SINGAPORE: Continuing to use masked National Registration Identity Card (NRIC) numbers would give Singaporeans a “false sense of security”, said Minister for Digital Development and Information Josephine Teo on Wednesday (Jan 8).
She was responding to a question from Member of Parliament Liang Eng Hwa (PAP-Bukit Panjang), who asked about the downsides to continuing to mask NRIC numbers, which he considered a “middle-ground approach”.
In her response to Mr Liang, Mrs Teo said masking NRIC numbers would be similar to using partial NRIC numbers, acknowledging that individuals and organisations would be comforted “psychologically” if full NRIC numbers are not known.
Algorithms that can guess or work out full NRIC numbers are now available online, especially if you know the birth year of the individual, she added.
“The ease of availability of such algorithms will mean that the continued use of masked NRIC numbers gives this false sense of security that will not go away,” said the minister.
If this false sense of security persists and people think that their full NRIC number is still a secret, continuing to use it as a password or an authenticator, the risk of scams or identity theft will rise, she added.
“We thought that the right thing to do was, whilst the problem is still relatively contained, we must try and bring a stop to this kind of practices,” said Mrs Teo.
Mrs Teo, alongside Second Minister for Finance Indranee Rajah, had earlier delivered ministerial statements in response to a slew of parliamentary questions filed by MPs on the recent saga.
The issue started in early December when ACRA's new Bizfile portal showed names and full NRIC numbers for free through its search function.
After a public outcry over privacy concerns, the government said on Dec 14 it had intended to change its practice of masking NRIC numbers only after explaining to citizens, but the new portal was launched before it could do so.
Days later, during a press conference, the government apologised for the “lapse of coordination”.
In parliament on Wednesday, Mr Xie Yao Quan (PAP-Jurong) asked for specific examples where the government will still require the use of full NRIC numbers and where other forms of identifier will be used.
With the planned move to unmask NRIC numbers, Mrs Teo noted that in some instances, “there will be no need for the NRIC number at all” and the use of names and other identifiers will be sufficient.
But there remain instances where full NRIC numbers will still be necessary, such as when applying for government subsidies.
“For example, if you are applying for subsidies, if you are hoping to access benefits that the government is able to provide to you, if you are laying claim to something important and something valuable to you, these would be instances where the full NRICs should be used,” the minister told the House.
Mrs Teo added that there are many such use cases and it “would not be possible at this point in time to list all of them”.
“There must be hundreds, if not thousands, of cases where internally or in … correspondence with citizens, there may be a reason to use some form of identification,” she said.
The government’s position is for each case to be carefully accessed. The process of deciding this has started but has not been completed, the minister added.
Ms Tin Pei Ling (PAP-MacPherson) asked about the government’s timeline for getting organisations to rectify their use of NRIC numbers for authentication.
The process of getting organisations to stop using NRIC numbers as authentication factors or default passwords will take time, given the amount of public education and outreach efforts that will be necessary, Mrs Teo replied.
But support is available, such as through the Personal Data Protection Commission and other government programmes that can put the organisations in touch with relevant experts and service providers, the minister added.
Dr Tan Wu Meng (PAP-Jurong) also asked if the government would continue to review how it approaches data collection, especially information that can be searched by the public or others outside of Singapore.
Ms Tin noted that Singaporeans are concerned about how their NRIC numbers can or cannot be used in scams or identity theft cases, and it would be helpful if the government could share more information about the safeguards in place.
In response, Mrs Teo noted that scammers usually use NRIC numbers to give the impression that they are authority figures.
“Very few of the scams, in fact, it is not quite so easy to pinpoint even one specific instance where the scammer was able to get hold of the NRIC number and then key that in to unlock the valuables,” she added.
Mr Yip Hon Weng (PAP-Yio Chu Kang) wanted to know what the government’s approach to NRIC numbers would be for less tech-savvy individuals like seniors, and how they would be educated on the risks of incorrectly using NRIC numbers.
Mrs Teo acknowledged that there will be “certain hard-to-reach segments”, including seniors or those of less privileged backgrounds, adding that the government is happy to work with the Silver Generation Office or Agency for Integrated Care to do so.
As for companies, trade associations and chambers who are “forward-leaning” have approached the government to better inform their members, including small to medium enterprises, on what to do, she added.
“We will use all channels available to the government in order to strengthen the outreach, and if members have suggestions on any groups that we may have missed out, please feel free to let us know too.”
Continue reading...
She was responding to a question from Member of Parliament Liang Eng Hwa (PAP-Bukit Panjang), who asked about the downsides to continuing to mask NRIC numbers, which he considered a “middle-ground approach”.
In her response to Mr Liang, Mrs Teo said masking NRIC numbers would be similar to using partial NRIC numbers, acknowledging that individuals and organisations would be comforted “psychologically” if full NRIC numbers are not known.
Algorithms that can guess or work out full NRIC numbers are now available online, especially if you know the birth year of the individual, she added.
“The ease of availability of such algorithms will mean that the continued use of masked NRIC numbers gives this false sense of security that will not go away,” said the minister.
If this false sense of security persists and people think that their full NRIC number is still a secret, continuing to use it as a password or an authenticator, the risk of scams or identity theft will rise, she added.
“We thought that the right thing to do was, whilst the problem is still relatively contained, we must try and bring a stop to this kind of practices,” said Mrs Teo.
Mrs Teo, alongside Second Minister for Finance Indranee Rajah, had earlier delivered ministerial statements in response to a slew of parliamentary questions filed by MPs on the recent saga.
The issue started in early December when ACRA's new Bizfile portal showed names and full NRIC numbers for free through its search function.
After a public outcry over privacy concerns, the government said on Dec 14 it had intended to change its practice of masking NRIC numbers only after explaining to citizens, but the new portal was launched before it could do so.
Days later, during a press conference, the government apologised for the “lapse of coordination”.
WHEN WILL FULL NRIC NUMBERS STILL BE REQUIRED?
In parliament on Wednesday, Mr Xie Yao Quan (PAP-Jurong) asked for specific examples where the government will still require the use of full NRIC numbers and where other forms of identifier will be used.
With the planned move to unmask NRIC numbers, Mrs Teo noted that in some instances, “there will be no need for the NRIC number at all” and the use of names and other identifiers will be sufficient.
But there remain instances where full NRIC numbers will still be necessary, such as when applying for government subsidies.
“For example, if you are applying for subsidies, if you are hoping to access benefits that the government is able to provide to you, if you are laying claim to something important and something valuable to you, these would be instances where the full NRICs should be used,” the minister told the House.
Mrs Teo added that there are many such use cases and it “would not be possible at this point in time to list all of them”.
“There must be hundreds, if not thousands, of cases where internally or in … correspondence with citizens, there may be a reason to use some form of identification,” she said.
The government’s position is for each case to be carefully accessed. The process of deciding this has started but has not been completed, the minister added.
Ms Tin Pei Ling (PAP-MacPherson) asked about the government’s timeline for getting organisations to rectify their use of NRIC numbers for authentication.
The process of getting organisations to stop using NRIC numbers as authentication factors or default passwords will take time, given the amount of public education and outreach efforts that will be necessary, Mrs Teo replied.
But support is available, such as through the Personal Data Protection Commission and other government programmes that can put the organisations in touch with relevant experts and service providers, the minister added.
Related:
PREVENTING SCAMS
Dr Tan Wu Meng (PAP-Jurong) also asked if the government would continue to review how it approaches data collection, especially information that can be searched by the public or others outside of Singapore.
Ms Tin noted that Singaporeans are concerned about how their NRIC numbers can or cannot be used in scams or identity theft cases, and it would be helpful if the government could share more information about the safeguards in place.
In response, Mrs Teo noted that scammers usually use NRIC numbers to give the impression that they are authority figures.
“Very few of the scams, in fact, it is not quite so easy to pinpoint even one specific instance where the scammer was able to get hold of the NRIC number and then key that in to unlock the valuables,” she added.
Mr Yip Hon Weng (PAP-Yio Chu Kang) wanted to know what the government’s approach to NRIC numbers would be for less tech-savvy individuals like seniors, and how they would be educated on the risks of incorrectly using NRIC numbers.
Mrs Teo acknowledged that there will be “certain hard-to-reach segments”, including seniors or those of less privileged backgrounds, adding that the government is happy to work with the Silver Generation Office or Agency for Integrated Care to do so.
As for companies, trade associations and chambers who are “forward-leaning” have approached the government to better inform their members, including small to medium enterprises, on what to do, she added.
“We will use all channels available to the government in order to strengthen the outreach, and if members have suggestions on any groups that we may have missed out, please feel free to let us know too.”
Continue reading...