'We are very sorry': Government apologises for confusion, anxiety over NRIC unmasking saga
The government apologised to the public on Thursday (Dec 19) for the saga over unmasking National Registration Identity Card (NRIC) numbers. “We are very sorry to have caused them much anxiety,” said Minister for Digital Development and Information Josephine Teo at a press conference, adding that the public’s concerns are taken seriously.
“We had wanted to give them better protection, and this required a change in our policy involving the use of NRIC numbers, because the current situation leaves us vulnerable.” The government had intended to make the change only after explaining to citizens the rationale but before it could do so, the Accounting and Corporate Regulatory Authority (ACRA) went ahead and launched its Bizfile portal, with a search function that produced people's names and full NRIC numbers. “On behalf of ACRA, I would like to apologise for causing anxiety and concerns to members of the public over the disclosure of NRIC numbers on our Bizfile portal,” said ACRA’s chief executive Chia-Tern Huey Min.
Mrs Chia-Tern said the Ministry of Digital Development and Information (MDDI) had in July “issued a circular for government agencies to cease any planned use of masked NRIC numbers in new business processes and services”. This was part of a wider government effort to uphold the use of NRIC numbers as a unique identifier, and to move away from the use of masked NRIC numbers, which provides a false sense of security, she said. “Unfortunately, there was a lapse of coordination between the staff on how this was to be implemented. ACRA then proceeded on the misunderstanding that it should unmask NRIC numbers in the new Bizfile portal,” explained Mrs Chia-Tern.
related:
What the move away from masked NRIC numbers means for Singaporeans
The current practice of masking NRIC numbers creates a false sense of security that such data is secret, said Digital Development and Information Minister Josephine Teo
Singaporeans have been asked to change the way they think about NRIC numbers and how they are used. The current practice of masking NRIC numbers creates a false sense of security that such data is secret, Digital Development and Information Minister Josephine Teo said in a press conference on Dec 19.
It also means organisations have started wrongly using NRIC numbers as passwords, or as ways to authenticate a person’s identity and grant them access to privileged information. Mrs Teo said government agencies had intended to start moving away from these practices by discontinuing the use of masked NRIC numbers. But a miscommunication between her ministry and the Accounting and Corporate Regulatory Authority (Acra) led to NRIC numbers being fully revealed on Acra’s new business portal.
The Straits Times highlights the changes:
- Is this a policy U-turn? Can all organisations collect NRIC numbers now?
- What does unmasking NRIC numbers mean?
- What is the difference between identification and authentication?
- Why shouldn’t NRIC numbers be used for authentication?
- Why can’t partial NRIC numbers be used for authentication?
- What is the difference between presenting an NRIC and stating your NRIC number?
- Why can’t the private sector share the same approach to NRIC numbers as the public sector?
- Am I at risk? What should I be wary of?
CNA Explains what does it mean for Singaporeans now that NRIC numbers will be unmasked?
The NRIC is a document which Singaporeans have to register for within a year of turning 15, or when someone becomes a citizen or permanent resident
The government said over the weekend that it will be changing the practice of masking National Registration Identity Card (NRIC) numbers, which means citizens' NRIC numbers may be publicly known. It had intended to make the change only after explaining to citizens the rationale but before it could do so, the Accounting and Corporate Regulatory Authority (ACRA) went ahead and launched a new portal with a search function that produced people's names and full NRIC numbers, raising concern and anxiety on the ground.
The NRIC is a document which Singaporeans have to register for within a year of turning 15, or when someone becomes a citizen or permanent resident, mandated under the National Registration Act of 1965. Those born before the year 2000 have NRIC numbers prefixed with “S”, while those born after the turn of the millennium have NRIC numbers starting with “T”. For those born before 1968, their NRIC numbers typically begin with 0 or 1 as they were assigned in order of issuance, instead of based on their birth year. The first NRIC number was issued in 1966 to Singapore’s first president, Yusof Ishak.
NUS associate professor of political science Bilveer Singh told CNA: “It has become the key overt marker of a Singaporean identity, something which we carry around on a daily basis.” It is used to register everything an individual did across many aspects of life, such as buying a house, opening a bank account and getting married, he said. Has its role changed?
The rise of new technologies, digitalisation and threats such as scams, have over the years presented new security concerns, with questions over whether nefarious actors can steal one’s personal data and details that are tied to a particular NRIC number, said Assoc Prof Singh.
Banks, insurers to review use of NRIC numbers
Addressing concerns of impersonators using NRICs to cheat banks, ABS said NRIC numbers alone cannot be used to make payment and fund transfers
Local banks and insurers are reviewing their use of NRIC numbers, and existing practices could change, they said in separate statements on Dec 19. Their statements came in the wake of security concerns over the disclosure of NRIC numbers in an updated version of Singapore’s business registry portal, run by the Accounting and Corporate Regulatory Authority (Acra).
Addressing concerns of impersonators using NRICs to cheat banks, the Association of Banks in Singapore (ABS) said NRIC numbers alone cannot be used to make payment and fund transfers. Customers who want to do so will have to pass multi-factor authentication challenges, in the form of one-time passwords or biometric authentication, to log in to their accounts. Higher-risk activities like high-value fund transfers or adding new payees will have to be further authorised, said ABS.
In calls that The Straits Times made to local banks in the past week, banks typically required callers to identify themselves by entering their NRIC numbers during the call. The caller is required to enter a one-time password before services or privileged information are provided. Transactions over the phone are also limited to fund transfers between the customer’s own accounts with the bank and not to anyone else, for security purposes.
Govt plans to stop masking NRIC numbers, apologises for ACRA publishing details in search results before public education
The government said early Saturday (Dec 14) that it intends to change the practice of masking National Registration Identity Card (NRIC) numbers, after privacy concerns were raised over the new Bizfile portal showing people's details for free in its search results.
The Ministry of Digital Development and Information (MDDI) said in response to media queries that the government had planned to make this change "only after explaining the issue and preparing the ground". However, the Accounting and Corporate Regulatory Authority (ACRA)'s new Bizfile portal had a search function that produced people's names and full NRIC numbers. This new portal was launched on Dec 9, before the government had announced its plans.
"We acknowledge that coordination could have been better so that ACRA’s move would not have run ahead of the government’s intent," said MDDI in its statement. "We apologise for this mistake and for causing anxiety to the public."
NRIC debacle boils down to the legal difference between identification and authentication
The Ministry of Digital Development and Information (MDDI) on Dec 14 announced that our NRIC numbers shouldn't be viewed as sensitive information any more than our names are
On Dec 9, the Accounting and Corporate Regulatory Authority (ACRA) launched its new Bizfile portal featuring a search function that displayed people's names and full National Registration Identity Card (NRIC) numbers, causing a public stir due to rising rates of scams related to identity theft.
The Ministry of Digital Development and Information (MDDI) on Dec 14 announced that our NRIC numbers shouldn't be viewed as sensitive information any more than our names are – but instead of assuaging the public, this seems to have generated more anxiety. Has there been a policy shift? In terms of the Personal Data Protection Act (PDPA) – no, as legislation has not changed. The PDPA has always been business-friendly, giving only baseline protection for personal data and encouraging data analytics – this has not changed either.
But the Personal Data Protection Commission's (PDPC) advisory guidelines do have to change in line with the announcement from MDDI. So why is this happening now? At the outset, we must distinguish between identification and authentication, which are related but quite different. To identify a person is simply to say this person is Mary and not Martha. But if there are two persons named Mary, for us to know which Mary we are referring to, we need the NRIC number to identify the person – to tell us whether it is Mary who is 50 years old, or Mary who is 20 years old. This is the identification purpose of the NRIC.
Govt apologises for Acra lapse, will accelerate efforts to educate public on proper NRIC use
(From left) Second Minister for Finance Indranee Rajah, Minister for Digital Development and Information Josephine Teo and Acra chief executive Chia-Tern Huey Min at a press conference on Dec 19
Efforts to educate the public on the proper use of NRIC numbers will be accelerated, amid uncertainty and anxiety after the disclosure of the identification numbers on the business portal of the Accounting and Corporate Regulatory Authority (Acra) last week.
Plans to consult the private sector on the issue will also be fast-tracked. At an almost two-hour press conference on Dec 19, Minister for Digital Development and Information Josephine Teo, Second Minister for Finance Indranee Rajah and Acra chief executive Chia-Tern Huey Min apologised multiple times for the anxiety caused. They also assured Singaporeans that the Government was taking the public’s concerns on the matter seriously.
Asked if the move away from the use of masked NRIC numbers was a policy U-turn, Mrs Teo said the Government has been consistent in its stance on the proper way NRIC numbers should be handled. The only thing that has changed is that the Government has decided not to use masked NRIC numbers, she said. This move is meant to protect Singaporeans from the vulnerabilities and risks associated with the incorrect practice of using the number as an authenticator, rather than a unique identifier, she said.
related:
Accounting and Corporate Regulatory Authority
Regulatory Authority (ACRA) is a statutory board under the Ministry of Finance of the Government of Singapore. ACRA is the regulator of business registration, financial reporting, public accountants and corporate service providers. ACRA is also responsible for developing the accountancy sector and setting the accounting standards for companies, charities co-operative societies, and societies in Singapore.
ACRA was formed on 1 April 2004 by the Accounting and Corporate Regulatory Act, which resulted in the merger of the then Registry of Companies and Businesses (RCB), and the Public Accountants’ Board (PAB). The merger was to synergise the monitoring of companies’ compliance with disclosure requirements,[3] and the regulation of public accountants performing statutory audit.
On 14 December 2024, the functionality allowing retrieval of NRIC numbers of individuals by name was disabled. ACRA explained that the functionality had been in line with a forthcoming broader government shift away from the use of masked NRIC numbers, and apologised for providing the functionality "before public education on the appropriate use of NRIC information could be done". The Ministry of Digital Development and Information also released a statement stating that there should "not be any sensitivity in having one's full NRIC number made public" since a NRIC number is a unique identifier and "is assumed to be known, just as our real names are known".
