News
The upcoming digital identity system ‘secure and inclusive for all citizens’ says Dr. Hans Wijayasuriya
View(s):By Tharushi Weerasinghe
Sri Lanka’s upcoming digital identity system, funded and integrated under a grant from the Indian government, has been defended by Dr. Hans Wijayasuriya, Chief Advisor to the President of Sri Lanka on Digital Economy, saying the implementation is now underway following multiple rounds of bilateral coordination.
The comments came as concerns over the data security of Sri Lankan citizens mounted.
The new system, which is based on the Modular Open Source Identity Platform (MOSIP), aims to provide a secure, inclusive, and modern digital identity framework for all citizens, he said.
India is providing a grant of approximately Rs. 10–12 billion for the Master System Integrator (MSI) component of the project, according to Dr. Wijayasuriya. He noted that in line with standard procedures for government-to-government grants, the MSI will be an entity of Indian Origin, and the Procurement Process will be carried out by the Indian government. Services and equipment, such as a primary and secondary data centre, servers, and 2,300 biometric kits for iris, fingerprint, and facial recognition, are being sourced through India’s National Institute for Smart Government (NISG).
Dr. Hans Wijayasuriya: Pic by Dilushi Wijesinghe
“The MSI’s role is limited strictly to the implementation phase,” said Dr. Wijayasuriya. “Once the system is fully deployed and tested, it will be handed over to the government of Sri Lanka to operate and manage.” This handover will occur before any personal citizen data is collected, he emphasised.
The platform selected, MOSIP, was approved by Sri Lanka’s Cabinet in 2021. “We wanted a world-class system that is secure, low-cost, open-source, and not vendor-locked. MOSIP ticked all those boxes and has now been adopted by countries like the Philippines, Ethiopia, and Morocco, with several other countries in the development stage,” Dr. Wijayasuriya said. Globally, over 120 million digital IDs have been issued through MOSIP.
He said that while the grant imposes limitations on contractor origin for the MSI phase, Sri Lankan authorities say this grant condition does not compromise the security or quality of the standards of implementation. “This is a complex, population-scale digital infrastructure,” he explained. “India is a country which has already been through this experience, having implemented Aadhaar, the world’s largest foundational ID system – selecting an Indian Origin MSI purely to implement the system does not in any way compromise the core principles of System Security or Data Protection, while ensuring a fast and efficient delivery of the implementation phase”
To ensure local ownership, a separate Request for Proposals (RFP) will soon be floated for a Managed Services Provider (MSP) that must be of Sri Lankan origin. The MSP will be trained in parallel with the implementation carried out by the MSI and will take full control once the system is operational.
“This handover to the MSP before Data being entered in the system is a non-negotiable condition and has been agreed by all parties” We are building Sri Lanka’s capability to manage this system in the long term,” said Dr. Wijayasuriya, noting the MSP could be a private company or a consortium involving the government.
The platform, he added, is designed with privacy and security “by design,” with multiple safeguards such as third-party audits, red-team testing, and strict role-based access control. “No other government system currently has this level of physical and cyber protection built in,” he said. The software, being open-source, is continuously tested by a global community from the software development and ethical hacking communities, and is subject to ongoing scrutiny and continuous enhancement.
Dr. Wijayasuriya also stressed that cybersecurity depends more on process, diligence and expertise than on nationality. “Whether a contractor is local or foreign doesn’t inherently guarantee or compromise safety.
Our focus has to be on the process of Testing, Data Protection and Cybersecurity Assurance, system and people capabilities, and governance.”
He added that most data breaches worldwide arise due to human or process lapses rather than system failure. “That’s why its essential that we invest significantly in capacity building across institutions and users in addition to establishing the cutting edge in Cybersecurity infrastructure”
According to Dr. Wijayasuriya, Sri Lanka’s Digital Public Infrastructure (DPI) Framework, and in particular the National Data Exchange, will enable consent-based data sharing across government and will include building blocks such as digital signatures, Verifiable credentials and several other facilities. While 70% of the population has access to smartphones, any Digital Credential, including the Digital ID itself, can be used in printed form, and alternative service channels will also be available to ensure inclusion is maximised and no one is left behind.
With respect to concerns about data residency, Dr. Wijayasuriya explained that in the specific case of the Digital ID, 100% of the data will be held within Sri Lanka, using highly secure and resident primary and secondary data centres with multiple layers of physical and virtual access restrictions. For less sensitive applications, however, institutions could use Data Classification Guidelines and Cloud Policies published by the Government to decide on the location for such lower sensitivity data, subject always to compliance with data protection laws and any sector-specific regulations. This would involve selecting between Resident, Public or Sovereign environments – the latter being a scenario where Sri Lanka holds the encryption keys and the data is held in an environment under Sri Lankan jurisdiction,” he said. Legal and institutional frameworks such as the new Cybersecurity Act, and Cybersecurity Regulatory Authority and the Data Protection Authority will strengthen the governance structure to enforce these safeguards.
“The digital ID will not carry more personal information than the current NIC, apart from biometric identifiers for iris and fingerprints,” Dr. Wijayasuriya said.
Discussions between India and Sri Lanka to finalise the scope and security conditions of the MSI contract have been ongoing since January, and Dr. Wijayasuriya assured that the agreement clearly defines boundaries between the MSI and the Sri Lankan-run MSP to ensure privacy is maintained and control is ultimately local.
GovTech will be the primary execution agency within Sri Lanka’s Digital Economy institutional framework, and will implement and oversee several horizontal platforms that serve the entire digital ecosystem, such as digital ID, the national data exchange, digital signatures, and federated data lake infrastructure. The goal is to maximise the use of horizontal platform infrastructures, which are now referred to as Digital Public Infrastructure, for the common good. All government institutions will interface with this infrastructure via APIs, and private sector entities will also be able to connect to access a multitude of services, including authentication.
A key feature of the new environment is consent-based information sharing between ministries and institutions for administrative functions. This environment will also enable connectivity between systems, from the Grama Niladhari level to institutions such as the Department of the Registrar General and the Department of Immigration and Emigration.
The best way to say that you found the home of your dreams is by finding it on Hitad.lk. We have listings for apartments for sale or rent in Sri Lanka, no matter what locale you're looking for! Whether you live in Colombo, Galle, Kandy, Matara, Jaffna and more - we've got them all!