Cybersecurity Bill

Thank you, Mr Speaker, for allowing me to speak on this important Bill. I first have to declare my interest. I work for a firm that provides cybersecurity and risk services.

Mr Speaker, the Cybersecurity Bill is timely, given its focus to strengthen the defences of our essential services and CII from cybersecurity threats from both private and state players.

We have seen growing evidence of how countries are being threatened by digital sabotage which targets essential services to cause disruption to the economy, as well as to confuse and demoralise citizens.

The Ukraine experience, as the Minister has shared earlier on, was one that is almost becoming a cyber-hacking "testbed" for other foreign state actors. On 23 December 2015, the control centres of three Ukrainian electricity distribution companies were taken control of, where malicious hackers opened breakers which caused more than 200,000 households to lose power. Nearly a year later, on 17 December 2016, a single transmission substation in northern Kiev lost power. These instances of sabotage took place on the tail of a political revolution in Kiev and the annexation of Crimea.

While similar attacks have not shown to be highly-motivated acts of sabotage in Singapore, in September last year, CSA had reported that several critical sectors were subjected to cyberattacks, and that the Singapore Government had been subjected to a malware attack by state-sponsored hackers. We have been fortunate that the recent Wannacry, Meltdown and Spectre malware attacks have not disrupted our essential services.

Nonetheless, these attacks are a clear and present danger to a compact nation like Singapore, where a politically or militarily motivated actor can use cyber warfare to sabotage our critical infrastructure and economy. Current international laws have not been effective to address cross-border hacking and state-sponsored attacks. In most cases, agencies have had difficulty to pin down hacking incidents to individuals or governments.

I believe the Cybersecurity Bill is a good start for Singapore to ensure that our essential services and sectors are well-protected and defended to prevent criminals or state players from threatening our economy and our way of life.

I welcome that this Bill looks into proactive measures to have owners of CIIs to be more accountable for reporting and the security readiness of their CIIs. It is important that relevant stake players provide timely reports of attacks and I fully support that the CSA drive industry-wide knowledge sharing and push for effective cyber defence measures.

Countries, such as Germany, Japan and the US, have already enacted cybersecurity legislation. In the Association of Southeast Asian Nations (ASEAN), Thailand and Vietnam are also considering similar legislation. Thus, this Bill is a timely reflection of our commitment to securing our nation and our status as a top-tier international hub and financial hub.

From the view of the industry, one of the key concerns will be whether the cost of compliance and the costs of systems upgrades will be significant. Consumers will also be concerned if these additional costs will be passed on to them, as many of these CII owners provide essential services, such as transport, water, electricity and communications.

We must strike a balance to protect our national and citizens' interests but yet be clear on what security standards and architectures that CIIs need to comply with, so that the costs incurred in upgrades and security operations will not overburden industry and consumers. The cyber arms race is not about to recede and will only intensify and hackers will continue to try to find weaknesses in systems to exploit. In this regard, I would like to make some suggestions.

One, it will be ideal if CSA can take the lead, together with the sector regulators, to set industry-wide leading practices, shared services and threat intelligence, so that CII players can achieve security readiness in a cost-efficient manner and yet be effective in deterring and responding to security threats.

Two, this Bill will drive greater accountability from the CII owners, and failure to comply with this new law will be criminal in nature. I support the need to make the owners of the CIIs accountable, but I hope that CSA be very clear on the benchmarks or, if appropriate, security architectures that CII owners need to comply with upfront. This will also help the relevant CIIs to plan their security roadmap effectively and better understand the investments they need to make. Otherwise, the industry risks putting in piecemeal measures that could be costly. It would also not be good if CII owners take a reactive approach to only wait for audit results and taking action only when told that they need to comply to them from time to time. Under the law, they will only be criminally penalised when they have not complied with a directive from the Commissioner. This may be too late if an incident happens. So, will the Ministry be providing the CIIs with specific benchmarks they need to achieve or a checklist of cybersecurity measures that need to be in place?

Three, I would like also to suggest that the Ministry and the sector regulators consider funding R&D for cybersecurity technology and operations centrally or within sectors. The involvement of CSA and sector regulators can catalyse CII operators to share findings and insights to accelerate cybersecurity enhancements. There are many common insights that could be derived from research and leading practices within specific sectors. This will help CII operators develop quicker and more effectively.

Mr Speaker, since 2015, the Ministry has been doing public and closed door consultations. I would like to ask the Minister, through the consultation exercises, whether the Ministry has performed an assessment of the readiness of the current CIIs in the various essential services sectors to comply with CSA's security requirements. Has the Ministry estimated how much it will cost for the CIIs to comply with the Cybersecurity Bill's requirements? What is the timeline that CIIs have come back that they need to get fully ready and compliant?

Under the Cybersecurity Bill, the Minister, the Commissioner and his deputies are given the authority to investigate and get CIIs to disclose information to assist with investigations. Citizens will be concerned that, as part of investigations, the authorities may need to access data residing within the CIIs and this may breach the privacy of individuals. What are the safeguards put in place to ensure that the broad investigation powers under this Bill do not invade the privacy of individuals and consumers?

Mr Speaker, under this regime, the Cybersecurity Bill will complement CMCA, which will be renamed CMA. What is the rationale of keeping the Acts separate as they both deal with essentially cybercrime? How would enforcement operations be divided across the two pieces of legislation to deal with cybercriminals involved in attacks, such as Ransomware, Malware or Distributed Denial of Services (DDOS) attacks? The same crime can technically be applied across both critical infrastructure and non-critical, and common information technology (IT) systems. So, is there a duplication of effort or duplication of resources? What features under the new Bill will enable our agencies to better address as well crimes arising from overseas actors?

Currently, the CIIs are defined based on systems located here in Singapore. Given that some CII operators may use technologies, such as cloud services or outsourced managed services based overseas, how does the regulator plan to designate these systems as CII, as the data and application may not reside, wholly or in part, in Singapore?

Mr Speaker, the Bill will put in place a licensing regime to providers of penetration testing and managed SOC monitoring services. I support this initiative as it will put in place a credible ecosystem to support our CIIs. This will also promote our service providers to be better trained and specialised to meet the standards required by the regulators. However, I would like to seek clarity from the Minister why does CSA only register companies and not allow for the licensing or registration of individuals. In this emerging field of cybersecurity, there are many global experts, or even white-hat hackers, whose expertise may be useful as freelancers to advise CII owners. Why does the Ministry not consider allowing individuals to be contracted by the CII owners?

From a manpower perspective, Mr Speaker, cybersecurity resources are in demand today. How is the Ministry planning to uplift the capabilities that we have to fulfil demand once the Bill comes into force? Do we have a significant capability gap today and how long does the Ministry estimate for us to fulfil this gap?

I would like to suggest that the Ministry put in more resources to build up cybersecurity capability that will help CIIs fund training and international exposure for their personnel for security training. The Ministry may also wish to facilitate manpower exchanges with leading technology research labs or CIIs overseas with leading practices. Some of the CIIs named are in sectors that are facing slowdown and may find it difficult to prioritise funds for this in the short term. Such a capability fund can help adoption, especially within the immediate future.

Mr Speaker, the defence of our nation, our people and its economy needs a new approach in this digital age. Countries have the ability to combine conventional and cyber tactics to weaken an opponent's defence by disrupting its essential services and its economy, and also to maximise confusion and uncertainty using both simple and sophisticated technologies in innovative ways.

This Bill is timely to stress the importance of strengthening our CIIs in the interest of national security. We have been developing our Total Defence capabilities across five pillars – military, civil, economic, social and psychological defence. It has worked for us for several decades. In this digital era and considering the emerging threat of hybrid warfare, it may be time for the Government to update our approach. Perhaps, it may be time to add a sixth pillar to our Total Defence framework in the area of cybersecurity or digital defence to counter the new threats in this digital era. Mr Speaker, I support this Bill.

Mr Speaker, this is a significant Bill which establishes a framework for the oversight and maintenance of cybersecurity in Singapore. Its ambit and reach are understandably wide in view of the reliance both the public and private sectors, including individuals, place on computer programmes, systems and services, and the devastating prospect of debilitating cyberattacks on critical sectors of the economy.

More specifically, the loss or exposure of private information may also erode trust in the Government, statutory agencies and private companies as the release of such information in the public realm can seldom ever be completely reversed.

I understand the Bill has received significant feedback from industry with an excess of 60 companies, many of them large corporates, and separately, a healthy number of industry associations – not forgetting civic-conscious and interested individuals – providing feedback to the Ministry on this Bill. For that reason, my clarifications will be limited to the Bill's broad principles and impulse, centring on queries that pertain to the operation of the envisaged Cybersecurity Act in practice.

The first clarification pertains to clause 7 of the Bill covering companies and entities that host CII that are partly located overseas for business reasons or simply logistical convenience. As a part of a Singaporean entity's CII ecosystem may be located overseas, how does the Bill ensure that this bifurcation does not render a particular CII susceptible to compromise or cyberattacks since CII computers and computer systems based overseas are not covered by this Bill?

Separately, in light of the feedback received, how common are such hybrid arrangements amongst public and private sector CII owners and is the Ministry concerned that some entities may seek to locate some elements of their CII overseas to hedge against the reach of the Act and, as a consequence, compromise its regulatory reach?

I have a similar clarification with regard to ownership of a CII, particularly if the owner is an offshore entity or individual. What regulatory oversight will the Bill realistically have over CII owners who operate outside our jurisdiction, and would this not represent a loophole?

Secondly, I seek some clarity on the compliance costs that are likely to result for both public and private sector entities as a result of this Bill. Feedback on such costs were received by the Ministry and there was a suggestion that grants should be extended to help organisations offset these costs. Can the Minister give us some sense or an estimate of the dollar value of the compliance costs of the Cybersecurity Bill with regard to, for example, CIIs in sectors referred to in Schedule 1 of the Bill – perhaps those covering the Civil Aviation Authority of Singapore (CAAS), the Public Utilities Board (PUB) and some public hospitals? Finally, how much would be set aside in the Budget for grants arising out of an increase in such compliance costs?

Thirdly, I understand from feedback to the Ministry that there was some concern about what constituted a significant security incident. The language of the Bill in clause 14 focuses on prescribed incidents suggesting that subsidiary legislation will clarify such words and terms. As the Bill imposes a duty on owners of CII to report incidents, can the Minister give the House a general sense, with examples of the specific thresholds of hypothetical incidents which may require reporting under the Bill.

With this as a backdrop, can the Minister also share with Parliament what punishment would be effected by this Bill against a company like Uber – assuming it is a CII – which caused the compromise of personal information, such as names, email addresses and personal contact numbers, of close to 380,000 Singaporeans and tried to conceal the same, as reported in November last year? How far does this Bill go to take a CII owner to task for non-reporting should a similar Uber-like episode occur after this Bill becomes law?

What other actions would the Government consider against entities that are negligent in securing their computer systems, particularly if such an incident is aggravated through willful concealment?

Fourthly, clause 19 of the Bill gives extraordinarily broad powers to the Commissioner of Cybersecurity and his officers to investigate cybersecurity threats and incidents against companies, entities and even individuals with respect to any computer or computer system in Singapore, not just CIIs. The ambit of these powers is best exemplified by clause 19(1)(a) of the Bill, which gives the Commissioner and any authorised officer the power to remove or make copies of a hard disk, for example, even if it is only to assess the impact or potential impact of a cybersecurity threat. Non-compliance carries with it a fine of up to $5,000 and/or an imprisonment term of up to six months.

For avoidance of any doubt, notwithstanding the remarks in the Report on Public Consultation on the draft Cybersecurity Bill where it was stated that such powers are to be applied in a calibrated manner and, more importantly, in response to major cybersecurity incidents against non-CIIs, can the Minister confirm the envisaged threshold of what qualifies as a major incident, so that the House is reassured that the Commissioner's powers will be used very judiciously and not against Government critics and individuals?

Coming back to the Uber example, does the Government foresee using such powers against foreign companies that operate in Singapore?

To conclude, Mr Speaker, I am concerned about how much Singaporeans are actually aware of their online signature and the importance of cybersecurity. While we seek to protect key infrastructure against cyberattacks, every Singaporean, who uses his or her smartphone to pay for goods and services or uses it as a social engagement tool, is susceptible to cyberattack or hacking. This prospect is likely to increase as Singapore undertakes its Smart Nation drive with more focus and coordination.

The CSA is in a privileged position to educate Singaporeans on security tips as we transition to a more cashless economy and live online, as many of us already do. What measures can Singaporeans look forward from the Government to protect them from cybersecurity threats in our Smart Nation journey? Mr Speaker, notwithstanding the clarifications sought, I support this Bill.

Mr Speaker, Sir, the Cybersecurity Bill is a forward-looking piece of legislation that ensures that our laws keep pace with the threats that we face as a nation.

The year 2017 has been called the Year of the Data Breach. Even within the first six months of 2017, the number of records stolen in breaches numbered almost two billion – even more than the whole of 2016, which was 1.4 billion. New malware samples reached an all-time high of 57.6 million in the third quarter of 2017, according to McAfee Labs Threat Report December 2017.

This is not just a matter of privacy or lost personal data – there are financial, security, proprietary interests at stake. A class action suit was initiated in the US last year against Equifax for data breach. They alleged that criminals used the stolen data to "apply for mortgages, credit cards, student loans, tap into bank debit accounts, file insurance claims and rack up substantial debts." Stolen identity also poses an international problem, a terrorist problem. Last month, Thai police arrested a man who allegedly forged passports, including Singapore passports, for groups, including a terrorist group.

Furthermore, breaches in cybersecurity can have debilitating effects on essential services. WannaCry, the first ransomware worm, crippled the healthcare system in England. It "shut down computers in more than 80 NHS organisations in England alone", cancelling almost 20,000 appointments in an appointment-based healthcare system, five hospitals resorted to diverting ambulances, unable to handle any more emergency cases. So, what we are debating today is serious.

Wannacry was a ransomeware worm and, by "worm", we are talking about a malware programme that is able to self-replicate to infect other computers and infiltrate through the connections in a computer network. The NotPetya in Ukraine, which utilised a hacked version of a major accounting programme widely used in Ukraine, affected companies in many different sectors, from shipping to pharmaceuticals and to outside Ukraine through multinational companies. Worse still, NotPetya encrypts files with no chance of recovery, that is, it was not a ransomeware.

Stuxnet, a different computer worm, caused a proportion of machinery in Iran’s nuclear facility to spin out of control in 2010. This cyberattack was executed through infected Universal Serial Buses (USBs), overcoming the "air gap". Since then, new methods to jump over an air gap has emerged. No sector has been spared cyberattacks, with commercial and healthcare sectors targeted the most.

This threat is not something remote to Singapore. The threat is real and palpable. Although Singapore’s critical infrastructure was not hit by Wannacry, Singapore malls were among the victims of that ransomware.

Within the past five years, there were notable occasions of security breaches. In 2014, Singapore’s Ministry of Foreign Affairs' IT system was breached. One thousand and five hundred SingPass users' IDs and passwords were reported to be potentially compromised and illegally accessed. In 2017, 850 Ministry of Defence (MINDEF) personnel’s National Registration Identity Card (NRIC) numbers, birth dates and telephone numbers were stolen following a cyberattack. Additionally, the National University of Singapore (NUS) and the Nanyang Technological University (NTU) reported an attack by "advanced persistent threat" (APT) actors that sought to "steal research and Government-related information."

These and many other instances are like red, flashing lights warning us to be vigilant. So, I concur with Minister Yaacob Ibrahim's point that we need to act and we need to act now.

Cybersecurity threats are nearer than we think. They could hit us faster than we can react and they could hit us harder than we can imagine. Therefore, this forward-looking Bill goes upstream to secure our information infrastructure through preventive and reactive compliance, so as to give us the upper hand and arsenal we can deploy against those who seek to do us harm.

Some key features of this Bill’s regulatory framework include: (a) reporting and investigating of breaches to facilitate damage control and prevent future occurrences under clauses 14, 19 and 20; (b) licensing of cybersecurity service providers in Part 5; and (c) regular auditing under clause 15 to ensure compliance and accountability. To facilitate accountability and promote compliance, clause 45 protects informers’ identities.

In today's age of technology, more infrastructure is being built, not from concrete and steel but, rather, in the realm of intangible cyberspace. This trajectory is bound to continue as Singapore moves toward being a "Smart Nation". Some of the future initiatives announced recently include digitalising of healthcare records even at the level of a private general practitioner (GP) through the National Electronic Health Record (NEHR) and the promoting of cashless payments.

As we seek to increase leveraging the conveniences and prowess of modern technology, it is critical that we protect and prevent attacks and crises from threatening our cyber infrastructure. The important place they have in the running of our country is reflected in this Bill’s designation of CII. This designation spans 11 broad areas of essential services set out in its First Schedule.

Cybersecurity in a computer network would only be as strong as the weakest link. A single vulnerability may be exploited to infect other areas and other computers in the network. Since computer networks extend beyond territorial boundaries and cyberattacks know no physical boundaries, clause 3 of this Bill extends regulation to computer networks that are wholly or partly in Singapore.

This Bill has been carefully calibrated for a consistent framework over the different sectors yet providing space for flexibility for purpose-oriented, sector-suited rules and practices. For example, the Commissioner’s written directions may be issued to a class of CII owners under clause 12(1); the Commissioner to direct more frequent audit above the two years "in any particular case" under clause 15(1)(a).

The Bill also provides for flexible codes of practice under clause 11 to be promulgated to promote best practices in cybersecurity. It is important that this regulatory skeleton provides sufficient flexibility to accommodate for changes in the realm of cyberspace and allow for careful calibration of regulation in the future. If there are too many regulations, the higher threshold to entry may perhaps shrink our well of cybersecurity expertise to draw from, harming our cybersecurity resilience, for example, through an over-reliance on a single provider which may multiply knock-on effects of a breach. Hence, the regulatory framework, in my view, needs to remain flexible for future refinement of regulatory controls.

This flexibility is especially crucial because technology is an ever-evolving landscape. Cybersecurity depends on innovation to keep up, keep ahead and remain effective. Recently, MINDEF invited white hat hackers to hack into MINDEF’s Internet-facing domains. This method of exposing vulnerabilities maximised the talent pool available locally and overseas. The non-prohibitive cost estimated at $100,000, compared to up to a million dollars for hiring a dedicated vulnerability assessment team. This is attractive fiscally. Would the Minister clarify how this Bill would affect non-mainstream methods of strengthening cybersecurity, such as white hats?

In this fast-changing technology-connected world, this Bill provides the preventive complement to the deterrent CMCA. It is a complement to that Act. It places our country to better respond to, prevent and secure the integrity of our computer systems through a strong, yet flexible, regulatory framework. For these reasons, Mr Speaker, I strongly support the Bill.

Mr Speaker, Sir, this is an important Bill that sets up the regulatory framework to protect Singapore from the increasing threat of cyberattacks. The extensive commentary and feedback received during the public consultation for the Bill show that the public recognises the importance of cybersecurity. In the responses to the feedback, we can also see the Government trying to balance the compliance burden on business with the necessary measures to protect the economy from cyberattacks.

Singapore’s cybersecurity strategy is a correct approach taken for a global city that depends on openness and connectedness to the world for its proper functioning. This approach can be described as a whole-of-Government approach that places public-private collaboration at the heart of the strategy with a strong future-oriented plan for capacity development and for value addition to the economy. This Bill is an integral part of the strategy and expresses the strategy’s approach.

I have three sets of clarifications for the Minister. The first set is more general and has to do with the strategy and its implementation; the second, on the scope of the Bill; and the third, on the specific provisions of the Bill.

The Paper setting out Singapore’s Cybersecurity Strategy was published more than a year ago in October 2016. The strategy has four pillars: building a resilient infrastructure, creating a safer cyberspace, developing a vibrant cybersecurity ecosystem and strengthening international partnerships.

I was rather surprised that there is very little mention of MINDEF in the Paper. It was mentioned once in the Paper when it was noted that MINDEF formed part of the National Cyber Incident Response Teams with CSA, the Government Technology Agency (GovTech) and the Ministry of Home Affairs (MHA). These teams are part of the plan to respond to Tier 1 cyber campaigns threatening national security and Tier 2 cyberattacks on a sector.

MINDEF is a 4G military force reliant on secure communications and information networks. It should already have well-developed cybersecurity infrastructure and capabilities. It would be a terrible waste if the military applications are not adapted for civilian use. Could the Minister share whether there are plans to synergise and share military cybersecurity knowledge and technology to develop and deepen our civilian cybersecurity infrastructure?

Afterall, as it is stated in the strategy Paper, cybersecurity is a way of putting Total Defence into action and everyone has a role in creating a safer cyberspace for everyone, and this must include the military. There are two other specific ways that the military could play a key role to realise our cybersecurity strategy objectives. These are already observed in public commentary on the strategy and many have pointed to the Israeli military as a successful example.

First, our military has a peculiar asset: the commitment of tens of thousands of full-time and operationally-ready National Servicemen. This represents a potentially significant investment of time, not only of manpower, but of brainpower, by our highly educated workforce. The time invested could be harnessed to serve both military and civilian cybersecurity needs.

A cybersecurity corps could be formed to train budding IT professionals when they are serving full-time National Service. Deferment could also be considered for these young men to obtain degrees in cybersecurity first, so that they would hone their classroom skills in the military. They could then enter the cybersecurity industry when they become operationally-ready and return to the military with enhanced knowledge and skills during their NSmen call-ups. This is a win-win method to develop a vibrant cybersecurity system for Singapore.

Second, our unique military institution could also be used to foster startups to develop Singapore’s cybersecurity industry. Israel is already ahead of everyone in this game and there are an estimated 420 cybersecurity companies in Israel today, many of which are at the forefront of innovation and exporting their technology. It is now well-known that the Israeli Defence Force acted as the incubator for the startups. We have similar institutional features here, so there is no reason why the Singapore Armed Forces (SAF) cannot also serve as such an incubator. It would be a win for the military and a win for our entrepreneurship sector and economy, too.

I move on now to the second set of clarifications on the scope of the Cybersecurity Bill. The Bill defines "critical information infrastructure" in section 7 as the computer system "necessary for the continuous delivery of an essential service", the compromise of which would lead to a serious effect on the availability of the essential service. Essential service is defined in section 2 as "any service essential to national security, defence, foreign relations, economy, public health, public safety or public order of Singapore, and specified in the First Schedule". I am surprised that higher education and research institutions are not listed as essential service in the First Schedule and would like the Minister to clarify why this is so.

There are three reasons why I am surprised. First, it was reported that the NUS and NTU both suffered separate cyberattacks in April last year. It appeared to be the work not of casual hackers but of carefully planned, sophisticated cyberattacks that might be aimed at stealing information related to the Government and research. This is an extreme cyberattack scenario which this Bill is aimed at defending against. If our top public universities are being targeted by organised hackers, who could not be named by CSA for operational security reasons, and they were going after some precious information which, again, CSA could not reveal for security reasons, then there must be critical information residing in our universities and research institutions.

Second, of course, a sophisticated, targeted cyberattack on our universities does not mean that the service provided by the universities is essential, as defined in the Bill. I am, however, inclined to argue that there is a lot of research that is going on in our universities and other associated research institutions that have to do with the continuous delivery of essential services. The theft of information related to these research projects could lead to cyberattacks or other forms of attack that could seriously affect the availability of essential services. I would like to ask the Government, therefore, to review whether the computer networks for research-related to essential services, especially Government-linked research projects, should also be considered as CIIs.

Third, our universities are central to cybersecurity innovation and training. In the Paper outlining Singapore’s Cybersecurity Strategy, four of our six autonomous universities are named as playing key roles in fostering cutting-edge research and development (R&D) and talent development. It is in the vision that each of the six universities would become a "cybersecurity centre of excellence" developing its own area of specialisation. The training of our cybersecurity workforce is also entrusted to the universities. The Singapore Institute of Technology (SIT) and the Singapore University of Technology and Design (SUTD) offer Bachelor and Master's programmes in cybersecurity. What this means is that there is a lot of meta-information on cybersecurity residing in our universities. The theft of this meta-information could compromise the general resilience of our cybersecurity infrastructure or that of specific CIIs.

I move on finally to the third and last set of clarifications that have to do with the duty to report cybersecurity incidents, as specified in section 14. I have two points of clarifications for this. The first is specific to section 14, and the second has to do with cybersecurity incident reporting in general. First, section 14(1)(b) specifies that the owner of a CII must notify the Commissioner of a cybersecurity incident in any computer or computer system under the owner’s control that is interconnected with or that communicates with the CII. This seems onerous, and yet, limiting.

It is onerous because it enlarges the scope of regulation beyond the CII into a far larger field of secondary computer systems. For the owner of a CII, this would mean the requirement of detection mechanisms in secondary computer systems. Yet, section 14(2) is not clear whether it is a legal requirement.

Would the Minister clarify whether it is a requirement for the owner of a CII to install detection mechanisms in secondary computer systems interconnected with the CII? Would the Minister also clarify whether this reporting requirement is, indeed, onerous, especially since MCI and CSA’s response to feedback during the consultation on the draft Bill stated that "computer systems in the supply chain supporting the operation of a CII will not be designated as CIIs", implying that the regulation would be more narrowly scoped.

Yet, section 14(1)(b) is limiting, if the intention is to protect the CII from cyberattacks in adjacent interconnected computer systems, as the clause is now worded to limit regulation to only secondary computer systems under the owner’s control.

I would like to ask the Minister to clarify what does "owner’s control" mean in real operational terms? What if the secondary computer system interconnected to the CII is not under the control of the CII owner? Does it mean that such a computer system would not pose a risk to the CII? If a secondary computer system not under the control of the CII would still pose a risk to the CII, then why limit reporting to secondary computer systems under the CII owner’s control? If the risk is the same regardless, then why not remove the need to report cybersecurity incidents in secondary computer systems altogether?

My final point has to do with the reporting of cybersecurity incidents beyond the CIIs. Threat reports issued by cybersecurity firms often point to the problem of under-reporting, as many companies and organisations often choose not to report or to reveal the full extent of cyberattacks and data thefts. This is understandable, as sensational news reports of major data breaches would undermine trust in these organisations and affect the bottom line of businesses.

At the same time, it is not viable for these organisations to hide such incidents from view, as it would erode the general resilience of cybersecurity infrastructure in the long run. Afterall, large-scale organised cyberattacks would likely begin with trial runs of mini attacks on non-critical computer systems. The only way forward might be to legislate mandatory reporting of all cybersecurity incidents to CSA with the assurance of confidentiality and indemnity.

Mr Speaker, Sir, the Cybersecurity Bill is a significant step forward in putting Singapore’s Cybersecurity Strategy into action. I support the Bill. It is an expression of our Total Defence culture. As such, I believe there is a greater role to be played by MINDEF to develop our cybersecurity capabilities and enhance our cybersecurity enterprises.

I also believe that the Government should look more closely at our Institutions of Higher Learning (IHLs) as they have already come under a severe cyberattack and their computer systems contain crucial information related to our essential services and meta-information related to our cybersecurity infrastructure.

Finally, I believe that we need to get the reporting of cybersecurity incidents right and there are kinks in this area in this Bill that the Minister could do well to straighten out.

Mr Speaker, Sir, the Cybersecurity Bill is an important one. It will enhance the oversight and protection of cybersecurity for our CII sectors.

I am heartened to note that we are building up our cybersecurity capabilities on a solid foundation and that the Government has been investing in developing a robust system. Last year, we ranked third globally in terms of cybersecurity spend as a percentage of gross domestic product (GDP) with 0.22%, behind Israel (0.35%) and the UK (0.26%).

However, we can do better to raise our cybersecurity standard. Just last month, the Public Accounts Committee (PAC) reported IT control problems in our public sector due to "agencies not complying with the controls put in place". I agree with the Committee’s assessment that these lapses, which cut across agencies, are significant in view of the IT security threats today.

PAC noted that the Ministry of Finance (MOF) has taken steps to deal with this problem on a whole-of-Government level, including the establishment of an interagency work group. At least one of the lapses originated from an IT vendor, which had been warned.

CSA had clarified in its report on the public consultation on the draft Cybersecurity Bill that "computer systems in the supply chain supporting the operation of a CII will not be designated as CII". However, CSA noted that CII owners have the option to impose cybersecurity requirements contractually on their vendors.

On one hand, I am concerned that this option may result in vulnerabilities. If CII owners choose not to impose cybersecurity requirements on their vendors, how robust will our systems be? Even if they do, will there be checks or audits to ensure our cybersecurity requirements are being met by the engaged vendors?

On the other hand, vendors, some of which are SMEs, may find it difficult to cope with added costs, for example, third-party costs, should they be bound by contractual cybersecurity obligations. Although reporting is compulsory, vendors, especially small ones, may not want to report as that means taking staff away from work to attend to investigations. Small companies are most vulnerable and their vulnerability may impact the CIIs which engaged them due to the sharing of data.

I would like to suggest that the Ministry assist such small companies upstream by providing a pool of trained personnel to look at how their systems can be strengthened. We have to be absolutely thorough to ensure that our systems are not being compromised through such weak links.

I now move on to the point on licensing of individual cybersecurity professionals. Due to concerns that this will pose practical difficulties for global cybersecurity service providers since they deploy employees from different parts of the world to deliver urgent services at short notice, CSA has decided to work with industry and professional association partners to establish voluntary accreditation regimes instead. But I am worried that, without licensing, we may be exposing ourselves to greater risks in the future. How do we minimise such exposures and ensure accountability and traceability?

Similarly, for personnel responsible for cybersecurity, especially senior staff, do we have checks in place to ensure that we recruit suitable persons to make sure that they are of good character with adequate proper training and who upgrade their knowledge continuously?

The cybersecurity sector is evolving rapidly and we must be careful not to compromise Internet and system hygiene in our enthusiasm to support developments and innovations in this area. While interconnectivity provides greater efficiency and productivity, in a way, we have also become more vulnerable and greater care must be taken across all networks. I conclude with my support for the Bill.

Mr Speaker, Sir, advancements in information and communications technology (ICT) have transformed our society and the way we live, work and play. We are living in an increasingly interconnected world enabled by digital technology, and the inadvertent rise of Internet of Things (IoT) will accelerate our dependency on technology to an unprecedented level in the near future.

Singapore remains one of the most connected country in the world. Internet penetration rate in Singapore is at 82.2%, much higher than the global average, and 70% of Singaporeans are active on a social media platform, more than double the global average of 34%.

The explosive growth of ICT has ushered in a golden age of digitalisation and has been instrumental in enabling research, applied science, healthcare, transportation and urban development, just to name a few areas. Building upon a robust ICT infrastructure is also the vision of transforming Singapore into a Smart Nation.

Yet, the exponential growth of ICT and our increasing dependency on digital systems have heightened our vulnerability to cyber incidents. These cyber incidents can take the form of cybercrime aimed at siphoning money from corporations and individuals; cyber terrorism and espionage aimed at crippling Government systems and pilfering sensitive information; or even seemingly innocuous cyber pranks that could lead to widespread havoc and social disruption.

In Singapore, our Government systems were also not spared from such incidents. We have heard various Members in the House already referring to the incidents and the attacks carried out against MINDEF and also our IHLs. What is more foreboding is the CSA warning that there has been a consistent and concerted effort to penetrate our Government’s IT system. Thus, the introduction of the Cybersecurity Bill is not only much needed, it is also timely. I do, however, have some points that I would like to raise for discussion and consideration.

Clause 4 of the Bill has vested the Minister with the authority to appoint a Cybersecurity Commissioner and a team of high-ranking cybersecurity officials who have a wide range of duties pertaining to the cybersecurity efforts in Singapore. Although the appointment of the team will help ensure that efforts across Ministries and Statutory Boards are coordinated and policies are implemented consistently, greater clarity perhaps needs to be given on how this jurisdiction will be established.

With the recently established GovTech taking on the role of the Chief Information Officer (CIO) of the Government, and CSA already monitoring cybersecurity, how will the newly established centralised cybersecurity office work alongside these agencies? How can we ensure that there is no duplication of duties and, more importantly, what is the unique value-add that the centralised cybersecurity office will bring to our cybersecurity ecosystem that GovTech and CSA are not already doing?

Part 3 of the Bill has vested the Cybersecurity Commissioner with the authority to designate computers and computer systems as CIIs and empower the cybersecurity office with greater oversight over these systems.

While the Bill has set out some guidelines regarding the criteria of designating CIIs, perhaps more consideration needs to be given also on how the status of a CII is designated and what constitutes the phrase, "essential services". For example, clause 1 in Part 3 of the Bill suggests that a CII can be defined as a computer or computer system that is necessary for the continuous delivery of essential services in Singapore.

Although some services might not be regarded as "essential", they could be considered significant, and any disruption of these entities could have a serious socio-economic impact. Moreover, there could also be private organisations that would require the appropriate assistance, advice and, more critically, protection in this area, too.

On a related note, if an organisation’s computer system, especially a commercial or private one, is designated as a CII, how much access to its database would the cybersecurity office have? For example, if the computer system contains sensitive personal data like health records from insurance companies or investment portfolios from private banks and private organisations, how would cybersecurity be balanced with the intrusion into the privacy of the individual?

I noted that the Minister earlier mentioned that cybersecurity officers are going to be bound by certain very clear guidelines and perhaps even legislation or laws with regard to ensuring confidentiality when they access such information. But I think we cannot deny that there are some potential ethical dilemmas that could arise when cybersecurity officers, in the course of their work, gain access to personal data that contains identifiers when the providers of that information did not give explicit consent for the information to be used or accessed.

While it might not fall strictly under the rubrics of the proposed Bill, how can we provisionally use the Bill to manage the issue of "fake news"? I am aware that the Parliamentary Select Committee will, no doubt, present its views on how the issue of fake news can be tackled in due time but, until then, can we utilise the provisions in this Bill to take action against the perpetrators of fake news?

If someone were to hack into a Government agency’s system and issue falsehoods via the agency’s website or automated broadcast system, then can the Government take issue with the perpetrators for committing a cybercrime and also prosecute them for what their hacking resulted in? For example, if someone hacks into the Singapore Police Force (SPF) website or creates a fake SPF site to spread fake news of terror acts, how would the Government deal with the perpetrators and the ensuing chaos that possibly could result from this cybercrime?

Fake news, as we all know, can lead to widespread panic that erodes the trust in public institutions. So, can the cybersecurity office hold the perpetrators of such cybercrimes responsible for the consequences of their crimes? Or will the crimes fall under other legislation, such as the CMA? And, if so, how can the Cybersecurity Bill complement the legislation under CMA?

Mr Speaker, Sir, advancements in science and technology have always benefited humanity by enhancing conveniences in our daily lives and enabling us to do things that once existed only in our imagination.

At the same time, there will always be deviant individuals who will use science and technology for criminal activities or subversive purposes. Consider how nuclear power has allowed humanity to make significant progress, yet that same nuclear power and capability, in the hands of the wrong individual, can have catastrophic consequences for humanity.

Digitisation and Internet technological advancement are no different. As much as they have tremendous benefits for humanity, there is a dark side to this as well. At best, cyber pranksters can cause widespread inconvenience. At worst, cyber terrorists can cause the deaths of hundreds of thousands, if not, millions of innocents.

I thus believe that it is timely that the Government is taking steps to address the critical issue of cybersecurity and I stand in firm support of this Bill.

Mr Speaker, I stand in support of the Bill. Members of this House have talked about the possibilities, as well as the dangers, offered by the Internet and we talk a lot about cybersecurity threats. So, I would not repeat those other than to point out the fact that Singapore is no less exposed to such threats.

On the contrary, as the financial services hub and a regional hub to many global corporations, we are among some of the most exposed countries in the world, making us an attractive proposition to hackers from around the world. It is key to see how vulnerable we are.

In a survey done last year by security services provider Quann of 150 senior IT professionals from Singapore, Hong Kong and Malaysia, it showed that 40% do not have an incident response plan when they are facing cyberattacks and 67% of those who had those plans admitted to not practising their incident response plans.

This stands to impact our reputation, credibility and position as a global corporate hub and a regional e-commerce platform. As Chair of ASEAN this year, Singapore has identified our aspirations to push for an ASEAN-wide e-commerce platform. For such an ambitious project, and to protect our business hub status, we need to make sure we have a strong cybersecurity framework and regime. In this regard, I am very supportive of this Bill. However, I would like to ask our Government to share more on an important issue which is: how do we keep watch on the guards?

First, how about the companies we are entrusting to protect the cyber world here? While we have certification regimes to manage such companies and ensure that they meet desirable quality standards, do we know enough about the people who are working in these companies? Do these professionals, who are certified, have a vested interest in Singapore? And what if they have interests that are contradictory to Singapore's? It is certainly not a stretch of imagination that we have foreign interests among our cybersecurity professionals here who may leverage their positions in having access to secret and confidential platforms. As such, I call for three things.

One, more thorough due diligence checks by our cybersecurity agencies on professionals. Two, re-examine the penalties for misuse of access to data, especially if the perpetrators are members of the cybersecurity industry who are supposed to guard the industry. Three, create a certification system that favours cyber professionals who have a vested interest in Singapore, people who have some real roots and deep roots in Singapore, rather than fly-by-night experts who drop by for ad hoc projects whom our laws have difficulty to reach and deter.

In addition, cybersecurity could be promoted as an engine of growth. Singapore has emerged as a trusted business hub because of our trusted regulations, our strict regulations and because of our people's trusted reputation. Properly executed, Singapore could naturally become a premier trusted business hub for Asia and for the region with regard to cybersecurity.

Can the Government share our plans to grow and internationalise the industry? Can the Government also share more about our manpower plans to prepare Singapore to take part in this exciting development?

In conclusion, while this Bill helps to create a strong cybersecurity regime for Singapore, we must also ensure that we are not caught blind-sided by any unforeseen circumstances, for doing so would be a risk that could prove very costly for Singaporeans in many ways. But if we get this right, it can also create many opportunities for Singapore. Mr Speaker, I fully support the Bill.