Draft Cybersecurity Bill not aimed at seizing data

We refer to the commentary “Balancing cyber security with data confidentiality” (Sept 4) by Mr Benjamin Tan and Mr Benjamin Goh.

It is unfortunate that Mr Tan and Mr Goh have misrepresented the draft Cybersecurity Bill.

The Bill does not provide the Commissioner of Cybersecurity with unfettered powers to investigate cybersecurity threats and incidents.

The Commissioner may seize a computer without consent only as a last resort in the event of a serious cyber security threat or incident.

Even then, the Bill specifies that this can only be done in consultation with the owner, after careful consideration of the business and operational impact, and only when all less disruptive means of investigation have been exhausted.

While the Bill does give the Commissioner powers to request for information under strict circumstances, such as to investigate cyber security threats and incidents, this will mostly be technical information.

Cyber Security Agency (CSA) officers will also be held criminally liable should they misuse such information.

It is not the CSA’s objective to seize companies’ information assets, proprietary business information or confidential client data.

Rather, the Bill aims to establish a framework to oversee and maintain national cyber security, and to empower CSA officers to carry out their functions.

There are safeguards in the Bill to ensure the reasonable exercise of these powers, which are clearly defined in scope and purpose.

We have held several rounds of consultations with key stakeholders on the draft Bill, including stakeholders in each critical information infrastructure (CII) sector, industry associations, and cyber security professionals.

The public consultation in July and August has further given us the opportunity to hear from and engage members of the public.

The CSA will be releasing a summary of public feedback received in due course, together with our responses.