A review panel has found that a series of misunderstandings, rather than deliberate wrongdoing, led to the display of full National Registration Identity Card (NRIC) numbers on the Accounting and Corporate Regulatory Authority's (ACRA) Bizfile portal last December.
A review panel has concluded that a series of missteps, rather than deliberate wrongdoing, led to the display of full National Registration Identity Card ( NRIC ) numbers on the Accounting and Corporate Regulatory Authority's (ACRA) Bizfile portal last December. The panel, chaired by Head of Civil Service Leo Yip, was tasked with examining government policy on responsible NRIC usage, investigating the Bizfile incident, and identifying lessons to prevent future occurrences.
While the panel found no evidence of intentional misconduct by Ministry of Digital Development and Information (MDDI) or ACRA officers, it highlighted several shortcomings on both sides that should have been avoided. The Prime Minister's Office released a statement confirming the panel's findings, noting that the report was submitted to Senior Minister Teo Chee Hean on February 25 and subsequently approved for public release by Prime Minister Lawrence Wong on February 27. Teo will deliver a ministerial statement on the report's contents in Parliament on March 6. ACRA, its parent ministry the Ministry of Finance, and MDDI have acknowledged the panel's findings and outlined steps to address the identified shortcomings. The incident sparked public concern over privacy when searches on ACRA's Bizfile portal inadvertently revealed complete NRIC numbers in search results.The issue came to light following an August 2022 review by the former Smart Nation and Digital Government Office (SNDGO), now part of MDDI, which aimed to curb the misuse of NRIC numbers for authentication and transition away from partial NRIC numbers. SNDGO issued a circular to government agencies in September 2023 addressing the first issue, emphasizing that NRIC numbers are intended for identification, not authentication. Separately, ACRA proposed in early 2024 to switch from full to partial NRIC numbers in People Profiles on the Bizfile portal. However, SNDGO informed ACRA of its plan to phase out partial NRIC numbers, leading to a misunderstanding. ACRA misinterpreted SNDGO's intentions, believing the long-term goal was to 'unmask' NRIC numbers. SNDGO failed to clarify that ceasing partial NRIC usage did not equate to unmasking full numbers. This contributed to subsequent communication breakdowns between ACRA and MDDI. In July 2024, MDDI issued a circular outlining its plan to stop using partial NRIC numbers internally and prevent their introduction in new internal and external applications. The circular also outlined plans to phase out existing external uses of masked NRIC numbers after assessing their use cases. MDDI conducted a briefing on the circular 11 days later, attended by two ACRA officers not involved in developing the updated Bizfile portal. A video recording and a document with frequently asked questions were emailed to data governance teams the following day, but were not attached to the initial circular or shared with ACRA senior leadership. Within ACRA, discussions occurred regarding the potential sensitivity of displaying full NRIC numbers in the People Search function, but the agency was heavily influenced by its earlier exchange with SNDGO, where the term 'unmask' was used. Additionally, ACRA referenced a line in the July circular stating that agencies must cease planned use of masked NRIC numbers in new digital products. Despite Bizfile not being a new platform, ACRA considered the updated portal to be a new digital product. Over 500,000 searches for NRIC numbers were conducted on the ACRA website between December 9 and 13, but no known threat actors were identified. In email exchanges, MDDI informed ACRA that it could continue using masked NRIC numbers 'for now' but should prepare for 'eventual unmasking,' using 'unmask' as shorthand for stopping the use of masked NRIC numbers. ACRA misinterpreted this to mean that masked NRIC numbers could be used on the old Bizfile portal, but full numbers would need to be displayed on the new portal as soon as possible. The report concluded that both sides failed to clarify the misunderstanding due to a lack of in-depth engagement on the meaning of their emails
NRIC Bizfile Privacy Data Security Singapore Government Miscommunication
Singapore Latest News, Singapore Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
NRIC unmasking issue: No evidence of deliberate wrongdoing by agencies, says Govt panelA Government review into the National Registration Identity Card (NRIC) unmasking issue found no evidence of deliberate wrongdoing or wilful action by officers from the Ministry of Digital Development and Information (MDDI) and Accounting and Corporate Regulatory Authority (Acra).
Read more »
Singapore Government Review Finds 'Shortcomings' in NRIC Data Exposure IncidentA review into a data privacy incident involving the exposure of Singaporean NRIC numbers on the Acra Bizfile portal found no deliberate wrongdoing but highlighted a 'confluence of shortcomings' by the Ministry of Digital Development and Information (MDDI) and Accounting and Corporate Regulatory Authority (Acra).
Read more »
Officers, leaders involved in NRIC unmasking saga may face financial consequencesThe Ministry of Digital Development and Information (MDDI) and the Accounting and Corporate Regulatory Authority (ACRA) also laid out steps that they will be taking to improve processes.
Read more »
Mix of shortcomings, misunderstandings led to full NRIC numbers being revealed on ACRA portalA "confluence" of shortcomings and misunderstandings led to the release of full NRIC numbers on an Accounting and Corporate Regulatory Authority (ACRA) platform last December. According to a panel chaired by the Head of Civil Service, there was no malicious or deliberate wrongdoing.
Read more »
Kennedy moves closer to top health job after clearing Senate panelWASHINGTON: Robert F Kennedy Jr, President Donald Trump's pick for health secretary, moved closer to securing the job on Tuesday (Feb 4), winning approval from a key Republican senator and a recommendation from the Finance Committee to advance him to a full Senate vote as soon as this week.
Read more »
Japan to Review Retrial System After Death Row Prisoner's AcquittalJapan's retrial system is facing scrutiny following the acquittal of Iwao Hakamada, the world's longest-serving death row prisoner. Critics argue the system's arduous process, which can take decades, does not adequately protect victims of wrongful convictions. The justice ministry will consult legal experts on potential revisions to the law, which hasn't been changed since its introduction over 70 years ago.
Read more »