Indian IT vendor jailed 28 weeks in Singapore over data breach

Indian national Janarthanan Tamil Kovan, 42, was sentenced to 28 weeks' jail in Singapore on Monday for endangering the safety of 18,016 State Courts files. He pleaded guilty under the Official Secrets Act and to making an unauthorised modification to a government-managed laptop. An employee of Lenovo PCCW Solutions, he was team leader of the courts' cloud system team. He granted an acquaintance remote access while attempting an examination, but no files were transferred.

Written by AI from NDTV — Top Stories · not yet reviewed by an editor · Published 29 Sept 2026, 9:09 am IST

Source

NDTV — Top Stories · read the original report ↗

#singapore#data breach#official secrets act#cybersecurity#court verdict

Desk check · compared with the source

What the desk checked (5)

Janarthanan Tamil Kovan, 42, was sentenced to 28 weeks' jail in Singapore on Monday. — Figure and date appear in source, attributed to local media reports via syndicated feed.
18,016 State Courts files were on the laptop when the remote connection was made; all but one were restricted and non-sensitive. — Specific figure appears in source, attributed to court documents cited by Channel News Asia.
No files were transferred during the remote session. — Stated in source without direct attribution to a named official; consistent with the rest of the account.
Prosecution sought seven to nine months' jail; defence sought three to four months. — Attributed to DPP Matthew Choo and defence lawyers S Balamurugan and A Ravidass.
Judge Lorraine Ho said risk of harm was great due to possible systemic attack and foreign access. — Attributed to the named district judge in the source.

Written by AI from NDTV — Top Stories · not yet reviewed by an editor · How we use AI · Report an error

Analysts’ view opinion

AI Strategic Affairs Analyst

On the surface this is an employee-negligence case; strategically it is a textbook convergence of insider risk and third-party vendor risk inside critical state infrastructure. Even though the court accepted that no files were transferred, the real exposure was that a device holding the State Courts' network architecture, login credentials and secret keys became reachable from a foreign IP address — effectively opening the door to an attacker's roadmap. Charging the case under the Official Secrets Act and imposing 28 weeks' jail signals Singapore is treating this as a national-security matter rather than an HR lapse.

Deep dive

Research brief · 8 facts · 5 dates · exam-ready

The brief

Context

An Indian national working in Singapore as an external IT vendor to the State Courts was jailed for 28 weeks after he let an acquaintance with an IP address in India remotely access his government-managed work laptop, which held 18,016 State Courts files. Janarthanan Tamil Kovan, 42, a service delivery manager with Lenovo PCCW Solutions and team leader of the State Courts' cloud system team, did so because his own laptop was faulty and he wanted to sit an IT governance certification exam. No files were transferred during the remote session, but the files contained login credentials, secret keys and network architecture details of the courts' network. He pleaded guilty under Singapore's Official Secrets Act and to making an unlawful modification to the laptop.

Key facts

Janarthanan Tamil Kovan, 42, an Indian national, was sentenced to 28 weeks' jail in Singapore on Monday.
He pleaded guilty to endangering the safety of State Courts and Government of Singapore documents under the Official Secrets Act and to unlawful modification of a government-managed laptop; a third charge was taken into consideration.
At the time of the remote connection, 18,016 State Courts files were stored on his Lenovo ThinkPad laptop.
All but one file were classified restricted and non-sensitive; one file was classified restricted and sensitive (high).
The files contained login credentials, secret keys and network architecture details of the State Courts' network; no files were transferred during the session.
In June 2024 he was attached to the State Courts as an external IT vendor, as a service delivery manager with Lenovo PCCW Solutions and team leader of the courts' cloud system team.
On Aug 4, 2025 he used the laptop to attempt a certified information security manager examination because his own laptop was faulty.
On Aug 14, 2025 a representative of the Singapore judiciary's Corporate Services Division lodged a police report about the unauthorised installation of the remote desktop application.

Timeline

June 2024Janarthanan, a service delivery manager with Lenovo PCCW Solutions, is attached to the State Courts as an external IT vendor and team leader of its cloud system team.
August 4, 2025Unable to operate the security-protected laptop for an information security certification exam, he contacts an acquaintance, Hari Balan, with an IP address in India, and grants remote access.
August 14, 2025The judiciary's Corporate Services Division lodges a police report over the unauthorised installation of the remote desktop application.
September 2025Janarthanan admits his actions endangered the safety of the files, which could have been transferred or stolen.
Monday (date of sentencing)District Judge Lorraine Ho sentences him to 28 weeks' jail; prosecution had sought seven to nine months, defence three to four.

Who has a stake

Janarthanan Tamil Kovan, 42 — Convicted and jailed 28 weeks; defence said he has a wife and two children in India and the family faces financial difficulties.
Singapore State Courts / judiciary — Custodian of 18,016 files whose credentials and network details could have enabled unauthorised access to case information and judges' notes.
Lenovo PCCW Solutions — Vendor employer whose own policy, along with GovTech's acceptable use policy, barred unauthorised access and modifications to the laptop.
GovTech (Singapore) — Sets the acceptable use policy governing government-managed devices such as the issued Lenovo ThinkPad.
Technology Crime Investigation Branch, Criminal Investigation Department — Investigated the unauthorised remote access case.
Prosecution and defence — DPP Matthew Choo sought 7-9 months' jail; lawyers S Balamurugan and A Ravidass sought 3-4 months.

Why it matters

The case shows how a single act of convenience by a trusted insider can expose an entire court system's credentials and network architecture to an unknown foreign entity, even when no data is actually stolen. It underlines the legal exposure of Indian IT professionals working as vendors on sensitive government systems abroad, where breaches of acceptable use policies can attract criminal liability under laws like the Official Secrets Act.

UPSC angle

Prelims pointers

Janarthanan Tamil Kovan, 42, jailed 28 weeks in Singapore for endangering 18,016 State Courts files.
Charges: Singapore's Official Secrets Act plus unlawful modification of a government-managed laptop; third charge taken into consideration.
Employer: Lenovo PCCW Solutions; device governed by GovTech's acceptable use policy.
Investigating agency: Technology Crime Investigation Branch, Criminal Investigation Department, Singapore.
Key dates: attachment June 2024; remote access Aug 4, 2025; police report Aug 14, 2025; admission September 2025.
Only one of the 18,016 files was classified restricted and sensitive (high); the rest restricted and non-sensitive.

Mains framing

The case is a textbook illustration of insider risk in outsourced government IT: a vendor employee entrusted with a device holding 18,016 State Courts files, including login credentials, secret keys and network architecture details, granted remote access to an acquaintance with an IP address in India merely to sit an information security certification exam on a faulty-laptop workaround. The immediate causes were personal convenience and disregard of two overlapping policies (GovTech's acceptable use policy and Lenovo's own), but the structural cause is the concentration of privileged access in outsourced team leaders. The implications are systemic rather than incidental: as District Judge Lorraine Ho noted, the risk of harm was great because credentials could enable a systemic attack and public alarm, and an unknown foreign entity gained access to data on the laptop — even though no files were transferred. The prosecution's point that the offender "ought to have known better" as head of the cloud system team, and that he did so ironically to take an information security exam, frames the accountability question. Deterrent sentencing, tighter device controls, monitoring of remote desktop installations and prompt reporting (the judiciary's police report came ten days later) are the visible responses in the source; broader policy prescriptions are not stated in the source.

Key terms

Official Secrets Act (Singapore): Law under which the accused pleaded guilty to endangering the safety of documents belonging to the State Courts and the Government of Singapore.
GovTech acceptable use policy: Singapore government rules governing use of government-managed devices; it prohibits unauthorised access and modifications to the issued laptop.
Certified Information Security Manager: Certification of an international professional association focused on IT governance, the exam for which the accused was attempting to take.
Remote desktop application: Software allowing another person to control a computer from elsewhere; its unauthorised installation triggered the judiciary's police report.
Technology Crime Investigation Branch: Unit of Singapore's Criminal Investigation Department that investigated the unauthorised access case.
Restricted and sensitive (high): Classification level of one of the 18,016 files; the remaining files were classified restricted and non-sensitive.

Practice questions

Insider threats, not external hackers, pose the gravest risk to government digital infrastructure. Discuss with reference to the outsourcing of critical IT functions.
Examine the legal and reputational risks faced by Indian IT professionals deployed on sensitive government projects abroad, using the Singapore State Courts data breach case.
Should courts treat data breaches where no data is actually transferred as seriously as completed thefts? Critically evaluate in light of the reasoning that the risk of systemic harm was great.

Grounded only in the source report — figures and dates are the source's, not inferred.

Next storyAirstrike near Myanmar market kills 49 in Rakhine →

← All stories