ScamShield privacy concerns
The article's description of ScamShield from the Singaporean government doesn't sound great from a privacy perspective. I don't doubt that it does track and block scammers, but it is also in a position to collect a bunch of private communications. Singapore is not a government well-known for respecting its citizens' rights, although to be honest there are few governments with an unblemished record on that.
I was hoping to find a technical analysis of the system online, but some quick searches didn't turn one up. It did find a wonderfully disconcerting FAQ page. I'm not sure whether the phrases there are legitimately summarizing the risks for a nontechnical audience or trying to gloss over the truth, but the parts about privacy and security risks appear wrong. A few examples:
Are there any privacy concerns with using the app?
No, both iOS and Android have strict privacy rules on what ScamShield can or cannot read. If a message comes from a contact saved on your phone, the SMS will not be sent to ScamShield. [...] Only messages sent by unknown persons via SMS will be read by the AI.
I am not familiar with any permission that works like this; usually, it's all SMS or none, not just ones from unknown numbers. For example, the
service for handling calls doesn't have any exceptions built into it, so unless they're using something else, they see all incoming and outgoing calls.
Once installed, can hackers hack into my phone if the app is compromised?
As the app does not individually identify any users, and it does not access any other data on your phone, you and your phone are not at risk if the app is compromised.
This is just wrong. It doesn't identify users, unless the attackers manage to compromise the app in which case they can do that themselves. Whether there is a unique identifier has little or no relevance to whether an attack could happen. I think they might be saying here that the backend system doesn't send commands to the app, thus a compromised backend wouldn't allow code execution on the app, but the text doesn't say that specifically so it's just a guess.
I attempted to check the permissions using Exodus, an Android app privacy checker, but it can't scan it because it's restricted to Singapore.