The Singapore CNA Insider investigation: how phone and laptop repair shops snoop and copy your data

Channel News Asia ran a multi-part Insider investigation in 2024 that mirrored, at scale, the methodology of the University of Guelph experiment two years earlier. Reporters left tagged-photo, tagged-document devices at Singapore phone and laptop repair shops, with the consent of the device owners (themselves CNA staff). The devices were instrumented with forensic logging.

The findings, in their own words, were that some technicians browsed customer files outside the work scope, that some copied data to external storage, and that in a smaller subset there was evidence of external transfer. The piece is one of the most methodical mass-market repair-shop expose ever published in English-speaking media.

§ Why CNA was able to publish what it published

The CNA investigation worked because the journalists controlled both ends of the experiment:

1. 01Consent on the device side. The owners knew the devices were instrumented and gave consent. This sidestepped the legal complexity of recording a third party.
2. 02Tagged data as the fingerprint. The decoy files had unique markers, so any later appearance elsewhere could be traced back to the specific shop visit.
3. 03Forensic logging as the evidence layer. The article is grounded in concrete events with timestamps, not anecdote.

This is the same evidence layer we ship to consumers, generalised. Tagged decoys are useful when you want to characterise a population. Forensic recording of your own device is what you actually want when you need per-incident evidence.

§ What Singapore is doing about it

Singapore Personal Data Protection Act (PDPA) is one of the more enforced data-protection regimes in the region. After the CNA investigation, there was incremental movement: more shops introduced explicit data-handling consent forms, the trade press began debating audit-log requirements, and the PDPC (Personal Data Protection Commission) took some additional advisory positions on third-party access scenarios.

What did not change at industry level was a mandated tamper-evident bench log. As of writing, no jurisdiction has imposed that requirement on the consumer repair industry.

§ Practical implications

The Singapore investigation is most useful as a teaching tool. It demonstrates, with a concrete dataset, that the snooping pattern documented in Canada (Guelph), in India (Kolkata, Trivandrum), and in the United States (Apple/Pegatron, Geek Squad) is also present in Singapore. The unifying factor is structural, not cultural.

Practically: bring your own evidence layer (Black Box on Windows, the pre-repair checklist for everything else). And read the full incident catalogue if you want to see how often this comes up.