MORE than 500,000 search queries were made on the Accounting and Corporate Regulatory Authority’s (Acra) BizFile portal between Dec 9 and 13, during the period when full National Registration Identity Card (NRIC) numbers were visible in free search results.
This was far above the usual daily traffic of 2,000 to 3,000 queries, Second Minister for Finance Indranee Rajah told Parliament on Wednesday (Jan 8).
Most queries were on Dec 13, following reports of full NRIC numbers being publicly visible on the new BizFile portal.
The searches were linked to about 28,000 IP addresses, the majority of which originated from Singapore. The government has found no evidence of “known threat actors” among the IP addresses, she said.
In separate ministerial statements on Wednesday, she and Minister for Digital Development and Information Josephine Teo addressed the BizFile incident and the government’s approach to NRIC numbers, responding to 51 questions filed by Members of Parliament.
The high traffic came about because a security feature in BizFile’s people search function, intended to differentiate between human users and bots, was “not working as intended”, said Indranee. This feature has since been fixed.
BT in your inbox
Start and end each day with the latest news stories and analyses delivered straight to your inbox.
The government could not to determine the exact number of NRIC numbers disclosed, as the BizFile portal is not configured to track individual queries within the search function.
Reviewing the incident
A panel has been convened to review the BizFile incident, led by head of civil service Leo Yip and including permanent secretaries from ministries not involved in NRIC policy.
The panel will examine two key issues: the government’s policy on the responsible use of NRIC numbers, and the disclosure of full NRIC numbers in the people search function of Acra’s BizFile portal.
“For both matters, the panel will study what happened, how the decisions were made, the implementation and communication processes, the coordination across public-sector agencies, and where the government should have done and can do better,” Indranee said.
The review is expected to be completed by February, with findings to be shared subsequently.
