Shutdown of Anti-SMS Spoofing Registry
Ministry of Digital Development and InformationSpeakers
Summary
This question concerns the transition from a pilot SMS registry to the full-fledged Singapore SMS Sender ID Registry (SSIR) and its specific advantages. Mr Yip Hon Weng asked about the rationale for replacing the pilot program, its benefits over international practices, and the onboarding timeline. Senior Minister of State Dr Janil Puthucheary explained that the SSIR proactively blocks spoofed messages and offers an affordable pricing model for SMEs. He reported that over 1,000 Sender IDs have been registered since March 2022, involving 25 organizations including banks and government agencies. Senior Minister of State Dr Janil Puthucheary added that authorities will monitor the landscape to determine if registration should eventually become mandatory.
Transcript
35 Mr Yip Hon Weng asked the Minister for Communications and Information (a) why was the anti-SMS spoofing registry shut just about over a month after Government agencies announced their intent to join the registry; (b) whether adequate time was given for the agencies to assess the new decision; (c) what are the ways by which the full-fledged Singapore SMS Sender ID Registry will be superior; (d) how will it put us in line with international practices; and (e) what is the timeline for banks, Government agencies and interested organisations to be fully onboarded.
The Senior Minister of State for Communications and Information (Dr Janil Puthucheary) (for the Minister for Communications and Information): Sir, the Infocomm Media Development Authority (IMDA) and its subsidiary, the Singapore Network Information Centre (SGNIC), have set up a full-fledged Singapore SMS Sender ID Registry (SSIR) which commenced operations on 4 March 2022. It replaced the SMS SenderID Registry pilot, which was started by IMDA and MAS in August 2021 and that pilot was done in collaboration with the UK Mobile Ecosystem Forum (MEF).
Under the previous MEF model, spoofed SMSes that use a registered Sender ID will still be received by consumers until the Sender ID owner confirms that the spoofed SMSes are not legitimate and should be blocked. The new SSIR takes a more proactive approach. It can block spoofed SMSes upfront and provide a greater control over anti-spoof measures that better protect Singaporeans. The pilot with MEF provided useful insights which have helped IMDA to set up SSIR quickly. In addition, SSIR will offer a more affordable pricing model to enable more widespread participation, especially for SMEs that are interested to sign up for the service.
Internationally, Singapore is one of the first few countries to have implemented a national SMS Sender ID Registry to better prevent spoofed SMSes. As of 30 March 2022, 25 organisations, including banks and Government agencies, have joined SSIR. Organisations, such as the Association of Banks in Singapore (ABS), Mobile Network Operators and SMS service providers, are in full support of SSIR, which continues to onboard new organisations interested in protecting their SMS Sender IDs.
Mr Speaker: Mr Yip Hon Weng.
Mr Yip Hon Weng (Yio Chu Kang): Thank you, Mr Speaker. I thank the Senior Minister of State for his reply. Will SSIR be made mandatory for banks and Government agencies? What agencies will be exempted and what penalties will be meted out if the required agencies do not join the registry?
Dr Janil Puthucheary: Sir, SSIR was set up to protect organisations that wish to register their SMS Sender IDs to prevent spoofing. With the pricing model, we hope that it is affordable, especially for SMEs. Specifically, organisations would pay a one-time set-up fee of $500 and $1,000 for every 10 Sender IDs. This makes it more affordable for smaller companies and organisations, such as SMEs, which would have fewer Sender IDs to register.
Having said that, so far, as of 30 March, there are more than 1,000 protected SMS Sender IDs in the registry already. So, IMDA will monitor the landscape to study if the registration of SMS Sender IDs should be mandatory or if there should be another framework in place.