It was an alarming headline taken from an article by Yahoo!SG: “S’pore among 25 govts using spy software: researchers.” The article, revolving around a report published by Citizen Lab, a think-tank at the University of Toronto, about a form of intrusion and surveillance software called FinSpy, made by UK-based Gamma Group International, suggested that the Singaporean government has been using software that allows them to “grab images off computer screens, record Skype chats, turn on cameras and microphones and log keystrokes.” A frightening thought…if it were true.
A closer look at the original Citizen Lab report reveals that the researchers merely found a “command and control” server for FinSpy in Singapore, operated by the company GPLHost. That company provides multi-domain hosting and has a presence in cities like Seattle, Paris, Singapore, Kuala Lumpur and Sydney, with most of their servers managed remotely.
The presence of a server in Singapore running FinSpy does not mean that it is being operated by a Singaporean, much less the Singaporean government. The Ministry of Home Affairs has denied that the government uses FinSpy (and the Yahoo!SG article has since been updated to reflect this).
Citizen Lab’s report may have triggered a false alarm, but many Singaporeans wonder about the degree of internet freedom they actually enjoy.
Chong Kai Xiong is a computer programmer who has volunteered with civil society groups, helping them with tech support and giving tips on IT security. “I would be somewhat surprised to see the government using FinSpy and similar software,” he said. “The main reason for my reservation is that FinSpy is intrusive and involves deception. Its installation is not automatic; the user must be deceived to click on the program stored in an email attachment. If found out, I think they would be in a lot of political and legal trouble.”
However, Chong warned that there is still a possibility of the government relying on some form of online surveillance. “The common uses of the Internet are not well secured by design, which is unfortunate. A lot of unencrypted data gets sent over the wire. If the government is able to wiretap our connections, which is very likely, they can gain a lot of information. But the thing is that there is no proof of this yet.”
Of course, internet surveillance is not the sole option open to governments. Old school methods exist too, and Singaporean activists have not failed to notice the government’s efforts to keep tabs on them.
Martyn See, a filmmaker whose political subjects have led to some of his work being banned in the country, added, “I believe that the government is monitoring dissidents and suspected religious extremists online. The US State Department’s annual human rights report on Singapore states so, and the Singapore government has never refuted that.”