Opening Remarks by Minister Josephine Teo at Press Conference on Responsible Use of NRIC Numbers

1. Thank you to the members of the media for being here. I would firstly like to acknowledge the concerns of the public, which we take very seriously.

2. We are very sorry to have caused them much anxiety. We have wanted to give them better protection, and this requires a change in our policy involving NRIC numbers because the current situation leaves us vulnerable. Let me explain why.

3. In our daily interactions, we are identified by our names. However, our names may not be unique. For example, for organisations dealing with many people, say a hospital with several patients named Tan Ah Kow, they can be confused and will each need a unique identifier, which is their NRIC number.

4. So, when the hospital needs to perform an operation or dispense medication, the doctor or nurse must make sure it is the right Tan Ah Kow, and they will ask “what is your NRIC number?”.

5. Because the main purpose of the NRIC number is to be a unique identifier, it cannot be a secret, just as our names are not secret. We must assume that our NRIC numbers are known to quite a few people.

6. However, over time, NRIC numbers have increasingly come to be used as more than just an identifier.

7. Some organisations have started depending on a person producing his full NRIC number as proof that the person is who he or she claims to be. He or she is then granted access to privileged information or services. That is, the NRIC number has also become an authenticator. This is not a good idea. Since our NRIC numbers are known to some other people, someone unauthorised may misuse our NRIC number to get access.

8. Partial (or masked) NRIC numbers are also frequently used. E.g. when we visit a condominium, and the security guard takes down our particulars, including our partial NRIC number. Many people think that this way, the full NRIC number remains concealed. This creates a false sense of security, because in fact from the partial number, you can make a good guess of what the full NRIC number is using simple algorithms, especially if you also know the person’s year of birth. This process is not at all difficult.

9. We therefore had to change the status quo, to move away from the NRIC number as an authenticator, and from using masked NRIC numbers for that false sense of security. We knew this had to be done over a period of time, and that a major effort would be needed to help Singaporeans understand the risks, because of our longstanding practices and habits. And it is better to do this while the problem is relatively contained.

10. Within government, we started to do a few things: Get agencies to stop using the NRIC number as a password or to prove someone is who he or she claims to be. Discontinue the use of masked NRIC numbers, starting with new services first, and then existing services as each service is updated.

11. Unfortunately, there was a lapse in coordination between the staffs on how this was to be implemented, and this led to ACRA’s unmasking of NRIC numbers in the new Bizfile.

12. Let me now ask Chief Executive of ACRA, Huey Min, to explain what happened¹, and Min Indranee will then set out the next steps from MOF’s perspective².

13. Thereafter I will provide a further explanation on our larger plans regarding NRIC practices³.

¹ Remarks by Chief Executive of ACRA, Mrs Chia-Tern Huey Min

² Remarks by Ms Indranee Rajah, Minister in the Prime Minister's Office, Second Minister for Finance and National Development

³ Closing Remarks by Minister Josephine Teo at Press Conference on Responsible Use of NRIC Numbers