Pedestrians cross a bridge in the Marina Bay area in Singapore as the pandemic begins to fade (Joseph Nair/NurPhoto via Getty Images)

The split seams in Singapore’s crisis controls

The region borrows from Singapore’s crisis machinery without noticing the gaps its own inquiries have already described.

Prathap Latchmanan

25 September 20264 min read

Australia’s official Covid-19 inquiry (Opens in new window) pointed to Singapore’s “unified and coherent governance model” as a lesson for crisis decision-making. It was right to. The more useful documents are the ones admirers skip: the inquiry reports that follow each failure and set out, in public, what the machinery could not reach.

Singapore does publish these. The Committee of Inquiry into the 2018 SingHealth cyber attack (Opens in new window) issued a public report of more than 400 pages. The White Paper on Singapore’s response to Covid-19 (Opens in new window) devotes a section to the migrant worker dormitory outbreak. The Committee of Inquiry into the 2013 Little India riot (Opens in new window) recommended cutting the layers of approval needed to activate the Special Operations Command.

I am Singaporean, and this is my own country’s record. Each of these inquiries named wiring failures – whether radio connectivity, approval layers, data pipes or escalation thresholds – and Singapore acted on them. Singapore is good at that work, which is why the WHO’s Director-General called it (Opens in new window) “a good example of an all-of-government approach”.

But there are still gaps that need to be closed.

Both are doing their jobs properly on their own terms. The failure belongs to the space between them.

Take the SingHealth report on an attack that exposed the personal particulars of almost 1.5 million patients. Its most damaging finding is an absence. “There is also no written protocol for how [Integrated Health Information Systems] staff who discover an IT security incident affecting a Cluster’s assets are to assess and report the matter.” IHiS is the central IT agency for the public healthcare system, since renamed Synapxe, and the cluster is the hospital group whose patients were exposed. Two institutions examined one event under different professional obligations, yet no written path connected them. The inquiry also found that the cluster’s information security officer “did not understand the significance of the information provided to him” and “effectively abdicated to the SIRM the responsibility of deciding whether to escalate the incident”. The SIRM is the security incident response manager, a technical role. The person responsible for escalation could not read what he had been handed.

The White Paper on the Covid outbreak records the same information on page 54. “We also lacked a consolidated picture of migrant workers who may have sought treatment for Acute Respiratory Infection (ARI) symptoms from different service providers, for instance, from non-governmental organisations (NGOs).” Employers held a fragment. So did dormitory operators, general practitioners, two ministries and the NGOs. No one was withholding. The White Paper states the cost in its own words: “Without a clear picture of the health risks, we were unable to justify taking the drastic step to restrict movements from and within dormitories.”

Call these seam failures. Information is there but not shared. A professional reaches a sound judgement, correct within the boundaries of their own institution, and it stops there. The next professional along holds information that would change that judgement and lacks the standing to force the crossing. Both are doing their jobs properly on their own terms. The failure belongs to the space between them.

Inquiries struggle with this, for a reason that has nothing to do with candour. An inquiry has to produce recommendations, and recommendations need an owner. Ministries own structures. Nobody owns a seam. So the finding is written down accurately, then converted into the nearest fix that has an owner: a new protocol, a clearer reporting line. Those fixes are worth having but do not reach the problem. Crossing a professional boundary while a crisis is still running requires someone to act against the instincts their institution spent a career building into them, and no protocol confers that.

Getting the structures right (Bruno BD/Unsplash)

This matters beyond Singapore, because others borrow from it. Australia modelled its COVIDSafe app (Opens in new window) on Singapore’s TraceTogether. What travels is the part that was working. A seam does not appear on a wiring diagram, and forms in a different place in every state, depending on which professions hold authority there. A country that adopts Singapore’s crisis command with a more powerful health ministry, or a police service of different standing, will find its seams elsewhere.

After most national exercises, the question asked is whether the agencies coordinated. Better to ask a different one. Ask how many times someone acted on information that arrived from outside their own profession, against their own institutional instinct, before authority caught up. On my reading of the published record, that behaviour is rarely designed for and almost never measured.

Singapore’s inquiries are unusually honest documents. They describe the seam clearly, every time. The recommendations then reach for the wiring, because wiring is what a recommendation can hold. Anyone borrowing the architecture should also read the paragraphs the recommendations left behind.

About the author

Prathap Latchmanan

Prathap Latchmanan served 19 years in the Singapore Armed Forces, leaving in August 2026 as a Lieutenant Colonel and Head of Joint Training Plans Branch.

Topics

Singapore Government & politics Cyber & technology Covid-19