S’porean pleads guilty to identity ‘harvesting’ using SingPass accounts

SINGAPORE — In the span of five months, he successfully “harvested” personal details of nearly 300 Singaporeans, which he sold to a China-based syndicate that was making sham visa applications for Chinese nationals seeking to enter Singapore.

James Sim Guan Liang, 39, obtained the personal details of these people because they used their NRIC number as their password for their SingPass login credentials.

Out of tens of thousands of attempts using NRIC numbers he had randomly picked, he succeeded in logging in to 293 individuals’ SingPass account between January and May 2011.

Today (Jan 25), Sim pleaded guilty to 73 charges, including 46 counts of unauthorised access to computer materials and 23 counts of unauthorised disclosure of any access code to access data under the Computer Misuse and Cybersecurity Act. Another 813 charges will be taken into consideration when he is sentenced.

The court heard that since 2006, Sim has been involved in syndicated identity trafficking through the now-defunct social networking website WhoLivesNearYou.com.

He met a Chinese national — known only as “Lemon” — through meet-ups with members from the site who had continually asked if Sim wanted to make money by handing over his NRIC in exchange for S$100.

He knew that his details were to be used to sponsor visa applications for Chinese nationals who wanted to come to Singapore but allowed this to continue for two years, until applications made using his NRIC number were rejected.

The prosecution said that after Sim “stumbled on the fact that NRIC numbers were actually in running order” and that the system did not stop NRIC numbers being used as SingPass passwords, he started to gather and sell SingPass credentials of others.

From his Toa Payoh home, Sim started trying to log in to the e-services portal of the Media Development Authority Singapore or the Central Provident Fund Board with random NRIC numbers. He systematically changed the last one or two digits and suffix of NRIC numbers in running sequence, chalking up tens of thousands of attempts to “harvest” personal particulars of strangers for sale to the syndicate.

Sim compiled these SingPass credentials before e-mailing them in batches to Lemon. He was paid S$300 for each batch of credentials, which were used to sponsor sham visa applications for Chinese nationals.

Twenty-three applications were successful, and of these, 20 Chinese nationals entered Singapore. Three of them subsequently committed criminal offences here — including overstaying and harassment charges — and were dealt with and repatriated.

Sim’s offences came to light when the Immigration and Checkpoints Authority of Singapore detected numerous suspicious visa applications made using a common credit card. The applications were also largely made through an IP address traced to Zhejiang, China, although none of the purported sponsors of the visa applications were in the country then.

The identities of Lemon and others from the syndicate remain unknown.

Sim faces a maximum penalty of two years’ jail and a S$5,000 fine for each of his charges for unauthorised access. He faces a maximum penalty of three years’ jail and a S$10,000 fine for each charge of unauthorised disclosure.

His next hearing has been fixed for Feb 26.