SINGAPORE: Opposition Members of Parliament questioned why the National Registration Identity Card (NRIC) unmasking issue was not brought to the House earlier, along with other clarifications on Wednesday (Jan 8).
Eight opposition MPs, including six from the Workers’ Party (WP) and two from the Progress Singapore Party (PSP), sought clarifications from Digital Development and Information Minister Josephine Teo and Second Minister for Finance Indranee Rajah, following their ministerial statements on the issue in parliament.
Here are some of the questions the MPs raised:
Leader of the Opposition Pritam Singh (WP-Aljunied) questioned why the matter of unmasking NRIC numbers was not brought to parliament earlier.
Noting that there had been feedback about unmasking NRIC numbers from previous public consultation exercises conducted by the Accounting and Corporate Regulatory Authority (ACRA), he said: “In view of the serious and significant public concern about how unmasking NRIC numbers took place could have occurred so easily, despite enough feedback about not just how the public but ACRA, itself, views the sanctity of NRIC numbers - by virtue of its consultation exercise in 2022 and 2024 - surely the matter would have had to be brought to parliament instead of simply interpreting a circular from the ministry.”
In response, Ms Indranee, who is also Minister in the Prime Minister’s Office, said this will be looked at in more detail by the review panel.
“My understanding was, when ACRA was looking at this, they were deciding whether or not to even give full NRIC numbers, but on the Ministry of Digital Development and Information (MDDI) side of the house, they had been indicating that they were reviewing this. And so that was put on hold.
“Then after that, the July circular came along, and the misunderstanding occurred, and then that's what happened. So that is the short sequence of what I know, but the review panel will look into this in more detail,” she said.
Several opposition MPs had also asked for more details on the internal government circular that was tied to the ACRA Bizfile incident and sent out in July.
In December, ACRA chief executive Chia-Tern Huey Min said, during a press conference, that the unmasking of NRIC numbers in the new Bizfile portal was due to a lapse of coordination between the staff on how this was to be implemented.
This resulted in ACRA misunderstanding that it should unmask NRIC numbers in the new Bizfile portal.
MP Sylvia Lim (WP-Aljunied) noted that ACRA had sought clarification from MDDI and asked about the nature of the clarification.
She also asked whether the review panel could share its minutes with the public, after it released its findings, so that “people can form their own judgment on how this misunderstanding could have occurred”.
In response, Ms Indranee said it was clear that the policy intent was not clearly understood and in some cases, there was a lapse in coordination. She declined to elaborate as the review panel will look at it in detail.
She added that she would leave it up to the review panel to decide whether it wants to release its minutes.
Non-constituency MP Leong Mun Wai asked whether any political officeholders cleared the internal government circular.
“My clarification is this … whether any political officeholders were giving directions when the civil servants in ACRA and MDDI were clarifying with each other on the instructions of the circular,” he asked.
“Depending on the answers, I would like to know whether our civil servants have been thrown under the bus.”
Responding to his question, Ms Indranee said no political officeholders were involved in the circular or giving direction on it, but added that he should wait for the findings of the after-action review.
Pointing out that large, regulated organisations such as insurers were reportedly still using NRIC numbers as default passwords, MP Gerald Giam (WP-Aljunied) asked if the government will legally prohibit government agencies and organisations from using NRIC numbers as authenticators and do so by a certain deadline.
In response, Mrs Teo said the practices for the private sector will have to be decided upon consultation.
“I do not want to say what the landing point is going to be, but even without a legal prohibition, I think organisations, if they care about their data security, and they care about protecting the data that they have in their possession or the services being accessed by people who are not intended to enjoy the service … should really rethink their authentication methods.
“Their customers ought to be sensitised to this too, that when the NRIC number is being used by an organisation as an authenticator, it's actually not safe at all.”
Sharing her personal experience, WP’s Ms Lim said some banks still require customers to produce their physical NRIC card for authentication and asked if the digital NRIC card could be used instead.
Mrs Teo said the digital NRIC card would be acceptable as an authenticator as it contains a person’s photograph.
“We have said quite clearly that the production of this digital NRIC card … is the same as producing the physical NRIC card. So I think that part is quite clear.”
MP Dennis Tan (WP-Hougang) asked if the government was prepared to provide suitable compensation or remedy to individuals whose NRIC numbers were downloaded and accessed by malicious actors for scams between Dec 9 and 13, when ACRA’s new Bizfile portal showed names and full NRIC numbers for free via its search function.
Ms Indranee said it is difficult to know whose information might have been accessed.
She added that anyone who has filed or provided personal information in a document or lodgement with ACRA would already know that the information would be publicly available.
Continue reading...
Eight opposition MPs, including six from the Workers’ Party (WP) and two from the Progress Singapore Party (PSP), sought clarifications from Digital Development and Information Minister Josephine Teo and Second Minister for Finance Indranee Rajah, following their ministerial statements on the issue in parliament.
Related:
Here are some of the questions the MPs raised:
WHY WASN’T THE ISSUE BROUGHT TO PARLIAMENT EARLIER
Leader of the Opposition Pritam Singh (WP-Aljunied) questioned why the matter of unmasking NRIC numbers was not brought to parliament earlier.
Noting that there had been feedback about unmasking NRIC numbers from previous public consultation exercises conducted by the Accounting and Corporate Regulatory Authority (ACRA), he said: “In view of the serious and significant public concern about how unmasking NRIC numbers took place could have occurred so easily, despite enough feedback about not just how the public but ACRA, itself, views the sanctity of NRIC numbers - by virtue of its consultation exercise in 2022 and 2024 - surely the matter would have had to be brought to parliament instead of simply interpreting a circular from the ministry.”
In response, Ms Indranee, who is also Minister in the Prime Minister’s Office, said this will be looked at in more detail by the review panel.
“My understanding was, when ACRA was looking at this, they were deciding whether or not to even give full NRIC numbers, but on the Ministry of Digital Development and Information (MDDI) side of the house, they had been indicating that they were reviewing this. And so that was put on hold.
“Then after that, the July circular came along, and the misunderstanding occurred, and then that's what happened. So that is the short sequence of what I know, but the review panel will look into this in more detail,” she said.
WHAT DIDN’T ACRA UNDERSTAND ABOUT THE INTERNAL GOVERNMENT CIRCULAR
Several opposition MPs had also asked for more details on the internal government circular that was tied to the ACRA Bizfile incident and sent out in July.
In December, ACRA chief executive Chia-Tern Huey Min said, during a press conference, that the unmasking of NRIC numbers in the new Bizfile portal was due to a lapse of coordination between the staff on how this was to be implemented.
This resulted in ACRA misunderstanding that it should unmask NRIC numbers in the new Bizfile portal.
MP Sylvia Lim (WP-Aljunied) noted that ACRA had sought clarification from MDDI and asked about the nature of the clarification.
She also asked whether the review panel could share its minutes with the public, after it released its findings, so that “people can form their own judgment on how this misunderstanding could have occurred”.
In response, Ms Indranee said it was clear that the policy intent was not clearly understood and in some cases, there was a lapse in coordination. She declined to elaborate as the review panel will look at it in detail.
She added that she would leave it up to the review panel to decide whether it wants to release its minutes.
Non-constituency MP Leong Mun Wai asked whether any political officeholders cleared the internal government circular.
“My clarification is this … whether any political officeholders were giving directions when the civil servants in ACRA and MDDI were clarifying with each other on the instructions of the circular,” he asked.
“Depending on the answers, I would like to know whether our civil servants have been thrown under the bus.”
Responding to his question, Ms Indranee said no political officeholders were involved in the circular or giving direction on it, but added that he should wait for the findings of the after-action review.
PROHIBITING NRIC NUMBERS AS AUTHENTICATORS
Pointing out that large, regulated organisations such as insurers were reportedly still using NRIC numbers as default passwords, MP Gerald Giam (WP-Aljunied) asked if the government will legally prohibit government agencies and organisations from using NRIC numbers as authenticators and do so by a certain deadline.
In response, Mrs Teo said the practices for the private sector will have to be decided upon consultation.
“I do not want to say what the landing point is going to be, but even without a legal prohibition, I think organisations, if they care about their data security, and they care about protecting the data that they have in their possession or the services being accessed by people who are not intended to enjoy the service … should really rethink their authentication methods.
“Their customers ought to be sensitised to this too, that when the NRIC number is being used by an organisation as an authenticator, it's actually not safe at all.”
Sharing her personal experience, WP’s Ms Lim said some banks still require customers to produce their physical NRIC card for authentication and asked if the digital NRIC card could be used instead.
Mrs Teo said the digital NRIC card would be acceptable as an authenticator as it contains a person’s photograph.
“We have said quite clearly that the production of this digital NRIC card … is the same as producing the physical NRIC card. So I think that part is quite clear.”
Related:
COMPENSATION FOR AFFECTED PARTIES
MP Dennis Tan (WP-Hougang) asked if the government was prepared to provide suitable compensation or remedy to individuals whose NRIC numbers were downloaded and accessed by malicious actors for scams between Dec 9 and 13, when ACRA’s new Bizfile portal showed names and full NRIC numbers for free via its search function.
Ms Indranee said it is difficult to know whose information might have been accessed.
She added that anyone who has filed or provided personal information in a document or lodgement with ACRA would already know that the information would be publicly available.
Continue reading...