5 ms·

i don't know whether this is true or not... maybe hongyi can comment here ;) but a lot of personal data in Singapore is wonderfully linked up across almost all

by princeb 10y ago

i don't know whether this is true or not... maybe hongyi can comment here ;) but a lot of personal data in Singapore is wonderfully linked up across almost all government departments in the country. all government services can be accessed through a single log-in: taxes, property, immigration, CPF (a plan similar to the 401(k)), healthcare and insurance, etc. are all on the same system. this might mean only one point of failure in any of the civil departments is needed to gain access to a lot of details about a person living in Singapore, resident or not. afaik, few other countries have integration as tight as this, so a failure somewhere could be contained. I suspect it is more vulnerable here.

jpatokal 10y ago
Problem is, since everything accessible via this single log-in is by definition open to the public Internet (because otherwise citizens can't use it), cutting government bureaucrats off the net does precisely nothing to reduce this attack surface or secure this data.
- princeb 10y ago
  you might get personal details of a single person by going through the public internet, but find your way onto a civil servant's machine and you might get personal details of everyone in Singapore. guessing it's probably going to be like how you access microdata in the US.
  - jpatokal 10y ago
    That public website is pulling the data from somewhere, yes? So if you can hack into that, you can likely extract all the data. I suspect this is more about the Singaporean government being paranoid about internal gov't docs leaking out, which airgapping would go some way to preventing. This is, after all, the country that tried journalists for revealing a deep dark secret: GDP growth figures. http://www.nytimes.com/1993/10/22/news/22iht-sing_0.html http://www.nytimes.com/1993/10/22/news/22iht-sing_0.html (Yes, that's 1993. But still.)
    - princeb 10y ago
      unauthorized dissemination of economic data is a serious offense in many countries. in the states, you can go to prison for it. in this Singapore case, the journalists and the official involved were fined. no jail. lucky them. the official involved is now our deputy PM and chairman of the central bank, after holding various ministerial positions in the last few decades.
      - bkor 10y ago
        > unauthorized dissemination of economic data is a serious offense in many countries. We're talking about GDP growth figures. Those can be under an embargo, but these should NOT be hidden. Pointing at others isn't needed.
        princeb 10y ago
        they were not hidden. they were released ahead of time. the uncanny accuracy of an expectation article a month before the official release led to the opening of the case
    - galdosdi 10y ago
      Yeah, but hacking into some random entry level public servant's desktop (and then using that to get to the mainframe) is probably a lot easier than hacking directly into the mainframe (or racks in a DC, who knows) that actually stores the data. The latter may take technical chops if singapore IT has their security together, but the former can be done by just spear phishing, leaving usb keys on the street, etc

by princeb 10y ago

jpatokal 10y ago

Problem is, since everything accessible via this single log-in is by definition open to the public Internet (because otherwise citizens can't use it), cutting government bureaucrats off the net does precisely nothing to reduce this attack surface or secure this data.

princeb 10y ago
you might get personal details of a single person by going through the public internet, but find your way onto a civil servant's machine and you might get personal details of everyone in Singapore. guessing it's probably going to be like how you access microdata in the US.
- jpatokal 10y ago
  That public website is pulling the data from somewhere, yes? So if you can hack into that, you can likely extract all the data. I suspect this is more about the Singaporean government being paranoid about internal gov't docs leaking out, which airgapping would go some way to preventing. This is, after all, the country that tried journalists for revealing a deep dark secret: GDP growth figures. http://www.nytimes.com/1993/10/22/news/22iht-sing_0.html http://www.nytimes.com/1993/10/22/news/22iht-sing_0.html (Yes, that's 1993. But still.)
  - princeb 10y ago
    unauthorized dissemination of economic data is a serious offense in many countries. in the states, you can go to prison for it. in this Singapore case, the journalists and the official involved were fined. no jail. lucky them. the official involved is now our deputy PM and chairman of the central bank, after holding various ministerial positions in the last few decades.
    - bkor 10y ago
      > unauthorized dissemination of economic data is a serious offense in many countries. We're talking about GDP growth figures. Those can be under an embargo, but these should NOT be hidden. Pointing at others isn't needed.
      - princeb 10y ago
        they were not hidden. they were released ahead of time. the uncanny accuracy of an expectation article a month before the official release led to the opening of the case
  - galdosdi 10y ago
    Yeah, but hacking into some random entry level public servant's desktop (and then using that to get to the mainframe) is probably a lot easier than hacking directly into the mainframe (or racks in a DC, who knows) that actually stores the data. The latter may take technical chops if singapore IT has their security together, but the former can be done by just spear phishing, leaving usb keys on the street, etc