The Hon. Chathura Galappaththi

¶ 01 Hon. Presiding Member, thank you for the opportunity in this debate on the expenditure heads of the Ministry of Science and Technology and the Ministry of Digital Economy.

¶ 02 If we prioritize our country’s issues, reducing theft, corruption, and fraud, and making the public service efficient are at the top. The one solution accepted by both Government and Opposition is digitalization. Although ICTA was established around 2002 to drive digitalization, due to successive administrations, the goal was not achieved; ICTA is now at the verge of closure.

¶ 03 While the world talked digitalization in 2018, we are already in the AI era now, yet we still discuss basic digitalization. Nevertheless, it is encouraging that the President and the team under him are keen on this. We in the Opposition will support maximally. Placing this Ministry under the President and appointing a knowledgeable and expert team is commendable.

¶ 04 President Gotabaya Rajapaksa also prioritized digitalization, but within six months, even leading IT figures like Dr. Sanjeewa Weeraratne left. May such setbacks not occur now, because this is the key ministry to rebuild the nation and deliver real “system change.”

¶ 05 The foundation identified is the digital ID. The difference between the existing National Identity Card and the digital ID, as briefed yesterday, is that the digital ID will include a digital number assigned at birth. The sensitive addition is biometric data—fingerprints, facial and iris scans—unique to individuals. There are concerns about national security if biometric data are compromised. This includes data of the President, Prime Minister, and senior security officials. If such data are stored centrally, access risk is higher than if decentralized. No one can guarantee a system will never be hacked. Global examples abound: 2013 LexisNexis breach; 2015 CIA Director’s private email hacked by a student; 2022 Dutch Intelligence breaching Russian foreign intelligence; 2024 Chinese actors breaching the US Treasury; 2025 January 10 attack on the US CFIUS-related office; and a recent large-scale outage of the “X” platform reportedly due to a cyber-attack. Locally, attempts to access A/L results, and the NMRA data deletion incident threatened national security via the Lanka Government Cloud.

¶ 06 A university junior of mine hacked systems at Colombo and Peradeniya Universities—local examples exist. Hackers target large, valuable datasets. Even big banks are less targeted compared to aggregated rails like “HelaPay,” which was reportedly attacked about two years ago, because of data centrality.

¶ 07 Therefore, data are of immense value. A friend of mine, Sujeev Rajakulendran, once received a Singapore offer to import goods at USD 1 each to sell locally in any quantity—the sole condition was that all customer data be shared. Many do not fully grasp the value of data.

¶ 08 Hence, making this project a reality without threatening national security is our collective goal, but decisions must be made with utmost care. If national and especially personal data fall into foreign hands, it is akin to handing over control. With AI, disinformation risks will grow. If compromised, bank accounts, loans, and credit cards could be misused.

¶ 09 My proposals: first, complete a robust cybersecurity framework and empower SLCERT, the Data Protection Authority, and the new agency with adequate authority. We heard yesterday that two cybersecurity Bills are forthcoming—one under the Ministry of Defence for national security and another under the Ministry of Digital Economy for public security—which is good.

¶ 10 Second, collect biometric data only after the cybersecurity framework is in place. Biometric data primarily serve authentication; currently, fingerprints taken for passports remain with that agency; banking app biometrics remain in banking systems; police fingerprints remain with police. Centralizing such data is unnecessary unless strictly required.

¶ 11 Third, adopt phased rollout—break into six-month segments; engage bug bounty communities and reputable security testing organizations, paying only upon verified findings.

¶ 12 Fourth, while building the security framework, do not sit idle—begin government digitalization via digital ID without biometrics to the maximum feasible extent; add biometrics later if necessary for authentication.

¶ 13 Fifth, start with stakeholder engagement and limited pilot projects, learn from shortcomings, and only then scale nationwide.

¶ 14 On the IT industry’s current challenges: during the 2022 crisis, IT sustained operations remotely, leading many to believe IT careers are secure. Many pursued IT degrees, but internships and placements are now scarce. Even IT graduates now approach politicians for jobs—unprecedented—because industry hiring has stagnated while AI reduces demand for large numbers of software engineers. The Government must respond quickly—invest in startups, especially product-based ventures, not only service-oriented ones. In Silicon Valley, only a fraction succeeds, but the ecosystem invests. Support local incubators like Hatch and others; be bold in investing. Establish a National Digital Procurement Portal swiftly, define requirements and guidelines, and channel projects to local talent to address unemployment.

¶ 15 Thank you.