{"loaderData":{"0-25":{"context":{"type":0,"statusCode":200,"cacheControlMaxAge":60,"regenerateInterval":180,"payload":{"pageType":"live-blog-landing-page","results":[{"title":"","url":"","description":"","type":"live-coverage","cards":[],"liveBlogData":{"htmlData":"

\r\n

Highlights: Ministerial statements on NRIC issue

\r\n\r\n

Ministers Josephine Teo and Indranee Rajah spoke about the responsible use of NRIC and the Acra lapse.

\r\n\r\n

Gabrielle Andres, Isabelle Liew, Ian Cheng

\r\n\r\n

Published: Jan 8, 2025

\r\n

\r\n","liveBlogId":"2116","isLiveBlog":true,"isMultidayLiveblog":false,"multidayLiveBlogMapping":[]}}],"uniqueName":"live-singapore-politics-parliament-ministerial-statement-nric-numbers","infiniteScroll":{"additionalStories":[]},"advertisements":[{"type":"lb1","page":"liveblog","slot":"/5908/st/lb1/liveblog","id":"dfp-ad-lb1"},{"type":"catfish","page":"liveblog","slot":"/5908/st/catfish/liveblog","id":"dfp-ad-catfish"},{"type":"prestitial","page":"liveblog","slot":"/5908/st/prestitial/liveblog","id":"dfp-ad-prestitial"}],"metaData":{"title":"Highlights: Ministerial statements on NRIC issue","ogTitle":"Highlights: Ministerial statements on NRIC issue","twitterTitle":"Highlights: Ministerial statements on NRIC issue","slug":"live-singapore-politics-parliament-ministerial-statement-nric-numbers","description":"Minister for Digital Development and Information Josephine Teo and Second Minister for Finance Indranee Rajah deliver ministerial statements.","ogDescription":"Minister for Digital Development and Information Josephine Teo and Second Minister for Finance Indranee Rajah deliver ministerial statements.","jsonLd":"{\"@context\":\"https:\\/\\/schema.org\",\"@type\":\"LiveBlogPosting\",\"@id\":\"https:\\/\\/www.straitstimes.com\\/live-singapore-politics-parliament-ministerial-statement-nric-numbers\",\"headline\":\"Parliament to discuss NRIC issue\",\"description\":\"Minister for Digital Development and Information Josephine Teo and Second Minister for Finance Indranee Rajah will deliver ministerial\",\"coverageStartTime\":\"2025-01-08T11:00:00+08:00\",\"coverageEndTime\":\"2025-01-08T23:00:00+08:00\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\/\\/www.straitstimes.com\\/assets\\/ST-logo-default-aoeSLh4S.png\",\"width\":\"1228\",\"height\":\"96\"}},\"liveBlogUpdate\":[{\"@type\":\"BlogPosting\",\"headline\":\"Jamus Lim asks for opt-out clause for directors who want to hide their NRIC numbers\",\"datePublished\":\"2025-01-08T16:02:50+08:00\",\"dateModified\":\"2025-01-08T17:18:31+08:00\",\"articleBody\":\"MP Jamus Lim (Sengkang GRC) suggests that some people might be unwilling to take up directorships in small and micro enterprises, where friends and family are often roped in as directors, if they are required to reveal their NRIC numbers. He asks if there can be an opt-out clause for such individuals, given that due diligence may not be necessary for such smaller firms.In response, Ms Indranee says the reason Acra provides information to the public is for corporate transparency and to protect the public.Giving the example of a person hiring a contractor to renovate their home only to find the work is not done, she says people transacting with businesses may run into problems and will need to be able to identify who they are dealing with to seek restitution. In the case of the renovation gone wrong, a person may need to search the Acra registry to find out who is behind the business, for example, to take legal action.Ms Indranee says that in Singapore and many other countries, \\u201cif you\\u2019re going to do business and transact with the public, the public has to know who you are and be able to contact you\\u201d.She says in some ways, Acra has already made some shifts, such as allowing individuals to use contact addresses instead of residential addresses. But she adds that there is no running away from the fact that people need to be able to identify who they are dealing with.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"msazali\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Not right to characterise move to change NRIC stance as \\u2018desensitisation\\u2019\",\"datePublished\":\"2025-01-08T15:40:58+08:00\",\"dateModified\":\"2025-01-08T17:04:20+08:00\",\"articleBody\":\"MP Jamus Lim (Sengkang GRC) says there is a difference between individuals acknowledging that usage of the NRIC number is not a foolproof method of identification and individuals being comfortable with their NRIC numbers being disseminated. Most Singaporeans would agree with the former but not the latter, he says.But Mrs Teo replies that his statement is erroneous, as the Government has never said the NRIC number was unsuitable as an identifier. In fact, it is a unique identifier and must be used for identification, she says. What the NRIC number should not be used for is authentication, she adds, noting there is a distinction between using the NRIC as an identifier and as an authenticator.In response to his comment on \\u201cwidespread desensitisation\\u201d, Mrs Teo says the Government is not making a change to allow the full NRIC number to be widely disclosed. The only change being made, she explains, is to stop the incorrect use of NRIC numbers as authenticators and passwords.\\u201cNowhere in this is there a need for desensitisation. I\\u2019m not sure that characterisation applies to what we\\u2019re seeking to do and will encourage members not to use this characterisation,\\u201d she adds.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"On the need for authenticators and Bizfile portal issues\",\"datePublished\":\"2025-01-08T15:34:16+08:00\",\"dateModified\":\"2025-01-08T16:49:44+08:00\",\"articleBody\":\"MP Gerald Giam (Aljunied GRC) asks how long the Government has known that organisations were using NRIC numbers as an authentication factor and why it did not prohibit such usage before December 2024.Pointing out that large, regulated organisations such as insurers were reportedly still using NRIC numbers as default passwords, Mr Giam asks Mrs Teo if the Government would legally prohibit agencies and organisations from using NRIC numbers as authenticators by a certain deadline.He also asks what would prevent NRIC numbers from being randomly generated, instead of partially masked NRIC numbers being unmasked through the use of algorithms, highlighting the existence of generators online that can do so.To Ms Indranee, he says business owners and corporate secretaries have reported that share transfers and annual returns could not be submitted on the new Bizfile portal \\u2013 basic functions that every business owner uses \\u2013 questioning if sufficient testing was conducted before the portal\\u2019s launch.On the use of NRIC numbers by organisations, Mrs Teo reiterates that the issue is relatively contained, adding that access to information, such as bank statements, typically involve additional security layers like one\\u2019s date of birth.She notes that before encrypted e-mails, such statements were physically mailed in envelopes that did not require special passwords to open.On organisations requiring additional authentication layers, Mrs Teo says they should consider if these additional authentication layers are needed. If they still require authentication, then her advice would be that NRIC numbers are not good authenticators and should not be used at all.On whether the Government would legally prohibit the use of NRIC numbers as authenticators, she says that practices for the private sector will be decided through consultation.Even without legal prohibition, Mrs Teo says organisations that care about data security and protecting the data in their possession, should rethink authentication methods. Customers should be sensitised to this, too, as it is unsafe for their NRIC numbers to be used as authenticators.On whether a new identifier could be invented that cannot be reverse-engineered, Mrs Teo says her answer still stands \\u2013 while the identifier is not meant to be secret or shared widely, some people will know, such as when individuals reveal their NRIC numbers when visiting a clinic or applying for a mobile phone line. Those determined to get a hold of one\\u2019s identifier will find a way to do so.Ms Indranee confirms with Mr Giam that his question to her is unrelated to the NRIC issue.She acknowledges that the new Bizfile portal has had initial issues, but Acra has extended the time allocated to users who need to file their documents and has indicated that no late penalties will be imposed on those who have difficulties with their filing. Those who continue to experience difficulties can contact Acra for assistance.Ms Indranee does not have details on the testing done for the new portal but says that some testing was done. She adds that Acra is working to resolve any technical difficulties.PHOTO: MDDI \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Govt to use \\u2018all channels\\u2019 in public education efforts: Josephine Teo\",\"datePublished\":\"2025-01-08T15:20:15+08:00\",\"dateModified\":\"2025-01-08T16:26:10+08:00\",\"articleBody\":\"MP Yip Hon Weng (Yio Chu Kang SMC) asks how MDDI plans to approach public education on the proper use of NRIC numbers, particularly for less tech-savvy individuals, such as seniors.Mrs Teo, in response, says the Government will use \\u201call channels\\u201d in outreach efforts involving those in hard-to-reach segments, including seniors and individuals from less privileged backgrounds.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"msazali\"}},{\"@type\":\"BlogPosting\",\"headline\":\"No political office-holders involved in MDDI\\u2019s circular\",\"datePublished\":\"2025-01-08T15:10:22+08:00\",\"dateModified\":\"2025-01-08T16:21:45+08:00\",\"articleBody\":\"Non-Constituency MP Leong Mun Wai asks whether any political office-holders cleared MDDI\\u2019s circular or gave directions to civil servants from Acra or MDDI during clarifications on the circular minute\\u2019s instructions.In response, Ms Indranee clarifies that no political office-holders were involved in MDDI\\u2019s circular minute and advises Mr Leong to wait for the findings from the review.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"MP Dennis Tan asks if Government will offer compensation\",\"datePublished\":\"2025-01-08T15:06:51+08:00\",\"dateModified\":\"2025-01-08T16:17:21+08:00\",\"articleBody\":\"MP Dennis Tan (Hougang) asks whether the Government plans to offer compensation to individuals whose NRIC numbers have been accessed or downloaded by malicious actors during the Dec 9 to 13, 2024, period.In response, Ms Indranee says it is currently unknown what information might have been accessed and whose information it was.Discussing compensation assumes that they know who has had their information accessed, she says.She adds that anybody who has filed or provided personal information to Acra would have been aware that the information is available publicly, as the purpose of the registry is public access.Ms Indranee also says she is unsure in which context the issue of compensation would arise.PHOTO: ST FILE\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Should MDDI\\u2019s circular be released? Review panel will decide\",\"datePublished\":\"2025-01-08T15:00:22+08:00\",\"dateModified\":\"2025-01-08T16:09:09+08:00\",\"articleBody\":\"Workers\\u2019 Party chairwoman Sylvia Lim notes Mrs Teo\\u2019s distinction between the use of NRIC numbers and the physical card, which may be used for authentication, and asks how this would apply to the digital NRIC within Singpass.She points out that many people no longer carry the physical card around and shares a personal experience where she was requested to produce the physical card.Ms Lim also asks whether the distinction between the physical and digital NRICs is a \\u201clogical and well-founded\\u201d one, and whether the digital NRIC should be accepted for authentication purposes.Referring to MDDI\\u2019s circular minute that was misunderstood by Acra, Ms Lim asks Ms Indranee about the nature of Acra\\u2019s clarification to MDDI and whether there was a response.Ms Lim also notes \\u201cintense interest\\u201d from the public on the circular minute and asked if it, along with the review panel\\u2019s report on the incident, could be made public to allow people to form their own judgment on how the misunderstanding occurred.Mrs Teo replies that the Singpass app includes information such as a photograph to verify the person holding the device displaying the digital NRIC. The production of the digital NRIC is the same as producing the physical NRIC and is acceptable as an authenticator.Ms Indranee says there was a response from MDDI on Acra\\u2019s clarification and that the communications between both parties \\u201ccontinued for a while\\u201d. But she declines to say more about it and prefers for the review panel to look at it in detail first.What is very clear, says Ms Indranee, is that there was no a clear understanding of the policy\\u2019s intent and in some cases lapses in coordination.Regarding the circular\\u2019s release to the public, Ms Indranee says she will let the review panel decide. But notes that government documents are not normally released in their entirety. Relevant extracts or portions may sometimes be cited instead.Ms Indranee says the \\u201cmost material part\\u201d in the minute were the words \\u201cto cease the use of the partial masked NRIC\\u201d, which is what led to the incident in question. \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"NRIC number used as identifier for SingPass, not password\",\"datePublished\":\"2025-01-08T14:54:41+08:00\",\"dateModified\":\"2025-01-08T15:49:09+08:00\",\"articleBody\":\"Non-Constituency MP Hazel Poa asks which Government agency and statutory board had been using NRIC numbers as authenticators and when they ceased this practice. She notes that SingPass, in particular, uses NRIC numbers as the user ID.In response, Mrs Teo says that following MDDI\\u2019s July 2024 circular, all public sector agencies ceased using NRIC numbers as authenticators. But she does not have details of which agencies had previously been using NRIC numbers in that manner.Regarding SingPass, Mrs Teo clarifies that while NRIC numbers are used as the default identifier, they are not used as passwords. SingPass allows users to change their user ID to something that is not their NRIC number, she adds, acknowledging that prior to this incident, not many may have been aware of this.PHOTO: LIANHE ZAOBAO\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Full NRIC number will be used as identifier in some instances\",\"datePublished\":\"2025-01-08T14:49:18+08:00\",\"dateModified\":\"2025-01-08T15:43:39+08:00\",\"articleBody\":\"MP Xie Yao Quan (Jurong GRC) asks for specific examples of cases where the Government will use full NRIC numbers moving forward and where other identifiers will be used.Mrs Teo says that in some instances, names or other identifiers would be sufficient. But full NRIC numbers will be necessary when an individual is applying for subsidies or accessing a benefit provided by the Government.She says there are many use cases, and it would not be possible to list them all.Each case merits its own considerations, and the process of deciding this has started but has not been completed, she adds. \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"msazali\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Govt will ensure incorrect practices around NRIC numbers will stop\",\"datePublished\":\"2025-01-08T14:38:51+08:00\",\"dateModified\":\"2025-01-08T15:37:27+08:00\",\"articleBody\":\"Workers\\u2019 Party MP Louis Chua (Sengkang GRC) refers to the 500,000 queries made on Acra\\u2019s portal from Dec 9 to 13. Given that it is unknown whose NRIC numbers were accessed, he asks if the Government would consider issuing notifications to households to inform them of the incident and the necessary precautions that can be taken.He points to the obligations private organisations have to inform affected parties in the event of a data breach.Mr Chua also asks about NRIC numbers being potentially used to unlock personal information, such as bank information and health records. He further queries whether the Government has a timeline for both public healthcare and private financial institutions to stop using NRIC numbers as an authenticator.In response, Mrs Teo says the Association of Banks has issued a statement that banks do not have the practice of using NRIC numbers as the sole factor of authentication and that awareness in certain sectors about such inappropriate practices is \\u201creasonably high\\u201d.But she adds that the Government does not want to assume as such and will go through the rigour of ensuring such practices will stop, especially given the large number of companies. As such, outside the regulated sectors, the Government has an even bigger challenge. \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"msazali\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Physical NRIC card remains suitable as authenticator, but not NRIC number\",\"datePublished\":\"2025-01-08T12:52:29+08:00\",\"dateModified\":\"2025-01-08T15:30:37+08:00\",\"articleBody\":\"The physical NRIC number remains suitable as an authenticator, as it contains other identifying information such as an individual\\u2019s photo and fingerprint, and is not easily faked, Mrs Teo says.She adds that someone providing just an NRIC number and claiming to be an individual does not have these additional factors of proof.Therefore, while the physical NRIC card can be used as an authenticator, the NRIC number itself should not be used as an authenticator, and organisations should not accept the NRIC number alone as proof of identity, Mrs Teo says.PHOTO: LIANHE ZAOBAO\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Pritam asks why NRIC policy was not clarified when Acra Bill debated in July 2024\",\"datePublished\":\"2025-01-08T14:27:11+08:00\",\"dateModified\":\"2025-01-08T15:28:59+08:00\",\"articleBody\":\"Leader of the Opposition Pritam Singh asks the next question.He points out that in July 2024, the House passed the Acra (Registry and Regulatory Enhancements) Bill, which laid out a framework to protect the confidentiality of personal information by limiting public access and allowing only specific parties to access such information for regulatory obligations.Mr Singh notes that Ms Indranee, in moving the Bill, confirmed that it laid the groundwork for the enhanced Bizfile system, but that she did not mention the Government\\u2019s new approach regarding NRIC numbers.He also cites a public consultation on the Bill, during which Acra proposed to partially mask the identification numbers of all individuals in its registers and introduce contact addresses in place of using people\\u2019s residential addresses.He quotes Acra as saying it would review the feedback and provide an update in due course, and asks why Acra had gone ahead with unmasking the NRIC numbers.Mr Singh adds that Acra and the Government would have been acutely aware that the public treats NRIC numbers as personal details.His second question is on why the matter of unmasking NRIC numbers, given the significant and public concern, was not brought to Parliament but instead addressed in a circular.In response, Ms Indranee, reading from Acra\\u2019s public consultation paper, says that while there were respondents concerned about privacy regarding NRIC numbers, others expressed concerns about needing the NRIC numbers and other information for corporate transparency and compliance with client requirements.Ms Indranee says Acra in its response said it would proceed with using a contact address as the default and would provide an update on the use of NRIC numbers following further review.She adds that it was her understanding that while Acra was mulling over the decision to use full NRIC numbers, MDDI was also contemplating the issue and sent a circular in July 2024. This circular contributed to the misunderstanding leading to the Bizfile incident.She adds that the review panel will look at this sequence of events in more detail.PHOTO: MDDI\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"\\u2018Right thing to do\\u2019 to change practice while problem \\u2018still relatively contained\\u2019: Josephine Teo\",\"datePublished\":\"2025-01-08T14:36:49+08:00\",\"dateModified\":\"2025-01-08T15:27:04+08:00\",\"articleBody\":\"MP Liang Eng Hwa (Bukit Panjang SMC) asks about the downsides of using masked NRIC numbers, saying that he feels it is a \\u201cmiddle-ground solution\\u201d that the public is comfortable with.In response, Mrs Teo reiterates a point from her ministerial statement on the growing availability of algorithms that can work out an individual\\u2019s full NRIC number from partial or masked numbers.She says the use of masked NRIC numbers gives a false sense of security, leads individuals to believe their full NRIC number are secret and safe to be used as passwords or authenticators.With the risks and harms of identity theft becoming more common, the Government decided to take the lead in stopping the practice of using masked or partial NRIC numbers, she adds.Mrs Teo says it would be irresponsible for the Government to not do anything about it.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"msazali\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Head of civil service to lead review panel on incident, will report to SM Teo Chee Hean\",\"datePublished\":\"2025-01-08T13:23:58+08:00\",\"dateModified\":\"2025-01-08T15:22:49+08:00\",\"articleBody\":\"A panel, led by civil service head Leo Yip, will review the root cause of the incident, Ms Indranee says.The panel will review the Government\\u2019s policy on the responsible use of NRIC number, and the disclosure of full NRIC numbers on Acra\\u2019s new Bizfile portal, she explains.The panel will include permanent secretaries whose ministries not involved in the NRIC policy or this incident, as well as the permanent secretaries of MDDI and the Ministry of Finance, which oversees Acra. It will report to Senior Minister Teo Chee Hean.The panel will study what happened, how the decisions were made, the implementation and communication processes, the coordination across public sector agencies and wherethe Government should have done better. It will also recommend areas for improvement.Regarding the People Search function on Bizfile, the panel will look into the design and its implementation, Ms Indranee says.It expects to complete its review in February.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Whole-of-government discussions on NRIC stance took place\",\"datePublished\":\"2025-01-08T14:29:06+08:00\",\"dateModified\":\"2025-01-08T15:19:07+08:00\",\"articleBody\":\"Mr Singh presses for answers regarding when the ministry determined that such a change was necessary, whether whole-of-government discussions took place and how many agencies, apart from Acra, misunderstood the circular sent by MDDI.In response, Mrs Teo says she does not have the exact date when discussions began but says it would have been \\u201csome months\\u201d before the circular was issued.She says whole-of-government discussions did take place, including briefings that allowed agencies to clarify the changes.Mrs Teo asks for Mr Singh\\u2019s understanding that going into specific details of the event would not reflect the whole picture and that it would be better to wait for the findings of the full review rather than cite specific events leading to the launch of the new Bizfile portal.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Why PDPC guidelines on collection of NRIC removed during incident\",\"datePublished\":\"2025-01-08T14:08:38+08:00\",\"dateModified\":\"2025-01-08T14:49:43+08:00\",\"articleBody\":\"MP Tin Pei Ling asks the first supplementary question, and among her questions were why the Personal Data Protection Commission (PDPC) guidelines on the collection of NRIC numbers were removed from the website during this incident. She also calls on the Government to be fair to civil servants and Acra in their investigation.In response, Mrs Teo thanks Ms Tin for the call to be fair, and says the Government\\u2019s investigation will be rigorous and thorough. She adds that, to be fair to all and to get to the bottom of the matter, it is best that people refrain from speculating on what took place.Regarding the withdrawal of the PDPC guidelines, Mrs Teo says they were taken off the website for only a \\u201cvery short period of time\\u201d to apply a \\u201cnew label\\u201d to them. This was to draw attention to the guidelines and highlight that the guidelines remain valid.Ms Tin also asks what actions will be taken to prevent the misuse of NRIC numbers.In reply, Mrs Teo says very few scams, if any, involve the NRIC numbers being used to directly access valuable data. She adds that the best protection is for individuals to avoid using their NRIC numbers as passwords or for authentication.Mrs Teo says the Bizfile portal issue may have led some to believe that the Government allows for NRIC numbers to be disclosed on a wide scale, but that is not its direction. The only change will be to prevent the incorrect use of NRIC numbers as authenticators. The policies, guidelines and duty of care when organisations collect such information have not changed.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Government will learn from this episode\",\"datePublished\":\"2025-01-08T13:29:53+08:00\",\"dateModified\":\"2025-01-08T14:39:03+08:00\",\"articleBody\":\"Ms Indranee reiterates three points as she wraps up her statement:\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Action against involved parties will depend on review outcome\",\"datePublished\":\"2025-01-08T13:27:57+08:00\",\"dateModified\":\"2025-01-08T14:33:32+08:00\",\"articleBody\":\"Whether action will be taken against those involved in the disclosure of NRIC numbers will depend on the outcome of the review, Ms Indranee says.\\u201cBased on the panel\\u2019s preliminary findings, the incident seems to be a genuine case of miscommunication borne out of insufficient understanding of the policy intent and each party\\u2019s needs and requirements,\\u201d she says.\\u201cNevertheless, if the panel uncovers facts that suggest actionable wrongdoing or serious lapses, it will refer the matter to the relevant bodies or authorities for further disciplinary or legal action.\\u201d\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Did Bizfile practices align with data protection policies?\",\"datePublished\":\"2025-01-08T13:26:27+08:00\",\"dateModified\":\"2025-01-08T14:30:41+08:00\",\"articleBody\":\"Acra, as a public agency, is required to meet personal data protection standards set out in the Public Sector (Governance) Act (PSGA) or the Government Instruction Manuals (IMs), which are standards similar to those under the Personal Data Protection Act that applies to the private sector, Ms Indranee says.She adds that Acra is legally allowed to disclose certain information in the interest of corporate transparency.As the review panel is still ascertaining the full facts of the Bizfile incident, it would be premature to conclude definitively whether there has been any breach of the PSGA or the Government IMs, Ms Indranee says.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"How individuals can protect themselves following the incident\",\"datePublished\":\"2025-01-08T13:22:30+08:00\",\"dateModified\":\"2025-01-08T14:15:02+08:00\",\"articleBody\":\"Individuals who are concerned that their NRIC numbers may have been accessed can take steps to protect themselves, Ms Indranee says.She urges them to ensure that their NRIC number is not used as a password for any of their digital accounts and advises those who are doing so to change it as soon as possible.She also adds that they should change their authenticator if they are currently using their NRIC numbers for the purpose.Lastly, she adds that people should not assume someone is a legitimate authority just because they know their NRIC number.\\u201cEven if someone can recite your full NRIC number, it would be prudent to ascertain their identity and intent by conducting other checks,\\u201d she says. \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Over 500,000 queries for NRIC numbers made on Acra's portal from Dec 9 to 13, up from 3,000 daily queries\",\"datePublished\":\"2025-01-08T13:21:15+08:00\",\"dateModified\":\"2025-01-08T14:11:23+08:00\",\"articleBody\":\" Ms Indranee emphasises that Acra\\u2019s database does not contain information on all Singapore citizens, but only individuals who are reflected in filings or lodgements made with Acra.Namely, these are individuals who are or have been involved in Acra-registered entities, such as companies, partnerships, as well as non-profit organisations that are companies limited by guarantee.Those who have not made any filing with Acra before would have not had their NRIC numbers collected or shared by Acra.But those who have incorporated a business or assumed a board directorship would have their information collected and made publicly available through the People Profile.Based on investigations so far, more than 500,000 queries were made on People Search from Dec 9 to 13, 2024 \\u2013 much higher than the usual daily traffic of 2,000 to 3,000 queries, Ms Indranee discloses.The bulk of these queries \\u2013 which came from an estimated 28,000 IP addresses, most of which were from Singapore \\u2013 were made on Dec 13, the day after news of the NRIC numbers on the new Bizfile portal broke.The Government is unable to identify the exact number of NRIC numbers that were disclosed through these queries, says Ms Indranee, as the portal is not configured to track individual queries for the People Search function.It has so far not uncovered any known threat actors, based on the IP addresses that were used to make the People Search queries between Dec 9 and 13, 2024.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"On time taken for Acra to disable the People Search function\",\"datePublished\":\"2025-01-08T13:19:57+08:00\",\"dateModified\":\"2025-01-08T14:02:12+08:00\",\"articleBody\":\"When public concerns first surfaced on Dec 12, 2024, MDDI and Acra needed time to assess whether the disclosure of full NRIC numbers on the People Search function was consistent with MDDI\\u2019s policy intent, as well as the feasibility and lead time needed to effect alternatives, Ms Indranee says.Ms Indranee also says disabling the search function was a last resort, given the impact on businesses and individuals who might need to use the function to conduct their due diligence checks.It was eventually agreed that temporarily disabling the function would be the best option to address public concerns while Acra reviews it. The function was disabled on the night of Dec 13.She acknowledges that the agencies \\u201ccould have been more prompt in their response\\u201d, but says one must also have regard to the considerations they were balancing at the time.She adds that the Government will study how it could have responded more quickly.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Events that led to Acra unmasking NRIC numbers in the search function\",\"datePublished\":\"2025-01-08T13:15:01+08:00\",\"dateModified\":\"2025-01-08T13:59:47+08:00\",\"articleBody\":\"As mentioned at a press conference on Dec 19, 2024, the Government is \\u201cthoroughly reviewing\\u201d the incident to ascertain what exactly happened, Ms Indranee says.While she adds she does not want to \\u201cprejudge the outcome\\u201d, she shares key facts that have been pieced together so farAs the Ministry of Digital Development and Information (MDDI) had concerns about how NRIC numbers were being used, it issued a circular minute in July 2024 directing all government agencies to stop using NRIC numbers as authenticators or passwords, and to cease any planned use of masked NRIC numbers in, for example, new business processes and digital services.Acra understood the directive to mean that it had to unmask and display in full the NRIC numbers in the People Search function on the Bizfile portal.After internal deliberations, Acra sought MDDI\\u2019s clarification on whether it was required to unmask NRIC numbers as such.But, due to a \\u201clapse in coordination\\u201d between MDDI and Acra, Acra continued its mistaken understanding of the directive and proceeded to disclose the full NRIC numbers in the People Search function on the new Bizfile portal when it launched on Dec 9.Ms Indranee stresses that it was not the Government\\u2019s intent for agencies to make datasets of NRIC numbers in their possession widely and easily accessible.In hindsight, she adds, it is clear that there were gaps in the communication and understanding of MDDI\\u2019s policy intent. The Government is reviewing this lapse in coordination and communication between MDDI and Acra, the scope of which she will elaborate on later in her statement.PHOTO: LIANHE ZAOBAO FILE\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"What changed in the new Bizfile portal launched on Dec 9\",\"datePublished\":\"2025-01-08T13:14:20+08:00\",\"dateModified\":\"2025-01-08T13:54:20+08:00\",\"articleBody\":\"The old Bizfile portal provided the name and masked NRIC numbers in its search results.But the new portal, launched on Dec 9, showed full NRIC numbers, until it was suspended on Dec 13, Ms Indranee says.The change to the People Search function meant that the public had free access to the full NRIC numbers of any individual in Acra\\u2019s database during this period.\\u201cThis understandably caused public concern since many Singaporeans view their NRIC numbers as sensitive and confidential information,\\u201d she says.Acra has since revised the People Search function to show only names. It no longer displays any NRIC number, whether masked or unmasked, she adds.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"NRIC numbers have always been publicly accessible on Bizfile portal\",\"datePublished\":\"2025-01-08T13:11:29+08:00\",\"dateModified\":\"2025-01-08T13:50:38+08:00\",\"articleBody\":\"Bizfile, Acra\\u2019s one-stop e-services portal, has always provided two key steps for people to access information on businesses and their associated individuals, Ms Indranee says.\\u201cStep 1\\u201d is the People Search function, which allows users to search for information on individuals associated with businesses and is free to use.On the old Bizfile profile \\u2013 in place before Dec 9, 2024 \\u2013 users could do a name search, which would return a list of individuals with the searched name, as well as the masked NRIC numbers of these individuals.Those who wanted more information on a specific individual would have to proceed to \\u201cStep 2\\u201d and purchase the People Profile for that person, which would give the person\\u2019s full name, full NRIC number, contact address, associated business and past and present position they have held or hold.Therefore, the public was able to obtain the full NRIC number of an individual associated with a business entity even on the old Bizfile portal, says Ms Indranee, adding that there was no change to \\u201cStep 2\\u201d on the new portal.\\u201cIn other words, the full NRIC number has always been publicly accessible upon the purchase of a People Profile, and this has not been an issue,\\u201d she adds.\\u201cThe NRIC number, in the context of a Bizfile search, has never been confidential or secret. The real issue is one of degree and ease of access and searchability.\\u201d \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Why public access to information such as NRIC numbers is necessary\",\"datePublished\":\"2025-01-08T13:06:38+08:00\",\"dateModified\":\"2025-01-08T13:45:00+08:00\",\"articleBody\":\"Many business registries worldwide provide public access to information on business entities and their associated individuals, such as NRIC numbers, Ms Indranee says.She adds that it is important to understand that public disclosure of NRIC numbers is not prohibited per se, and the real issue is the degree and ease of access to NRIC numbers.To appreciate the distinction, it is necessary to understand how Acra\\u2019s Bizfile portal works, she says.Ms Indranee gives an example of why public access to such information is necessary. For instance, when a bank onboards a new corporate client, it will need to conduct background checks on the company\\u2019s directors to help it ascertain if the directors have any history of financial misconduct or if they have been involved in companies with financial or regulatory issues before granting credit facilities.Information on the company\\u2019s directors, such as their NRIC numbers, will be useful to the bank when confirming the directors\\u2019 identities.This is the same for companies and investors considering mergers and acquisitions, who conduct due diligence checks on the identities and shareholdings of their counterpart\\u2019s company directors.NRIC numbers also help to deter illicit activities, as business owners, directors and other key position holders of businesses who are publicly known can be easily traced and held accountable for illegal activities, she adds.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Govt planned to change internal practices, before moving to the private sector\",\"datePublished\":\"2025-01-08T12:44:07+08:00\",\"dateModified\":\"2025-01-08T13:39:49+08:00\",\"articleBody\":\"The Government had planned to change its internal practices before moving to change practices in the private sector and non-profit organisations, Mrs Teo says in response to a Ms Cheryl Chan (East Coast GRC), who asks why the efforts to change did not include the private sector.The Government believed this would allow it to better understand implementation challenges and facilitate a smoother transition in the private sector, she adds.It had also planned to launch a major effort to raise awareness among Singaporeans about the risks of incorrect use of NRIC numbers.The Bizfile incident was an \\u201cunfortunate misstep\\u201d, and it means that these plans have to be brought forward, Mrs Teo says.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"NRIC numbers will not be exposed on wide scale: Josephine Teo\",\"datePublished\":\"2025-01-08T12:36:58+08:00\",\"dateModified\":\"2025-01-08T13:38:53+08:00\",\"articleBody\":\" Minister for Digital Development and Information Josephine Teo begins her ministerial statement by apologising for the anxiety and confusion caused by the Acra Bizfile incident.\\u201cWe take the public\\u2019s concerns seriously and are very sorry for the mistake that caused them much anxiety,\\u201d she says.She clarifies that the Government will not change its policy to allow full NRIC numbers to be exposed on a wide scale.NRIC numbers remain personal data and can be collected only when there is a need to do so. Mrs Teo adds that existing guidelines on the collection of NRIC numbers, such as ensuring protection of the data, will not change.But there are organisations using NRIC numbers incorrectly, and the Government\\u2019s plan was to address this issue while it was relatively contained, she says.Her statement will address the current incorrect uses, why that needs to change and the authorities\\u2019 next steps.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Acra has power to collect information on business entities\",\"datePublished\":\"2025-01-08T13:05:45+08:00\",\"dateModified\":\"2025-01-08T13:37:35+08:00\",\"articleBody\":\"Answering questions on why Acra needs to provide public access to information, Ms Indranee says that as the national regulator of business registration and financial reporting, Acra\\u2019s mission is to foster a trusted business environment.To maintain corporate transparency, facilitate business transactions and guard against illicit activities, Acra is empowered to collect and maintain information on business entities and their associated individuals, and also provide public access to such information.For instance, Acra is allowed by law to give public access to information such as NRIC numbers, Unique Entity Numbers, registered addresses and paid-up capital.This allows people to transact with Singapore business entities and know whom they are dealing with, Ms Indranee adds.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Indranee Rajah begins statement\",\"datePublished\":\"2025-01-08T13:05:13+08:00\",\"dateModified\":\"2025-01-08T13:34:18+08:00\",\"articleBody\":\"Second Minister for Finance Indranee Rajah begins her speech by acknowledging the public anxiety and confusion caused by the disclosure of full NRIC numbers on the Acra Bizfile platform and apologising for it.She says her statement will cover three areas:Acra\\u2019s mandate to provide public access to basic information on businesses and their associated individuals.The series of events that led to Acra changing the People Search function to unmask NRIC numbers. Whether a review of the incident will be conducted, and if any action will be taken against those involved.PHOTO: MDDI\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Existing guidelines will not change, but incorrect uses of NRIC have to\",\"datePublished\":\"2025-01-08T12:59:27+08:00\",\"dateModified\":\"2025-01-08T13:30:17+08:00\",\"articleBody\":\"In summary, Mrs Teo says the Government understands the public\\u2019s concerns about NRIC numbers, and it was not the Government\\u2019s intention to make the full NRIC number widely disclosed. It is not heading in that direction, she adds.NRIC numbers are personal data and can only be collected and used when there is a need to, with organisations that hold them having a duty of care, subject to law. These existing guidelines will not change.What needs to change are the incorrect uses of the NRIC number. By taking action as soon as possible, the public can increase protection for everyone.This then allows for the use of the full NRIC number as a unique identifier whenever needed.Mrs Teo proceeds to summarise, in Mandarin, key points of her ministerial statement.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Acra must comply with standards for data protection\",\"datePublished\":\"2025-01-08T12:54:26+08:00\",\"dateModified\":\"2025-01-08T13:26:34+08:00\",\"articleBody\":\"Some MPs asked about Acra\\u2019s compliance with the Personal Data Protection Act (PDPA) requirements and the Government\\u2019s data protection measures.Mrs Teo says Acra is expected to comply with internal rules and the Public Sector (Governance) Act, which are no less stringent than the PDPA.Across the Government, audits are conducted regularly to ensure that public agencies, including Acra, comply with the standards for data protection and the security of information and communications technology systems, she adds.She cites that in the most recent audit exercise, there were very few significant findings, and all had been addressed by the agencies concerned. There has also been a reduction in data incidents of medium severity and above.The Government takes these rules and controls very seriously and will continue to regularly review safeguards, she adds.PHOTO: LIANHE ZAOBAO\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Public education efforts will raise awareness of incorrect uses of NRIC, help guide S\\u2019poreans\",\"datePublished\":\"2025-01-08T12:53:14+08:00\",\"dateModified\":\"2025-01-08T13:21:57+08:00\",\"articleBody\":\"Incorrect uses of the NRIC may not be well understood by the public, Mrs Teo says.Public education efforts will raise awareness among organisations and individuals and guide them on what they should do, she adds.Responding to Mr Gerald Giam\\u2019s question on alternatives to the current NRIC number system, Mrs Teo says the risks do not arise directly from the structure of the NRIC number.\\u201cRather the risks arise when the NRIC number, which is meant to be a unique identifier, is incorrectly used as an authenticator or a password,\\u201d she says.\\u201cEven if we were to create an alternative identifier, we would still have a problem if organisations used it as an authenticator, and individuals used it as a password.\\u201d\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"No plans for Acra to extend fee-based tiered access policy to more personal data\",\"datePublished\":\"2025-01-08T13:20:10+08:00\",\"dateModified\":\"2025-01-08T13:20:10+08:00\",\"articleBody\":\"Responding to Associate Professor Jamus Lim\\u2019s (Sengkang GRC) question on whether Acra intends to extend more personal data to its fee-based tiered access policy, Ms Indranee says there are no plans to do so.The issue is not about collecting or disclosing more personal data, she reiterates, but the ease of access to and the searchability of existing personal data that is currently publicly accessible.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Isabelle Liew\"}},{\"@type\":\"BlogPosting\",\"headline\":\"What should individuals do? Understand and review\",\"datePublished\":\"2025-01-08T12:52:42+08:00\",\"dateModified\":\"2025-01-08T13:18:15+08:00\",\"articleBody\":\"Individuals can:1) Clarify their understanding of the NRIC number.NRIC numbers, like names, are not secrets, even if they are not widely disclosed, Mrs Teo reiterates.For example, she says, if someone we do not recognise calls out our name and starts to behave as though they know us well, we would be slightly suspicious and should not fully trust this person just because they know our name.The same applies to NRIC numbers. Individuals should not automatically assume that parties who know their NRIC numbers know them well, are figures of authority or can be trusted.2) Review their passwords.Those using their NRIC numbers as passwords to access any information or service have mistakenly used it as an authenticator and should change their passwords immediately.Most NRIC-related scams involve victims who think they are speaking to figures of authority and end up taking actions that harm themselves, such as transferring money without further checks, Mrs Teo says. Very few cases have involved scammers directly using NRIC numbers to unlock access to valuables.Risks arise from the incorrect use of NRIC numbers. If individuals stop using NRIC numbers as passwords, and organisations stop using NRIC numbers as authenticators, it will go a long way towards preventing harms from scams and identity theft, she adds.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Considerations to be taken when updating guidelines on use of NRIC number\",\"datePublished\":\"2025-01-08T12:52:14+08:00\",\"dateModified\":\"2025-01-08T13:09:04+08:00\",\"articleBody\":\"Mrs Teo says the Government aims to start public consultations soon, and initial soundings with the private sector suggest that there can be different approaches to the use of NRIC numbers.She says some organisations that are currently using partial NRIC numbers can stop the practice and replace them with alternative means of identification, such as mobile phone numbers or e-mail addresses, or drop them entirely.But she acknowledges there are organisations that need to accurately identify individuals and can justify the collection of full NRIC numbers, even if they are not required by law.Mrs Teo cites applications for and disbursement of substantial financial aid as one such scenario.\\u201cWe will take these considerations on board when updating the guidelines,\\u201d she says, adding that the PDPC (Personal Data Protection Commission) will support businesses in changing their authentication methods.She also emphasises that NRIC numbers are personal data, and organisations collecting and using them must \\u201ccontinue to exercise a duty of care\\u201d.Mrs Teo adds: \\u201cSubject to applicable law, they must notify and seek consent on use, and also ensure the data is sufficiently protected.\\u201cCertainly, they should not disclose the NRIC numbers unless there are good reasons to do so.\\u201d\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"What should private sector organisations do?\",\"datePublished\":\"2025-01-08T12:50:33+08:00\",\"dateModified\":\"2025-01-08T13:02:04+08:00\",\"articleBody\":\"As for the private sector, Mrs Teo says they can take the following steps for now:1) Those using NRIC numbers as a factor of authentication or as default passwords should stop this practice as soon as possible.2)Those that presently collect partial NRIC numbers to identify people can continue to do so, as the guidelines for the private sector have not yet changed. The Government will consider how these guidelines should be updated after consulting the public.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Government started taking steps to stop incorrect NRIC uses\",\"datePublished\":\"2025-01-08T12:39:34+08:00\",\"dateModified\":\"2025-01-08T12:58:53+08:00\",\"articleBody\":\"Responding to questions from Dr Tan Wu Meng, Mr Liang Eng Hwa and Ms Sylvia Lim, Mrs Teo says the incorrect use of NRIC numbers led the Government to take steps to stop the practice.These measures include not using the NRIC number as an authenticator and moving away from the use of masked NRIC numbers, which can give a false sense of security.\\u201cWe knew this transition would take time,\\u201d Mrs Teo says. \\u201cBut it was better to start while the problem is relatively contained, and for the Government to take the lead.\\u201dShe adds that the Government has asked agencies not to plan new uses for the NRIC numbers, aiming to eventually discontinue the use of masked NRIC numbers.But the lapse in coordination between agencies led to Acra\\u2019s misunderstanding and the disclosure of NRIC numbers in the Bizfile portal.\\u201cWhat we should have made clear was that moving away from the use of masked NRIC numbers did not mean automatically using the full NRIC number instead in every case,\\u201d she says. \\u201cAt no point was our intention to disclose full NRIC numbers on a wide scale.\\u201dThere would be instances where there would be no need for the NRIC number at all, instead of using masked numbers. In other cases, names or other identifiers would be enough.But she points out that there could also be cases in which NRIC numbers should be used, but adds that each case would have to be assessed and decided individually.\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"gabriellea\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Current incorrect uses of NRIC numbers and need for change\",\"datePublished\":\"2025-01-08T12:39:05+08:00\",\"dateModified\":\"2025-01-08T12:44:35+08:00\",\"articleBody\":\"Organisations that deal with large numbers of people need a better way of uniquely identifying individuals beyond NRIC numbers, Mrs Teo says. While NRIC numbers are unique identifiers, they cannot be secret.Over time, NRIC numbers have become increasingly used as more than an identifier, with some organisations assuming that if someone can cite an NRIC number, that individual must be the person in question \\u2013 this is \\u201cclearly wrong\\u201d, she says.When such assumptions are made, the NRIC number becomes an authenticator \\u2013 a key to unlock more information or services, or to prove an individual\\u2019s identity \\u2013 which is \\u201cclearly inappropriate\\u201d.Some individuals have also started to use their NRIC numbers as their passwords, as they were under the impression that the full number is secret. But algorithms available online now make it easier to work out the full NRIC number from partial or masked numbers.As such, the continued use of partial or masked NRIC numbers gives both organisations and individuals a false sense of security, making the practice of using NRIC numbers as passwords a bad idea. \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"What the Government says it will do next\",\"datePublished\":\"2025-01-08T12:10:07+08:00\",\"dateModified\":\"2025-01-08T12:24:23+08:00\",\"articleBody\":\"At a press conference on Dec 19, 2024, Minister for Digital Development and Information Josephine Teo, Second Minister for Finance Indranee Rajah and Acra chief executive Chia-Tern Huey Min apologised for the anxiety caused by the disclosure of NRIC numbers.They also assured Singaporeans that the Government was taking the public\\u2019s concerns on the matter seriously.The Ministry of Digital Development and Information has planned a public education campaign to address topics such as risks associated with improper use of NRIC numbers, ways Singaporeans can better protect themselves and how organisations can correct their incorrect practices.The authorities also need to educate the public on how they view the NRIC number and to return it to its original purpose as a unique identifier, Mrs Teo said.A public consultation is also scheduled in 2025 to get feedback from the private sector and members of the public.READ MORE HEREST PHOTO: JASON QUAH \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"The difference between identification and authentication, why this matters\",\"datePublished\":\"2025-01-08T12:21:31+08:00\",\"dateModified\":\"2025-01-08T12:24:15+08:00\",\"articleBody\":\"Identification involves using your NRIC number to state who you are, whereas authentication involves using your NRIC number to prove that you are who you claim to be.NRIC numbers were originally created as unique identifiers for citizens, but they have been wrongly used by some organisations as passwords or as a means of authenticating identity to grant access to privileged information.Minister for Digital Development and Information Josephine Teo during a press conference on Dec 19, 2024, said NRIC numbers are meant as a unique identifier and cannot be a secret, just as people\\u2019s names are not a secret,But this does not mean that people should fully reveal NRIC numbers in all circumstances.Partial NRIC numbers should also not be relied on for authentication, as they give a false sense of security that the numbers are concealed. These numbers can be easily unravelled using simple algorithms, leaving users vulnerable to fraud.Fraudsters who obtain a full NRIC number can impersonate individuals to access services that still rely on NRIC numbers for authentication.Organisations that use NRIC numbers for authenticating transactions or logins should stop this practice. Instead, they should use more secure alternatives, such as one-time passwords or biometric data.READ MORE HEREST PHOTO: SHINTARO TAY\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"Parliament to discuss NRIC issue\",\"datePublished\":\"2025-01-08T11:45:27+08:00\",\"dateModified\":\"2025-01-08T12:08:04+08:00\",\"articleBody\":\"Good morning, and welcome to The Straits Times\\u2019 live coverage of the ministerial statements on the NRIC saga.Minister for Digital Development and Information Josephine Teo and Second Minister for Finance Indranee Rajah are expected to deliver separate statements from around 12.30pm.MPs have filed 51 parliamentary questions on the issue.PHOTO: LIANHE ZAOBAOREAD MORE HERE \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"msazali\"}},{\"@type\":\"BlogPosting\",\"headline\":\"37 parliamentary questions: What MPs are asking\",\"datePublished\":\"2025-01-08T12:00:16+08:00\",\"dateModified\":\"2025-01-08T12:00:16+08:00\",\"articleBody\":\"MPs filed 37 parliamentary questions regarding the Government\\u2019s move away from masked NRIC numbers, with many asking about the potential risks related to scams, identity theft and data privacy, as well as seeking greater clarity on the new policy.Mr Yip Hon Weng (Yio Chu Kang) asked whether the move could pose a risk in the rise of NRIC-related scams, particularly among the elderly. Mr Louis Chua (Sengkang GRC) noted the possibility of NRIC numbers being used to unlock personal information and asked for the Government\\u2019s assessment of this risk.Mr Lim Biow Chuan (Mountbatten) sought the Ministry of Digital Development and Information\\u2019s response to cyber-security experts, who have raised concerns that NRIC numbers could be used by bad actors to impersonate authority figures or commit crime.Regarding the move away from using NRIC numbers for authentication, Progress Singapore Party Non-Constituency MP Hazel Poa asked about steps taken to ensure compliance by the private sector. Nominated MP Ong Hua Han questioned about support provided for healthcare and financial institutions during the transition.ST PHOTO: GIN TAY\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}},{\"@type\":\"BlogPosting\",\"headline\":\"How the NRIC issue unfolded\",\"datePublished\":\"2025-01-08T11:50:23+08:00\",\"dateModified\":\"2025-01-08T11:50:23+08:00\",\"articleBody\":\"The full NRIC numbers of individuals linked to business entities registered under the Accounting and Corporate Regulatory Authority\\u2019s (Acra) database were accessible for free on its new Bizfile web portal, which was launched on Dec 9, 2024.Acra disabled the feature on Dec 13 after the public raised concerns about privacy and potential scams. The agency did not disclose how many NRIC numbers were exposed during this period.It emerged that the unmasking of NRIC numbers resulted from a coordination mishap. In July, the Ministry of Digital Development and Information issued a circular to government agencies to cease any planned use of masked NRIC numbers in new business processes and services. But Acra misunderstood this to mean that it should unmask NRIC numbers on its new portal.At a press conference on Dec 19, Minister for Digital Development and Information Josephine Teo said the move away from masked NRIC numbers was meant to address the incorrect practice of using the number as an authenticator rather than a unique identifier.The authorities are accelerating public education efforts on the use of NRIC numbers, Mrs Teo added, apologising for the anxiety caused.PHOTO: LIANHE ZAOBAO \",\"publisher\":{\"@type\":\"Organization\",\"name\":\"The Straits Times\"},\"author\":{\"@type\":\"Person\",\"name\":\"Ian Cheng\"}}]}","keywords":"Singapore Parliament, NRIC, Minister for Digital Development and Information, MDDI","robots":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1","image":"https://static1.straitstimes.com.sg/s3fs-public/articles/2025/01/08/kc-parlcoll0801.jpg?VersionId=Cae52bh7ePYqHQetFFZ_jKTOrbkpMOQt"},"gaData":{"level2":"23","chapter1":"","chapter2":"","title":"Live:_Parliament_to_discuss_NRIC_issue","title_ga":"Live: Parliament to discuss NRIC issue","pagination":"1","contenttype":"live blog"}},"dependentPaths":[]}}},"actionData":null,"errors":null}