Govt apologises for causing anxiety, confusion over unmasking of NRIC numbers

The government has apologised for causing anxiety and confusion among the public over the unmasking of NRIC numbers on the Bizfile platform. 

"We are very sorry to have caused them much anxiety,” said Minister for Digital Development and Information Josephine Teo, who emphasised that the public's concerns are taken seriously. 

Speaking at a joint press conference on Thursday (Dec 19), she clarified that the move to eventually unmask NRIC numbers was to give the public "better protection", as the current situation leaves people vulnerable. 

The government’s plans to discontinue the use of masked NRIC numbers was meant to be implemented first on new services, and subsequently older services as they get updated.

Implementing it in the private sector would only happen after a public consultation was done, said Teo. 

The authorities had wanted to make the change after explaining its rationale, but a "miscommunication" regarding its implementation led to the launch of the Accounting and Corporate Regulatory Authority's (Acra) new Bizfile platform on Dec 9, which had a search function that produced people's full NRIC numbers with their names.

This happened before the government could announce its plans.

Chia-Tern Huey Min, chief executive of Acra, said on Thursday that mistake was caused by a "lapse of coordination" between the staff on how the government's plans were to be implemented.

[[nid:712490]]

"Acra then proceeded on the misunderstanding that it should unmask NRIC numbers in the new Bizfile portal," she explained.

"This was a mistake on Acra's part, and I apologise for this. Our oversight has caused anxiety and confusion to the public."

The authority disabled the "people search" function on its new portal last Friday. 

Addressing public concerns about the accessibility of NRIC numbers, Second Minister for Finance Indranee Rajah emphasised that the change does not mean all masked NRIC numbers will be unmasked. 

"That's exactly what Acra thought too, so I'm just trying to illustrate that that’s how the error occurred," she said.

She also added that Acra does not have every citizen's information. The database only has information of persons running an entity that is registered with Acra. 

"If you had made a filing with Acra to become a company director, or already are a company director, then your information is collected and made publicly available." 

Revised platform won't display NRIC numbers

Moving forward, Acra will introduce a revised search function on Bizfile next week, said Indranee.

The revised platform will no longer show any NRIC number, masked or unmasked. 

For those who require more information about an individual, they can pay and obtain the full profile — including the full NRIC number — from Bizfile. 

Noting that the new change might cause some inconvenience to Bizfile users, Indranee added that one way to narrow the search for a particular individual is to enter their full name and company name. 

"We believe it is the right balance to strike between corporate transparency and public concerns regarding personal information," she said.

The Ministry of Finance and Acra are also thoroughly reviewing the incident, so as to improve the communication and coordination between agencies. 

NRIC number as unique identifier

Instead of being used as authenticators or passwords, NRIC numbers should instead be seen as unique identifiers, said the Ministry of Digital Development and Information. 

As a person's NRIC number is known to other people, they may misuse it to gain access to privileged information. 

This can happen when organisations accept NRIC numbers as a way to prove that a person is who he claims to be, to access confidential documents. 

Malicious actors may also make a "good guess" of an individual's full NRIC number from the masked version, especially if they know the person's birth year. 

"These practices and mindsets must change. We know this will take time. That’s why we are not rushing to change policy. We will start by focusing on the incorrect use of NRIC numbers and stopping such practices," Teo said.

"This means moving away from using the NRIC number as a password, and moving away from using the NRIC number as an authenticator, to prove that a person is who he claims to be."

The ministry said that full NRIC numbers should only be used for high-fidelity identification, such as during medical procedures and subscribing to a phone line. 

They should not be used for retail memberships or to participate in lucky draws, it added. Instead, alternative identifiers should be used for those situations, such as handphone numbers and email addresses.

claudiatan@asiaone.com