Laws changed to prepare for roll-out of iris scans at checkpoints
The move to collect iris images as an extra personal identifier, besides photographs and fingerprints, was among four proposed amendments to the National Registration Act tabled by the Ministry of Home Affairs (MHA). Reuters file photo
SINGAPORE — Laws were passed on Thursday (Nov 10) to allow the Government to scan the eyes of Singapore citizens and permanent residents and collect the iris images, in a bid to strengthen identity verification at immigration checkpoints, but this was not before parliamentarians raised privacy and security concerns.
Some were uneasy about how such technology — so advanced it can suss out identities metres away — could encroach on privacy, while others raised the issue of how such data may be vulnerable to cyberattacks.
The move to collect iris images as an extra personal identifier, besides photographs and fingerprints, was among four proposed amendments to the National Registration Act tabled by the Ministry of Home Affairs (MHA).
In the next two years, the authorities will progressively roll out iris-scanning technology at the country’s checkpoints.
Senior Minister of State (Home Affairs) Desmond Lee said that the collection of iris images is slated to begin next year. This would be done during registration and re-registration for the National Registration Identity Card (NRIC) at ages 15 and 30 respectively, and during passport applications and renewals.
The iris scans are meant to complement the existing identity-verification methods using photographs and fingerprints. Fingerprints, for instance, may fade as a person ages or does a great deal of manual work, Mr Lee said.
He added that some travellers found it difficult to use the automated clearance at checkpoints because of poor fingerprint quality, for example, and had to be directed to the manned counters. Iris scans, which can be done in seconds, will help get around this difficulty, and they will cut down overall waiting times in queues as well.
However, given that iris scans are contactless, there is the spectre of covert scanning, as opposed to fingerprint scans, which require “active participation”, Member of Parliament (MP) Patrick Tay said.
Citing scientific sources, he told the House that such scans could take place “as far as 12m away”, and asked what safeguards are and would be in place to prevent data possibly collected by non-consensual means from being misused. Stolen iris scans may give rise to identity theft, for example.
MP Joan Pereira, who shared similar concerns, said that some researchers had already found a way to recreate synthetic eye images that match digital iris codes used by iris-recognition systems.
In response, Mr Lee said that studies showed “very sophisticated equipment” would be needed to replicate iris patterns. Biometric systems for iris recognition also have built-in mechanisms to ensure the data are authentic.
Another amendment to the Act allows the Immigration & Checkpoints Authority (ICA) to appoint people outside the agency, such as private entities, to be registration officers. They perform “carefully selected” functions that include the enrolment of iris images.
Non-Constituency MP Leon Perera asked if such workers would be required to sign the Official Secrets Act and if the MHA would do a privacy impact assessment before outsourcing national-registration functions to firms, given the “highly sensitive” nature of personal identifiers.
MP Melvin Yong asked about measures to ensure officers protect and encrypt data appropriately.
Mr Lee said that the ICA has strict controls, for example, that allow only authorised ICA officers access to the database, and encryption of sensitive data such as iris images before storage.
Non-ICA employees will not perform sensitive functions such as accessing, retrieving or altering personal data. The data they collect would also be transmitted to the ICA directly, he assured.
Each employee would have to be appointed by ICA’s commissioner after “necessary screening measures” and be deemed “public servants” for the purposes of the penal code.
Apart from enhancing security checks, the amended laws will allow the ICA to refuse the registration of inappropriate names that run counter to public interest, such as one that is offensive or confusing, or resembles or represents a title, rank or award. Mr Lee said that registrations of inappropriate names, though “very few and far between”, happen from time to time.
ICA officers are also empowered under the changes to investigate offences under the Act, including seizing suspicious identity cards — a function previously performed only by the police.
In Parliament, Mr Lee revealed that the ICA is exploring having another re-registration phase for NRICs beyond the current re-registration age of 30 — so that data such as photos may be updated — and more details on this would be given “in due course”.
