Josephine Teo
Singapore
“The Government's risk-calibrated approach to data security in artificial intelligence (AI) systems was explained in a written reply, given on 9 January 2024, to related questions asked by Dr Tan Wu Meng and Mr Gerald Giam.”
“Access to frontier models is helpful for specific use cases, such as advanced research and cybersecurity. However, these form a small proportion of artificial intelligence (AI) demand. For most industry, Government and research uses, capable models are already available.”
“The Government tracks the development of technical standards for identifying artificial intelligence (AI)-generated content, including watermarking and digital provenance approaches, as part of broader efforts to manage AI-related risks.”
“Upon receiving a valid report of intimate image abuse, the Commissioner of Online Safety is empowered by law to direct Online Service Providers (OSPs) to disable access by Singapore users to the specified harmful online material. This direction may be extended to cover identical copies found on the platform.”
“The Government is committed to keeping children safe online. We have announced plans to extend age assurance requirements to designated social media services, including requiring platforms to keep users under 13 off their services.”
“Under the Online Safety (Relief and Accountability) Act 2025, the Commissioner of Online Safety is empowered to issue directions to platforms to remove specified harmful content, including intimate image abuse.”
The complete record
Every one of 2,900 lines we hold for Josephine Teo, in date order, each linked to its source. Free to read, in full, without an account. Page 12 of 58.
“A composition framework is therefore necessary, and is already practised in established jurisdictions like the US, the UK and New Zealand. On the provisions for buses to also collect advance passenger information, let me assure Mr Desmond Choo, Mr Derrick Goh, Ms Poh Li San and Mr Yip Hon Weng that no timeline has been fixed. ICA has been engaging bus operators since July 2022, and will continue to do so before firming up any plans to collect such information. Similarly for the NBDs, raised by Mr Desmond Choo and Mr Yip Hon Weng, we will continue discussions with the operators to find a practicable way forward before proceeding. It is premature to go into details but in the event of non-compliance, ICA intends to make a holistic assessment of the facts of the case before deciding whether to prosecute. The offence of failing to comply with NBDs will likely be compoundable; and this can be provided for in subsidiary legislation. Mr Murali Pillai and Mr Yip Hon Weng asked about public transport operators such as SBS Transit. The Bill specifically excludes public bus operators from the submission of advance passenger information or to comply with the NBDs. This is because tickets are not being sold in advance and advance passenger information thus cannot be collected for ICA’s screening. Mr Desmond Choo also asked for data on undesirable travellers transiting through our checkpoints. Prior to the COVID-19 pandemic, there was a monthly average of 110 undesirable travellers denied entry into Singapore. With an NBD regime, we could keep such undesirable travelers from even coming to Singapore, especially those who pose a high security risk. Transport operators such as the airlines could also save resources from having to repatriate these travellers.”
“For manual clearance, immigration officers are trained to conduct facial checks to ensure that the person is the rightful holder of the passport. For those undeterred and caught, we will deal with them firmly. Between 2020 and 2022, there were 38 cases prosecuted in court involving the use of false passports or travel documents. The risk of entry approvals being wrongly granted, which Mr Shawn Huang asked about, is no higher with the NCC than with the current system. Moreover, ICA and HTX will conduct thorough end-to-end testing for any system changes before deployment. Sir, Mr Yip Hon Weng asked about the impact of ICA’s shift to the use of digital permits and passes to verify immigration status. Since February 2023, ICA only issues digital Long-Term Passes. Individuals no longer need to visit ICA to collect the physical card, nor run the risk of losing or damaging it. ICA will not issue new physical cards for Long-Term Pass Holders but previously issued cards will remain valid until they expire or are cancelled. ICA will digitalise other pass types in due course. If an individual does not have a smart electronic device to display his digital permit or pass, he can enlist the help of family members to access the digital documents from ICA’s e-Services and print a copy to be used at our checkpoints. As such, we do not expect the digitalisation of passes to cause congestion. Next, I will go on to ICA’s future-proofing initiatives. Mr Derrick Goh asked about the root cause of non-compliance by airlines in submitting advance passenger information. From ICA’s experience, it usually boils down to tardiness. Without being able to screen incoming travellers before their arrival, immigration clearance will be slower.”
“ICA will audit CAG’s compliance and conduct regular checks on CAG’s systems. As for the questions Mr Gerald Giam and Mr Vikram Nair raised, whether such data will be shared with other governments or foreign airport operators so as to facilitate immigration clearance for Singaporeans abroad, for security reasons this is not yet on the cards. Members will be reassured to know that ICA itself must also comply with data protection provisions set out in the Public Sector (Governance) Act and the Instruction Manual 8. It will retain traveller data only for the period necessary for immigration processing, analytics or investigation. Once these tasks are completed and ICA no longer needs the data, they will be de-personalised and properly deleted. In the unlikely event of a data breach, ICA and HTX will immediately conduct investigations to stop the breach, trace the extent of the breach, and prevent further breaches through remediation measures. On top of that, system vendors are obliged to adhere to data protection, cybersecurity and breach procedures as part of their contractual obligations to ICA, and must extend full cooperation and assistance to ICA at no additional cost. Whether with analogue or digital systems, a determined criminal may still try to breach immigration controls. ICA will deploy monitoring tools to constantly check on its systems. They are equipped with the capability to detect impersonation and forged or tampered passports presented for clearance. Mr Gan Thiam Poh will be glad to know that the more recent use of multi-modal biometric clearance systems has in fact resulted in better detection of individuals seeking to impersonate others.”
“To Ms Poh's query, only Singapore-registered companies can undertake IT projects related to ICA. All employees of vendors undergo a compulsory security screening exercise and must be cleared before they are allowed to work on the project. They are bound by a non-disclosure agreement and may be held criminally liable for any wrongful or unauthorised communication, possession or use of information under the relevant laws such as the Public Sector (Governance) Act. To uphold high standards of cybersecurity, HTX also carries out independent Vulnerability Assessment and Penetration Testing exercises prior to commissioning and annually thereafter. This complements the regular audits by ICA to identify and address vulnerabilities. I hope Mr Vikram Nair will be reassured to know that ICA will also deploy more advanced scanning technologies and sensors to automate security checks for vehicles. Additionally, AI will also be used to strengthen detection capabilities for cargo. These assurances are relevant for both cyber and data security. The Minister’s approval is required for access to and disclosure of data, and must satisfy the purposes specified in the Act, such as for the enforcement of criminal law, failing which an offence can be made out. In addition, the data will be encrypted and go through secured data exchange gateways. Specific to the biometric-enabled departure journey at Changi Airport that Mr Derrick Goh asked about, the Changi Airport Group (CAG) will be bound by the terms of a data sharing agreement with ICA. It puts the onus on CAG to take all reasonable measures to ensure the data is protected against unauthorised access, use, disclosure, modification or misuse. This includes setting up relevant access controls such as Two-Factor Authentication.”
“To assist seniors who may not be able to provide certain biometrics or who may not be digitally savvy, I assure Mr Gan, Mr Giam and Mr Yip that immigration officers will be on hand to help. The officers can also conduct manual clearance by exception. As immigration clearance becomes more digitalised, ICA is fully aware of its responsibility in ensuring the availability and resilience of its systems. It therefore works closely with the Home Team Science and Technology Agency (HTX) and GovTech to meet reliability and security requirements in upstream design. For example, the next generation Automated Border Clearance System (ABCS) will allow travellers to continue using automated clearance gates if there are any outages. This is possible because they will be equipped with failover capabilities such as UPS or uninterruptible power supply and can still function if the supporting systems such as the online biometrics database is down. Nonetheless, some of the NCC capabilities are novel and highly customised to Singapore's context. Despite our best efforts, disruptions may still happen. Our business continuity plans will then be promptly activated through a combination of measures such as recalling off-duty officers and prioritising traveller clearance according to departure times. This should help minimise service degradation. This is also the careful approach as we undertake the ongoing upgrade of the Multi-Modal Biometrics System (MMBS), which Mr Giam asked about. In addition, ICA monitors systems performance to ensure benchmarks are met. With large systems, external vendors may be involved. ICA and HTX can and will pursue liquidated damages from a vendor if the systems fail to meet the required standards.”
“Mr Speaker, I thank the Members for their thoughtful comments and strong support of the Bill. Please allow me to address their questions in turn. Where digitalisation and automated immigration clearance is concerned, there are three broad buckets of concerns. The first has to do with cyber readiness and resilience; the second on data security; and the third, how we deal with impersonations. Mr Derrick Goh, Mr Desmond Choo, Mr Gan Thiam Poh, Mr Gerald Giam, Mr Shawn Huang, Mr Vikram Nair and Mr Yip Hon Weng asked many good questions. Ms Poh Li San knows the issues particularly well, being deeply involved in airport management. Sir, Singapore will be one of the first few countries in the world to introduce automated, passport-free immigration clearance. Besides Dubai, which already offers passport-free clearance for certain enrolled travellers, we do not know exactly which other countries have similar plans. MHA and ICA will certainly seek to enable more convenient travel for our people but it is likely that physical passports will still be required for many countries outside of Singapore. To prepare for this NCC, ICA has been training its officers since 2020. Mr Choo will be glad to know that as a result, around 4,000 ICA officers are able to take on higher-value jobs in assessment and investigation, using newly acquired skills such as investigative interviewing and profiling. Besides levelling up staff capabilities, the key to a successful implementation of the NCC is universal coverage of all travellers. This requires a willingness to phase out traditional methods of identifying and authenticating travellers. The alternative of running two systems in parallel is not only costly but also cumbersome.”
“The Infocomm Media Development Authority (IMDA) conducts periodic consumer surveys to gain a better understanding on the usage trends of, and satisfaction with, postal services in Singapore. In IMDA’s 2020 survey, 88% of respondents indicated that they were satisfied with the service quality for delivery of letters. In addition to IMDA’s surveys, SingPost also carries out its own customer satisfaction surveys at post offices and through its MyPostman programme. SingPost’s 2022 surveys showed an average score of around four out of five for its post office and postman services. IMDA also regularly monitors SingPost’s compliance with the Quality of Service (QoS) standards through quarterly independent assessments. Through these measures, IMDA will continue to safeguard consumer interest and ensure that SingPost continues to provide a reliable and good quality postal service.”
“There are standards in place across the whole of Government to regularly review security and access controls of all IT accounts, including privileged accounts. The frequency of review of privileged accounts is tied to the criticality as well as sensitivity of the systems these accounts have access to. It ranges from one to three months.”
“NLB is supporting MSF’s efforts to build an inclusive society through the Enabling Masterplan 2030 and continues to collaborate with partners and the disability community to co-create inclusive libraries for all.”
“The National Library Board (NLB) is committed to providing an inclusive environment for all Singaporeans to discover the joy of reading and learning. To ensure the availability of suitable programmes for Persons with Disabilities (PwDs), NLB has curated programmes like Sensory Storytime, and provided relevant resources, such as screen reader-friendly documents and live captioning. One of the newer initiatives launched on 30 January 2023 is NLB’s Accessible Membership, which allows members to enjoy the following benefits: (a) a longer borrowing period for general lending items; (b) a longer renewal period for items that are renewable; (c) free reservation of eligible items, such as books, magazines and audiovisual materials; and (d) priority access to accessible features in Punggol Regional Library. The Accessible Membership is currently open to beneficiaries of eligible disability schemes and services under the Ministry of Social and Family Development (MSF), and students from Government-funded Special Education schools. Ongoing efforts between NLB and MSF will expand the Accessible Membership scheme, starting with those on SG Enable’s Developmental Disability Registry. NLB will provide further updates when ready. NLB will continue to ensure equitable access to library resources, with features that are available to all library members, regardless of whether they have an Accessible Membership. For example, Punggol Regional Library, which opened this year, includes several accessible features, such as an Accessible Collection with books written in Braille, assistive technology devices, Calm Pods and wheelchair-accessible book borrowing stations.”
“Such steps include (a) minimising the amount of customer data that appears in riders’ user accounts; (b) contractually prohibiting the sale or leasing of user accounts; and (c) educating their food delivery riders on the riders’ obligations under PDPA with respect to customer data. If an individual has queries or concerns about how a food delivery company has handled their personal data, they can approach the company’s data protection officer to seek clarification and convey their expectations.”
“This response to Ms Yeo Wan Ling’s question will also address a related question filed by Mr Yip Hon Weng for a Sitting on or after 7 July 2023. The Ministry of Communications and Information works with the Ministry of Home Affairs (MHA) and other enforcement agencies to continually assess the adequacy of our measures to address illegal activity online as well as to protect users of online platforms. Where online activities lead to breaches of the law, for example, sale of food delivery rider accounts leading to illegal moonlighting by foreign workers, or the provision of illegal car-pooling services matched via online platforms, the relevant agencies will not hesitate to take enforcement action against the illegal act. We are also taking steps to strengthen legislation and make clear the obligations of online platforms. For example, MHA has introduced the Online Criminal Harms Bill. If passed, the Bill will empower law enforcement agencies to issue Directions to online services, other entities or individuals when there is online activity suspected to be in aid of criminal offences. The collection, use and disclosure of personal data in Singapore is governed by the Personal Data Protection Act (PDPA). It applies to all organisations, including food delivery companies, and imposes security requirements to prevent unauthorised access, use and disclosure. Enforcement action can and have been taken against those who breach the requirements. Food delivery riders, who are contractors of food delivery platforms, also have obligations on the collection, use and disclosure of data of the customers. Nonetheless, we expect food delivery companies to take steps to help prevent their contractors from selling customer data or sharing them with unauthorised parties.”
“The more we share with our international counterparts, the more we are able to look over the horizon and take steps to raise our own regulatory measures in accordance. The way in which we have introduced regulations for online media, for example, how do we look after safety issues, how do we tackle criminal harms that are being carried out online – and yesterday's new legislation is a good example of this. When it has become clearer what is necessary and useful, I think Singapore's advantage is in being able to move quite fast and that is the advantage that we should try and sustain over time.”
“I would also say that using automotives as an example, it is not just the thing itself, the device itself, the equipment itself, that can have safety features built in. In order to promote road safety, actually, human society figured out that traffic lights are important. We figured out that speed limits are important. But you do not need the same speed limits on highways versus country roads. And then, we figured out that, okay, if you had an ageing population, vulnerable segments of the population, you can do a Silver Zone – well, that is what we do. So, my own sense of it is that, in AI, the equivalent of the seat belts, the air bags, the equivalent of the traffic lights, the speed limits, all these things will have to be built up. And back to the Member's question then about whether there will be a central agency that can be effective in regulating AI, it remains to be seen because we have to understand what the useful regulatory measures are in the first place. Keep in mind that we cannot operate only on the basis of domestic interests. All of these regulations have to inter-operate with our counterparts overseas. Otherwise, our businesses will find it very difficult to meet the requirements when they operate in different jurisdictions. So, international standards, what will be useful, these things will be developed. We will see the emergence of new standards, new certifications and new regulatory frameworks. The approach that we take in Singapore is to try our best to be plugged into as many of these conversations as possible. We will not be the only ones thinking about governance. We are not the only ones.”
“Mdm Deputy Speaker, I think Ms Tin hit the nail on the head when she talked about working with other agencies to understand how AI is being deployed in their respective sectors and also the industries that they oversee and then to identify what should be the right approach in regulating them. If I can give an analogy, when I am asked this question about AI governance, there is no doubt it is happening very quickly and we will see accelerated deployments potentially across many different sectors, but it still takes time to understand fully how the risks present themselves and what to do about moderating these risks. The automobile industry is a very good example. When cars were first made available, their reach was not very wide. People could not afford to buy automotives. Those came a little later. It would probably be the same for AI deployment, too. AI, for example, takes a lot of compute power, so, it is not cheap to implement AI systems. As such, the early implementations will still take time to present themselves. But going back to the example of automotives, it was not immediately obvious to people that what helps to prevent deaths and injuries in a motor vehicle accident would be something like a seat belt. Seat belts came much later. And subsequent to seat belts, then people figured out that having an air bag is quite useful, too. But these kinds of measures, they do not present themselves at the outset. We do not really know what will work. It takes research, it takes a lot of exchange of knowledge and understanding. And then, after a while, we figured out that maybe, seat belts should be made a requirement; maybe air bags should be required as well.”
“We will continue to monitor developments and are prepared to adjust our implementation approach as knowledge and understanding evolves. AI governance is also an area that benefits from more international cooperation. In this regard, Singapore is engaging widely with our international partners through multilateral platforms, such as the Global Partnership on Artificial Intelligence (GPAI). As the upcoming Chair of the Fourth ASEAN Digital Ministers Meeting (ADGMIN), Singapore hopes to work with fellow ASEAN member states to develop an ASEAN Guide on AI Governance and Ethics. In addition, we are engaging other like-minded partners, such as Israel, the Republic of Korea and the UK, with whom we have signed Memoranda of Understanding (MOUs) to cooperate on AI and emerging technologies. With the US, we have been partnering their National Institute of Standards and Technology (NIST) to advance our alignment on AI governance.”
“Mdm Deputy Speaker, I thank Ms Tin for her question. Singapore supports the responsible development and deployment of artificial intelligence (AI) to unlock its transformative potential on our economy and society. Our governance approach is a practical and risk-based one, as explained at the Sittings of 21 April 2023 and 9 May 2023. AI is fast becoming a general-purpose technology that is applied across many sectors and use cases. We cannot and should not adopt a one-size-fits-all approach to regulate it, nor is it realistic to address in advance every risk out there. Nonetheless, the Government hopes to see AI deployed in a responsible and ethical way, aligned with international norms. The Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC) have several initiatives to guide the development and deployment of AI. In 2019, PDPC published the Model AI Governance Framework to turn AI ethical principles into implementable business practices for companies to safely deploy AI solutions. IMDA has open-sourced AI Verify, an AI governance testing framework and software toolkit. It strengthens trust by enabling objective validation of a company’s implementation of responsible AI. It is, however, a minimum viable product that we hope will grow over time. Later this year, PDPC will be issuing Advisory Guidelines on the Use of Personal Data in AI Systems to provide guidance on how the Personal Data Protection Act will apply to the collection and use of personal data in AI systems for decision-making, predictions or recommendations. These initiatives have been noticed and commended by our international and industry partners as practical steps for thinking about how responsible AI developments can be implemented.”
“Sorry, Mdm Deputy Speaker. I did not answer one part of the question. Are we requiring them to do that? I think I have to remind Members that we did not have a funding relationship with them before the period that was being investigated by the ARC. What reason do we have to ask for an investigation of that nature? But going forward, henceforth, that is where the accountability has to be very clear.”
“Mdm Deputy Speaker, the ARC's report is public except for the redaction of names of individuals as well as companies. I have no more information to offer to Mr Tan other than what he is able to access from the public records. It was asked by the Board to meet a set of terms of reference. The intention of the Board was to establish the scale of the circulation numbers being overstated. I am not aware of the terms of reference asking for the ARC to investigate the matter before September 2020. I am not aware of them being asked to investigate the goings-on before that. So, therefore, myself, what I can share is that, from the report, I did not see them making conclusions. I did not see them drawing conclusions for the period before that.”
“Mdm Deputy Speaker, the findings have only been made available recently. As to whether the other agencies intend to take regulatory action, this is something for them to decide and I cannot answer on their behalf.”
“I thank the Member for his suggestion and we will certainly share it with SMT so that they can take it into account.”
“In other words, SMT is well aware that it is one thing to tell people what the findings are; it is quite another to commit to making improvements. And the improvements in governance essentially are to do three things. It is to make sure that bad things do not happen again; it is to ensure that your systems for controls and contracting, pricing have to be cleaned up, made better; and the other aspect of governance that needs to be improved is also the culture – how people view these kinds of things and their willingness to tolerate them or to speak against them. MCI takes all of these matters of accountability seriously. SMT knows it at the Board level as well as the management level. They know that in the reviews that we will be conducting as a part of this funding arrangement, this topic will consistently come up. And we will have to satisfy ourselves that the remedies have been implemented and effort is being made to sustain trust by the public.”
“Mdm Deputy Speaker, I thank Ms Soh for her question. It is a very good one. In my engagements with SMT, they are themselves equally concerned if the level of trust that is ascribed to them by the public suffers a loss as a result of this incident. I believe this is a key consideration why SMT has taken great pains to ensure that it has undertaken a full and thorough investigation. It took pains to make the findings public; it took pains to be quite careful about whether there was a potential offence to have been committed and they decided not to take any chances but, instead, to file a Police report. So, the seriousness of this incident and its potential impact on the levels of trust that the public has in SMT and its titles, are not lost on its Board as well as the management. There is another matter that MCI would be equally concerned with and SMT knows this. Henceforth, SMT is in receipt of public funding. Therefore, its ability to be held accountable will be carefully scrutinised, both by MCI as well as by the public. This accountability in relation to funding will include the extent to which SMT has been successful in its transformation, especially towards digital media. It will also be held accountable for maintaining trust. Therefore, the measures that the Member talked about, not only will MCI track, SMT itself will be interested. We will rely on independent reports, such as those carried out by Reuters Institute, but we will also have our own studies to confirm what these independent resources have established as findings. Accountability to the public also extends to improving governance. If you look at the media reports and also in the ARC's findings, there is a significant portion of the reports that cover governance measures.”
“Mdm Deputy Speaker, I believe Mr Leong may not have been in the Chamber when I addressed his first question. I can confirm that the Government started disbursing funds to SMT in March 2023. At the time, the ARC had not completed its findings. But the important point to note is that by March 2023, only then, funding arrangements with SMT started, whereas the events in question took place well before March 2023. So, I hope that answers the Member's question. The second question is whether there will be further action taken against those who had been involved in this incident. That is a matter for the Police to decide. A Police report has been filed. The Police have commenced investigations. The investigations will have to take its full course and then a decision will be taken.”
“Mdm Deputy Speaker, at this point, we will not be at liberty to disclose the full range of the Police's investigations. Are they specifically looking to establish liability in the context that Mr Giam described? That is for the Police to decide. On the Member's second question on accountability to the donors and the other parties that made resources available to SPH Limited, the purpose of making full disclosure on the findings is precisely to allow these entities to decide if they want to take further action. So, they can, if they choose to. It is not for us to decide on their behalf.”
“Mdm Deputy Speaker, as I explained in my response to the Member Mr Ang earlier, the thrust of the funding is directed towards talent development, technology upgrade and sustaining vernacular media. We expect that some of the funding will be needed for general purposes. These measures that SMT needs to take obviously require some resource allocation on their part, both in terms of the manpower as well as the management bandwidth. We expect them to manage within the block of funding that is provided to them. As far as possible, we size the funding according to the needs that are most pertinent to successful transformation. Strengthening governance is certainly a big part of it, but we also expect SMT to allocate its own resources accordingly. So, for the time being, there is no specific intention to ring-fence resources for improving governance, but to expect SMT to direct resources towards improving governance. That is part of the expectation.”
“The KPIs, therefore, that we have included in the funding arrangement include the total reach and engagement of SMT's full range of products, with a focus on their digital platforms, because we have to keep in mind that the whole purpose for funding SMT is to ensure that the digital transformation is successful. Therefore, the KPIs must be reached, and, in particular, digital reach. We will, in fact, also ask for specific reach indicators for vernacular groups and youths, because the funding is directed mainly in three areas: the technology upgrade; the talent development, building up the newsrooms; and, very importantly, in terms of how vernacular media continue to be safeguarded. Therefore, the KPIs follow the thrusts of our funding objectives. SMT is required to submit regular reports on their KPI performance, which must also be independently audited, as I mentioned earlier. And if the KPI targets are not met, the amount of funding will be impacted.”
“Mdm Deputy Speaker, I thank the Member for his two questions. Maybe I will take the second question first. Mr Ang had asked why were the names of the companies and the staff who were involved in the potential wrongdoing not made public. As Members will know, the matter has been referred to the Police for investigations. SMT has provided all the findings that the ARC submitted to the Board and this full set of findings would have already been made available to the Police. They include the names of the companies and the people involved. So, as far as the ARC's findings were concerned, the Police have full view of it. Nothing that was provided to the Police was redacted. Because it is an ongoing investigation, as to who will eventually have to be held liable under the law, these things will need to take their natural course. It is for the relevant authorities, after they have completed their investigations, to determine what information to publicly disclose and when to do so, so as to not affect the outcome of their investigations. That will be something that has to be left to a later date. Mr Ang asked specifically whether circulation is part of the KPIs. As I explained to Members in February 2023 during the Parliament Sitting and in response to Members' questions, and as I have also alluded to earlier in my response, circulation is a metric that is no longer as relevant. A title that is being circulated in print today can be read by multiple people. And as media move more and more online, it is not so much the circulation that matters. It is the reach. The reach measures how often people come into contact with the contents of a particular title. So, it is reach that is more important.”
“In this regard, we have built in safeguards that allow the Government to conduct our own ad hoc audits. If serious wrongdoings are found, we have the right to terminate funding. MCI will also be reviewing the terms of the funding agreement, including the KPIs and funding quantum, at the mid-term juncture. SMT's ability to address these management issues will be taken into consideration. Madam, I have updated Members on what I can. The outstanding matter of the Police investigation should be allowed to take its course. At its conclusion, the follow-up actions will also be made public.”
“This point has often been overlooked. This whole set of findings arose out of SMT's own internal review, which no one in particular asked them to do. They themselves felt it was important to start on a clean slate. SMT has assured us that it intends to follow up on the ARC's recommendations to ensure organisation-wide accountability and to bring the organisation forward. We welcome the plans SMT has set in motion, including instituting internationally accepted benchmarks and extensively reviewing its governance and control measures. This is an ongoing process and MCI will work closely with SMT to ensure these measures are implemented. To Mr Murali's question on reporting standards, the key point is to ensure reports are consistent with international best practice. It is in SMT’s own interest to uphold reporting standards, with or without regulation. Ms Tin and Mr Zhulkarnain asked if we will impose additional safeguards, and Mr Leong asked if we would put in key performance indicators (KPIs) evaluating SMT's improvements in risk management and controls. To assure Members, the funding agreement concluded in March this year already contains measures to ensure accountability, for example: (a) SMT is required to submit specific information on KPIs, including their methodologies and sources. These must be agreed upon and SMT is not allowed to change them without MCI's consent; (b) SMT's KPI performance and financial statements must also be audited by independent external auditors. However, the evaluation of and improvements to internal processes are clearly the responsibility of SMT's executive team. The Government will intervene if there is a case of misconduct or mismanagement of public funding.”
“Yet, revenue streams are a fraction of what they were in the heyday of print media. Advertising revenue has been squeezed, with a large share going to platforms run by Big Tech. Growing subscription revenue in a world of free news is also challenging – only 15% of Singapore readers surveyed by Reuters Institute are willing to pay for it. The challenge is even more pronounced for vernacular publications, which have smaller readerships. Yet, it is critical to preserve them. They are an essential part of our multicultural society and unique identity and give voice to our ethnic communities. The Government's funding is, ultimately, to fulfil a public good – that of trusted news media enabled through quality journalism. MCI is committed to working with SMT to overcome the challenges of disruption and succeed in its transformation. Therefore, to Mr Yip Hon Weng and Mr Leong Mun Wai's questions, the Government will continue funding SMT at the amounts we committed to. This does not, however, mean that we have no additional expectations of SMT in light of this incident. We acknowledge their seriousness in investigating the concerns and for making the findings public. As it is now a matter for the Police to consider, we should turn our focus to making sure SMT will discharge its public duties responsibly on an ongoing basis. At the leadership level, the SMT management and board have demonstrated commitment to changing legacy practices. We expect SMT to persist in addressing internal weaknesses and systematically follow up on the required changes. Members will recall that the circulation data issue emerged because SMT was conducting its own review and due diligence following the transfer of the media business from SPH Limited in December 2021.”
“This leads me to the third set of questions that Members have asked: whether this affects the Government’s funding to SMT. The Reuters Institute Digital News Report is published annually and its 2023 edition released last month is a timely reminder why funding support for mainstream media remains necessary. Even with dozens of news sources easily available, audiences in Singapore consistently turn to our mainstream media when they need something they can trust. Specifically, trust levels in all the SMT’s major titles remained much higher than the global average – 73% of respondents expressed trust in The Straits Times, up three percentage points from last year. This is against the backdrop of the erosion of trust in news globally, from an already modest 42% last year to 40% this year. Trusted news media made possible by quality journalism is a public good we cannot afford to compromise on. It is more important than ever when the environment is full of disinformation and sensationalised news. However, SMT can only deliver quality journalism if they can continue to strengthen their capabilities and reach audiences in the digital age. Media consumption has moved online rapidly, disrupting the entire industry. In the same report by Reuters Institute, the share of respondents who consume print news has dropped to 22%, from 53% just six years ago. SMT must move decisively into the online space. But the new competencies take time to build and the economics of news media in the digital era do not make it easy for newsrooms to survive, let alone fund new investments. The costs of running a professional newsroom remain high, and data and technology infrastructure require substantial upfront costs.”
“She asked if NLB had been a subscriber of SPH Media’s publications. The answer is yes. NLB’s subscription provides its members with access to various titles published by SPH Media. Neither the subscription rates nor members’ access are related to circulation numbers. There is, therefore, no impact of any kind. Members Ms Jessica Tan and Ms Tin Pei Ling asked how SMT will take up the ARC’s recommendations. SMT has shared with the Ministry of Communications and Information (MCI) that its follow-up is in three main areas. One, they will benchmark their reporting to international standards. They are commissioning the World Association of Newspapers and News Publishers (WAN-IFRA) to review and advise on their methods for measuring the reach of various titles. These are the metrics that the public, businesses and the Government will be concerned with, to know how many people come into contact with a title’s content. Two, SMT will improve internal controls, including tightening deal structure and pricing approval procedures, such as requirements for approvals at the appropriate levels; strengthening guidelines and checks for revenue and cost recognition; improving separation of duties among staff to ensure data accuracy and accountability; and commissioning external parties to review its governance, control and compliance measures, with the aim of embedding the enhancements into a new enterprise resource planning system. Three, SMT will enhance its risk management practices throughout the organisation and review its risk culture. SMT has assured MCI that they will implement these measures immediately and will provide us with regular status updates on a half-yearly basis.”
“First, the overstatement of circulation numbers amounted to around 82,600 average daily copies at August 2021. This is around 10% of overall circulation of their main titles. The ARC did not find any evidence of the involvement of the journalism and editorial departments. Second, the ARC found that the accounting impact was not deemed to be material to the financial statements of SPH Media Group for the financial year ending August 2022 taken as a whole. For the financial year ending August 2021, there was approximately S$110,000 in understatement of profits. Third, there were possible offences committed, based on several findings. Circulation numbers had been reported in a manner inconsistent with established standards, there was improper accounting of revenue and there was a barter deal which was possibly a questionable arrangement, entered into for the sole purpose of inflating circulation numbers. Consequently, the ARC has recommended that a Police report be filed and the Board has done so. To Mr Murali Pillai and Mr Ang Wei Neng’s questions on the specific offences being considered, I am unable to give further details as this is now an ongoing Police investigation. Ms Tin Pei Ling asked whether the overstated circulation figures and consequent financial impact have been corrected. After SMT was formed in December 2021, it began internally reviewing the data it took over and rectified the inconsistencies detected. Its accounts since its first financial year ending August 2022 no longer have these inconsistencies. As for the period before SMT was formed, these findings have been made public and further actions to deal with the erroneous figures are matters to be decided by the relevant parties involved then. Ms Hany Soh filed a related question for a future Sitting.”
“I will also address the Question filed by Ms Hany Soh1 for a future Sitting. Madam, Members have asked for updates on the SPH Media Trust (SMT)'s review of overstated circulation numbers, which covers the period of September 2020 to March 2022. Madam, in the February 2023 Sitting of Parliament, Members had asked a range of questions on this matter. In response, I made three key points. The first is that the events took place before SMT was formed, when the media business was under SPH Limited (SPHL), a privately listed company. The second point is that whatever happened had no bearing on public funds, because the Government did not have a funding relationship with SMT before the end of 2022. For avoidance of doubt, the first tranche of funding was disbursed in March 2023. In other words, the events preceded the period of funding. No public funds had been involved. Correspondingly, the question of loss of public funds does not arise. Third, I explained the Government’s reasons for funding SMT’s transformation, which had little to do with circulation. Nevertheless, the Government made it clear that it expected SMT to properly investigate the matter and to give the public a proper account. SMT’s Audit and Risk Committee (ARC) has since concluded its investigations and its findings have been extensively reported. My update to Members will, therefore, focus on three areas, namely, the ARC’s findings; what SMT will do to address the underlying issues; and what the Government will put in place to ensure public funding to SMT remains prudent and accountable. Let me first deal with the ARC’s observations. As Members will have read in media reports, there were three noteworthy findings.”
“Mdm Deputy Speaker, may I seek your permission to take Question Nos 2 to 9 in today’s Order Paper?”
“But I would encourage Members to watch out for when the draft codes are actually published. At that time, you are certainly welcome to give your views. 4.08 pm”
“Mr Deputy Speaker, there are essentially two areas of interventions that could be very helpful. First, you must be able to catch the perpetrators. One of the difficulties of many of these platforms is that your identity can be shielded. In fact, the platform does not really know who you are. So, one of the requirements of the codes of practice – I say this with the caveat, and I hope Members understand this – the codes of practice have yet to be published, even in draft form. I do not want to give the impression that this is what has been decided. But one of the potential and, I think, a very useful area of intervention has to do with account verification. Who is actually behind the account? Who is operating the account? We may impose certain requirements through the code on service providers in determining a user authentication process. That is one area of intervention that could be fruitful. I mentioned this in relation to the TSR. The TSR gives you a broad sense. You could think of the TSR as something that we have put out on a voluntary basis. But if you introduce a code of practice, then you are essentially saying to service providers that you now need to introduce these measures. The other probably useful intervention is in terms of requiring some confirmation that the good has been received before the money is released. Mr Yong talked about an escrow account, but that is not the only way in which you can assure the buyer using any particular platform, any e-commerce platform, that he has not been deceived. In other words, he makes a payment. The payment is held on his behalf. Only upon his confirmation of the receipt of the goods is the money released to the purported seller. These are two broad areas of interventions that could be helpful.”
“Technically speaking, SMS is not anything that is offered online. If we apply the strict definition of an online scam, SMSes are not strictly covered. What you have described as SMS redirection, we have dealt with it earlier at two levels. Firstly, at the network level, there were possible gaps – vulnerabilities that allow for such kinds of messages to be intercepted. That gap has been plugged. What you described as SMS interception very often refers to victims unknowingly giving up their credentials. The two are different. If it is a technical issue, the gap has been plugged. If it is a matter of individuals being tricked or being deceived into giving up their credentials, then that is quite another matter.”
“Sir, the answer to Mr Giam's first question is yes, but I also must caution Members against becoming overly comforted by the idea that even a website that is blank for now, but looks like it could be used, will be or can be blocked under the law. These websites can be spawned in the millions. It is very easy. There are so many permutations that the scammers can think of. As much as the Police would like to be able to shut them down, I must caution that we do not expect that they will all be eliminated. Second, I think in terms of WhatsApp, WhatsApp has end-to-end encryption. So, you and I actually can report a user who makes contact with us. Any message that you receive from an unwelcome party, you can make a request to the service provider, and the service providers have their own policies as to whether it is blocked or not. As to the question of whether the levers within this Bill can apply to WhatsApp – yes, if we believe that there is an underlying offence that is being carried out and there is some indication as to how it is being perpetuated through this particular communication service. The answer is yes. On SMS redirection – I am afraid I am not very clear about the nature of the Member's question. Perhaps I could trouble him to explain it to me a little bit more.”
“We will continue to improve the product to make it more robust and make it easier, as you say, for people to report the scams and to as best as possible, try and block the verified scam callers, as well as content. But I must caution that our developers are mindful that we do not go beyond what people expect of privacy protection. So, that is them exercising a degree of self-restraint. In discussing such issues with my colleagues from other jurisdictions – I shall not mention where – where the population is much more accustomed to a far higher degree of surveillance, yes indeed, some of these measures can go a lot further. I am mindful, and I think Members have continued to remind us that there is only so much you can do and there are certain thresholds we should not cross. Mr Deputy Speaker, I thank the Members for their support of the Bill. It is another important step towards creating a safer online space for Singaporeans. It complements existing efforts to act more effectively against online criminal activities, through partnerships with our people, the Government and industry. Mr Deputy Speaker, I beg to move.”
“SPF also works closely with the Cyber Security Agency (CSA) and the IMDA to develop joint cybersafe materials and participate in public events to share the materials with members of the public. Some examples include the Digital for Life Festival organised by IMDA and the sharing on the safe use of the internet by IMDA's Digital Ambassadors with seniors in particular. I know this is a group that Mr Yip is particularly concerned about. Mr Deputy Speaker, I believe I have covered most of the ground. I have on my notes here points that were made by Mr Giam with respect to calls. I think he said that shutting down websites is one thing – what about calls? Actually, the topic of whether calls should be blocked has been covered separately. I think in previous updates on anti-scam measures, we had talked about the fact that IMDA implements call blocking on a very wide scale. If my memory serves me right, as recently as February or March, I think we updated the House that upwards of 55 million calls are blocked every single day right now. That is just how many you have. It is either every single day, every single week or every single month; any way, it is 55 million – a big number. Calls are not the primary target of this Bill. Calls are an important way in which scammers reach their victims and we have taken active steps to block them. I can update the House that IMDA is seriously looking at giving phone users the option to block all international calls, which is primarily how scam calls get piped through. That is something in the works, and I hope to be able to give Members an update in the not-too-distant future. I thank Mr Giam for his acknowledgment of the value that the ScamShield brings.”
“Mr Yip asked how we would deal with attempts by members of the public to circumvent the Directions. The Government will do its best to protect the people in Singapore by preventing online criminal content and activities from reaching them. However, if individuals choose to circumvent these protections and use VPN or other means to access dubious content sources, they do so at their own risk. We cannot protect people who deliberately avoid the protection. Mr Yip, and I believe, Mr Giam, also called for greater efforts to educate the public and to sensitise them to the threat of online harms. We fully agree with them. The Police have worked with several stakeholders to educate the public and raise awareness on scams. Some of these initiatives include proactive dissemination of information and advisories on scams and sharing of successful prosecutions on a regular basis; e-shoppers on watch interest group, collaborations with e-commerce platforms such as Shopee for the interactive in-app anti-scam quiz and collaborations with retailers such as Gardenia, iJooz and Canadian Pizza to display anti-scam messages on their platforms. The Police have also set up the Scam Public Education Office to drive anti-scam outreach, which will involve working closely with community partners. The Scam Public Education Office will collaborate with the National Crime Prevention Council to create and curate anti-scam educational content for the public. It will partner the private sector and community agencies to tailor anti-scam material for different population groups such as youths and seniors, migrant workers, banking services users and digital platform users.”
“There has to be a basis for making those allegations. Opinions – people are free to continue to make. But if you say something that is factually incorrect and it is carried online, it can go very far and it has public interest, and that is where POFMA could be considered. That is the first point. Other than that, opinions – anyone is free to continue to offer theirs. The second point is that in the vast majority of the cases where POFMA directions have been issued, the receivers have complied in full and the content they had put up originally remain fully accessible. Most of the POFMA directions are like that. Anyone can still read what was originally made available. They can decide for themselves. To the third point, Mr Pritam Singh specifically mentioned Asia Sentinel. I do not wish to go into that in great detail because it has no bearing on the Bill we are debating. I would invite him, if he is very interested, to file a Parliamentary Question and we can address his concerns. Ms Ang asked what technology and capabilities the Government is investing in. Given the speed and scale at which online criminal harms can be perpetrated, manual processes will not be effective. The Government is making more use of analytics and also AI, for example, to detect and shut down scam websites faster. In implementing AI, we will keep in mind the potential downsides as shared by Mr Zhulkarnain. In line with Mr Yip's suggestions, we will continue to work with agencies such as the Government Technology Agency (GovTech) to make reporting channels for the public more easily accessible. On Ms Ang's and Mr Yip's queries about overseas perpetrators, cooperation across borders is needed to take them to task. We will certainly continue to strengthen our international partnerships.”
“The Bill has been drafted with this in mind, allowing us to add further offences via amendments to the First and Second Schedules, where necessary. MHA will work closely with other agencies to monitor developments in the technology space and respond nimbly to threats that can be posed by emerging technology, such as generative AI. Mr Singh asked what other harms the Online Criminal Harms Act might cover in future. Mr Ng asked about the inclusion of offences relating to the sale of animals, birds and wildlife. For now, the Bill focuses on criminal offences that pertain to national security, national harmony and individual safety. We will consider Mr Ng's suggestion in future reviews. As to other harms, they must be criminal in nature and have an online nexus. Ms Ang had queries about the information request provisions for investigating underlying offences. While we seek to investigate cases expeditiously, we will set reasonable timelines for online services to comply with such requests. Next, I will deal with the questions and suggestions which relate to our broader efforts against online criminal harms and scams. Strictly, these fall outside the scope of today's Bill and some of them have been discussed in this House before. I shall therefore be brief. With respect to the points made by Mr Singh regarding other legislation, these have already been debated in great detail on previous occasions, and they have no bearing on today's Bill in particular. I will however make three brief points. The first is that I believe Mr Singh mentioned POFMA and that with POFMA, the Government decides what is truth. I think that is not quite a correct characterisation. Mr Singh knows very well that POFMA deals with false statements of fact. These false statements of fact can be proven.”
“It will be an offence under this Bill if the designated online service does not comply with the notice. Mr Ng asked about the provision that the requirements of a code of practice have effect, despite duties imposed by any rule of law, contract, or rule of professional conduct. This clause is similar to provisions under POFMA and the amended Broadcasting Act. As an example, one rule of law is the obligation of confidentiality under contract or common law. However, with the said provision in this Bill, an online service cannot reject a requirement to provide information on the basis that it is under an obligation of confidentiality. To reassure Mr Ng, the competent authority cannot issue any code as it pleases. Any code being considered must fulfil the purpose set out in the Third Schedule. Any amendments to the Third Schedule must be presented to Parliament. Ms Ang and Mr Zhulkarnain asked whether Directions and Orders will need to be complied with while the reconsideration or the appeal is ongoing. The answer is yes, because any stay on reconsideration or appeal would mean that more people would continue to be harmed by the online criminal activity. To reassure Members, we have provided within the Bill that the Reviewing Tribunal must complete its work expeditiously. On Mr Murali's question about the finality of appeals made to the Minister or to the Reviewing Tribunal, there is no ouster clause within this Bill. Decisions made by the Minister and the Reviewing Tribunal will be documented and can be subject to judicial review. Mr Zhulkarnain asked that the Bill be periodically reviewed to keep up-to-date with evolving online criminal harms and the state of technology. We agree this is important.”
“The TSR is a publicly available report that rates major e-commerce platforms based on the anti-scam measures they have in place. The higher the rating, the more anti-scam features a platform has. I encourage members of the public to refer to the TSR when transacting online and exercise caution when transacting on platforms with lower ratings. When engaging your residents on how to protect themselves from scams, Members can also encourage your residents to refer to the TSR when transacting online. Mr Murali and Mr Ng had queries on the technical provisions in the codes of practice. Codes of practice issued under clause 21(4) of the Bill do not have legislative effect. This means that they do not constitute law. Such provisions are common for codes of practice under Singapore legislation. In our case, given the fast-evolving nature of the online space, we anticipate that the competent authority may need to adjust provisions in the codes of practice every now and then, to keep pace with emerging threats and industry developments, including tailoring the codes to different types of online services. This is similar to how licensing conditions in regulated sectors are today determined and varied as necessary by the licensing authority. Let me reassure Mr Murali that notwithstanding the legal position of the codes of practice, we have provided in the Bill that persons acting reasonably to comply with the codes of practice will not incur civil and criminal liability. We will also be able to take action if any provision of the codes are not complied with, which Mr Yong was also concerned about. In such instances, the competent authority is empowered to issue a rectification notice to a non-compliant entity.”
“He suggested that given the role of the competent authority, it should operate separately from the investigation arm of a law enforcement agency. This will indeed be our approach. The competent authority will be sited within the Singapore Police Force (SPF), and will be structurally separate from the Police units that perform investigative functions. In building up the competent authority’s office, the appointment of authorised officers by the Minister will take into account the expertise and relationships required to effectively administer the Bill, as Mr Murali has pointed out. Designated officers would be those who are charged with detecting, enforcing, or investigating the specified offences. They would be best placed to determine whether and what kind of Directions should be issued, and will do so independently of the competent authority. Administratively, we intend for there to be a single point of contact to issue the Directions. This function will reside with the competent authority. The competent authority will therefore have an overall picture of all the Directions being issued. Mr Singh asked for the details of the codes of practice. Mr Yong asked whether the codes of practice could include requirements for e-commerce platforms, such as seller verification and escrow accounts. The purposes of the codes of practice are set out in the Third Schedule, and they do provide for user verification and payment protections. The Codes will apply to designated online services, which can include e-commerce platforms that are assessed to pose significant risk of scams or malicious cyber activities. Requirements for designated e-commerce platforms will take reference from the E-commerce Marketplace Transaction Safety Ratings (TSR).”
“The amended Broadcasting Act applies to online communication services, but as a start, only social media services are subject to the provisions under the amended Broadcasting Act. The Online Criminal Harms Bill will cover all mediums of online communications through which criminal activities could be conducted. So, that is the second difference. Thirdly, the levers to deal with scams and malicious cyber activities are quite different. The Broadcasting Act's code of practice for online safety will require social media services to respond to user reports on scams. A user submits a report, the code says, you, as a social media service, have a responsibility to act on that report. But given the need to protect victims from falling prey to scams and to ensure that scams can be efficiently and effectively addressed, the Online Criminal Harms Act, when it takes effect, will take one step further to provide the Government with the targeted levers to issue Directions against scams and malicious cyber activities, including against online activity that is suspected to be in preparation for such offences. This is the part that is quite key. The offence may not yet have materialised. It has not necessarily taken place, but it looks to be, from past cases, that this is preparation in service of that offence. There will also be requirements for the designated online services to put in place proactive measures to detect and minimise scams and malicious cyber activities. So, those are the three areas where the two differ; and the two actually complement each other. Mr Murali asked about the structure and delineation of roles between the competent authority, authorised officer and designated officer.”
“POFMA and FICA were designed specifically to handle online falsehoods and foreign interference respectively, and will continue to be used for such threats. We recognise, however, that some cases are complex and levers under multiple legislation could apply. We will consider the unique aspects of each case and use the appropriate levers. Here, it may be useful for me to address a point that Mr Gerald Giam made. I believe he asked specifically that we already have some levers under the Broadcasting Act, when the Online Safety Bill was passed and now we are trying to pass the Online Criminal Harms Bill – what is it that the new Bill will do that we were not able to do in the previous legislation? Perhaps it is useful to then compare and contrast more broadly what this set of legislation or legislative tools are designed to achieve that we were not able to do previously. There are essentially three areas. First is in terms of the scope of content that is covered. The amended Broadcasting Act covers egregious content as defined in the Act, with the key focus on online safety, including content advocating or instructing on suicide, or self-harm, content posing public health risk in Singapore and content likely to cause racial and religious disharmony in Singapore. So, those were the kinds of things that we covered last year, when we debated the Online Safety Bill. The Online Criminal Harms Bill will cover a broader scope of online criminal harms, including illegal moneylending, unlawful gambling and drug-related offences. So, the scope of coverage is not identical. Secondly is the scope of services covered. They overlap to some extent but are also not identical.”