SingHealth cyber attack: First COI hearing on Aug 28, to be closed-door

SINGAPORE – The Committee of Inquiry (COI) looking into events and factors leading to the cyber attack on public healthcare cluster SingHealth will hold its first hearing closed-door on Aug 28.

The COI, chaired by retired senior judge Richard Magnus, said it is in the interests of national security that some hearings will be held behind closed doors, or in camera. For instance, the evidence may be exploited to carry out further cyber attacks or patients’ personal data may be revealed.

All other hearings will be held in public. Hearings held after Aug 28 will consist of both public and closed-door hearings, the COI said in a statement on Tuesday (August 7), the same day it held its first pre-inquiry conference.

Expert witnesses will be called to give evidence on cybersecurity measures. The COI will also receive public submissions, and will advise the public how and when they should make their submissions.

The COI will conduct a site visit to SingHealth to be briefed on the network architecture of the affected IT systems and the cybersecurity measures in place before the attack.

In Singapore’s worst cyber attack, which took place between June 27 and July 4 and which the Government announced on July 20, sophisticated hackers stole the personal data of 1.5 million SingHealth patients. Of the patients affected, 160,000 of them including Prime Minister Lee Hsien Loong also had information on their outpatient medication stolen.

The attack was the work of an advanced persistent threat group that could be state-linked, said Minister for Communications and Information S Iswaran in Parliament on Monday.

The hackers used advanced tools including customised malware that was able to evade SingHealth’s anti-virus software and security tools.

For national security reasons, Mr Iswaran said the Government will not name the party it believes is behind the attack.

Member of Parliament and former Workers’ Party chief Low Thia Khiang asked if the Government could disclose the state that was linked to the cyber attack, if the authorities knew the name of the group behind the attack and from where it was launched.

Mr Iswaran reiterated that the Government will not attribute the attack specifically. “In this sort of matter, while one can have a high level of confidence, one may not be able to have the certainty that you might need in order to specifically assign responsibility, and this is the kind of evidentiary threshold that may not stand up in a court of law,” he said.

“But at the operational level, the agencies that are involved have a high level of confidence.”

Besides Mr Magnus, the other three members of the COI are Mr Lee Fook Sun, executive chairman of cybersecurity solutions firm Quann World; Mr T K Udairam, group chief operating officer of healthcare technology firm Sheares Healthcare Management; and Ms Cham Hui Fong, assistant secretary-general of the National Trades Union Congress.

The COI was convened on July 24 and held its first administrative meeting the next day.

Mr Magnus also met with Solicitor-General Kwek Mean Luck, who has been designated by the Attorney-General to lead evidence in the inquiry. They discussed the appointment of investigators to assist the COI.

At Tuesday’s pre-inquiry conference, Mr Kwek informed the COI that the Public Prosecutor had appointed an investigation team led by the Cyber Security Agency and supported by the Criminal Investigation Department.

Mr Kwek requested for time to fully investigate into the matters set out in the terms of reference. The COI – which is to submit its report by Dec 31 – agreed and will receive an update on the status of investigations at the next pre-inquiry conference. Mr Kwek said some aspects of investigations have been completed and that the Attorney-General’s Chambers would be ready to lead evidence from the first witness, whose identity was not revealed.