Josephine Teo
Singapore
“The Government's risk-calibrated approach to data security in artificial intelligence (AI) systems was explained in a written reply, given on 9 January 2024, to related questions asked by Dr Tan Wu Meng and Mr Gerald Giam.”
“Access to frontier models is helpful for specific use cases, such as advanced research and cybersecurity. However, these form a small proportion of artificial intelligence (AI) demand. For most industry, Government and research uses, capable models are already available.”
“The Government tracks the development of technical standards for identifying artificial intelligence (AI)-generated content, including watermarking and digital provenance approaches, as part of broader efforts to manage AI-related risks.”
“Upon receiving a valid report of intimate image abuse, the Commissioner of Online Safety is empowered by law to direct Online Service Providers (OSPs) to disable access by Singapore users to the specified harmful online material. This direction may be extended to cover identical copies found on the platform.”
“The Government is committed to keeping children safe online. We have announced plans to extend age assurance requirements to designated social media services, including requiring platforms to keep users under 13 off their services.”
“Under the Online Safety (Relief and Accountability) Act 2025, the Commissioner of Online Safety is empowered to issue directions to platforms to remove specified harmful content, including intimate image abuse.”
The complete record
Every one of 2,900 lines we hold for Josephine Teo, in date order, each linked to its source. Free to read, in full, without an account. Page 8 of 58.
“Sir, I think there is no doubt in all of the Members' minds that when an incident of such a nature happens, inevitably there will be questions about digital resilience. There will be questions about why we should continue to engage digitally for the most important transactions in our day-to-day lives and people are naturally concerned about the reliability. So, we fully understand that. I think there is no shortcut to achieving public confidence. We need to be able to put the systems in place. We need to also demonstrate that when disruptions occur, and they inevitably will occur, we are able to recover very quickly. It is not different from how our residents will feedback to us about their confidence regarding lift systems. For example, the lifts will, from time to time, break down. It happens in every constituency and the residents will very naturally also tell you that, "I can accept that, as long as you are able to recover it within a short time". There is a difference between the lift system being out of service for two weeks, versus two days, versus two hours. And that is also the approach that we must take. And there is no amount of assurance that you can provide, except by demonstrating that this is indeed possible, which is why our emphasis has to be on the ability to respond to incidents. It also has to be a whole-of-system approach. It cannot be just the Government being able to do this. As I explained earlier in my reply, in this case, Government services and essential services were largely unaffected. This is not to say that we are secretly happy that nothing happened so badly and that the hit was taken by others. That is not the approach at all. Citizens do not differentiate how the disruption occurred. It occurred.”
“Sir, the short answer to the Member's question is yes, from the first hour.”
“We are in the process of consulting with the various stakeholders and, in due course, we will be able to say more about that.”
“The threat and risk assessments are also reviewed at regular intervals so that they remain up to date. Additionally, CSA has also introduced the CII Supply Chain Programme. I mentioned this earlier. This was in 2022. What does the Supply Chain Programme help, whether it is Government agencies or, indeed, any other system owner, achieve? It gives them a toolkit to help identify and inventorise their vendors. It is very often the case that when something happens, system owners do not know what hit them, even if it has been reported in the media that this was a particular software failure, because the system owners may not know that their systems contain this particular software. So, a simple fact of inventorising what goes into your system is already no small feat because of the number of vendors involved along the whole supply chain. So, the toolkit helps the systems owners to also assess and rate their cyber supply chain risk using a standardised vendor management methodology. So, that is another thing that we have put in place. To the Member's point about a single point of failure, we agree and there are ways in which we mitigate against that. For Government systems, critical functions are required to cater for redundancy. You must be able to have a failover, and this could include both the hardware and software components, networks and databases, as well as even aspects of the physical environment. So, this is something that is already practised and you can always improve them. The Digital Infrastructure Act that we had talked about will seek to improve resilience that are over and above what needs to be done within the cyber system environment. We will have more details.”
“Mr Speaker, the hon Member has a number of questions rolled into his supplementary. Let me try and deal with supply chain risks more broadly and what we do about them in CII. In fact, CSA's threat and risk assessment for CII already cover supply chain risks of this nature today. So, it is not something that is new or unknown or we are caught by surprise in that regard. We have put in place measures to tackle the supply chain risks that the CIIs face, holistically. For example, under the Cybersecurity Code of Practice, CII owners must adopt, to the extent possible, the Defence by Diversity principle. To explain to Members what this means – take any IT system. If the system does not have much diversity in terms of its defences and a single attack vector can immobilise the most key components of the system, then the system does not have Defence by Diversity. If the system wants to achieve Defence by Diversity, what the system owner needs to do is to have a different variety of vendors that the system owner works with, different system architectures to the extent possible, different configurations, different communications pathways and, indeed, different vendors for whether hardware or software. So, Defence by Diversity is something that we ask CII owners to adopt to the extent possible. That is also why, in many instances, we emphasise how software systems ought to be interoperable. Because if interoperability is not common, then you can imagine that for system owners, they are stuck. Once system owners use system A, they must also use the other related systems for A. If they cannot choose to use B, then they do not have that diversity. So, that is a very important principle. It is already part of the way we operate.”
“For example, Software as a Service will put the onus on the vendor to ensure that their software remains secure and available for use. This is something that we will have to keep in mind and see what we can do about. To the Member's specific questions – when we have exercises, for example, are different partners in the supply chain involved? Possibly, if they have a major impact on the system's usability as well as resilience, but there are so many vendors involved and it may not be possible to include all of them in the exercises.”
“Sir, it is an excellent question. If I could seek your indulgence, it deserves a fuller response. Firstly, the use of third-party software is unavoidable because technological systems are complex. Third-party software can offer a wide range of functionalities to meet the requirements of various organisations, the Government included, and this saves time and resources from having to develop such software from scratch. When using third-party software in their ICT systems, Government agencies are required to undergo a thorough risk assessment and to put in place the mitigating measures. That is already baseline. To the extent possible, agencies must put in place quality assurance measures to ensure that the software changes that will be inevitable will not introduce errors in critical systems. Such measures include testing software updates in controlled settings prior to going live. IT people are very familiar with this – you test it in a controlled environment before you put it to the overall system and then see what happens. We also deploy software changes progressively to small groups of users before rolling it out widely. This usually allows us to catch and isolate issues early. But I say "usually" because it does not happen all the time. There are ways in which the system components interact with each other that are not always possible to map out so clearly. In addition, agencies with critical systems are required to review the change management processes of their software providers through regular independent audits. This ensures that software changes can be rolled out smoothly and securely. In some instances, depending on the service provided, it may be beyond the control of users, including governments.”
“Mr Speaker, actually, it is in the businesses' own interest to have contingency plans in place. If they are affected, or if their customers are affected, certainly, the operational impact could be considerable. Certainly, their reputations are also at risk. The Government has to adopt a risk-based approach and that would include being quite careful about the occasions when we impose compulsory requirements. If we attempt to prescribe the measures that businesses must take and we are not careful as to the occasions that we do so, firstly, it could take agency and the sense of ownership away from the IT systems' owners, because then the thinking could be that, if the Government does not say so, then we do not need to do. That would be to the detriment of all of us. Secondly, it is also, from a sense of humility, that we decide that this is not a good approach, because there are so many different components that go into a system's resilience. To imagine that we have full understanding of all the different things that could cause major disruptions is, I believe, unwise. I should also say that, in this particular instance, it was a fairly innocuous software update. No one could have expected the amount of disruption that it caused around the world. So, I would say that we will, in certain instances, require measures to be mandated. But in the vast majority of the cases, it is important to allow the systems owners and, indeed, to require the systems owners to take ownership, to build up their systems' resilience. That is still the approach that we would prefer to take.”
“Businesses must also play their part to improve their resilience when disruptions occur and recognise that it is in their own as well as their customers' interests to do so. When things are running smoothly, businesses may question why they should incur cost or prioritise efforts to assess and improve their resilience measures. Unfortunately, some may not take appropriate action until it is too late. We therefore encourage businesses to conduct their own risk management and assessment measures and put in place the appropriate business continuity plans to help business continuity in the event of a disruption. SingCERT has recently published an advisory on building digital resiliency, which can be found on CSA's website. As part of the support for enterprises' digitalisation, my Ministry offers other practical resources and financial assistance to encourage robust IT practices. This includes CSA's cybersecurity toolkits and IMDA's SMEs Go Digital Programme. While these efforts may not specifically address IT outages like the one related to CrowdStrike, they can help businesses prevent incidents and recover more quickly should disruptions occur. I also encourage all businesses to take advantage of the Government's resource support to strengthen their digital resilience.”
“Most of the affected systems recovered within a day and services returned to normal. As Members know, IT systems may experience outages and disruptions from time to time. In this particular instance, it is not yet fully understood what caused a relatively routine software update to have created such major disruptions around the world. My Ministry has set up an internal task force to engage relevant partners to gain insights into the incident and assess if further measures should be taken to improve Singapore's resilience when such disruptions occur. In the meantime, one key lesson can already be reinforced. As we have said on previous occasions, even with best efforts, not all disruptions can be prevented. Systems owners should, therefore, have plans in place to help them recover quickly from unexpected disturbances. On its part, the Government adopts a risk-based approach to ensure that our critical systems and Essential Services (ES) are resilient. Critical Information Infrastructures (CIIs), ES and Government services are all subject to stringent requirements and have to put in place robust business continuity plans, disaster recovery plans and incident response plans. The Cybersecurity Act and specific sectoral regulations hold CII and key ES operators accountable for meeting the baseline security and resilience requirements. This includes timely review of risk assessments and audits. For example, Government agencies using third-party software in their information and communication technologies (ICT) systems have to do a thorough risk assessment and put in place the necessary mitigation measures. CSA also established the CII Supply Chain Programme to better manage key vendor supply chain risks.”
“Sir, on 19 July 2024, a faulty software update by cybersecurity service provider CrowdStrike disrupted major services around the world. Images of the now infamous "blue screen of death" appeared in media news cycles and attracted significant public attention. According to public reports, outages were experienced by users of the Microsoft Windows operating system that adopted CrowdStrike’s Falcon Endpoint Detection and Response (EDR) solution. It is a security solution that requires frequent and timely updates to be effective. The Members' questions fall broadly into two categories: first, what is the impact of the outage in Singapore, particularly in relation to services provided by the Government; second, what are the lessons learnt, particularly in relation to the resilience of our IT systems. Fortuitously, Government services and most essential services in Singapore were unaffected by the outages. However, some businesses that use CrowdStrike's Falcon EDR solution were affected. In most cases, the impact was to internal staff. In a minority of the cases, customers were impacted due to service disruptions. Prominent examples of these were the passenger check-in for some airlines at Changi Terminal 4 and gantry operations at some Housing and Development Board carparks. Customers of affected businesses met with delays and were inconvenienced. However, business continuity plans kicked in. These included switching over to manual processes, such as for flight ticketing and check-in. The Singapore Cyber Emergency Response Team (SingCERT) of the Cyber Security Agency of Singapore (CSA) also quickly issued an advisory to guide affected systems administrators and users on how to manually recover their systems.”
“Mr Speaker, my response will also cover the matters raised in the Oral Questions by Assoc Prof Razwana Begum1,2,3, which are scheduled for a subsequent Sitting. With your permission, Sir, I would also like to invite all interested Members to seek clarifications after I have given my reply today. If the questions have been addressed, it may not be necessary to proceed with the Questions for future Sittings.”
“Mr Speaker, may I have your permission to answer together Oral Question Nos 5 to 10 on today's Order Paper, Written Question Nos 27 and 28 on today's Order Paper, and Question Nos 60, 64, 65, 66, 68 and 69 on yesterday's Order Paper, filed by Members like Miss Cheryl Chan, Ms Ng Ling Ling and Mr Desmond Choo, as they are all related to the outage of information technology (IT) systems caused by CrowdStrike's faulty software update on 19 July 2024?”
“M1 has fully migrated all its individual and enterprise 3G subscribers to 4G or 5G services and has started the phased retirement of its 3G network since 1 August 2024. Singtel and StarHub plan to commence retiring their 3G services from November 2024 to give their remaining 3G subscribers more time to migrate.”
“In July 2023, Mobile Network Operators (MNOs) M1, Singtel and StarHub announced plans to retire their 3G networks. This will unlock spectrum capacity for future-ready 5G networks to provide users with a better mobile experience and support enterprise digital transformation. MNOs were informed by the Infocomm Media Development Authority (IMDA) that they could start retiring their 3G networks from 31 July 2024, provided they ensure the smooth migration of remaining 3G subscribers to 4G or 5G networks. IMDA has closely monitored the MNOs' progress. Over the past year, the MNOs have actively reached out to their 3G subscribers to raise awareness of the 3G network retirement and their plans to assist subscribers in the migration. Beyond SMS messages, emails, and notifications via MNOs' mobile applications targeted at the broad base of 3G subscribers, there were concerted efforts to reach out to vulnerable groups. For example, M1 and Singtel called seniors directly and delivered 4G or 5G SIM cards to the homes of subscribers with mobility challenges. IMDA supported MNOs in their outreach efforts by roping in relevant community partners with touchpoints to vulnerable groups including seniors and creating awareness of the 3G network retirement. The MNOs are also offering 3G subscribers 4G and 5G service plans that do not leave them worse off for at least two years (e.g. no additional subscription fees and no less favourable service terms). MNOs also support 3G subscribers with phone options, such as $0 phones with the purchase of lowest-cost contract plans and free upgrades to 4G or 5G SIM cards. Some MNOs have taken additional steps to support low-income 3G subscribers, such as providing them with refurbished or new mobile phones.”
“We do not track the number of searches on the gov.sg website, which hosts the Factually page. We can, however, identify the most viewed articles. The top five most viewed Factually topics published between 2019 to 2023, in descending order, were on COVID-19, Ridout Road, fiscal policy, the Central Provident Fund and public housing. Page views of COVID-19 articles are substantially higher than other topics.”
“The Signalling System 7 (SS7) and Diameter protocols are standard international telecommunication network signalling protocols used in 3G and 4G mobile networks, respectively. They are used by mobile operators who connect to each other for functions, such as the setting up of calls and routing of SMSes. While there are known vulnerabilities with these protocols, there are no alternative protocols in 3G and 4G networks which are more secure and approved by international standard bodies, such as 3rd Generation Partnership Project (3GPP) and European Telecommunications Standards Institute (ETSI). Mobile operators are required to put in place measures to secure their networks, including against vulnerabilities inherent in the SS7 and Diameter protocols. To address the vulnerabilities of these older protocols, mobile operators have implemented measures, such as specialised firewalls and system safeguards, to ensure early detection of suspicious network activities and blocking any unauthorised access detected. They have also implemented further control measures to secure their connections with other mobile networks, such as through the use of network encryption. These measures are aligned with international standards development organisations, such as Global System for Mobile Communications Association (GSMA). These older protocols are no longer adopted in 5G mobile networks, where more secure protocols have been implemented, which overcome the inherent vulnerabilities of older protocols by design.”
“These questions for written answer will be addressed by oral reply to similar questions on the Order Paper for 7 August 2024. [Please refer to "Singapore's Preparedness for Global Technology Outages and Impact of Recent CrowdStrike Incident", Official Report, 7 August 2024, Vol 95, Issue 139, Oral Answers to Questions section.]”
“The Ministry’s name change is thus a natural progression from our expanded work scope and reflects the role we already play, leading a range of digital developments across the economic, social and Government domains. Collaboration with trade associations and chambers (TACs) has been and will continue to be important to the Ministry’s mission to create a thriving digital future for all. TACs are valued partners in engaging businesses and contribute much to the shaping of digital economy strategies and initiatives. We work closely with TACs, such as the Singapore Business Federation, Singapore Computer Society and SGTech, in upskilling our workforce and in strengthening enterprise digitalisation. In fact, they are amongst the network of partners that pledged their commitment to the recently launched Digital Enterprise Blueprint, which aims to establish Singapore as a nation of empowered enterprises and workers.”
“The renaming of the Ministry of Communications and Information (MCI) to the Ministry of Digital Development and Information, or MDDI in short, reflects the growing digital development agenda across the whole-of-Government. Digitalisation has become an increasingly important part of our daily lives: from how we communicate and access information, to how businesses operate and how the Government delivers services. Advancements in technology, such as artificial intelligence (AI), are also driving unprecedented change. They present opportunities for growth and innovation, as well as significant risks that we must address. Over the years, the Ministry and other agencies across the Government have been deepening our work in the digital domain to address emerging issues and meet growing demands. For example, we have teams negotiating digital economy agreements, shoring up AI governance and improving our digital infrastructure, such as through upgrades to our Nationwide Broadband Network. We regularly update our laws and regulatory approaches to address new risks and threats in the digital domain. We are growing the range of digital Government services and have achieved high adoption rates for our national digital identity system. We are continually working to strengthen digital inclusion for vulnerable groups. Other agencies have also been harnessing digital technologies to improve citizens’ everyday lives, such as implementing seamless, automated immigration clearance at our airport and enabling the convenient booking of health appointments. Last October, we merged the Smart Nation and Digital Government Group and the MCI’s digital development functions to better position the Government to advance Singapore’s digital agenda.”
“Mr Speaker, I think, with respect, I would request the Member to file PQs to his first and third questions. He asked specifically about what casinos may have received in terms of cash proceeds from their customers and from their patrons. I do not have the information offhand. So, respectfully, I would ask the Member to file a PQ if it is something that he is very interested in. And I believe his third question is also in terms of the actions. They do not relate directly to this Bill. So, respectfully, please file a PQ. The Member did talk about sentencing and I think I have responded to it in my round-up speech. The Member himself has referred to Minister Shanmugam's reply to the Member at the Sitting in May. To reiterate, the sentencing regime is quite comparable to other leading jurisdictions. What the Courts decide to mete out by way of the sentence itself is something for the Court to decide. And I have explained earlier what are the factors that the Courts look into. I think one thing that we need to keep in mind is that, ultimately, the Courts must consider what crime was committed within our jurisdiction. The sums may be very large, but what was the activity in Singapore that constituted the crime? That is something we have to keep in mind.”
“Thank you, Mr Speaker. It is a very interesting question and I think it is a reminder to us not to take any single number on its own and forget the context. If you look at 20% of a very large number of STRs, are we happier that filers have chosen to surface information that they are concerned about and then we manage to find that only 20% of them are useful, or are we happier that they are very sparse with their filing and then the base becomes very small, but those that you can act on may be very high, and are you better off under those circumstances? I would say that we are not overly seized by a single number, but the point that the Member made is still a relevant one, which is that gatekeepers and their sector regulators need to improve the way in which they are looking at transactions and their effectiveness in identifying those that are suspicious. So, that is the process that is still ongoing, and I think because the landscape for money laundering will change very quickly, what may look like very obvious signs of financial crime today will be superseded by new types of behaviour that deserve greater attention. So, that is, I think, the greater emphasis of where our efforts need to be.”
“Singapore will therefore have to continue to be vigilant and we will not hesitate to further tighten our laws against money laundering where necessary, to ensure that our financial and business ecosystem remains reputable and trusted and continues to thrive. Sir, I beg to move. [(proc text) Question proposed. (proc text)]”
“Clauses 16 and 17 amend sections 370 and 372 of the CPC, to include a requirement that an absconded person who is suspected of having committed an arrestable offence under our laws or serious offence under the CDSA, must personally present himself before a law enforcement officer to assist in the investigations, prior to making a claim to the property seized in respect of the offence. Additionally, clause 16 amends the CPC to provide that the Court may consider whether the property was obtained through legitimate sources, such as income or investments, before the seized property may be released to a third party, even if that third party has not committed any crimes. That party cannot prove his entitlement to the property simply because it was a gift from the absconded person. Taken together, these amendments will enable the Government to better deal with absconded suspects, through depriving them of the financial gains of their money laundering and other criminal activities, if they refuse to return to Singapore for investigations. To be clear, these amendments continue to be subject to judicial oversight and only affect persons who are suspected to have committed offences in Singapore and have absconded, as well as properties seized in relation to these offences. The proposal does not change the existing law or procedures for persons who are not "absconded persons". Sir, today's Bill is another step in strengthening our AML/CFT regime. It will not be the last. Criminals will continue to explore other ways to circumvent even the most stringent of measures, in the fast-changing money laundering landscape.”
“By staying out of Singapore and, hence, stymying investigations, they have hope that the seized property would eventually be released back to them. Clause 16 amends the CPC such that the Court must not dispose of the seized property, if there is any pending investigation in relation to an absconded person who is reasonably suspected of having committed an offence in respect of the property, regardless of the progress of the investigation. Law enforcement agencies can lawfully seize property only where they have reason to suspect that an offence has been committed or the property has some nexus to the offence. Further, the Court will also have to determine that the continued seizure will not cause injustice to any person entitled to the possession of the property. This ensures due process in the proceedings. Next, section 372 of the CPC currently provides that if the person entitled to a seized property is unknown or cannot be found, the property will be vested in the Government if no one establishes a claim to it within six months of a public notice. However, an absconded person can lay a claim to the property through a legal counsel, while refusing to return to Singapore to cooperate with the investigations. Moreover, absconded persons could try to find creative means to insulate their properties from forfeiture or confiscation. For example, they could vest the legal title to the properties in other individuals, who may not have committed offences in Singapore. These individuals may then present themselves as innocent claimants to the property.”
“These amendments will allow law enforcement agencies to reduce the cost of property maintenance and preserve the value of seized or restrained properties to facilitate subsequent asset recovery and restitution to the victims. We will also make amendments to deal with properties in cases where the suspect has absconded. In the course of investigations, law enforcement agencies may seize properties linked to persons who are suspected of having committed offences under Singapore's laws but cannot be found despite efforts to reach out to them. In some cases, the persons may have left Singapore and cannot be extradited or refuse to return. This is not uncommon in cross-border financial crimes, such as money laundering and scams. Investigations can be wilfully stalled by such absconded persons if they decide to stay out of Singapore in order to avoid being imprisoned for their crimes. But law enforcement agencies need to interview them for the investigations. Today, the CPC prohibits the Court from releasing a seized property if the property is required for any investigation, inquiry, trial or any proceeding under the law. However, if the law enforcement agencies fail to satisfy the Court that any of these grounds for continued seizure of the property applies, the Court may order the property's release or disposal. If the absconded person refuses to return to Singapore, it may become increasingly difficult for the Police, over time, to justify how the continued seizure of the property remains relevant to the investigations, which are not making headway because they cannot interview the person. This presents an opportunity for absconded persons to frustrate due process.”
“We have taken a risk-based approach, aligned with FATF's recommendations, and propose to designate specific foreign environmental crimes which have been assessed to pose a higher risk of their proceeds being laundered in Singapore. These are illegal logging, land clearing, mining, waste trafficking and wildlife trade. The amendment will allow the law enforcement agencies to investigate money laundering offences if it is suspected that the monies in Singapore are derived from such serious environmental crimes committed overseas. Third, this Bill introduces three proposals to improve the processes to deal with seized properties in general, including those linked to money laundering. Currently, when seized or restrained property is no longer required for investigations or court proceedings, law enforcement agencies must obtain the consent of all parties involved if they want to obtain a court order to sell the property. This is highly impractical because, if there is no consensus amongst the parties, law enforcement agencies will need to continue to manage and maintain the property. These properties can include vehicles, liquor, luxury watches and livestock. Not only are they costly to maintain, they also tend to depreciate in value. The costs of maintenance are borne by the state. Clauses 14 to 16 will amend the CPC and the CDSA to allow the Court to order the sale of a seized or restrained property without the consent of all parties involved, provided the Court is satisfied that, the value of the property is likely to depreciate or undue costs are involved in maintaining the property; or the sale would be in the interests of justice.”
“It will be sufficient for the prosecution to prove that the money launderer knew or had reasonable grounds to believe that the property he was dealing with were the gains from criminal conduct. This amendment will significantly alleviate the challenges faced by the prosecution today when dealing with money laundering offences, in cases where the monies laundered had passed through many bank accounts and intermediaries in foreign jurisdictions before entering Singapore. We also propose to designate foreign environmental crimes as money laundering predicate offences. Currently, law enforcement agencies are only able to investigate money laundering offences arising from the commission of an offence outside Singapore if the foreign offence is also a serious offence under Singapore's laws. Environmental crimes, such as illegal mining, illegal waste trafficking and illegal logging, are not applicable in our domestic context and, hence, not considered serious offences in Singapore. This limits our ability to investigate money laundering associated with such foreign offences. However, these crimes are one of the largest contributors to transnational organised criminal activities in the East Asia and Pacific region. There is a high propensity for funds arising from such crimes to flow into Singapore, given that we are a well-connected international financial, trading and transit hub. This was highlighted in Singapore's Environmental Crime Money Laundering National Risk Assessment, which we recently published. Clause 13 therefore introduces a Third Schedule to the CDSA, which will designate serious foreign environmental crimes as money laundering predicate offences.”
“Regulators will then have greater insight into the risks and trends relating to their sectors, and be able to take more effective supervisory and regulatory actions. Guardrails for the data-sharing will be implemented to protect data confidentiality. Next, we will amend and enhance the levers for prosecution of money laundering cases arising from criminal conduct abroad. After our investigators painstakingly turn over the stones and uncover the suspects and their activities, the next big challenge is navigating the legal hurdles to successfully prosecute them. To do so, the prosecution needs to show that the monies, allegedly laundered in Singapore, are benefits derived from criminal conduct. In cases where the criminal conduct is committed outside Singapore, the authorities are currently required to show the complete trail of the monies from the point the crime was committed overseas to the point the monies were deposited with the money launderer in Singapore. In many cases, law enforcement agencies face enormous challenges in obtaining the necessary evidence from foreign victims, entities and authorities. This is especially so if the criminal proceeds had flowed through many jurisdictions before entering Singapore, which is often the case. Criminals do this to conceal the origin of their proceeds and exploit such legal requirements to their advantage. To enhance our abilities to effectively prosecute money laundering offences, clause 11 of the Bill amends section 56 of the CDSA such that the prosecution will no longer need to prove that the monies allegedly laundered in Singapore were benefits from criminal conduct nor show the complete trail.”
“Very often, money launderers will conduct and layer their activities across different sectors and use different front entities, so as to avoid detection. When interacting with individual Government agencies, they may leave traces of suspicion, which, on their own, may not raise concerns. However, when triangulated and pieced together with information from other agencies and sources, including Suspicious Transaction Reports (STRs), a more revealing picture may emerge. This can then trigger and support investigations by the relevant law enforcement agencies. Clauses 18 to 21 introduce amendments to the Income Tax Act, Goods and Services Tax Act, Regulation of Imports and Exports Act, and the Free Trade Zones Act. The amendments will allow the Inland Revenue Authority of Singapore (IRAS) and Singapore Customs to share tax data and trade data respectively, with Singapore's Financial Intelligence Unit. This will allow the Suspicious Transaction Reporting Office of the Singapore Police Force to augment its analyses of money laundering risks and, in turn, provide richer financial intelligence to law enforcement agencies and AML/CFT regulators for appropriate enforcement action. The United Kingdom, New Zealand and South Korea have similar tax data sharing arrangements. Likewise, Hong Kong, the United States (US) and Luxembourg have trade data sharing arrangements with their Customs agencies. Additionally, clause 10 introduces amendments to the CDSA to allow any AML/CFT regulator, such as the Council for Estate Agencies (CEA) and the Accounting and Corporate Regulatory Authority (ACRA), to have access to suspicious transactions reports filed by their respective regulated entities.”
“Sir, allow me to elaborate on the key features of the Bill. The Bill seeks to: first, align our framework for Anti-Money Laundering and Countering the Financing of Terrorism, or AML/CFT, framework with the FATF standards to better prevent and detect money laundering; second, enhance the ability of Government agencies to detect and enforce against money laundering through enhanced data sharing and strengthened prosecutorial levers; and third, clarify and improve our processes to deal with seized or restrained properties linked to suspected criminal activities. First, on our AML/CFT framework for casino operators. Customer due diligence (CDD) checks conducted by gatekeepers in various sectors, is key to preventing suspicious individuals from sinking roots into our system and detecting any illicit activities early. Casino operators are one such gatekeeper. To align with FATF's standards, clause 2 will amend the Casino Control Act to require casino operators to conduct tighter CDD checks on patrons at the point of transaction. The threshold for CDD checks will be lowered from the current threshold of single cash transactions involving $10,000 or more or deposits into a deposit account involving $5,000 or more to cover single cash transactions or deposits involving $4,000 or more. Additionally, the Gambling Regulatory Authority of Singapore will be empowered to require casino operators, when conducting CDD checks, to also consider proliferation financing risks. These are the risks of financing the proliferation of weapons of mass destruction. Second, this Bill will enhance the ability of relevant Government agencies to detect and enforce against money laundering through enhanced data sharing, and strengthened prosecutorial levers. On data sharing.”
“Inevitably, some of them enter pristine waters, polluting rivers and estuaries, much against the wishes of local communities. Illicit monies flow through many jurisdictions, but are especially attracted to global financial centres, such as London, Hong Kong, New York, Delaware, Switzerland and Singapore. This is because the open, efficient and well-connected infrastructure of such centres that makes them attractive to legitimate investors is also useful for criminals to move and hide their monies. I shared some examples with Parliament last year. More of such cases have surfaced since. In February this year, the Hong Kong authorities arrested seven Hong Kong residents suspected of laundering US$1.8 billion of proceeds from online scams in India and the illegal sale of electronics and rare gems. The authorities seized more than US$21 million worth of assets as part of the operation. In April, two managers of a Saudi oil exploration company went on trial in Switzerland for alleged fraud and money laundering of at least US$1.8 billion. Singapore strives to be a reputable, trusted and thriving financial and business hub. We have a hard-earned track record and every intention to keep our system clean. This must mean keeping money launderers out of our system as best as we can. Our anti-money laundering regime has three pillars: (a) prevention through a robust legal and regulatory framework to deter such criminals; (b) detection to ensure that illicit activities are picked up early; and (c) enforcement. We take firm and prompt enforcement action against money laundering. In this Bill, we have proposed enhancements across all three pillars to empower our agencies with strengthened levers and toolkits against money laundering.”
“Sir, our laws to tackle money laundering include the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act, or CDSA for short, as well as the Criminal Procedure Code, or CPC. Like our other laws, we regularly review the CDSA and CPC to ensure that they remain relevant and effective. Money laundering, in particular, is one crime which has evolved significantly. Money launderers are finding new ways to evade detection, taking advantage of technological innovations meant to facilitate legitimate financial and business transactions. Consequently, international standards against money laundering have been enhanced. This includes those set by the Financial Action Task Force (FATF), the international body that sets global standards to tackle money laundering and terrorism and proliferation financing. Each new money laundering case uncovered in Singapore or around the world provides useful lessons and this includes our $3 billion case. We have been distilling the learning points through careful studies of the changing modus operandi, as well as the new standards promulgated by FATF. This Bill is a continuation of our ongoing efforts to ensure that Singapore’s regime keeps pace with evolving standards and trends, so that we can continue to deal effectively with attempts to launder criminal proceeds through Singapore. According to the International Criminal Police Organisation (INTERPOL), around US$2 to $3 trillion of illicit proceeds are channelled through the global financial system every year. US$2 to $3 trillion. Think about it. These numbers are bigger than the gross domestic product (GDP) of most countries, Singapore included. In the ocean of money flows, criminal proceeds are like toxic waste that gets carried along.”
“They can put such advice into practice in preschools and encourage their adoption at home. MOH and MSF will finalise and announce these initiatives in the coming months. At the same time, Ministry of Communications and Information is working with MOH and MSF to strengthen safeguards where practical.”
“With the growing availability of age assurance methods, we are seriously studying how the industry can do more on this front to better protect children online. Excessive use of social media is also a key concern associated with anxiety, depression, insomnia and stress. These associations are linked to the duration, frequency and number of social media platforms being used2. It is as yet unclear if putting warning labels on social media platforms, on its own, will be effective in curbing excessive use. We have instead adopted a more holistic strategy which includes educating and providing stronger support to parents and children. For parents who suspect that their children may have developed dependency on social media, they can seek help from community service providers, such as TOUCH Community Services, which runs counselling and intervention programmes for affected youths. Alternatively, parents can tap on specialised services, such as the National Addictions Management Service (NAMS), for assessment and intervention. We also recognise that it is important to go upstream to provide support and create awareness amongst parents early, even before the child is born. Prevention is better than cure. In this regard, the Government is committed to taking more decisive and effective measures to shape the habit of device usage. The Ministry of Health (MOH) and the Ministry of Social and Family Development (MSF) oversee the key touchpoints for children up to six years old, through child and maternity care and preschools. They intend to make their advice on device usage and screen time clearer and more definitive and to deliver them consistently across all healthcare settings with more reminders.”
“My response will also address a similar question for written answer raised by Mr Sitoh Yih Pin1 for a subsequent Sitting. The Singapore Government strongly believes in protecting our citizens, especially children, from harmful online content and potential addiction. In this regard, regulation plays an important role. On online harms, we have taken a targeted approach. Under the Broadcasting Act, the Infocomm Media Development Authority (IMDA) has designated six Social Media Services (SMSs) with significant reach or impact in Singapore. They are Facebook, HardwareZone, Instagram, TikTok, X (formerly Twitter) and YouTube. These SMSs are required to comply with the Code of Practice for Online Safety (Online Safety Code), which took effect on 18 July 2023. The Online Safety Code requires designated SMSs to have in place additional measures to enhance the online safety of children. These include ensuring that children are not targeted to receive content that SMSs are reasonably aware to be detrimental to their physical or mental well-being, having in place more restrictive account settings for children, and providing tools for children or their parents to manage their safety. Designated SMSs are due to submit their first online safety compliance reports by end-July 2024 and we will evaluate their compliance with the Online Safety Code before assessing if there is a need to tighten any requirements. Age assurance remains one of our key considerations in ensuring the online safety of children. While most major social media services require users to be at least 13 years old, they rely primarily on users’ self-declaration.”
“Data centres (DCs) are foundational to Singapore’s digital economy. However, they are intensive users of electricity and water. The three-year pause in the growth of the DC industry was imposed to study how this growth could be managed sustainably, in line with our international climate commitments. During this pause, the Infocomm Media Development Authority (IMDA) and the Singapore Economic Development Board consulted the industry and end-users extensively on ways to grow our DC sector sustainably through best-in-class and energy-efficient DCs. One key approach was the pilot DC-Call for Application (or DC-CFA) in 2022 to invite proposals for sustainable DCs. The four DC operators that were awarded capacity in the call have committed to building new DCs with innovations, such as liquid cooling and the use of energy-efficient IT equipment. In addition to DC-CFA, we are developing new standards to shift existing and new DCs towards greener operations. These include the world’s first Tropical DC standard, which enables DCs in Singapore and other similar climates to operate safely at higher temperatures and thus reduce the energy needed for cooling. This new standard complements global industry best practices, which are already adopted by many DCs locally. To ensure that Singapore remains at the forefront of DC sustainability, IMDA recently released the Green DC Roadmap, which outlines the Government’s plans to work with the industry to pioneer solutions for greater energy efficiency at the hardware and software levels, as well as to accelerate the use of green energy.”
“They should proactively install cybersecurity apps in their personal devices and adopt good cyber hygiene practices, such as not downloading apps or files from unknown persons or entities.”
“Cybersecurity apps, which include anti-virus apps, help to protect mobile devices against malware and phishing attacks. The Cyber Security Agency (CSA) has been encouraging users of mobile devices to install cybersecurity apps on their devices in its public education initiatives. According to CSA's 2022 Cybersecurity Public Awareness Survey, five in ten persons installed cybersecurity apps, an increase from four in ten persons in 2020. To help the public choose suitable cybersecurity apps based on their needs and budget, CSA published a list of recommended cybersecurity apps. This list has been available since September 2023 and has been publicised through various Government outreach initiatives. For example, CSA works through SG Digital Office's Digital Ambassadors to share the list with seniors at community centres and digital community hubs and to install cybersecurity apps on their mobile devices upon request. CSA has received positive feedback from members of public that they found the list useful. CSA has also been working with industry players to better protect Singaporeans and their mobile devices from potential malware infections. For example, Google and CSA launched a pilot programme in February 2024, in which Google Play Protect will block the installation of apps that are likely to be malicious, as an added layer of protection for Android mobile users. Last year, CSA also worked with our major retail banks to implement anti-malware security measures on their banking apps to better protect their customers against malware-enabled scams. As malicious actors' malware techniques are constantly evolving, CSA's efforts must be complemented by users' vigilance.”
“Commercial advertising in Singapore is regulated by the Advertising Standards Authority of Singapore (ASAS) through the Singapore Code of Advertising Practice (SCAP). SCAP applies to all advertisements for any goods and services appearing in any form or any media. It stipulates that all advertisements should be legal, decent, honest and truthful. SCAP also stipulates that "special care should be taken in marketing communication directed towards or depicting children and young people". This includes ensuring that the content does not contain any statement or visual presentation that might have the effect of harming children mentally, morally or physically. Advertisements are not required to be approved by ASAS before they are published. ASAS adopts a complaints-based approach in reviewing potential advertising breaches when reported to them. ASAS promotes ethical advertising through the SCAP and can inform advertisers to amend or withdraw advertisements that are deemed to have breached the SCAP. ASAS also periodically reviews the SCAP to ensure it continues to address key issues in the evolving advertising landscape. These reviews are made in consultation with relevant Government agencies, such as the Infocomm Media Development Authority, Monetary Authority of Singapore, Health Sciences Authority, Singapore Food Agency, Gambling Regulatory Authority as well as the advertising industry. ASAS is conducting such a review currently.”
“Besides enhancing our governance approach domestically, we collaborate with international partners to build a trusted environment for AI worldwide. For instance, we have conducted a joint mapping exercise between AI Verify and the US' AI Risk Management Framework, to harmonise approaches and streamline the compliance burdens on organisations deploying AI across different jurisdictions. We will continue to seek out such opportunities and adapt our methods in tandem with the technology development.”
“The Singapore National AI Strategy 2.0 identifies the presence of a trusted ecosystem as a key enabler for robust AI development. In fact, Singapore was a first-mover in launching our AI Model Governance Framework back in 2019, which recommends best practices to address governance issues in AI deployment. We continue to update it to address emerging risks, including by launching a Framework for Generative AI this year. Meanwhile, the Government also provides practical support for organisations seeking to manage risks in the development and deployment of AI, including through launching open-source testing toolkits, such as AI Verify to help them validate their AI systems' performance on internationally-recognised governance principles like robustness and explainability. These frameworks provide a useful baseline for the Government to partner industry on managing and assessing AI risks across the ecosystem. In the finance sector, financial institutions are guided by sector-specific AI governance guidelines, such as the Monetary Authority of Singapore's (MAS') Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT), which aligns closely to the earlier-mentioned AI governance frameworks. Many companies have supplemented these with additional internal guidelines to oversee AI development, examples of which can be found in the Personal Data Protection Commission's Compendium of Use Cases for the Model AI Governance Framework. For example, DBS has implemented its own Responsible Data Use framework for its AI models to comply with legal, security and quality standards and utilises risk assessment tools, such as the probability-severity matrix.”
“The Government is committed to delivering public digital services which are user-friendly and accessible. First, the Digital Service Standards (DSS) helps agencies design and develop digital services that are (a) accessible and inclusive; (b) usable; and (c) relevant. The DSS incorporates the Web Content Accessibility Guidelines (WCAG), which is a set of international standards to increase the accessibility of web content for seniors and persons with disabilities. Second, in addition to meeting the WCAG standards, the DSS further encourages agencies to conduct usability checks prior to implementing their digital services. Besides engaging their target users directly, agencies can tap on the Smart Nation Ambassador Citizens Co-Creation Group which includes representatives from diverse groups, such as persons with disabilities, low-income families and seniors. Third, to support agencies in this effort, the Government Technology Agency (GovTech) conducts regular independent usability checks on frequently used online services to help agencies identify areas of improvement. In addition, GovTech provides agencies with central diagnostic tools, such as the (a) whole-of-Government Application Analytics (WOGAA) tool which automates real-time reporting of metrics such as transaction completion rate, customer satisfaction; and (b) Purple A11y, which helps agencies identify and rectify parts of their websites which persons with disabilities may find hard to access. The processes are in place so that government online services are user-friendly and accessible. We welcome specific suggestions or observations that can help us improve further.”
“We will continue to monitor the landscape, act on emerging trends and close off known avenues for scammers to reach prospective victims. This includes tightening our measures further, where necessary.”
“Since 2019, the Infocomm Media Development Authority (IMDA) has been working with telecommunication companies (telcos) to strengthen our safeguards against calls from spoofed local numbers. Today, any local or international calls that spoof local numbers will be blocked by telcos. With these measures in place, scammers have quickly changed their tactics. Some scammers buy local SIM cards through illicit means and use them to make calls from our local networks. Such calls will show up on the victims' phone as a local number and without the "+65" prefix. These are not spoofed calls. They come from the local SIM cards used to make scam calls. We have taken steps to strengthen deterrence against the use of local SIM cards for crime and to ensure accountability for the use of SIM cards. On 2 April 2024, the Law Enforcement and Other Matters Bill was passed in Parliament. This will make it an offence for individuals to allow the irresponsible registration and misuse of local SIM cards to facilitate scams. These new offences will carry a fine of up to $10,000 or imprisonment of up to three years, or both. IMDA has also tightened the registration of SIM cards and started imposing limits on the number of postpaid SIM cards per subscriber. For instance, since mid-April 2024, each subscriber is only allowed to sign up for a maximum of 10 postpaid SIM cards. This strikes a balance between stopping illegitimate purchases in bulk and bona fide uses, such as multiple subscriptions for family members. Collectively, these new measures aim to make it more difficult for criminal syndicates to operate in Singapore and help deter abuse of our telecommunications channels. These measures are part of our multi-pronged efforts to fight scams.”
“The National Multimodal Large Language Model Programme (NMLP) was launched in December 2023 as a research programme to build up Singapore's capabilities in developing LLMs that can better understand the multi-lingual and multicultural context of Singapore and Southeast Asia. The NMLP is still a nascent effort. So far, researchers have benefitted from data, such as those from open government publications and records as well as contributed content from partners for which no remuneration was required. In any case, we will continue to adopt a consultative approach for Generative AI projects trained in the local and regional context. IMDA has engaged a range of organisations and associations to understand their views. Specifically for the local writer's community, the Infocomm Media Development Authority is working with the National Arts Council for outreach and has also partnered the not-for-profit organisation, SingLit Station, to conduct a survey on their willingness to be involved in research efforts.”
“The Personal Data Protection Act (PDPA) governs the collection, use and disclosure of personal data by private sector organisations. Colleagues from the Ministry of Education have shared more details about the facts of the incident. The Personal Data Protection Commission of Singapore is currently investigating if any private sector organisation involved has breached data protection obligations under the PDPA.”
“The Personal Data Protection Act (PDPA) requires an organisation to cease retention of personal data or dispose of it in a proper manner when it is no longer needed for the purposes it was collected for, or other legitimate business or legal purpose. This requirement applies regardless of whether consent had or had not been given for the organisation's collection, use or disclosure of personal data. Retention limits under the PDPA sufficiently safeguard the further use of an individual's personal data. If the organisation does not adhere to these requirements, the Personal Data Protection Commission (PDPC) has the power to direct the organisation to destroy, or stop collecting, using or disclosing, the personal data concerned.”
“Government funding provided to SPH Media Trust (SMT) is intended to support its talent, technology and vernacular capabilities. Outside of this, SMT may independently raise funding from other sources, based on its business decisions and operating needs. Information on SMT's finances can be obtained from ACRA.”
“There is no set time frame to convene a content review committee. The Government takes into consideration Singapore's prevailing media and social landscape in deciding when to convene content regulatory reviews and the appropriate format for such reviews. For example, in the lead up to the Online Safety (Miscellaneous Amendments) Bill of 2022, the Ministry of Communications and Information (MCI) conducted extensive engagements, including a public consultation with a wide range of stakeholders, to gather their feedback and suggestions on the proposed measures to enhance online safety. More recently, to develop the Code of Practice for Online Safety which applies to designated Social Media Services (SMSes), the Infocomm Media Development Authority also consulted various stakeholders, including the designated SMSes, to gather feedback before finalising the Code. On specific content, policies and standards, we also continue to consult a range of advisory committees. These varied approaches provide more flexibility in responding to shifts in the media landscape, community sentiments and societal norms.”