GEIS-新闻详情

New law mooted to minimise digital service disruptions due to cloud, data centre outages

2024-03-01 00:00:00.0 海峡时报-新加坡原网页

SINGAPORE – Singapore is mulling over a new law to hold cloud services and data centre operators to greater accountability, recognising that any failure of their infrastructure could disrupt Singapore’s economy and society.

The Digital Infrastructure Act (DIA) comes on the back of recent outages in the banking and healthcare sectors that MPs said have dented public confidence.

“The DIA will focus on digital infrastructure that can cause significant impact on the economy and society, if disrupted,” Minister for Communications and Information Josephine Teo told Parliament on March 1.

She said that cloud service players and data centres power a wide array of digital services that enterprises and consumers use daily. These include online banking and payments, e-government services, ride-hailing and digital identity management.

“These operators may, therefore, need to meet higher security and resilience standards to reduce the likelihood of systemic disruptions,” Mrs Teo said during the debate on her ministry’s budget.

For instance, on Oct 14, 2023, more than 2.5 million payment and ATM transactions could not be completed by DBS Bank and Citibank customers.

The disruptions were caused by a fault in the cooling system of an Equinix data centre used by the two banks.

Catch up on the news that everyone’s talking about

Thank you!

By signing up, I accept SPH Media's Terms & Conditions and Privacy Policy as amended from time to time.

Yes, I would also like to receive SPH Media Group's SPH Media Limited, its related corporations and affiliates as well as their agents and authorised service providers.

marketing and promotions.

While the disaster recovery and contingency plans of both banks kicked in, their services were fully restored only in the early hours of Oct 15.

Also, on Nov 1, 2023, the websites of major public hospitals, polyclinics and healthcare clusters in Singapore crashed for seven hours.

Ms Tin Pei Ling (MacPherson) said that the disruptions affected the public’s trust in digital services and urged that minimum standards be put in place.

Mr Christopher de Souza (Holland-Bukit Timah GRC) also said that risks must be properly allocated to the right commercial entities to incentivise risk management.

Meanwhile, Ms Jessica Tan (East Coast GRC) and Mr Xie Yao Quan (Jurong GRC) asked how Singapore could bolster the security and resilience of its infrastructure.

Mrs Teo replied that an inter-agency task force led by the Ministry of Communications and Information is drafting the scope of the DIA, which will complement upcoming amendments to the six-year-old Cybersecurity Act.

The Cybersecurity (Amendment) Bill, to be tabled in Parliament next week, seeks to compel digital infrastructure and service providers to report cyber attacks within hours or comply with specified safety standards.

Failing to do so may result in penalties.

Remote video URL

“While enhancing our cyber-security posture is important, it is not enough. Past outages in Singapore and elsewhere have shown that disruptions can occur due to non-cyber causes,” said Mrs Teo.

Thus, the DIA aims to address a broader set of resilience risks faced by digital infrastructure and service providers, including misconfigurations in cloud architecture and outages caused by fires, water leakages and cooling system failures, said Mrs Teo.

The Cybersecurity (Amendment) Bill and DIA borrow concepts from similar legislations in the European Union, Germany and Australia that require major outages and cyber incidents to be reported to the authorities, among other obligations.

Players that could come under both legislations in Singapore include data centre operators Equinix and Microsoft, as well as cloud service providers Google and Amazon Web Services.