The Government is preparing new Legislation to establish a National Cyber Security Regulatory Authority, which will have powers to introduce measures to strengthen data protection and prevent cyberattacks targeting Government institutions, Digital Economy Ministry Secretary T R Waruna Sri Dhanapala said. Speaking to The Daily Morning yesterday (2), Dhanapala said that the draft Bill had been revised for the second time following Cabinet of Ministers instructions and is expected to be presented to Parliament soon for approval.
He said that the proposed Authority would place greater emphasis on proactive measures to prevent cyber threats, including potential attacks by hackers and other parties targeting Government institutions and their data. The Authority would also be able to introduce regulations requiring organisations providing cyber security services to obtain certification. This would include setting standards for such service providers, including requirements relating to the number of qualified professionals that they employ.
Dhanapala said that the proposed Legislation could also provide for regulations to address the misuse of subscriber identity module cards and internal network facilities for criminal activities.
Commenting on international cooperation, he said that Sri Lanka had already signed the United Nations Convention against Cybercrime and is looking at moving towards its ratification. Ratification could help Sri Lanka obtain international assistance in investigating cybercrime operations involving foreign nationals and activities conducted from overseas targeting the country. It could also strengthen cooperation with the International Criminal Police Organisation and cyber security focal points in other countries when cyber activities originating in Sri Lanka posed threats to the country or other nations, he said.
However, Dhanapala acknowledged that only a very small number of cases had been pursued under the Computer Crimes Act, No. 24 of 2007, with attempts to pursue one or two cases not having progressed further.
He said that cyber security came under the Ministry, which is currently responsible for regulating the sector and responding to complaints relating to computer-related crimes and cyber security incidents. The Ministry also alerted relevant parties and platforms, including Meta, Google and Facebook, about large-scale cyber scam operations allegedly carried out by foreign nationals.
He added that other laws, including those relating to organised crime and foreign exchange violations, could also be used. Foreign nationals who entered the country on visas issued for specific purposes but engaged in other activities could also face action under the relevant laws.
Meanwhile, Police Media Spokesman, Assistant Superintendent of Police and attorney F.U. Wootler explained: "The problem is that most of these foreigners conduct their scamming operations overseas. Therefore, there are no local complainants, and we don’t have the necessary proceedings or evidence to initiate legal action".
In such circumstances, the authorities examined whether the suspects had violated the Immigrants and Emigrants Act. If violations are established, action could be taken through deportation, removal or extradition. He said that when the Police raided locations suspected of being used for scam operations, electronic equipment, including laptops and mobile phones, are taken into Police custody. Investigators then obtained court orders to examine the contents of the devices. However, accessing the information is sometimes difficult because of the advanced methods used to conceal or protect the data, making it difficult to identify complainants and establish evidence.
The Justice Ministry acknowledged the need to consider amendments to the Act.