• Birth, Marriage, and Death Certificate System (Registrar General Department)
• e-Revenue License system (Department of Motor Traffic)
• Police Clearance System (Department of Police)
• Country of Origin Certificate Issuance online system (Department of Commerce)
• Pension system (Department of Pensions)
• e-Local Government System
• Department of Meteorology website
• Registrar of Companies website
• Sri Lanka Accounting and Auditing Standards Board website
• ICTA website

The outcome was that Sri Lankans had to rely on manual services, resulting in long queues at government offices. For some, this also meant traveling across the country to access these services.

What’s Lanka Government Cloud?

The Lanka Government Network’s origins, where LGC is a part of, date back as far as the ICTA itself. In 2009, ICTA had reportedly connected 325 locations as part of LGN’s physical network. It also launched Lanka Gate, its flagship software infrastructure at the time.

By 2012, the Government of Sri Lanka soft-launched “Lanka Cloud” as an extension of the project. LGN officially came under the Lanka Government Information Infrastructure. It was mandated with the “management and maintenance of the institutional infrastructure of the Government of Sri Lanka”. ICTA stated the Lanka Cloud setup was designed to create over 150 servers (VMWare virtualization).

In 2018, the platform was upgraded and relaunched as LGC 2.0/LGN 2.0. It moved from a private cloud to a hybrid cloud model. The idea was that an open-source platform like OpenStack would be scalable and more efficient than the previous VMWare platform. Additionally, LGC 2.0 aims to set the foundation for more recent, large-scale projects like Sri Lanka Unique Digital Identity (SL-UDI) and National Data Exchange (NDX).

What went wrong?

Following the outage, ICTA issued a statement confirming that an LGC disruption caused several e-government services to crash. The Ministry of Digital Economy says an LGN capacity limit caused the disruption. The statement further pointed out that LGC is undergoing expansion throughout October, aiming to address capacity and operational constraints.

These capacity issues aren’t new to the government cloud platform. In fact, LGC 2.0 maxxed out its resource utilization by mid-2022 and was unable to expand its resources owing to the economic crisis at the time.

However, a report from The Examiner points the actual reason to a system migration issue. The current system is being migrated to a managed cloud setup, which the government contracted to SLT in May. The report further states that the contracts of the providers for the old system weren’t extended for months leading up to the outage. This made these services unavailable during the migration.

SLT itself has been iffy about its relationship with the LGN project. Despite providing critical infrastructure for years, the ISP has gone as far as to state that it doesn’t provide any hosting services to Lanka Government Cloud. In 2016, SLT was selected to provide a high-speed optical fiber communications network for LGN as part of its upgrade to LGN 2.0. The upgrade was carried out over two years, at LKR 12.7 billion.

Redundancies and backups

At the time, the government also gave SLT the green light to negotiate with other service providers to facilitate infrastructure support for LGN 2.0. While there were attempts at a split-managed cloud between SLT and Dialog later on, the plans reportedly never materialized.

Additionally, the nature of government digital procurements meant ICTA itself owned and managed the servers, set up at SLT’s Internet Data Centre in Pitipana.

It doesn’t help that LGC seemingly has no effective backups in place either. Disaster recovery plans are a critical part of data-centric infrastructure, particularly at the scale of LGC. But despite multiple calls on the need for backups by the government, ranging from ICTA meeting minutes to bidding documents, the outage only proved the poor state of LGC’s overall disaster recovery plan.

A recurring issue

Unfortunately, this isn’t the first time an LGN issue has impacted Sri Lanka’s e-government services. The Foreign Ministry’s Electronic Document Attestation System has failed at least twice over the past five years. The e-Revenue License system has suffered a similar fate multiple times, with the portal crashing even after a system upgrade.

In 2021, LGC was also caught up in the NMRA controversy. Terabytes of pharmaceutical companies’ data to the National Medicines Regulatory Authority (NMRA) went missing from LGC servers.

Two years later, a ransomware attack impacted all of LGN’s gov.lk emails, losing months of government emails with no backups. ICTA CEO Mahesh Perera stated that no backups were available at the time owing to administrative problems.

Then there’s the security problem. Sri Lanka’s government websites are infamous for suffering cybersecurity attacks, whether due to operating without SSL certificates or being left vulnerable enough for teenagers to deface them. But even when hacks have left hundreds of thousands of personal records compromised, the government has rarely bothered to address the severity of a fundamental problem with its digital infrastructure.

Protecting the data

Ironically, all this comes at a time when the government approved the Personal Data Protection Act amendment bill. The amended bill is to be adopted into law on October 21, following its third reading. The Act was officially passed into law in 2022. But it’s only set to become active once the Data Protection Authority is established and operational.

On paper, this would prompt every organization to comply legally with how personal data is processed and stored. As to how effectively the Act will be enacted, particularly around State Operated Enterprise personal data violations, remains to be seen.

Alongside the Personal Data Protection Act, Sri Lanka is also looking at pushing the cyber security bill into law, though the Ministry of Digital Economy has stated it will be delayed until next year.

The digital priority question

On top of this, the ICTA launched a public consultation on Cloud Policy and Strategy for Sri Lanka early this year. The call comes as the government looks to formulate a regulatory framework for its sovereign cloud strategy.

The idea is local data storage and governance while allowing global cloud providers to operate under a strong regulatory framework. It proves critical for the government’s more ambitious projects like SL-UDI. “We need a sovereign cloud for the country which can meet all local and international security standards,” says ICTA Director Sanjaya Karunasena about Sri Lanka’s sovereign cloud plans. “We’re currently in discussions with potential parties to establish a mechanism for all qualified local and international players to participate in the cloud setup process”, he further said.

Alongside a national framework for a sovereign cloud, the Government of Sri Lanka has set its eyes on building a superapp. It hopes to streamline fragmented government services and build awareness. The ICTA expects to get through its first phase before the end of 2026.

Lanka Government Cloud, data, and eroding trust

So, it’s worth asking what protection mechanisms are set in place, be it data redundancy or regulatory frameworks. How is the infrastructure managed to ensure smooth operations? Who is held accountable when thousands of citizens are locked out of accessing vital government services? Now, with more government functionalities set to come online, these questions only seem to grow bigger.

Projects like GovPay, Pravesha, and the National Air Quality Network have shown what successful e-government services look like and how effectively they can serve the citizenry. But a digital infrastructure that keeps glitching at critical levels not only undermines these successes but also puts the spotlight on the government’s misguided digital priorities.

More importantly, incidents like the LGC outage inconvenience citizens at large and erode whatever trust the government is trying to build with its digitalization plans.

After all, what does it say about a country’s digital infrastructure where critical government services go offline due to poor administrative practices? What does it say about a country with ambitions of a digitalized future that includes digital ID and AI, but fails to build reliable and functioning systems? What does it say about a country that refuses to take accountability for its digital failings beyond just an online statement?

The post Lanka Government Cloud and Sri Lanka’s deepening digital fragility appeared first on ReadMe.

Chemmani sits at the entrance to Jaffna town — a reminder of the crimes endured by the Jaffna Peninsula during the 30-year-long armed conflict between the Sri Lankan state and the Liberation Tigers of Tamil Eelam (LTTE).

In 1996, 18-year-old schoolgirl Krishanthy Kumaraswamy was raped and murdered there. Her mother, brother, and neighbour, who went in search of her, were also consequently murdered at the site. 

Ambika Satkunanathan, a human rights activist, notes that it’s one of the “rare cases” in which the perpetrators of human rights violations associated with the war were convicted. The first accused in the case — a Sri Lankan army soldier named Somaratne Rajapaksa — told the court that hundreds of disappeared were buried at the same site. Exhumations followed shortly after in 1999 to unearth 15 human skeletal remains. 

But justice was halting. There were no further convictions and no further investigations. 

Ten years later, in 2009, the armed conflict came to an end. More allegations of war crimes committed against the Tamil people followed. Both domestically and internationally, Tamils spoke about their disappeared relatives, their dead, their wounds still waiting to be healed.

In search of accountability

In the 16 years that followed, successive Sri Lankan governments have given little regard to accountability mechanisms. Calls for an international mechanism for investigations into war crimes have often been dismissed. 

But earlier this year, the construction of a building in Chemmani led to the discovery of human remains again. In the months that followed, over 200 skeletons were excavated, including small children. Some were buried with their school bags on their backs, others with toys. 

Chemmani adds to a long line of horrific discoveries over the past three decades. The largest excavation of a mass grave was in Mannar in 2013, leading to 318 skeletons. Two mass graves in the south of the island – in Sooriyakanda and Matale – speak of the violence associated with the JVP uprisings in the ‘70s and ‘80s. 

GPR, DNA sequencing, and excavations  

In mass grave excavations, technology is mainly used to assist investigations through non-invasive survey technologies like Ground Penetrating Radar (GPR) and DNA sequencing. But the Office on Missing Persons (OMP) believes that it’s important to learn from different contexts where effective mass grave investigations have been conducted. 

“In many of them, we see the widespread use of technology for the different phases of investigation, from locating a site to bone analysis to the final identification of individuals. In Sri Lanka, investigators have used drones in some cases to record the site prior to excavation and to identify the boundaries of the grave. In other countries where eyewitnesses can’t provide precise coordinates of a gravesite, more advanced drones with LiDAR remote sensing are used to help pinpoint such locations,” notes OMP board member Mirak Raheem. 

Raheem also explained that other technological inputs, like accredited DNA laboratories able to work with highly degraded bone samples, are vital in mass grave investigations. However, these technologies are expensive, requiring continuous investments. 

“So, as a country, we must decide how these investments can be most efficiently made — whether through sending samples to foreign labs or by establishing our own.” 

While new technology can be used, Raheem says it’s important to “take a step back” and consider the obstacles to effectively using existing technology. For instance, the law provides for the use of video testimony for witnesses and victims who are currently not in the country — a provision that he believes could be “critical” for moving individual cases forward.

“But this has not been widely used. So, we should ask why? Unless we address some of these challenges, such as security fears, we won’t be able to realise the full potential of new technology.”

Tech’s fallacy 

He also emphasises the need to be aware that technology isn’t the solution for every issue. This is evident in the ‘CSI effect’ of DNA, where judges, juries, lawyers, and the general public see DNA as the gold standard. While DNA is vital for identification, it must not be treated as the only tool, as it has limitations and challenges like false positives from DNA tests, says Raheem. 

Thus, he cautions against relying on one single method for identification: “We must compare antemortem information with the skeleton and associated finds, such as clothes and jewelry. We also need to look at circumstances, like other individuals who went missing at the same time from the same location, and whether their remains are also at the site. The use of this contextual data in conjunction with the more specialised forms of analysis, such as DNA, allows us to view the cases with a much more encompassing lens.”

The OMP recommends a multidisciplinary approach in order to conduct effective investigations into mass graves. Such an approach would go beyond the skillsets of forensic archeologists and anthropologists to also draw on those of geologists, ballistic specialists, historians, archivists, and criminal investigators, among others, to develop an integrated report. 

Additionally, the OMP recommends the participation of families of the disappeared in mass grave cases who hold such critical information. 

“While the OMP has been working on building its database on data of missing persons and sites of forensic interest, it has been advocating for a more extensive database including unidentified bodies and registered deaths, which would not only help the OMP but other state agencies to assist in investigations, protect the rights of citizens, and ensure the dignity of the dead.” 

Social media 

Unlike in previous instances when mass graves were discovered, Chemmani quickly garnered social media attention this year. Mostly northern journalists meticulously documented the months-long exhumations on various social media platforms. The story gained traction and refused to die. International media too picked up the story, understanding the significance it holds for Tamils, still asking for accountability. 

The case is an example of the critical role played by social media in the conversation regarding the war. Satkunanathan says social media is important as there’s a “veil of silence in the Sinhala and English mainstream media, and to some extent social media, where issues related to the war, especially wartime violations, are concerned”. 

“Therefore, it is social media that has enabled activists, survivors, and journalists to give visibility to justice and accountability issues. International media too often picks up these issues after it’s highlighted on social media.” 

One north-based journalist says that audience engagement on posts documenting the exhumations at Chemmani is “extremely high”. 

“More eyes from the south of Sri Lanka are on these posts, actively engaging. People are trying to understand what is happening in the north and the east. They’re asking: what is the truth? There’s a trust-building process happening through social media. I’ve also observed heightened engagement from journalists in the south, with some specifically saying they came to Chemmani for coverage after seeing ours on social media.”

However, this engagement can also be negative. One study analysing over 4,000 Sinhalese comments on eleven Facebook posts, reveals a “dominant pattern of defensive nationalism, systematic deflection through whataboutism, and disturbing dehumanisation of victims.”

Limitations 

Recognising the democratising nature of social media platforms, recent Sri Lankan governments have taken the defensive approach. In early 2023, the Online Safety Act was passed, sending a chilling effect across the island on its potential consequences for free speech. 

Even without the OSA, governments have weaponised the Prevention of Terrorism Act and the ICCPR Act to crack down on expression. Following the Easter Sunday terror attacks, the Muslim minority suffered under the PTA – one harrowing example is Ahnaf Jazeem, a poet imprisoned for years, but acquitted of all charges last year. 

With the state using existing laws in such a cruel manner, the introduction of the OSA only added to the fears of rights activists and journalists. Within months of its introduction in 2024, politicians weren’t shy about its implementation. Those like Harin Fernando wrote to the IGP, urging action under the OSA for false claims about him.

Activists like Satkunanathan believe that governments have reacted in this way to restrict the online space because they understand the “pivotal role” played by social media. 

For instance, in times of heightened political activity like the Digana riots in 2018 and the Easter Sunday terror attacks in 2019, governments have shut down social media altogether, restricting online speech. There were even attempts to curb online communication during the 2022 people’s protests against the Gotabaya Rajapaksa presidency. 

These attempts to control conversations online are complemented by offline harassment of activists, survivors, and journalists in multiple ways.

It’s not just the state controlling speech online. Fingers have also been pointed at big tech for removing and filtering sensitive narratives – a problem not limited to Sri Lanka. For example, social media giants have also been accused of filtering content critical of Israel since 2023. 

The generative AI problem

Meanwhile, the online dialogue about Chemmani has also led to other worrying incidents. Lawyer Ranitha Gnanarajah, who represents family members of the disappeared, highlighted incidents where social media users created images using AI to generate humans for the photographs of the exhumed skeletons. 

“The AI created the wrong gender and age. Sensationalising issues in this way has the direct opposite of seeking justice, and must not be accepted by the community. Such actions can water down the process that is happening at the ground level, and also increase the trauma or stress of the family members,” says Gnanarajah. 

The lingering question

When the armed conflict was drawing to a bloody close, government censorship worked to control narratives. Only state media were allowed inside the war zone in May 2009, during the war’s final days. In the years before, clear divisions were seen between the coverage in the Sinhala press and the Tamil press. Sinhala Buddhist majority views took center stage, and links have been drawn between media censorship, media culpability, and war crimes. 

Today, we live in a different era. Technology can help unearth the truth, and social media can help disseminate it, but the question still lingers: how do we use that truth in the pursuit of accountability and to support those in their pursuit of justice? The answer to that question may not be found on social media platforms, but through collective action that goes beyond.

The post Chemmani: Technology’s pursuit of accountability for war crimes in Sri Lanka appeared first on ReadMe.

Arimac Digital’s journey has never been about technology alone. As the company puts it, “It has been about people — the communities empowered, the enterprises transformed, and the fusion of human creativity with technological innovation at the center of every digital experience.” Over the years, Arimac has grown into a company that serves over 180 clients worldwide, including global giants across industries, such as Etihad, VISA, Emirates, Ooredoo, Samsung, Victoria’s Secret, and Vodafone. From humanoid robotics and AI systems to reimagining financial services with Arimac FinSpace and redefining aviation experiences with Arimac AirSpace, Arimac Digital’s story is one of relentless effort. Recent milestones such as launching a next-generation trading platform for a leading investment firm and developing a customer-first self-care mobile app for Vodafone Vanuatu highlight how the company blends deep technology to solve complex, real-world problems.

Arimac Digital has also become a leading developer of super apps across multiple industries — creating one-stop digital ecosystems that use advanced technology and micro-behavioral insights to enhance customer experiences, whether it’s paying bills, transferring funds, or managing everyday services.

Its work has earned recognition on the global stage, including being the most awarded company at the 2019 Asia Pacific ICT Alliance with the Gold Award win for the Banking & Marketing category, winning the most number of awards in the Sri Lankan IT Landscape in 2021, winning the Gold Award for South Asia’s Best Branch Digitalization at the Asia Banker Awards, securing the Best Digital Bank Sri Lanka 2024 title for Peoples Bank at the EuroMoney Awards for Excellence, winning Gold for the Etihad Guest App for Best Innovation, and a Silver for the Ooredoo YOOZ App at the Middle East & North Africa Stevie Awards, and being the GSMA – Global Mobile Awards Winner under the Best Mobile Money Service category. Arimac Digital has also celebrated multiple wins at the NBQSA, further cementing its reputation as a trailblazer in digital transformation.

“As we celebrate 14 years of Arimac Digital, we are reminded that technology is only as powerful as the human potential it unlocks. Our journey has been about more than building digital solutions. It has been about creating empathetic, intelligent systems that transform lives. Looking ahead, our mission remains clear: to fuse human imagination with AI-powered innovation, and to co-create the next generation of solutions that shape industries and empower communities worldwide,” said Chamira Jayasinghe, Chief Executive Officer of Arimac Digital.

As Arimac Digital steps into its 15th year, the company states that it “carries forward the same spirit that defined its beginning: curiosity and boldness”, along with the belief that when technology is built with heart, it can ignite imagination and transform the world.

The post Arimac Digital Celebrates 14 Years appeared first on ReadMe.

Available in all three languages, the National Air Quality Network monitors six pollutants: PM2.5, PM10, Ozone (O₃), Carbon Monoxide (CO), Nitrogen Dioxide (NO₂), and Sulfur Dioxide (SO₂). Additionally, it tracks CO₂, Volatile Organic Compounds (VOCs), and other weather factors. The data itself gets updated regularly with regulatory particulate monitors every hour, gas analyzers every 1–5 minutes, and low-cost micro-sensors every 1–15 minutes “depending on configuration” according to the CEA.

The dashboard is maintained by CEA with contributions from the National Building Research Organization (NBRO) and funding from the Vehicular Emission Testing Trust Fund (VETP). The CEA is reportedly looking to add more institutions in the future.

The post CEA launches real-time air quality monitoring platform appeared first on ReadMe.

According to the company, lossless streaming is now rolling out for Spotify Premium subscribers in select markets. This means the feature won’t be a separate higher-priced tier, but instead a free addition to existing Spotify Premium subscribers. Lossless streaming is opening up to users in more than 50 countries through October. Spotify states that those in Australia, Austria, Czechia, Denmark, Germany, Japan, New Zealand, the Netherlands, Portugal, Sweden, the US, and the UK should already start to see the feature on the app.

Once lossless audio is available, users should receive a notification and can toggle the feature via Media Quality in settings. In terms of hardware (Spotify Connect), lossless streaming is currently supported on Sony, Bose, Samsung, and Sennheiser, with Sonos and Amazon support to come next month.

It’s worth noting that Spotify’s lossless offering caps at 24-bit/44.1 kHz FLAC. Other services like Apple Music, Tidal, Amazon Music, and Qobuz all offer up to 24-bit /192 kHz. However, it’s possible Spotify may be saving up the higher bit-rate for a higher-priced tier.

As of now, it’s unclear when the South Asian market will see lossless on Spotify Premium. But given the usual trend for the smaller markets, it might be a few months away at least for Sri Lanka. Spotify itself hasn’t made any indication when other countries could expect lossless audio.

The post Spotify is finally bringing lossless streaming appeared first on ReadMe.

As per the minister, the bill will be held off until the national cybersecurity implementation strategy report comes out. The government had appointed a committee tasked with developing the national cybersecurity strategy and was expected to publish this report later this year.

The post Cyber security bill delayed appeared first on ReadMe.

Speaking at a press conference, the deputy minister stated that the Telecommunications Regulatory Commission of Sri Lanka (TRCSL) is prepping for the tender, set to be 51 days after the final discussion with the stakeholders. This discussion is believed to be held within the next few weeks.

5G, a promise unrealized

The promise of 5G has been in the making for many years. Ericsson reports that over 5G subscriptions reached 2.4 billion by 2024, with a projection of 2.9 billion connections at the end of this year. Within the South Asian region, India has shown the most notable adoption trend as 5G penetration crossed 130 million subscribers by the end of 2023. The country expects to hit 970 million by 2030, according to Ericsson. Incidentally, 5G in Sri Lanka has yet to kick off commercially, despite claiming to be the first country to trial 5G in South Asia. While efforts are seemingly ongoing to expedite deployment, the situation still appears to be murky at best.

As of now, TRCSL plans to auction spectrums in the 3.5 GHz and 27 GHz bands for 10-year periods. This includes four 50MHz frequencies in the 3.5GHz band and four 100MHz frequencies in the 27GHz band. These plans are a part of the regulator’s framework in an amended consultation paper from early 2024.

The updated allotment comes amid the approved acquisition of Airtel Sri Lanka by Dialog Axiata in 2023. This meant that Dialog would hold a 63% market share of mobile subscriptions. As a result, the restructured market redistributed spectrums in the 850, 900, and 2300 MHz bands among telco operators, with the remaining spectrum in the 2.6GHz band assigned to Hutchison Telecommunications Lanka (Hutch Sri Lanka).

The long-awaited auction

While it remains to be seen when it will take place, the upcoming 5G auction is likely to be one of the three, as per TRCSL:

• An auction open to all qualified bidders
• An administrative assignment to a single wholesale network
• An auction for existing operators with attached sharing obligations

Additionally, the regulator plans to attach certain rollout obligations for the licenses, where operators will be required to launch 5G at a minimum number of base stations in each district within the first three years. The idea is to ensure access to 5G across the country.

Previously, the 5G spectrum auction was scheduled for early 2022, but it was pushed to 2023 until plans eventually fell apart. Part of this lies with the economic crisis that hit Sri Lanka three years ago, preceded by the effects of COVID-19, which exposed a lot of the industry’s shortcomings in internet access and affordability. But even with the infrastructure investments in recent years, telcos questioned the feasibility of launching 5G in Sri Lanka, particularly on the massive investments needed and the ROI of it all.

What about the spectrum?

In any case, auctioning is only part of the process. 5G’s longevity and accessibility depend on the extent of frequency allocation for the technology. Over the past few years, telco operators have been shutting down 3G networks and pushing customers to 4G. In addition to the current allocations in the 3.5GHz and 27GHz bands, TRCSL’s spectrum roadmap plans for 2024 – 2029 indicate that the 1800MHz and 2100MHz bands may be rearranged for spectrum efficiency. However, it’s unclear what this will look like post-Airtel acquisition.

The TRCSL roadmap plan also specifies the 700MHz band for better 4G and 5G coverage. However, this is currently used for broadcasting and will only be available once the analog operators update to digital broadcasting. The digital TV project has been in the works for over a decade. The original plan was to shut down analog by 2017 and complete the move to digital broadcasting by this year.

According to Minister Weeraratne, the government will engage in discussions with the Japanese government to move forward with the digital broadcasting push. A Japanese International Cooperation Agency (JICA) was previously in the works for the digital TV project. TRCSL’s roadmap suggests that the implementation of digital TV broadcasting and the analog switch-off could likely go beyond 2028.

5G in Sri Lanka and ambitions

Sri Lanka has a habit of tracking poorly when it comes to upgrading its digital infrastructure. Despite the conversation around digitalization and plans of ambitious projects like an LKR 100 million fund for AI, crucial technology projects are often stalled or move sluggishly. Be it data privacy, number portability, or digital TV, there’s little to be said about following through on years of digital promises.

The promise of 5G is no different. Its numerous opportunities have been talked to no end, but actual implementation has yet to see the light. Whether 2025 will finally be the year 5G kicks off on the island, only time will tell.

The post 5G in Sri Lanka: Is 2025 the year? appeared first on ReadMe.

As of now, it remains unclear how the Ministry of Health’s systems were compromised or the extent of the breach. However, the post’s sample dataset indicates that the breached data at least includes NICs, phone numbers, addresses, medical appointment details, and other sensitive personal information.

As per the post, the seller is asking a ransom of $3,000 for the dataset. But despite the post being up for more than a day, the Ministry of Health has yet to issue any statement regarding the incident.

Another day, another government site hack

This isn’t the first time a state-owned health system has been compromised in recent years. Mobitel’s e-channeling platform was leaking patient data until a Reddit post made the vulnerability public last November. The Ministry of Health website itself has been defaced at least three times since 2020.

Unfortunately, the issue far exceeds the health sector. The Ministry of Health data breach follows a string of cybersecurity incidents around government-run digital properties. The government’s digital infrastructure has been a routine target for many years. But a combination of increasingly ambitious bad actors and lagging security processes has only painted the Government of Sri Lanka a wider mark. Whether it’s running websites with no SSL certificates or losing entire email databases, the government’s track record continues to be abysmal.

However, the private sector hasn’t fared all that better either. In 2022, a PayHere hack exposed over 1.5 million records amounting to 65GB of data, in what was the biggest data breach in Sri Lanka at the time. Three years later, a Cargills Bank data breach exposed over 1.9 terabytes of data.

Lagging legislation

Incidentally, the Ministry of Health data breach comes less than two months after the government revealed plans to establish the Cyber Security Authority, a core part of the proposed Cyber Security Bill. The government also stated that it aims to set up the National Cyber Security Operations Centre (NCSOC) under Sri Lanka CERT.

According to Deputy Digital Minister Eranga Weeraratne, the NCSOC will initially implement real-time monitoring of critical government systems such as the Inland Revenue Department and the Central Bank of Sri Lanka. The ministry plans to expand its capabilities to real-time surveillance of critical data infrastructure in both public and private sectors.

Apart from the Cyber Security Authority and the NCSOC, the government also approved a five-year Cyber Protection Strategy plan for the 2025 – 2029 period. Unfortunately, the current status of the government’s digital infrastructure and the attitude towards security do little to inspire confidence.

For instance, the Personal Data Protection Act was passed into law in 2022. Its Data Protection Authority is yet to be operational. More importantly, the implementation of the act itself remains nonexistent to this day. Even amid the slew of data breaches and security incidents since its passing into legislation, the act has done little to protect citizen data.

Sri Lanka has been through enough wake-up calls for the government to take better care of its digital infrastructure. But the Ministry of Health data breach sadly says otherwise.

The post Ministry of Health hack likely compromised nearly 400,000 records appeared first on ReadMe.

The formation of Short Circuit brings together full-stack product engineering, UX design, performance marketing, and commercialization. The group employs over 500 people spanning across Sri Lanka, India, Qatar, and Singapore. With a presence already in North America, Europe, the Middle East, and Asia, Short Circuit aims to grow its footprint further over the next few years.

We see Short Circuit as a highly structured, investable business. The leadership’s financial clarity, disciplined approach, and investor alignment make this a standout transaction.

Ray Abeywardena, CEO of HNB Investment Bank

As part of the deal, Surge Global’s Bhanuka Harischandra will head the newly formed entity as its Group Managing Director, with Dave Chesson as the Group Chairman and Mahesh Patel as a Director. Calcey’s Mangala Karunaratne is also on the Board as a director, but will be stepping away from the company’s daily operations.

Back in 2002, Mangala founded Calcey Technologies in Sri Lanka following the dot-com bubble bust. Over the years, the company grew into a leading tech company in the country, employing over 150 people with a clientele covering North America, Europe, and Australia.

“I first met Bhanuka in 2014 at a startup conference. He was a 20-year-old who simply wanted to build a globally competitive digital marketing company out of Sri Lanka. I saw the fire and the chip on his shoulder, I got involved then and there as an advisor and an investor,” comments Mangala.

“We’re not just another digital services firm. Short Circuit is built to operate like a performance-led platform – part execution, part investment engine,” says Bhanuka. He goes on to state, “We’re here to take bold, calculated bets, build actual service quality, and create real IP. This isn’t about bloated scale, it’s about building something durable, disciplined, and valuable.”

The post Surge Global and Calcey merge to form Short Circuit in $40 million deal appeared first on ReadMe.

Over the years, the company has outgrown its reputation as a keyboard app, with services extending to news, contactless payments, doctor channeling, and more recently, online payments to government services. However, Helakuru’s entry into the mobility space marks a significant departure from its usual offerings.

“We believe that ride-hailing in Sri Lanka should be fair and open, not price-controlled by algorithms or locked inside closed systems,” says Dhanika on why Helakuru is getting into the business. It remains to be seen how HelaGo will compete with the likes of PickMe, Uber, and Kangaroo. In the past, alternative ride-hailing apps have tried to usurp PickMe and Uber’s stronghold on the Sri Lankan market, though to no success.

Of course, Helakuru is bound to weigh most of its initial momentum on the goodwill and the millions of users. As of now, Helakuru hosts 4.4 million Sri Lankans daily, according to Dhanika. Whether that adds any meaningful competition in the long run will depend on how it solves existing issues, particularly how it answers the all too familiar question, “cash da? card da?”

HelaGo on Helakuru

The company has yet to reveal what HelaGo will look like for users. The service is set to launch soon on the Helakuru app with tuktuks, motorcycles, and cars as likely available options. The company’s official announcement indicates that long-distance and package deliveries may be under consideration, given the call for lorry and van drivers.

Either way, prospective drivers can now register for HelaGo via the Helakuru app. While passengers can access HelaGo via the main app, drivers will have a separate app. Dhanika says that over 500 drivers signed up for the service within three hours of making the announcement.

The post From keyboard to cars: HelaGo is Helakuru’s ride hailing debut appeared first on ReadMe.