Singapore still is mulling over new rules that will, amongst others, instruct social media platforms to disable access to content it deems harmful. It will not, however, bar the use of hyperlinks in SMS or other messaging apps as doing so will not eliminate the risk of someone falling prey to phishing attacks.
The Ministry of Communications and Information (MCI) last month said it was working on two proposed Codes of Practice that aimed to improve the safety of social media users in the country. The first would require social media services providers to adopt upstream “system-wide” processes to bolster online safety for their users, particularly, the young.
The second Code of Practice would empower industry regulator Infocomm Media Development Authority (IMDA) to instruct social media platforms to cut access to specific “egregious harmful content” that remained available in spite of these operators’ content moderation systems. The government deemed such content to encompass sexual harm, self-harm, public security, as well as racial or religious intolerance.
The new enforcement framework would provide IMDA the power to direct any social media service accessible from Singapore to block access to specific types of harmful content or disallow specific online accounts to communicate such content or engage users in the country.
The ministry noted that while such services had made efforts to address this issue, it was concerned that online harms continued to prevail and that these were compounded when amplified on social media.
MCI said in a written parliamentary response this week that governments worldwide also were looking at ways to effectively regulate social media services.
“As with all forms of regulations, non-compliance must result in enforcement actions. MCI has studied relevant international regulatory models and provisions under existing local laws. We will provide details of the enforcement framework in due course,” the ministry said.
Various measures needed to mitigate phishing threats
While it mulls over new regulations for social media, Singapore has taken more concrete steps to mitigate risks stemming from embedded hyperlinks in SMS and other messaging platforms.
The government in January said it was reviewing the public sector’s use of SMS and clickable links in interacting with the public as part of efforts to combat phishing scams. The move came after SMS-phishing scams involving OCBC Bank customers, where scammers manipulated SMS Sender ID details to direct victims to phishing phishing websites, resulted in losses of more than SG$8.5 million. Banks then were instructed to remove hyperlinks from email or SMS messages sent to consumers.
In its parliamentary response this week, the Smart Nation Digital Government Group (SNDGG) said it had assessed the use of links by government agencies and determined that removing them in SMS, email or other messaging platforms would not eliminate the risks of users falling prey to phishing attempts.
To better mitigate such threats, it instead would implement detection and prevention measures at the backend as well as drive user awareness on how to safeguard against such scams from perpetuating through the use of hyperlinks.
Elaborating on the backend measures, SNDGG said the government would use only domains ending with “.gov.sg” when sending SMS messages with links. However, there were exceptions where government agencies collaborated with other organisations and other websites could be used. Such sites would be listed online so users could check unfamiliar websites before interacting with them.
SNDGG added that the Singapore SMS Sender ID Registry was established in March 2022 to block SMS messages that spoofed the sender IDs of targeted entities, including government agencies and banks. To date, more than 50 organisations have signed up for the registry, with all government agencies “progressively onboarding” as well.
The government still was evaluating whether it would be necessary to require all users of alphanumeric sender IDs to participate in the registry.
Telcos also were implementing capabilities in their networks to block scam messages and calls, including robocalls and anyone spoofing numbers of local government agencies and emergency services, said SNDGG. It added that the government also implemented multi-factor authentication–including the use of biometrics–on SingPass, which residents needed to access e-government services.
In addition, plans were underway to launch a WhatsApp channel for the National Crime Prevention Council in the third quarter. This would enable citizens to more quickly report suspected scams and enable the government to “crowdsource information” and respond to scam websites and messages, SNDGG said.
It added that IMDA also was collaborating with the Singapore Police Force to identify and block suspected scam websites. Some 12,000 suspected scam websites were blocked last year.
Misconfigurations main cause of digital bank service disruptions
Scams aside, errors were the main cause of disruptions to online banking services over the past year.
Four retail banks–Citibank Singapore, DBS Bank, OCBC, and United Overseas Bank (UOB)–reported eight interruptions to their digital banking services since July 2021. Mostly resolved within three hours, the incidents affected an average of 12,000 customers, said Tharman Shanmugaratnam, Singapore’s Senior Minister and Minister in Charge of Monetary Authority of Singapore (MAS) in his parliamentary response this week.
The longest disruption, lasting 39 hours, involved DBS in November last year that later was attributed to a malfunction of the bank’s access control servers.
While one disruption was related to an outage at a third-party cloud service provider, Tharman said the banks themselves mainly were the root causes of these incidents. The minister pointed to software misconfigurations, system malfunctions, and errors that were introduced when the banks were making system changes.
MAS required all banks to be able to recover systems supporting critical banking services, such as fund transfers and payments, within four hours following any disruption. The total unscheduled downtime for each critical system also must not exceed four hours within any 12-month period.
Tharman said MAS would take supervisory action when the banks breached these requirements.
DBS, for instance, was instructed to engage an independent expert to conduct a review of the bank’s service disruption, including the bank’s controls and recovery actions and preventive measures for similar incidents in future.
DBS also had to rectify all shortcomings identified from the review and implement measures to ensure any future disruption to its digital banking services was resolved quickly and adequately, Tharman said.
“The recent incidents highlight the need for banks to continually review their IT resilience strategy and ensure that there is sufficient redundancy and fault tolerance built into their digital banking IT infrastructure,” the minister wrote. “Swift diagnosis and recovery of systems, coupled with robust business continuity management, are critical in minimising the impact of an IT disruption.”
He added that MAS introduced business continuity management guidelines that outlined measures financial institutions should employ to sustain critical business services and minimise service disruption. With cloud adoption increasing the sector’s exposure to third-party risks, MAS also had highlighted such risks as a key area for financial institutions to focus on in both the BCM guidelines as well as its technology risk management guidelines.
