Hansard, Thursday, 6 March 2025

1 Mr Neil Parekh Nimil Rajnikant asked the Minister for Foreign Affairs (a) what does Singapore consider the key priorities for the Association of Southeast Asian Nations (ASEAN) in its relations with the United States (US) under the new Trump administration, bearing in mind the US President's absence from ASEAN summits during his first term as President; and (b) what messages will Singapore convey to its US counterparts during the ASEAN country dialogues and at the East Asia Summit under the chairmanship of Malaysia.

Mr Speaker, the short answer to Mr Neil Parekh's question is economics – trade, investment, energy.

The United States (US) remains a critical partner for Singapore and for the Association of Southeast Asian Nations (ASEAN). The US' presence in our region has in fact underpinned our peace, stability and prosperity in Southeast Asia for many decades. The US is, by a significant margin, the largest foreign investor in ASEAN. And the US is also ASEAN's second largest trading partner.

The US has been an active supporter of ASEAN and this includes strengthening collaboration in new growth areas, for instance artificial intelligence (AI), cyber security and energy transition.

The omni-directional engagement on the part of ASEAN towards the US, to China, to the EU, to India, to Australia and indeed all the middle powers, and our emerging links with Africa and South America, is an essential element of ASEAN's vision for an open, inclusive and rules-based regional architecture in our region. We believe this is the way to secure peace and prosperity, and also based on the appreciation of the fact that in contrast to many parts of the world, Southeast Asia remains at peace and has good prospects for significant growth in the decades to come.

In this respect, the US' commitment to the ASEAN Outlook on the Indo-Pacific, which they have expressed on previous occasions, is reaffirmation of this point.

We will keep emphasising the mutually beneficial nature of ASEAN's interactions and engagement with the US. This engagement will continue to contribute in fact for mutual benefit of both ASEAN and America, and create an area in this part of the world which is safer, stronger and more prosperous.

It is worth reminding this House that in fact if you add, cumulatively, all the economies of the members of ASEAN, we already constitute the world's fifth largest economy and we expect to be on track to become the fourth largest economy by 2030. The trade and investments from the US into our region support hundreds and thousands of jobs in Southeast Asia but similarly, it also supports over 600,000 jobs in America itself. So, the point here is that this is a mutually beneficial relationship.

ASEAN's rapidly developing economies present significant opportunities for American companies including areas like critical minerals, energy, manufacturing, technology, including digital and AI.

Another point worth emphasising is that one-third of global trade passes through the critical maritime shipping lanes in Southeast Asia, including the Straits of Malacca and Singapore, and beyond that, into the South China Sea. The US' presence in the region, both economically and therefore also having interests to protect from a defence perspective, has been crucial to maintaining stability and opportunities in our part of the world. From an ASEAN perspective, the primacy of the United Nations Convention on the Law of the Seas (UNCLOS), which sets out maritime entitlements, and avenues for peaceful resolutions of disputes, and sets out as a right freedom of navigation and overflight, is crucial for ASEAN, both from a stability point of view as well as economic prospects for the future.

So, Mr Speaker, we will continue to work with our partners in ASEAN to seek opportunities for high-level engagement with the new US administration on this basis.

Mr Neil Parekh.

I thank the Minister for the comprehensive response as well as the comprehensive discussions during the Committee of Supply with all the other political officeholders.

My question is related to Ukraine. Does the Minister and envisage a role for ASEAN or Singapore in the peace negotiations that hopefully will get underway very soon, similar, to the way we made an effort to bring the US and North Korea together a few years ago?

The short answer is no. There are far more proximate partners and stakeholders in the dispute, in the conflict between Ukraine and Russia, than Southeast Asia. So, the short answer is no.

Having said that, let me give a Southeast Asian perspective. If you look at the votes of the 10 ASEAN member states, you will find that all of us, in our votes and in our explanation of votes at the UN, have emphasised the importance of the UN Charter and the principles of sovereign equality, political independence and territorial integrity.

ASEAN, perhaps also because of our past experience in the Cold War, has absolutely no intention of allowing ourselves to be a future arena for proxy wars and we will certainly have no intention to allow ourselves to be caught in the strategic contestations between superpowers in the future.

So, bear in mind ASEAN's history. Bear in mind, ASEAN's prospects for the future. Bear in mind, our adherence to international law in the UN Charter. And just as importantly, bear in mind, our prospects for the future.

And that is why I began my answer to you just now that the short answer is no. And if I may add, I had I had an introductory telephone conversation with the Secretary of State Mr Marco Rubio last night. Both of us emphasised economics – so trade, investments, energy.

2 Ms Hazel Poa asked the Minister for Sustainability and the Environment (a) whether NEA has information on what types of waste materials are stored at the warehouse at 11 Kranji Crescent that caught fire on 19 February 2025; (b) whether the four-day fire at the warehouse has exposed residents nearby to toxic pollutants; and (c) if so, what pollutants have residents been exposed to as a result of the fire.

The site that caught fire on 19 February is occupied by a General Waste Disposal Facility. It is licensed to receive industrial and commercial waste for sorting prior to recycling and disposal. The facility contained materials such as paper, plastics, glass, scrap metal, wood waste and e-waste, but it is not licensed to store toxic industrial waste or hazardous substances. Investigations by the National Environment Agency (NEA) and the Singapore Civil Defence Force (SCDF) are ongoing to ascertain whether the facility had adhered to the relevant licensing and fire safety requirements.

The facility is around two kilometres away from the nearest residences. Based on NEA's ambient air quality monitoring network, the air quality in the West region remained within the normal range throughout the four-day duration of the fire.

Ms Poa.

I think the Senior Minister of State for her reply. Does NEA keep track of what materials are stored by recycling companies in their warehouses and whether they rectify any fire safety violations to reduce reoccurrence of such a happening?

Sir, NEA does conduct inspections of these premises from time to time. For this particular premises, they actually did six inspections since 2021. They also regularly send out advisories to these waste recycling facilities to remind them of the need to be cognisant of fire safety risk, to continuously review their fire safety measures to make sure that they are relevant and adequate.

NEA works together with SCDF. SCDF itself also conducts scheduled and regular inspections of these premises. And I understand that SCDF also conducted 10 inspections between 2018 and 2024 for this premises. Where there are non-compliance, these would be issued out. So, for this premises, I think they issued four Fire Hazard Abatement Notices, which is actually a warning to ask them to rectify some non-compliance issues like obstruction of fire exit door or fire extinguisher or faulty fire exit sign. There were three Notices of Offence. Again, this is for non-compliance, for instance, if there is unauthorised fire safety construction. But all these were actually rectified.

3 Mr Yip Hon Weng asked the Minister for Health (a) whether he can elaborate on how our pandemic preparedness plan has been updated to include large-scale influenza outbreaks; (b) specifically, what measures are in place to handle a sudden spike in infections; and (c) how does the Ministry ensure sufficient healthcare capacity during such surges.

Mr Speaker, Sir, large-scale influenza outbreaks are not new and will hit us from time to time. The best way to protect ourselves is for the public, especially those who are medically vulnerable, to take preventive measures. These include having updated vaccinations, practising good personal hygiene and when unwell, wearing face masks, limiting social contacts and seeking medical attention promptly when needed.

If there is a spike in influenza infections, we may have to release our stockpile of antivirals to reduce the risk of infection and severe outcomes, or to secure more supply of new vaccines.

Our public hospitals treat high patient volumes on a daily basis. In surges, they have to tap on alternative care models such as Mobile Inpatient Care at Home for suitable patients and Transitional Care Facilities for medically stable patients.

Mr Yip.

Thank you, Mr Speaker. I thank the Senior Minister of State for his reply. In light of recent influenza outbreaks in regional countries, such as Thailand, what steps is the Ministry taking to enhance influenza vaccination coverage amongst the high-risk populations in Singapore? For instance, in Yio Chu Kang, we work with donors and clinics to provide free flu vaccinations for seniors. And how are these strategies informed by lessons learnt from COVID-19 vaccination roll-outs?

Sir, I thank Mr Yip for his question and for the work that he is doing in his constituency to enhance vaccine coverage. Indeed, we have to increase the awareness of the importance of vaccine coverage for high-risk populations. And high-risk populations for influenza are particularly the seniors that he mentioned, anyone over the age of 65, anyone with chronic medical conditions and people who are vulnerable either because of a condition that causes low immunity or increased risk of acquiring an illness such as influenza.

This is something that we have to think about on an ongoing basis. It is not a illness where it comes once and then it is gone. This is illness that is endemic and it is seasonal – the virus changes, every season. And it is also not an illness where you can be vaccinated once and then are protected for life. You have to update your vaccinations on a regular basis. And so, issues to do with awareness and education, we need to continue on an ongoing basis. And we do so at the medical facilities, or if general practitioners, family physicians are seeing someone over the age of 65 for other routine care, they often do and should ask about when the last influenza vaccination was and offer it, if appropriate.

Similarly, this is something that anyone who is in regular contact with seniors as a result of the service that they are offering, such as the examples that Mr Yip provided in his constituency, can and should ask seniors. Even on a personal level for family members, children can very often play an important role in reminding their parents. So, for me, for example, for many years, I have had the habit of using my parents' wedding anniversary as a marker in my calendar to nag them, gently nudge them. And then, as they have now become a little bit older, I take on the responsibility of making the appointment for them to then go and receive their influenza vaccinations.

So, from an organisational, a social and a personal level, we can often find ways to constantly remind the seniors amongst us above the age of 65 that a regular influenza vaccination would be a very important part of protecting themselves. In parallel, the good social habits, the personal hygiene that I mentioned in my original Parliamentary Question answer also need to continue to be reinforced.

4 Ms Yeo Wan Ling asked the Minister for Transport (a) what measures are taken to stop the illegal practice of carpooling arrangements set up via online chatgroups; and (b) whether the Ministry will embark on a public education campaign on allowable forms of carpooling in Singapore.

The Land Transport Authority (LTA) conducts enforcement actions against drivers who are found to have provided illegal car-pooling services. An individual who provides an illegal car-pooling service may face a fine of up to $3,000, up to six months' imprisonment, or both. Those who provide an illegal car-pool matching service may face a fine of up to $10,000, up to six months' imprisonment, or both. Members of the public who come across individuals providing illegal car-pooling services may write to LTA or notify LTA through the OneMotoring portal.

For safety, we strongly encourage commuters who wish to book point-to-point transport (P2P) services, including commercial car-pooling, to do so via licensed business platforms.

I want to thank the Member for her suggestion for a campaign to improve public awareness of the allowable forms of car-pooling. LTA will work with the taxi and private hire vehicle drivers' associations on this.

Ms Yeo.

Thank you, Speaker. I declare that I am the advisor to the National Private Hire Vehicles Association, an affiliate association to the National Trades Union Congress (NTUC).

The illegal practice of carpooling arrangement set up via online chatgroups continues to be an issue, creating safety concerns for passengers and affecting the professional reputation of licensed P2P drivers. A quick search on Telegram last week using SGHitch already yields five different active chatgroups, the largest, having a member base of 49,115, and the smallest with a base of 3,000. Almost every minute, in these chats, there is an offer to or from a driver to carpool and offer from a passenger to hitch a ride.

In Singapore, it is only legal to carpool for a fee via licensed business platforms. Given that serious safety issues can come with the use of such unlicensed services – from the outrage of modesty to the most recent case of death where the driver did not even have a Class 3 licence – what more can the Ministry do to educate the public on the use of such services? And would the Ministry consider also disallowing paid carpooling amongst strangers, even in matching platforms for the safety of all commuters?

I want to thank the Member for her supplementary questions. As she has noted, currently, we only allow carpooling services if it is through a licensed carpooling operator or through a permitted licence-exempt operator, which is one that has got a fleet of less than 800 cars. These operators are able to record the driver as well as the trip, check on the validity of the driver's licence and also enforce on the maximum two trips per day requirement. This really is to protect the commuters or passengers' safety, provide the commuter with some safeguards.

Carpooling services acquired through informal channels like Telegram, SGHitch that are non-business entities are not allowed. They are banned.

There is some value in providing or allowing some of these carpooling services. Because it optimises vehicle road capacity, the use of the vehicle, as well as, of course, reduce carbon footprint. Totally banning carpooling services will not necessarily remove the problem. In fact, it may exacerbate the problem. If you look at the informal channels, as the Member has rightly pointed out, there is demand. So, when there is demand, there is supply.

And therefore I agree with the Member that besides enforcement actions through enforcement operations that we will continue to do, it is good to intensify our public education efforts to raise awareness among the public that their safety is not protected if they go through these informal channels, and that if they require such carpooling services, they should do it through the licensed or licence-exempt permitted operators. We will work with the associations to look at such a campaign.

5 Mr Yip Hon Weng asked the Minister for Social and Family Development in view of the challenges faced by some single parents and individuals with disabilities in renewing their financial assistance under ComCare schemes (a) whether the Ministry can provide details on the efforts to streamline the Social Service Offices' processes to ensure timelier responses for such renewal applications; and (b) whether there are plans to implement an automatic renewal system for cases with chronic or permanent medical conditions.

Sir, through digitalisation, we have made ComCare applications simpler and more convenient especially for those who cannot easily leave their homes to apply for help. Applications for ComCare Short-to-Medium-Term Assistance can be made online on the SupportGoWhere portal. Applicants who need help with their online application can call our hotline and our call agents will walk them through the application. Our officers can make home visits to assist those who still cannot apply online despite the guidance and are home-bound, such as the elderly or people with disabilities.

The Social Service Officers would have to speak to applicants to find out more about their financial situations and needs. This can be done through phone calls, video conferencing calls or a home visit, if an applicant is unable to meet face-to-face at our office. For persons who are permanently unable to work and have little or no financial means or family support, we can provide ComCare Long Term Assistance where the period between each renewal is longer. The renewal process is still important as it serves as important touchpoints for our officers to check on our clients' wellbeing and identify any new needs.

Mr Yip.

Thank you, Mr Speaker. I thank the Senior Parliamentary Secretary for his reply. Considering the recurring nature of chronic or permanent medical conditions, what are the Ministry's views on implementing an automatic renewal system for ComCare assistance in such cases? And what potential benefits or challenges have been identified in adopting this approach? And how might it improve the quality of life for some of these affected Singaporeans?

Sir, I thank Mr Yip for his supplementary question. I think there is a need to strike a balance here: a balance between ensuring accountability because it is public money that we are dealing with, but perhaps a more important point is the need for us to check in on a regular basis with these clients. Because we do want to make sure that circumstances within the family have not quite deteriorated and if they have or if they have improved, what are the additional things that we can do to better support these clients.

So, considering the two, I think there is a need for us to still ensure that this renewal process is in place. But for cases where, based on their own merits, we can extend the interval for which each of this renewal is being carried out.

6 Ms Hazel Poa asked the Minister for Home Affairs what is the Singapore Civil Defence Force's policy for dealing with offenders who have been repeatedly issued notices of offence for severe breaches of fire safety regulations.

Sir, the Singapore Civil Defence Force (SCDF) adopts an escalatory approach in enforcing against breaches of fire safety regulations.

It issues abatement notices or impose composition fines for minor cases of non-compliance. Higher fines are imposed for repeated instances, and prosecution in court may follow if the errant party fails to rectify the non-compliance. An example of a minor non-compliance would be undertaking minor partition works that affect the fire safety design of a space without seeking approval from SCDF.

For more serious breaches and repeated offences of serious breaches, SCDF will consider prosecution. An example of a serious breach is erection of illegal structures that would seriously compromise escape in the event of a fire.

Ms Poa.

I thank the Minister of State for his reply. In view of the recent fire at the Kranji warehouse, does the Ministry feel that there is a need to adopt a tougher position against repeat offenders?

Sir, we have always taken, like what I shared earlier, an escalatory enforcement approach. In cases like the one that the Member referred to, and also as shared by my colleague Dr Amy Khor, whereby the SCDF went to inspect 10 times during the said period. And all the non-compliance issues were rectified.

So, we work with with the owners, and like what I shared in my answer, if there are serious breaches, we will take them to task. We will look at the setting, the context and at the same time, we will not hesitate, not only in taking action but will continue to do inspections, making sure that they are safe.

I think at the end of the day, every case is unique and we not only take an escalatory approach, we are very serious about this, because fires not only cause damages, lives may be lost. We are very serious and we will continue to ensure that fire safety is well adhered to by owners.

Mr Dennis Tan.

Thank you, Mr Speaker. Can I ask the Minister of State for serious cases of persistent reoffending, would the Ministry consider, if necessary, working with other agencies or Ministries to consider imposing a business suspension to deter reoffending?

Sir, we do work with our agencies and partners. What is key, like what I said earlier, is an escalatory approach. While we can use our levers, we also have our other agencies who can use their levers. At the end of the day, fire safety is critical. We do not compromise because what is key is that we want to make sure that while they are able to continue their business, lives are not at risk.

7 Mr Yip Hon Weng asked the Prime Minister and Minister for Finance (a) whether the Ministry will consider introducing an extension of the GST Voucher scheme to assist more middle-income households in view of rising living costs and household expenses; (b) whether the Ministry will review the assessable income threshold to qualify for GST-related assistance; and (c) whether there are plans to offer additional support for families with children who fall within the qualifying income threshold.

Mr Speaker, the Goods and Services Tax Voucher (GSTV) scheme helps lower- and middle-income households offset their GST expenses. We last updated the Assessable Income threshold for the GSTV scheme in 2022 and will continue to review this to ensure support is targeted at those who need it more.

The Government has also introduced Cost-of-Living (COL) measures to help Singaporean households cope with their living expenses. As announced at Budget 2025, the Government will be providing additional Community Development Council (CDC) Vouchers to all Singaporean households and providing additional U-Save such that eligible HDB households will receive double the regular U-Save, or up to $760, this financial year.

On top of these, the families that meet the eligibility criteria will receive additional support as announced at Budget 2025 in the form of $500 Child LifeSG Credits for each Singaporean child aged 12 and below this year, and $500 top-ups to the Edusave account or Post-Secondary Education Account for Singaporeans aged 13 to 20 years this year.

We have also introduced structural enhancements to better support families. These include a further reduction in the monthly full-day childcare fee caps in Government-supported preschools, and the opening of nearly 40,000 new infant and childcare places by Anchor Operators over the next few years.

We have also rolled out the Large Families Scheme, which includes $1,000 in Large Family LifeSG Credits disbursed annually to families for each of their third and subsequent child during the years that the child turns one to six. These will help to defray a wide range of household expenses for families with children.

Order. End of Question Time.

[Pursuant to Standing Order No 22(3), provided that Members had not asked for questions standing in their names to be postponed to a later Sitting day or withdrawn, written answers to questions not reached by the end of Question Time are reproduced in the Appendix.]

Mr Speaker, I move, "That, notwithstanding Standing Order 91(2), the Ministerial Statement on Review into the Public Disclosure of Full NRIC Numbers on Bizfile People Search be taken before the resumption of proceedings on the Estimates of Expenditure for FY2025/2026 at this day's Sitting".

Supply business ordinarily takes precedence over Ministerial Statements. However, the Ministerial Statement is on a matter of some importance and it would be more efficient for the disposal of Parliamentary Business for the Ministerial Statement to be taken before the resumption of the debate on the Committee of Supply. Members will have sufficient time to seek clarifications from Senior Minister Teo Chee Hean, who will deliver the Ministerial Statement.

[(proc text) Question put, and agreed to. (proc text)]

[(proc text) Resolved, (proc text)]

[(proc text) That, notwithstanding Standing Order 91(2), the Ministerial Statement on "Review into the Public Disclosure of Full NRIC Numbers on Bizfile People Search" be taken before the resumption of proceedings on the Estimates of Expenditure for FY2025/2026 at this day's Sitting. – [Ms Indranee Rajah] (proc text)]

Ministerial Statement. Senior Minister Teo Chee Hean.

With your permission, Mr Speaker, may I request the Clerks to distribute a handout to Members, which I will refer to during my Statement? Members may also access the handout through the MP@SGPARL App.

Please proceed. [A handout was distributed to hon Members. Please refer to Annex 1.]

Thank you, Mr Speaker. Sir, on 9 December last year, the Accounting and Corporate Regulatory Authority (ACRA) launched its new Bizfile portal to replace its existing system. Like its predecessor, the new portal included a People Search function. This function allowed users to search for and select the individuals associated with registered business entities whose information they wished to access through the purchase of a People Profile. So, there is a People Search function and the People Profile function. The People Search function is generally available to everyone, anyone. The People Profile function sits behind a paywall.

But unlike the old Bizfile portal, which showed partial National Registration Identity Card (NRIC) numbers in the People Search results, the new Bizfile portal displayed full NRIC numbers. This caused public anxiety about how easily full NRIC numbers could be searched for and accessed. Therefore, the People Search function was disabled on the night of 13 December 2024.

The Minister for Digital Development and Information, Mrs Josephine Teo, and the Second Minister for Finance, Ms Indranee Rajah, held a media conference on 19 December 2024, during which they apologised for the anxiety caused. They explained what had happened and the Government's intent to change the existing practice of using partial NRIC numbers. Ministers Josephine Teo and Indranee Rajah also made Ministerial Statements to this House on 8 January 2025 and responded to requests for clarifications from Members.

To thoroughly review the matter, the Prime Minister directed the Head of the Civil Service to set up a Panel to review the Government's policy on the responsible use of NRIC numbers where it pertained to the Bizfile portal; second, to determine what led to the Bizfile incident; and to identify learning points so that similar incidents do not recur.

The Panel also reviewed the design and implementation of the People Search function and the response to the incident by ACRA and the Ministry of Digital Development and Information (MDDI), from the time public concerns arose on 12 December 2024 until the People Search function was disabled on 13 December 2024.

The Panel submitted its report to me on 25 February 2025. I reviewed the report and reported to the Prime Minister that I had accepted its findings and recommendations. After studying the report carefully, the Prime Minister agreed with its findings, its assessment of the shortcomings and the learning points identified. He said that the Government would take the lessons to heart to improve its processes and strive to do better. He directed that the report be released to the public and for the matter to be deliberated in Parliament. ACRA and MDDI have also accepted the findings and released separate media statements on their follow-up actions.

Hon Members would have had the opportunity to study the report, which was made public on 3 March 2025.

Sir, before we turn to the Panel's findings, I will briefly summarise the issues regarding the use of full and partial NRIC numbers. This is set out on the first page of the handout, which is the Annex to the Panel's report. Minister Josephine Teo had addressed these issues in her Ministerial Statement on 8 January 2025 to this House. So, allow me to recap these issues briefly.

The NRIC number allows the individual to be referred to uniquely and definitively. It is important to definitively refer to an individual by using the full NRIC number when required by law and for other purposes, such as for medical procedures and business transactions.

However, the NRIC number had also become used by some organisations, not just to definitively refer to the individual, but also based just on the NRIC number, to carry out important and sensitive actions. The use of the NRIC number in this way is unsafe, because the person's NRIC number is likely to be already known to other persons or organisations.

Some organisations and people had also come to assume that the use of partial NRIC numbers means that the full NRIC number is thereby concealed and protected. Sir, with the availability of online algorithms, it is now easier and faster to work out full NRIC numbers from the partial NRIC numbers.

The use of partial NRIC numbers, therefore, neither meets the need to have a definitive way of referring uniquely to an individual, nor does it offer effective protection from the full NRIC number becoming known.

To address these issues, the former Smart Nation and Digital Government Office (SNDGO), now part of MDDI, commenced a policy review in 2022. The review determined that we should take steps to stop the incorrect use of NRIC numbers for authentication and also move organisations away from the use of partial NRIC numbers. This would allow NRIC numbers to be returned to their proper use as unique identifiers.

The Ministers overseeing SNDGO were responsible for deciding the policy direction on the use of NRIC numbers. The Ministers endorsed the policy intent of returning NRIC numbers to their proper use as unique identifiers and the broad implementation approach to do so.

The Permanent Secretaries of SNDGO, and subsequently MDDI, had overall responsibility for the implementation plans in accordance with the guidance from the Ministers. SNDGO, and subsequently MDDI, knew the transition would take time and planned for the public sector to take the lead on both: (a) stopping the use of NRIC numbers for authentication; and (b) moving away from the use of partial NRIC numbers. It also started developing plans for public education and private sector engagements on the proper use of NRIC numbers and the risks of using partial NRIC numbers.

So, with that background, I refer Members to the second page of the handout, which is on the timeline of key events. The full listing is in the table in the report. Briefly, the key facts are as follows.

SNDGO had planned for the public sector to move first in a phased approach. On 5 July 2024, MDDI issued a Circular Minute (CM) to public agencies to stop the use of NRIC numbers for authentication and to start moving away from the use of partial NRIC numbers. MDDI conducted a briefing on 16 July 2024 for agencies, including ACRA, on the CM, and answered their questions on it. The video recording of the briefing and MDDI's responses to agencies' Frequently Asked Questions (FAQs) were disseminated to agencies the next day. ACRA subsequently sought clarifications via email from MDDI on how the CM applied to the display of NRIC numbers in the search results of People Search in the new Bizfile portal.

However, communications between the two sides were not clear. ACRA misunderstood MDDI's instruction in the July 2024 CM for agencies to "immediately cease any planned use of masked NRIC numbers, for example, in new business processes or digital products". ACRA interpreted this as a requirement to "unmask" or disclose NRIC numbers in full in the People Search function on the new Bizfile portal.

However, MDDI had intended that agencies could continue to use partial NRIC numbers for their existing external-facing use cases, but were not to introduce new use cases of partial NRIC numbers. To MDDI, ACRA's Bizfile People Search function was considered an existing use case because it was a service that was already existing in the old portal.

MDDI had also assumed that when agencies stopped using partial NRIC numbers, they would consider if NRIC numbers even remained necessary for those use cases. This would be in line with existing requirements under the Government's Instruction Manual on Information Communications Technology and Smart Systems Management (IM8).

Based on ACRA's interpretation of the July 2024 CM, ACRA then instructed its IT vendor on 17 August 2024 to make the requisite system changes to display NRIC numbers in full in the People Search function on the new Bizfile portal, which was then launched on 9 December 2024.

Sir, I will now move on to the Panel's findings, which are summarised in the third page of the handout. The Panel found that a confluence of several shortcomings on the part of both MDDI and ACRA, and how they had interacted with each other on this issue, led to the incident.

First, the Panel found that MDDI should have been clearer in its policy communications in its July 2024 CM. MDDI and ACRA staff did not realise that ACRA had misunderstood how the July 2024 CM applied to the new Bizfile portal. Specifically, MDDI should have explained key terms and phrases in the CM more clearly.

Although MDDI did make efforts to brief agencies on the requirements of the July 2024 CM and disseminated the video recording of the briefing as well as the FAQs to them, the relevant documents were not appended to the CM. So, if one referred to the CM, one would not have seen the other clarifications arising from the session that MDDI had with the agencies.

Second, there were internal shortcomings within ACRA in sharing and acting on the information from MDDI on the July 2024 CM. The FAQs mentioned earlier were not properly disseminated within ACRA by the officers who had attended the briefing and the officers who had received the video and the email of what had happened. And this contributed to ACRA's continued misinterpretation of the July 2024 CM and resulted in them making decisions based on incomplete information. These FAQs would, for example, have alerted ACRA that stopping the use of partial NRIC numbers did not mean showing full NRIC numbers in every case, and agencies could decide to drop the use of NRIC numbers altogether.

Third, the Panel found that MDDI should have paid more attention to the implementation plan for new use cases of partial NRIC numbers that were more complex, such as public registries. The Panel found that, in directing agencies to stop new use cases of partial NRIC numbers, MDDI did not differentiate between simpler use cases, like one-to-one correspondence between public agencies and members of the public, and more complex use cases, like public registries, which could potentially disclose a large amount of data to third parties performing searches.

ACRA, as the national business registry of Singapore, is one such public registry. One of ACRA's functions is to provide public access to certain information in the registry, so as to maintain corporate transparency. The standard approach for public registries is to have safeguards, such as a paywall, so that, as far as possible, access to the needed information from the registry is available only to users for whom the service is intended. But there is also often a search function for the registry, before these safeguards, which is open to everyone to narrow down the information in the registry which the user wishes to access, and agencies have to determine how much to reveal when someone performs a search without having to go through safeguards, such as a paywall, for the information. For such complex use cases, additional guidance from MDDI would have helped agencies decide whether disclosing full NRIC numbers was necessary, and if so, determine what safeguards should be put in place.

Fourth, in deciding to disclose full NRIC numbers in People Search, ACRA did not first assess the proper balance between sharing full NRIC numbers and ensuring that they were not too readily accessible on the People Search function. This contravened the Government's internal rules on data management, namely, IM8, which ACRA was required to comply with under the Public Sector (Governance) Act (or PSGA).

Sir, ACRA's frame of mind when interpreting the July 2024 CM was influenced by its discussions with MDDI five months earlier in February 2024. In February 2024, five months earlier, ACRA had planned a change to its People Profile – the part after the paywall – to only provide partial NRIC numbers instead of the full NRIC numbers, which it had all along been providing. At that time, SNDGO had advised ACRA on the wider move towards stopping public agencies from using partial NRIC numbers. So, this was in February. Bizfile users had also given feedback to ACRA that full NRIC numbers were needed for corporate transparency. So, in view of this feedback and ACRA's exchange with SNDGO, ACRA decided to continue providing the full NRIC numbers in the People Profile function instead of making its proposed changes to partial NRIC numbers. So, this is the People Profile function, which is after the paywall, and these were events and discussions in February, five months before the events that occurred.

So, this exchange with SNDGO in February gave ACRA the impression that the policy intent was to "unmask" all partial NRIC numbers, which was not the case. But that was ACRA's frame of mind when interpreting how the July 2024 CM should be applied to the People Search function in the new Bizfile portal, specifically whether to continue providing partial NRIC numbers or to change to providing full NRIC numbers instead to the part before the paywall.

Nonetheless, even if ACRA was under the mistaken impression that the July 2024 CM required them to disclose full NRIC numbers in People Search, ACRA ought to still have, as required by IM8, assessed the proper balance between the public interest in sharing full NRIC numbers, which was to promote corporate transparency, and the competing public interest in ensuring that full NRIC numbers were not too readily accessible.

The Panel found that the design of the People Search function of the new Bizfile portal made individuals' NRIC numbers too easily available to those who were improperly using the People Search function in a way that went beyond its intended purpose.

Fifth, the review found that certain security features for the People Search function were not adequately implemented for the new Bizfile portal. ACRA had required its IT vendor to implement various security features in the People Search function of the new Bizfile portal to protect against unintended uses by, for instance, limiting the extent of searches allowed.

However, certain security features were not adequately implemented when the new Bizfile portal was launched on 9 December 2024. After disabling the People Search function, ACRA requested that the Government Technology Agency of Singapore (GovTech) review the security features of the People Search function. So, this was after the fact, after the People Search function had already been launched.

The review found that some security features, including the CAPTCHA functionality, were not adequately implemented, allowing potential data retrieval using scripts from 9 to 13 December 2024.

These security issues were rectified by the vendor in the revised People Search function before it resumed service on 28 December 2024. ACRA is following up with the vendor and considering all its available options. Without prejudice to any such options, the Panel noted that ACRA remains ultimately accountable for the implementation of the People Search function, even though it had contracted this to its vendor.

The sixth and last finding of the Panel was that the incident management after public concerns on the Bizfile portal surfaced on 12 December 2024 should have been better. Upon receiving the public feedback, ACRA and MDDI should have ascertained more quickly the key facts of how the Bizfile incident happened and ACRA should have disabled the People Search function sooner. Doing so would have addressed public concerns in a more timely manner.

The public communications and response to public concerns should also have been better coordinated and clearer. And in hindsight, the Government should have made clear to the public at the outset that moving away from the use of partial NRIC numbers did not automatically mean using full NRIC numbers in every case or disclosing them on a large scale.

The Panel noted that the incident took place before MDDI had begun public education and engagement on the proper use of NRIC numbers as a unique identifier. If you recall, the implementation of this was in the public sector and the engagement of the private sector had not begun yet. So, this exacerbated public concerns when full NRIC numbers were easily searchable and accessible in the People Search function, since many members of the public would not have been familiar with the issues associated with the use of NRIC numbers. The Panel was of the view that it would have been better for MDDI to have embarked on public education and engagement earlier than what it had planned.

Mr Speaker, Sir, the details of the Panel's findings are in the report. Having reviewed it, I agree with the findings. I would like to thank the Panel for their thorough work on this matter. As I had stated earlier, ACRA and MDDI have both accepted the Panel's findings and are following up to address the issues identified, as set out in their respective media statements.

Beyond the agencies involved, this incident offers valuable and important lessons for the wider Public Service. To meet changing circumstances and new challenges, the Public Service will need to continually update its policies and practices. Some of these changes will not be straightforward. How we communicate and implement them will be critical. The Bizfile incident demonstrates that close coordination and careful attention to detail are required. Sometimes, it is a single issue, but at other times, it can be a confluence of factors that can lead to such incidents. The lessons that the Panel has identified will be disseminated across the whole of the Public Service. Agencies are expected to take them on board and apply them to their work to avoid similar incidents from recurring.

Sir, beyond learning lessons, accountability is important as well. The political office holders overseeing ACRA as well as the Smart Nation work in MDDI have overall responsibility for the organisations under their charge. And this is regardless of whether they had specific or direct responsibility for the actions that led to the shortcomings that occurred. So, this distinction between an overall responsibility that political office holders have for the organisations under their charge and the specific or direct responsibility for the actions that led to the shortcomings that occurred.

Both Ministers Josephine Teo and Indranee Rajah have publicly accepted this overall responsibility and also apologised for what has happened.

At the Public Service level, the Permanent Secretaries of SNDGO, and subsequently MDDI, were responsible for implementing the policy. The Chief Executive of ACRA was responsible for the new Bizfile portal's design and implementation. While the Panel did not find any evidence of deliberate wrongdoing or wilful inaction by the ACRA and MDDI officers involved in this incident, the shortcomings identified, including ACRA's contravention of IM8, should have been avoided.

Mr Speaker, Sir, I should make clear that this review panel was not a disciplinary process. While the Panel's report serves as a reference, any disciplinary action, if warranted in relation to individual officers, will need to be conducted in accordance with the applicable frameworks and processes in the respective public agencies involved, and this is only proper.

The Public Service Division, MDDI and ACRA have taken into account the findings of the Panel and have thus reviewed the roles, responsibilities and actions of the relevant officers involved in the shortcomings highlighted in the report. These officers include those whose actions contributed directly to the shortcomings, as well as senior management who were responsible for providing oversight and guidance to the officers and are responsible for the proper functioning of their organisations.

The agencies have assessed that while there was no malicious or wilful wrongdoing by the officers, there were inadequacies in their judgement and actions, and appropriate measures are being taken against them. These measures range from counselling to retraining to reductions in performance grade, which will carry financial consequences, such as a reduction in their performance-based payments.

As for ACRA's contravention of IM8, PSGA does not prescribe financial penalties for public agencies that contravene IM8, and there is a good reason for that. The cost of any financial penalties would ultimately have to be borne by the public purse if we impose a financial penalty on a public agency. And therefore, such penalties would not be meaningful. Instead, as I have stated, the necessary actions will be taken against the officers responsible. The PSGA is designed with that in mind.

The Ministers overseeing ACRA as well as the Smart Nation work in MDDI had overall responsibility for the organisations under their charge and the Prime Minister will take into account this incident in his evaluation of the Ministers.

Mr Speaker, Sir, the Public Service holds its officers to a high standard of conduct and excellence. Singaporeans deserve and expect this. Given the range and complexity of public services, from time to time, mistakes will be made. If there is misconduct or malicious intent, we will deal with it severely and those involved will be punished. Where there had been no malicious or wilful wrongdoing, due consideration should be given to whether the officers had acted in good faith when we decide on what actions to take.

And most importantly, the lessons arising from the incident must be learnt and internalised, not only by the officers involved or their agencies, but by the Public Service as a whole, so that they are not repeated.

Mr Speaker, Sir, trust in the Public Service is essential. Maintaining that trust is, therefore, central to how we operate. When things go wrong, we are upfront with Singaporeans on where we have fallen short. We conduct thorough reviews and make improvements to our systems and processes to serve Singaporeans better while remaining fair to our officers.

Sir, this recent incident, while regrettable, demonstrates the Government's commitment to continuous improvement, to uphold the trust that Singaporeans have placed in the Government and the Public Service.

Sir, I will be happy to take any clarifications.

Order. We will now have clarifications on the Ministerial Statement. I can see that there are many Members wanting to seek clarifications. So, I would like to take this opportunity to remind Members that pursuant to Standing Order 23, Members may seek clarifications on the Ministerial Statement, but no debate should be allowed.

Members can seek clarifications by way of asking questions. If any preamble is required and if it takes too long, I will interject and ask you to get straight to asking your clarifications. So, I seek Members' understanding to keep your clarifications clear and concise. I will ask the same of the Senior Minister in his responses.

Mr Pritam Singh.

Mr Speaker, I have three clarifications for the Senior Minister. The questions are follow-ups from my Parliamentary Question filed for the 7 January 2025 Sitting. [Please refer to "Explanation and Impact of Policy Change on Full NRIC Number and Further Measures on Public Education and Protection of Sensitive Identifiable Information", Official Report, 7 January 2025, Vol 95, Issue 148, Oral Answers to Questions section.]

The first pertains to the CM of 5 July and this is found at pages 20 and 21 of the report. It is not clear from the report whether ACRA provided a list of all existing communication and correspondence with members of the public that used masked NRIC numbers. Did ACRA send this list to MDDI? When did they send it and what was MDDI's response? This is vis-à-vis paragraph 9 of CM.

The second question is on ACRA's conversation with MDDI. It started in February 2024 and it concerned the People Profile function, not the People Search function. At page 15 of the report, it states that from 5 July – that was the point in time when the CM was distributed – to early August, ACRA had, "sought clarification from MDDI on how the July CM should apply to ACRA's new Bizfile portal," which was the one launched on 9 December.

It begs the question: what clarification was sought by ACRA and what was MDDI's response? In the report, I note at paragraph 48, it states that on 30 July, an ACRA officer, who had not gone for the MDDI briefing and did not see the FAQ document that MDDI had emailed; and this officer asked MDDI if ACRA needed to cater system enhancements to remove the masking of NRIC numbers in the People Search function. So, it would appear that the new Bizfile portal already was going to continue what the old Bizfile portal was providing to the public: masked NRIC numbers in the People Search function.

So, it would be helpful to understand what clarifications were sought, because at this point it seems like MDDI confirming to ACRA that it can continue to display masked NRIC numbers in the People Search function "for now", but that it should be prepared for eventual unmasking at a point when MDDI was going to issue future guidance. So, at that point, 30 July, it would seem everybody is ad idem on the way forward. So, this I think is the point which begs further questions – what went wrong after this point?

Once again, there is emphasis in the report on paragraph 7 of the CM and the confusion, and Senior Minister has explained how new business processes were misunderstood by ACRA. But paragraph 9, as I alluded to, makes it quite clear that ACRA, in this case, was supposed to provide MDDI a list of their existing correspondence with members of the public using masked NRIC numbers. So, that really is the subject of my question: when was that done?

The final question is, at what point did the senior leadership of ACRA fully reviewed the new Bizfile portal before it went public? Was there any independent assessment done about the full unmasking of NRIC numbers on the People Search function? I ask this question because in the conclusion of the report, it states that ACRA did not first assess the proper balance between sharing full NRIC numbers and ensuring that they were not too readily accessible. So, did they assess this balance at any point in time?

Mr Speaker, first, I would like to thank Mr Pritam Singh for having read the report in such detail. That is very useful and he should also understand the conclusions that were arrived at in the report and what I had just said. In fact, he has identified all the misunderstandings in the communication between the two agencies which led to this unfortunate incident. In fact, this is described in the report as well as in my speech just now.

The two were communicating with each other but they had different frames of mind and therefore, they went away with different understandings of what the CM said and also different understandings of the communications and emails that they had with each other. In fact, that is really what was identified as one of the shortcomings in the report and in my Statement just now.

So, indeed that is the case. There was a gap in understanding between the two agencies. In spite of the fact that they had communicated with each other, each went away thinking that they had put their point across clearly and each went away thinking that the other understood what was to be done and what was meant. But that was not the case.

Did ACRA send all the instances and so forth? I am sure they have, but the relevant point is that they were communicating on this particular instance and had a gap in understanding between the two.

Did ACRA make an assessment? They probably did, but as I pointed out, and as the Panel pointed out, they did not make a proper assessment of the balance between their function of making such a registry available and conveniently so to users, and the need to manage the access to information in such a search function. So, that was a shortcoming on the part of ACRA.

Ms Jessica Tan.

Mr Speaker, while the report did not indicate that there was any malicious intent or wilful action, the findings of the review panel did indicate that the Government's internal rules on data management policies were contravened, and Senior Minister Teo touched on the point of public trust.

As Government agencies store, access and handle personal information of Singaporeans in engagements and provision of various Government services and with digitisation, what assurances can be given to Singaporeans on the proper handling of personal data by Government agencies? Because it is not just about policies, it is not just about rules; it is about that balance.

I actually worry that it may come to the point of everyone being so afraid to move forward because of that. But it is a difficult challenge. Given this incident and the learning from this instance, it may lead to everyone being overly cautious. I need to understand what will be done across the Government to help our officers move forward and be able to make that right judgement call. It is not an easy problem to address.

Mr Speaker, perhaps this is an opportunity to explain the process for ensuring data privacy and making sure that data is properly dealt with in the public sector versus the structure for the private sector.

In the private sector, there is the Personal Data Protection Act 2012 (or PDPA) and in the public sector there is the PSGA. And they largely mirror each other. In fact, some of the things that are in PDPA today, were originally already in the public sector's rules for data governance in IM8, even before PDPA was announced. And some of the things that were eventually enacted in PDPA and the guidance provided by the Personal Data Protection Commission (PDPC) were also adopted in the public sector. So, the two mirror each other.

But there are a couple of important differences between the two and I will take this opportunity to explain what they are.

First of all, there is no expectation within the private sector that different private sector corporations interact with one another and share data with one another, purportedly to serve the customer better. In fact, private sector agencies are quite protective of the data that they have because they see that as a competitive advantage, and we also do not allow private sector organisations to sell their data to others for profit. So, by and large, they do not share with others.

In the public sector, there is an expectation that to serve citizens better, there is some sharing between the two. We sometimes hear, in Parliament also, "You already know this. Why do you keep on asking me for it?" So, in order to serve residents better, we do share data and this is allowed in the PSGA.

For example, you apply for a Housing and Development Board (HDB) flat, access your Central Provident Fund (CPF) account and all those kind of things, it is shared and available. If someone applies for social service support, that information is available so that the person in a distressed situation already does not have to keep on providing the same information again.

So, that is an expectation and it is different between the private sector and the public sector.

There is another important difference, which is what the financial penalties are. First of all, in the PDPA, the financial penalties are directed against the organisation; whereas in the PSGA, as I explained, if you direct the financial penalties against a Government agency, it is actually not very meaningful, because they all come, eventually, from the public purse. So, the financial penalties arise from actions taken against individual officers.

In the PDPA, originally, there were no specified penalties against individuals. Eventually, in 2020, the PDPA took some of the provisions in the PSGA and imported them into the PDPA, so that in some circumstances, the PDPA can be used to take action against individuals.

So, there is always a mirroring between the two and there are differences between the two.

First of all, the public sector does have a very strong and robust system for the management of data and the sharing of data, and for taking action against persons who contravene them. So, that is the start point.

Should this cause persons to become overly careful? I think that it is always a possibility whenever an incident such as this arises. But that is why it is important to identify the shortcomings clearly. Do not go in with a big bazooka and flatten everybody, but differentiate between the responsibilities of the individuals. Individuals who are responsible, they have to be held to account, but we must do so in a well-balanced and fair way to the individuals. This is the approach that we take and which we will continue to.

There are 14 hands that I counted. If the answer is already given by the Minister, please do not repeat the clarification. Mr Liang Eng Hwa.

Sir, I refer to paragraph 48, which is about the exchanges between MDDI and ACRA. I read in that paragraph, where in the reply from MDDI to ACRA, it states that "ACRA can continue to display masked NRIC numbers in the People Search function for now". And it continues to say that it should be prepared for the "eventual unmasking of the NRIC number".

Can I ask the Senior Minister whether that remains the policy position – the eventual unmasking of the NRIC number? And in the case of the People Search function, what is the direction ahead? Would ACRA eventually stop displaying the masked NRIC number? Would the full NRIC number be shown in some way, with some controls or with some safeguards?

My second clarification is related to page 16 for the chronology of key events. The report mentioned that ACRA did have internal deliberations about the risk of showing full NRIC numbers in the People Search function. It shows that ACRA did have concerns, at least, at the working level, but they went ahead because they misunderstood the instructions from the July 2024 CM. Can I ask if there is a deeper issue here, where an agency felt compelled to just go ahead with the launch even though internally, they have some serious concerns or reservations on the public implications? And whether does the Public Service have the mechanism where officers at the working level who may have spotted a potential high-risk situation, for example, in the upcoming implementation, are able to flag out these concerns and get attention from the management?

If I may just say what has happened to the People Search function, the part before the paywall. ACRA has resumed service on that function, but without NRIC numbers, whether full or partial. Because they have done an assessment now and have come to the conclusion that it is possible to serve the intended users without having to use full or partial NRIC numbers, and that is what they have done. So, that is the situation.

Mr Liang has also read the report very, very carefully – and I am glad that he has done so – and identified certain places where there were gaps. Indeed, they communicated with each other and in the communication that Mr Liang cited, that showed how the two of them misunderstood each other – what is new, what is existing, there was a gap in understanding. Was the new Bizfile portal new? Or was it an existing use case? So, there was a gap there.

Also, what does stopping the use of partial NRIC numbers mean? Does it mean that where you had partial NRIC numbers before, you just go and use full NRIC numbers? So, there was a gap there in communication between the two agencies.

The question that Mr Liang asked is, is there a process for making sure that agencies can communicate and do this? In fact, they did. MDDI conducted a briefing, engaged the agencies, answered the questions and disseminated them the next day.

Within ACRA, there were some shortcomings. There was a shortcoming that was identified by the Panel where they did not fully communicate internally what the position was. And therefore, when ACRA and the senior management were making decisions on this, they were doing so without the benefit of the additional information that had come out of MDDI's briefings and interactions with the agencies. I think that describes how they had a difference of understanding.

But as Mr Liang indicated, there is a more important aspect here, which is that officers, especially at the senior level, need to understand the intent behind what the policy is – and certainly, officers at the senior level should be able to do so – and not implement things which are just going by the letter. And if there is a problem and there is an issue, they should engage with each other and thrash that out thoroughly. And I think that is one of the important lessons that we have learnt from this case.

Ms Sylvia Lim.

Thank you, Sir. I have two clarifications for the Senior Minister.

First, I found what he said about the overall accountability of Ministers very interesting. He mentioned that the two Ministers involved would have this incident taken into account by the Prime Minister in his assessment of their overall performance. But the fact is the Prime Minister is the Minister for Finance and ACRA is a Statutory Board within the Ministry of Finance. So, how does that work as far as the Prime Minister is concerned? Because he is also overall responsible for ACRA, in that sense.

The second clarification is about the report's shortcoming number six, which talks about shortcomings in incident management after the public concerns were raised on 12 December. I am personally aware that it is a reality in the Civil Service, and probably private sector, that in December, there are many staff that are on annual leave, we expect them to clear their leave. And December is usually a time when there are less staff around.

So, I would like to ask him whether this aspect of key decision-makers not being so readily available, did it feature at all in causing any delays in the incident response? And does he think that this could be a potential issue, even if it is not an issue in this case?

The second point first, Mr Speaker. Certainly, it could have been a factor. But to the Panel which reviewed the thing, it was not an acceptable excuse or reason. The agencies still have to be responsible for what they are doing, whatever season of the year it is. So, that was not something which the Panel took into account – and I think rightly so.

On the point of the Prime Minister's responsibility, well, the Prime Minister is responsible for everything. But he has to delegate his responsibilities to Ministers who are responsible for Ministries, agencies and functions. That is part of the Prime Minister's role. If the Prime Minister tried to be responsible for everything, he would not be able to function at all. One of the responsibilities of the Prime Minister is to know when he should delegate and when he should intervene. I hope that Ms Sylvia Lim appreciates that.

I am also glad to note that Ms Sylvia Lim takes accountability, especially accountability of leaders of organisations, as something which is very serious, and which should be accepted when mistakes are made.

Ms Tin Pei Ling.

Thank you, Mr Speaker. Three questions for the Senior Minister. First, on the incident management. I think there have been useful lessons drawn. In this case, it was shared in the report that the lessons will be disseminated to the broader Public Service. I would like to ask who may be coordinating this for this particular incident. Also, looking ahead, should there be similar incidents or other crisis-type of incidents happening, who will be coordinating the response and making sure that investigations and responses are being done in a timely manner?

Because in this case, I think there was a time gap at the beginning, so it allowed a lot of doubts and questions from the public to foment. With digitalisation, information and speculations got worse as a result of that; it did not quite help with that sense of public anxiety. So, I wanted to ask if there would be someone or some body to coordinate this going forward, arising from this incident.

Second is that I think quite clearly from the report as well as the questions to and fro so far, there has been no malicious intent, no deliberate wilful inaction or action. It was really everyone trying their best to do what they think is right. As Government business gets more complex, there are so many issues at hand. How do we strike the balance?

On the one hand, ensuring that discipline is taken for errors being done and continuing to strengthen public trust, but on the other hand, continuing to encourage public officers to take calculated risks when necessary so that innovations can still happen, so that things can still move forward, and not to always be worried about what ifs and do not do anything at all. I do not think that will serve us well as well. So, how do we balance that? Because from the report, I feel a bit worried – are we going to hammer them too much? Because that may not be sending the right signal to the broader Public Service as well.

Lastly, which pertains to a question that I had asked as a supplementary question during the previous Sitting. Given that there are still enterprises using the NRIC number as authentication, what is the progress of the Government's effort in getting them to rectify this? If this is not the right platform for me to ask this, I will file a question separately.

I would like to thank Ms Tin. She has also read the report very thoroughly. I am glad to see that.

There is an existing process within the Government for actually coordinating across. And certainly, in the Public Service. There is the Committee of Permanent Secretaries, which meets regularly. They discuss issues of importance and issues where coordination between Ministries and agencies should take place.

But apart from that, although the digital world, as Ms Tin correctly points out, spins faster, we also use digital means very often in communicating with each other. I am sure that among the Permanent Secretaries, they will communicate with each other. They probably have their own address group, where things which are important, which have to be acted on quickly, are communicated with each other. In fact, because in this day and age, people also travel a lot, so wherever they are in the world, they will also know what is happening. It is a faster process as well in disseminating information and also making sure that things are understood.

I should say that by and large, the Public Service actually works very well and coordinates very well. Instances like this do take place, but they are, fortunately, few and far between. But they do take place. So, how do we deal with instances like this and the officers who have come short in their performance?

I think Ms Tin, and Ms Jessica Tan also, pointed out quite importantly, we should not come down like a tonne of bricks on officers for issues like this, even if they have become public and have caused public anxiety. We should deal with them fairly and in accordance with the Public Sector's disciplinary processes.

This is something which I think will give assurance to our officers that just because the thing has become publicly known and caused some anxiety, that we will come down on them in an unfair way. We have to evaluate what they did, what they did not do, what they should have done, what was the intent behind it and then decide on the appropriate action to be taken.

And that is the way that we should continue to deal with the Public Service so that our Public Service will continue to do all the things that they need to do for us, including taking calculated risks, if they need to, but not take risks dangerously.

So, these are things which we should continue to be able to do with our public officers.

On the enterprises' use of NRIC as authentication, the Public Service has stopped this practice within the Public Service. There is appropriate guidance going out to private sector organisations to also cease this practice because it is quite unsafe. This is something which is ongoing. If there are private sector organisations which do not realise that they should stop using NRICs for authentication, I think they probably have not been paying any attention to the media on this issue at all.

But I should explain what is the difference between authentication and using an identifier because there is still a little bit of confusion.

Let me give an example, say, email. All of us have an email address and quite often we even use our own name as the email address. We want the people whom we interact with to know our email address so that they can contact us. So, the email address is an identifier of one form and in fact, it is unique because the email service provider has to have the unique names, otherwise it will go to the wrong person. So, you actually make your email address available to others.

But for authentication purposes, it is quite different. You do not tell your password to others. That is something which you keep for yourself and your email service provider knows. So, there is a difference between an identifier and an authentication.

This is an example in which most people will understand that, yes, you can use your name as your email address. That is not insecure, and it is very often convenient and expected. But please do not use your name as your password or your NRIC as your password because, a good number of people know it. So, that is the difference between the two.

Dr Tan Wu Meng.

I thank the Senior Minister for the Ministerial Statement. I have asked two Parliamentary Questions on the same topic in January. My clarifications will fall into two buckets. The first on mindsets and instincts. The second on IT security.

Sir, firstly, on mindsets and instincts, can I ask, in hindsight, could there have been earlier involvement of agencies with a specific security mindset when the new Bizfile portal was being designed and implemented? In particular, does the Senior Minister agree that in the modern era, we must assume that any database with a search function will attract cyber troublemakers trying to download and scrap as much of the information as possible? And as such, how can we further strengthen the instincts or even the sixth sense within agencies and officers to be more sensitised to these dangers, especially for databases that contain NRICs, because the NRIC number is unique and cannot be changed? Once it is being harvested, that bell cannot be unrung.

Secondly, on IT security, can I ask the Senior Minister is there room to strengthen the red team capability and the use of red teams within the Government to look at the security of online portals that might provide access to personal data even through a search function, especially for projects where there is a greater risk if there is a security glitch? For example, and I have read the report, it mentions that ACRA outsourced the portal security to the portal vendor. The vendor then outsourced security penetration tests to a security reviewer. And yet, when GovTech came in, they discovered that the security features were not adequately implemented. In this vein, do we know if the same portal vendor and the same security reviewer are providing services to any other Government portals or Government organisations?

Sir, hindsight is a marvelous thing. I use it very often myself too. But in any situation, each organisation and each leader has to make the decision based on the information that he has and is able to obtain.

Specifically on IT security, yes, indeed, it is important that when organisations implement an IT system or change an IT system, that they take security into account. In fact, that is one of the requirements of IM8 and which organisations often find a little bit too prescriptive and overbearing. But that is a necessity and for the reasons that Dr Tan has pointed out. So, we do do that.

And I should say that the Government does not try to build every IT system itself. There are very reputable IT companies and vendors out there which the Government should make use of. And there are also very reputable IT security companies out there, some of them are at the leading edge of IT security, which the Government should also make use of. So, we should not and do not need to try to do everything ourselves. This is the approach that we take. And in the evaluation of whom to assign or whom to award the tenders to, these are taken into account.

But, of course, just as the Government can make mistakes sometimes, the IT vendors too, are not perfect, as we know. Even IT security companies or companies which sell IT security as their main product have made mistakes and been penetrated in an embarrassing way before. So, we need to keep on being vigilant.

I should say, without going into too many details, because we do not want to give away exactly what we do in maintaining IT security, we do have a system of red teaming, which is quite rigorous. And we also invite the public to help us. We actually have a bug bounty system, one which is evergreen. That means, if you do find a bug or you do find a way in which you can penetrate a Government system, you let us know, and there is a bounty for it. And this is evergreen.

But we also do, from time to time, have a hunting season. So, for certain of our systems, we invite white hatters to attack those systems. And then, we also have a bounty system for that. So, indeed, we have a system for that.

But for our process for choosing vendors, both IT vendors, as well as security vendors, I should say that if a vendor has been found to not have fulfilled his responsibilities properly, we take that into account in future awarding of tenders, because then, how can you be sure, as Dr Tan has pointed out.

And I am very careful with what I am saying, because as I pointed out, ACRA is keeping all its options open with regard to the IT vendor. But ultimately, the organisation which owns the system, which is ACRA, has ultimate responsibility for it. And ACRA accepts that responsibility.

Ms Hazel Poa.

Speaker, I have three clarifications for the Senior Minister. Paragraphs 76 and 77 of the report tells us that the vendor was the one who appointed the independent security reviewer, not ACRA. And the report was not submitted to ACRA directly from the reviewer, but it was, in fact, the vendor who submitted the report on the test on its own product.

It appears to me as if this process has huge potential for abuse. Is there no concern over this procedure? Does it meet with the governance standards for the public sector? That is my first clarification.

My second clarification is: it is obvious from the report that ACRA did realise that there is a conflict between its understanding of the July CM with its obligations under IM8 and PSGA. Why did ACRA prioritise compliance with the July CM over compliance with IM8 and PSGA? And will there be instruction or guidelines given to organisations how they are to deal with such situations when they find them themselves in apparent positions of conflict? For example, it would appear from the report that ACRA sought clarification primarily over emails. Would it not be better to have a conversation or a meeting over this to sort out any misunderstandings? That is my second clarification.