SINGAPORE — Singapore already boasts one of the world's most advanced national digital identity programs, SingPass, which residents can use for more than 400 digital services, including accessing tax returns and applying for public housing.
Now, they can use it with just their faces.
Singapore's 4 million people will be able to access government services and more through a new facial verification feature in its national identity program, the country announced in July. Dubbed SingPass Face Verification, the new feature allows users to securely log in to their accounts without the need to remember passwords, and it is meant to be used at public kiosks and on home computers, tablets and mobile phones. It was also tested at a bank in July.
The rollout is part of the government's 2.4 billion-dollar ($1.75 billion U.S.) Smart Nation initiative, launched in 2014, under which the country has revamped its online government services, such as providing access to open data, adding interconnected lampposts with sensors and introducing cashless payment systems. The island state boasts a robust 4G wireless network and about 1.5 smartphones per person, according to the country's telecommunications regulator, the Infocomm Media Development Authority.
Face recognition and verification technology has advanced quickly in recent years, powering Snapchat filters and concert security to software that can unlock iPhones and make sure people are wearing masks. In China, facial recognition technology has become a significant part of the security and surveillance system.
Singapore's rollout of facial verification to SingPass is one of the biggest efforts yet to weave the technology into everyday life. But it comes with warnings from privacy advocates and technology watchdogs about the risk of abuse.
Indulekshmi Rajeswari, a Singaporean privacy lawyer and LGBTQ activist who is based in Germany, said the government has not yet clearly explained the benefits of facial recognition, noting that the government is exempt from data privacy laws.
"Even if we say that rogue government employees are not the problem, I can think of a lot of problems where the whole of the government will find ways to legally misuse the technology to surveil their citizens," she said.
Singapore's Government Technology Agency, or GovTech, has said the data that is collected is "purpose-driven," meaning that it is collected only for a particular transaction and that the selfie data stored on secured government servers is deleted after 30 days.
The new face verification system could also be used in private-sector organizations and in education, where "proof of presence is required when a student takes his or her examinations." That having been said, no personal data will be shared with the private sector, GovTech said.
The agency also said deploying the facial verification feature will allow older Singaporeans easier access to online banking services without the need to manage multiple accounts and passwords.
Singapore's system includes some features to prevent people from trying to hack the technology.
The new system was jointly developed by iProov, a United Kingdom-based biometric authentication supplier, and Toppan Ecquaria, a Singapore-based digital government service platform provider. Instead of just verifying the face being presented to the camera, iProov's Genuine Presence Assurance technology uses the screen to illuminate a user's face with a cryptographic sequence of colors, which takes less than 7 seconds. It can be used on any device, as long as it has a screen, including web browsers.
The technology claims to be able to prevent logins made with photographs, masks and deepfakes. It has been tested by the U.S. Department of Homeland Security and the U.K. government, as well as the Singapore government. It can also prevent replay attacks, which use a recording of a person's face to authenticate.
"A deepfaker can't predict the color sequence to put onto their forgery of your face, so it prevents deepfakes, too. And of course real, live human faces reflect the colors differently from photos, screens or masks, so we spot those reliably, too," said Andrew Bud, iProov's CEO and founder.
Besides Singapore, iProov is working to get its system deployed in the United States at land borders as part of the Trusted Traveler Program, and it is already being used in the U.K.'s immigration and health agencies.