Balakrishnan)

Increasing need to use SingPass and the discontinuation of the OneKey token

Fourteenth Parliament Of Singapore – First Session For The Sitting On 4 January 2021

Questions

Mr Chong Kee Hiong asked the Prime Minister (a) with the increasing need to use SingPass, what measures are in place to ensure privacy and security for users, especially senior and vulnerable citizens, when they depend on third parties who are tasked to assist them to navigate online services and enter their IDs and passwords; and (b) whether the Government will consider maintaining more alternative avenues, such as physical counters, for the elderly to avail of such services without the need for SingPass as they have difficulty keeping up with the pace of digitalisation.

Mr Gerald Giam Yean Song asked the Prime Minister with the discontinuation of the OneKey token from 1 April 2021, how will GovTech ensure that (a) all residents who do not own a mobile phone will be able to access government e-services using SingPass, given that a local mobile phone is required for the SingPass two-factor authentication (2FA) process; and (b) notwithstanding the introduction of Multi-User SMS 2FA, whether alternative 2FA methods can be provided to enable residents with no mobile phones to login with SingPass independently, without the assistance of a third party.

Answer

Oral reply by Dr Vivian Balakrishnan, Minister-in-Charge of the Smart Nation Initiative and Minister for Foreign Affairs (for the Prime Minister)

We are committed to building an inclusive Smart Nation, one where nobody is digitally excluded.

Members would be aware that the key element for the delivery of digital services is to get digital identity right. In the case of Singapore, our national digital identity is expressed through SingPass.

For the well over 90% of people in Singapore who have access to a smartphone, I think all of you, particularly in this House, would use SingPass through SingPass Mobile. And I would take a bet, that most of us who use SingPass Mobile have forgotten our password, because we depend on the biometric features of our smartphone to not only authenticate but also to act as a two-factor authentication system. So, these two questions really relate to the minority of Singaporeans who do not have a smartphone. You will also recollect that in the old days – I said old because it is quite many years ago – SingPass consisted of a user ID and password. This was not secure enough. Therefore, we introduced a two-factor authentication system.

The two-factor authentication system, the second factor was delivered either through an SMS or through a token – we called it the OneKey token. The challenge with delivering an SMS is that it requires someone to have a phone, otherwise the SMS message with the one-time password will not reach you. Or to use a token. The token will be phased out and the last day of use will be 31 March 2021.

Therefore, these two questions relate to the small minority of people without a smartphone, without a mobile phone and for whom, the use of the token as a second-factor authentication will not be available from the first of April this year.

I want to emphasise, that when we design our digital services, we design them to be accessible, secure and convenient. We therefore have to have this assurance that after 31 March this year, these services will continue to be available for everyone just as they have been today.

So let me explain how we are adapting our system. The first thing is, many Members of this House may not be aware of this new system we have rolled out called facial verification. This allows users who do not have a mobile phone to log into the SingPass system without the help of a third party. And they do so by using an Internet-enabled computer with a web camera, webcam for short. The webcam allows the computer to scan your face, the system then verifies that against the biometric information that the Government has on all of us through ICA. That means, it verifies against the face on record that we use for Identity Card or our Passport. This allows people to log on and to authenticate to SingPass even if they do not have a smartphone. But that requires a webcam.

So, the next supplementary question you would ask, what about those who do not have access to a computer with a webcam? The answer is that if you do not have access to such a device, you can access it through kiosks which the Government has rolled out at selected public locations. These locations include all CPF Service Centres, IRAS Taxpayer and Business Service Centre, Our Tampines Hub's Public Service Centre, Geylang East Public Library – I am just going through a list but this list is going to keep expanding. So, in other words, even if you do not have a computer with a webcam, do not worry there is still a physical counter which you can access.

The next point I would make, is that the other modification we have introduced is what we call Multi-User SMS two-factor authentication, in which users can opt and nominate to have their SMS one-time password sent to another SingPass user who has a mobile phone. This allows a resident – remember without a smartphone – without a mobile phone, to continue to access services with the help of a trusted family member. For this mode to work, obviously, the key word is trust. And our system has to make sure that it also protects privacy and security.

Now, how do we do that? Before the nomination of a trusted party is activated, there is a strict process for us to ensure that we have verified identities of both persons, the nominator and the trusted party, explain to them the use of these and to obtain – very importantly – obtain consent. I would also emphasise that the person who is nominated would only get the one-time password. That person does not have access to the services which the actual user is logging on, does not have access to the information or the transactions that the actual user is transacting in.

The next point is that we will provide help for all those who need it so that they will always be able to have access and skills for an increasingly digitalised environment. Basically, we have to put our money where our mouth is and ensure that no one is excluded simply because of lack of resources. For instance, we have the Home Access scheme, which subsidises broadband connectivity and a smartphone or a tablet for lower income households – especially focused on low-income seniors. Our low-income seniors can go to a SG Digital community hub to apply for support under the Mobile Access for Seniors scheme, which offers eligible seniors a subsidised smartphone and a mobile plan. The subsidised smartphone starts from as low as $20, the mobile plan from as low as $5 a month. And I am sure if someone cannot afford that, if they see their local Member of Parliament, we will find ways to help people. So, do not worry about access to equipment or devices.

But actually, the greater challenge is skills – digital skills and that is why we have the SG Digital Office, which is supporting seniors to pick up these skills, including the most important skill – how to use SingPass Mobile. And again, if you have observed the digital clinics in our community clubs, you will notice that that is almost 101, the first lesson which is provided. For those who need it, we will also provide in-person support at the 55 SG Digital community hubs at our community clubs and libraries islandwide and at PA's Tech Connect initiative and Integrated Public Service Centres.

Finally, for those who truly require a physical means to access public services, we will make sure that physical counters remain available.

Whilst the Government is working towards the digital delivery of all Government services, we will also ensure that everyone always has access to all these services.