Safeguards for Elderly and Vulnerable Users as More Government Services Move to Singpass Digital Platform

Mr Gerald Giam Yean Song asked the Prime Minister with the discontinuation of the OneKey token from 1 April 2021, how will GovTech ensure that (a) all residents who do not own a mobile phone will be able to access Government e-services using Singpass, given that a local mobile phone is required for the Singpass two-factor authentication (2FA) process; and (b) notwithstanding the introduction of Multi-User SMS 2FA, whether alternative 2FA methods can be provided to enable residents with no mobile phones to login with Singpass independently, without the assistance of a third party.

Mr Speaker, we are committed to building an inclusive Smart Nation, one where nobody is digitally excluded.

Members would be aware that the key element for the delivery of digital services is to get digital identity right. In the case of Singapore, our national digital identity is expressed through Singpass.

For the well over 90% of people in Singapore who have access to a smartphone, I think all of you, particularly in this House, would use Singpass through Singpass Mobile. And I would take a bet, that most of us who use Singpass Mobile have forgotten our password, because we depend on the biometric features of our smartphone to not only authenticate but also to act as a two-factor authentication system. So, these two questions really relate to the minority of Singaporeans who do not have a smartphone. You will also recollect that in the old days – I said old because it is quite many years ago – Singpass consisted of a user ID and password. This was not secure enough. Therefore, we introduced a two-factor authentication system.

The two-factor authentication system, the second factor was delivered either through an SMS or through a token – we called it the OneKey token. The challenge with delivering an SMS is that it requires someone to have a phone, otherwise the SMS message with the one-time password will not reach you. Or to use a token. The token will be phased out and the last day of use will be 31 March 2021.

Therefore, these two questions relate to the small minority of people without a smartphone, without a mobile phone and for whom, the use of the token as a second-factor authentication will not be available from the first of April this year.

I want to emphasise, that when we design our digital services, we design them to be accessible, secure and convenient. We therefore have to have this assurance that after 31 March this year, these services will continue to be available for everyone just as they have been today.

So, let me explain how we are adapting our system. The first thing is, many Members of this House may not be aware of this new system we have rolled out called facial verification. This allows users who do not have a mobile phone to log into the Singpass system without the help of a third party. And they do so by using an Internet-enabled computer with a web camera, webcam for short. The webcam allows the computer to scan your face, the system then verifies that against the biometric information that the Government has on all of us through ICA. That means, it verifies against the face on record that we use for Identity Card or our Passport. This allows people to log on and to authenticate to Singpass even if they do not have a smartphone. But that requires a webcam.

So, the next supplementary question you would ask, what about those who do not have access to a computer with a webcam? The answer is that if you do not have access to such a device you can access it through kiosks which the Government has rolled out at selected public locations. These locations include all CPF Service Centres, IRAS Taxpayer and Business Service Centre, Our Tampines Hub's Public Service Centre, Geylang East Public Library – I am just going through a list but this list is going to keep expanding. So, in other words, even if you do not have a computer with a webcam, do not worry there is still a physical counter which you can access.

The next point I would make, is that the other modification we have introduced is what we call Multi-User SMS two-factor authentication, in which users can opt and nominate to have their SMS one-time password sent to another Singpass user who has a mobile phone. This allows a resident – remember without a smartphone – without a mobile phone, to continue to access services with the help of a trusted family member. For this mode to work, obviously, the key word is trust. And our system has to make sure that it also protects privacy and security.

How do we do that? Before the nomination of a trusted party is activated, there is a strict process for us to ensure that we have verified identities of both persons, the nominator and the trusted party, explain to them the use of these and to obtain – very importantly – obtain consent. I would also emphasise that the person who is nominated would only get the one-time password. That person does not have access to the services which the actual user is logging on, does not have access to the information or the transactions that the actual user is transacting in.

The next point is that we will provide help for all those who need it so that there will always be able to have access and skills for an increasingly digitalised environment. Basically, we have to put our money where our mouth is and ensure that no one is excluded simply because of lack of resources. For instance, we have the Home Access scheme, which subsidises broadband connectivity and a smartphone or a tablet for lower income households especially focused on low-income seniors. Our low-income seniors can go to a SG Digital community hub to apply for support under the Mobile Access for Seniors scheme, which offers eligible seniors a subsidised smartphone and a mobile plan. The subsidised smartphone starts from as low as $20, the mobile plan from as low as $5 a month. And I am sure if someone cannot afford that, if they see their local Member of Parliament, we will find ways to help people. So, do not worry about access to equipment or devices.

But actually, the greater challenge is skills – digital skills and that is why we have the SG Digital Office, which is supporting seniors to pick up these skills, including the most important skill, is how to use Singpass Mobile. And again, if you have observed the digital clinics in our community clubs, you will notice that that is almost 101, the first lesson which is provided. For those who need it, we will also provide in-person support at the 55 SG Digital community hubs at our community clubs and libraries islandwide and at PA's Tech Connect initiative and Integrated Public Service Centres.

Finally, for those who truly require a physical means to access public services, we will make sure that physical counters remain available.

Whilst the Government is working towards the digital delivery of all Government services, we will also ensure that everyone always has access to all these services.

Mr Speaker, the Minister has said that the people who are not able to use Singpass right now because of the phasing out of the OneKey token are in the minority, which is true. But many in this minority are the elderly, the less educated and the disabled. So, although they are a minority, they must not find themselves excluded because of the phasing out of this OneKey token.

For example, face verification can be done only if the user is physically present at these counters that the Minister has explained. However, residents who are physically disabled will find themselves having difficulty visiting the counters. I understand that there are other methods of logging in but none of these fully replace the OneKey token which allows users to log in independently without the mobile phone.

So, will GovTech consider introducing other 2FA methods that do not require users to have a mobile phone or be physically present at counters?

Secondly, I also note that several locations like the IRAS Service Centres will have the counters that provide the Singpass face verification. Can such counters also be extended to all Social Service Offices (SSOs) because many residents who visit the SSOs are not tech-savvy but they need to log into the Singpass to retrieve supporting documents like CPF statements and HDB statements?

And, lastly, will residents without a recent photo on record at ICA be able to be matched by the face verification algorithm?

I thank the Member for the questions. But, in fact, that is precisely the point. I have gone to great lengths to explain how the system will work, even without access to a smart phone, without access to a mobile phone and how you can either have someone else whom you rely on as a trusted party to be the mediator of the second factor authentication as well as a new method which we call facial recognition.

My point is that we totally agree with you that we must make sure no one is excluded, that no one is worse off in the face of the inevitable progress of digital technology.

I also want to reiterate the point that I made earlier that the key thing actually is not hardware or devices, it is really trust, confidence, digital literacy. And for this, I think I will also say – and I think from all Members' experience – hand-holding is necessary. And that is why the SG Digital Office and the more we can roll that out on the ground, accessible, so that someone is there to hold your hand and explain and teach the person, the better. So, you have my assurance that we will continue to roll this out. And the Member's suggestion on Social Service Offices, I think we will look at it. This is part of the delivery of Government services at the retail level.

What was the Member's third point? Sorry, I want to make sure I answer him accurately.

Yes, thank you. That is a valid point. I think Members will also now realise why ICA has been fastidiously reminding people at a certain age to update photos so that the photo on record is a recent one. And I would also add, because Singaporeans are quite well travelled at least until 2020 came along, if all of you were to log on to your Singpass Mobile now and look at your National Digital ID, you will realise that that photograph has been updated to your latest passport photograph.

But, nevertheless, your point is valid, we need to make sure we have got updated photos. I would also add this additional point. That the digital systems actually are fairly robust and are able to identify, even if we have got more eye bags, wrinkles and grey hair on our visages.

I am glad to hear Minister say that physical counters will still be around to help those who really do not have the skill sets to do it, and also to minimise the risk. They want to do it themselves rather than relying on someone to key in the Singpass password for them. So, my first supplementary question is, is there a timeline where physical counters would be phased out?

My second question is, how would the Government ensure that the private sector also maintains access to services which do not require Singpass, especially for the senior citizens. Because I get feedback from citizens, senior citizens that to open a bank account now, going to the counter with an identity card is not good enough. They still need to go through the Singpass route.

Thank you. Those are two very salient supplementary questions. Is there a timeline to phase out physical counters? If you ask me, I would believe there is no timeline to phase out physical counters because there will always be a need for some contact, some hand-holding, some training, some engagement.

Now, how and where the physical counters are expressed on the ground, will vary with time. Today, the common ones we are all used to is community clubs, libraries and other suggestions. I think that list would evolve but I do not see the time when we will eliminate all physical counters and human-to-human interactions.

Your next point was on the private sector. And here, this is another important question because the example that you cited – opening a bank account, it used to be that you showed up at the bank with your IC or your passport and maybe if you had, for those of us old enough to have a POSB account with stamps and all that, there was a track record, and it seemed quite seamless to open a bank account.

Actually, that same capability is available today but banks have also had to keep up with the times, both in terms of the digital possibilities which have opened up as well as the dangers of fraud and impersonation in the new world. That is why you will find that today, most banks, in fact all our local banks, when you actually are opening a new account, will try their best to get you to also use Singpass. The reason why they want to use Singpass is because of this other module which we call "MyInfo". Which means the Government as the ultimate custodian or a source of truth of trusted data that "I am who I am; I exist; my details, address and so on and so forth". You realise many times now, you do not need to keep filling up forms repeatedly because the private sector wants to have access with consent to those fields of data which the Government verifies and that is why the banks today would prefer that you use Singpass Mobile and that you authorise them so that they can get the data that they need in a way which they feel is more accurate.

So, the point I am trying to make is that these are possibilities which emerge because we are a Smart Nation, because we use the digital tools available. But even as we do this, we must make sure nobody gets left behind. And that is why the focus on training, on hand-holding, on physical counters to get people past this hurdle. Thank you for that very important point.