COMPUTER MISUSE BILL

Order for Second Reading read.

The Minister for Home Affairs (Prof. S. Jayakumar): Mr Speaker, Sir, I beg to move, "That the Bill be now read a Second time."

By way of introduction, may I say, Sir, that, as we all know, computer technology today has a great impact on the economic life in our country. The technology is used in nearly all sectors of society - public sector, financial and banking community, service industries, manufacturing and trading sectors, and so on - in order to enhance productivity and business competitiveness.

While computers undoubtedly have much beneficial uses, they are also capable of being abused for criminal or selfish objectives. The widespread use of computer technology in Singapore and the growing reliance on it makes us more vulnerable to such abuses.

The objective of the Bill, Sir, is to deal with crimes committed with or involving the use of computers, for which existing legislation is inadequate.

Let me touch on the main features of the Bill. Presently, computer or computer-assisted crimes reported to the Police are dealt with under our general existing laws, eg, as cases of mischief, theft, cheating, criminal breach of trust under the Penal Code. But it is difficult to proceed under these general laws because of the special nature of computer technology. Furthermore, the existing penalties under the general laws do not always sufficiently deter computer criminals, eg, mischief under section 426 of the Penal Code only carries a maximum jail sentence of three months or a fine. The Penal Code, enacted many years ago, is also inadequate in dealing with the misuse of computers.

This Bill, Sir, therefore, incorporates those offences which are unique to computer technology. Let me say that the Bill is modelled largely after the United Kingdom Computer Misuse Act, 1990. It creates four new offences.

Let me deal with the first offence. The first offence deals with unauthorised access. Under clause 3 of the Bill, anyone who knowingly causes a computer to perform any function for the purpose of securing access without authority to any computer program or data will be guilty of an offence. This provision against unauthorised access deals with what is commonly referred to as "hacking". Persons who knowingly "hack" into computer systems even without malicious intent can be prosecuted under this provision.

The second offence deals with unauthorised modification. This is because computer technology allows the relatively easy modification of computer programs or data. Under clause 5, it will be an offence for any person to do any act which he knows will cause an unauthorised modification of the contents of any computer. This will cover introduction of viruses into a computer system. "Unauthorised modification" has been widely defined in clause 2 to include the addition of any program or data into the contents of a computer.

The third offence deals with unauthorised use or interception of computer service. Under clause 6 of the Bill, it will be an offence for anyone to knowingly use or intercept without authority computer service, ie, computer time, data processing, storage or retrieval of data. Not only can computer service be expensive, but it can also contain sensitive and confidential information such as financial information and business particulars. Unauthorised use or interception of computer service is made illegal, for example, where such information is retrieved or used without the knowledge or approval of the owner of the computer system. Any person using or causing to be used the computer or any other device for the purpose of unauthorised use or interception of computer service will also be committing an offence under this clause.

The penalties for these three computer offences are identical. The offender would be liable to a fine not exceeding $2,000 or to imprisonment for a term not exceeding two years or to both. If the offender causes any damage by the offences exceeding $10,000, the offender will be liable to a fine not exceeding $20,000 or to imprisonment for a term not exceeding five years or to both.

The punishment for these three offences has been carefully considered. Where no damage is caused or the damage caused by the commission of these offences is minimal, the offence would attract a lesser penalty. In other cases where the damage caused to the computer system or data is substantial, that is, above $10,000, the offence will attract a heavier penalty. This two-tier approach, it is hoped, will deter would-be offenders from doing anything which could be potentially capable of causing damage to computer systems and data such as planting viruses, logic bombs and wiping out software and data. It is essential that computer systems, which play an essential and vital role in this age of modern society in Singapore, be protected. However, if there are extenuating and mitigating circumstances, the Court can still exercise its discretion to impose a lesser penalty. That may address the concerns that a person who unwittingly causes extensive damage may be subject to the higher penalty.

The fourth new offence deals with computer-assisted-crime where a computer is used to commit further offences. Under clause 4 of the Bill, it will be an offence for anyone to cause a computer to perform any function for the purpose of securing access without authority to a computer program or data with the intention of committing offences involving property, fraud, dishonesty or which causes bodily harm punishable upon conviction with imprisonment for a term of two years or more. As the potential offered by computer technology is exploited to facilitate or commit further offences, the penalty for this offence is even more severe than the other three offences. Upon conviction, the offender is liable to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 10 years or to both.

If I may turn to enforcement and proof. To ensure effective enforcement, all offences under the Bill will be made seizable. A police officer may arrest without warrant any person reasonably suspected of having committed one of these offences. There is no need for a specific provision under the Bill to empower the Police to confiscate the equipment of a suspect as these powers already exist in the Criminal Procedure Code.

Clause 14 empowers a police officer (in addition to the powers under the Criminal Procedure Code) in connection with the investigation of offences, first, to have access to, inspect and check the operations of any computer and any associated apparatus or material; and, secondly, to require the user, or any person having the charge, of the computer to provide him with reasonable assistance in the investigation.

Because of the intangible nature of computer transactions, Members will understand that proof of computer offences will not be easy to establish. For this reason, clauses 11, 12 and 13 of the Bill contain special provisions for computer output to be admissible in Court for prosecution under the Bill.

To summarise, Sir, this Bill allows the authorities and the Court to deal effectively with that small minority of persons who perpetrate computer and computer-assisted crime. It will send a deterrent signal to all those who intend to misuse or exploit computer technology with criminal intent. At the same time, it is my hope that the Bill will have a reassuring effect to the majority of persons and organisations for whom the computer has become indispensable in their lives and business activities.

Sir, I beg to move.

Question proposed.

Dr Arthur Beng Kian Lam: Mr Speaker, Sir, Singapore is committed to the use of information technology to assist us in our economic development and to improve our quality of life. Today, the computer is an essential part of the office equipment and management of many a business both large and small. The smooth running and success of business may depend on the data that is captured in these computers. For example, a breakdown of the computers is a major disaster for financial and trading houses, many Government agencies and even small businesses.

Sir, using a computer is like using the TV set or driving a car. Many of us know how to use the TV set or drive a car, but few of us understand the complicated circuitry of the TV set or the special features of a car engine. If something should go wrong, we depend on the technicians, mechanics or engineers to advise us. In the case of the computer industry, we depend on the data entry clerks, programmers, systems analysts, hardware and software support teams and the electronic engineers. Likewise, the person who uses the computer for very intricate procedures, from the managing director to the clerical assistant, thanks to technology which has made the computer so user-friendly, does not need to know the intricacies of the inside of the computer box.

What makes for successful computerisation? It begins with good advice from the professionals to select the correct hardware and software for the purpose (what the industry calls the "solution" to the needs of the customer) and the daily operation of relying on dependable staff to key in and update the correct data. As the industry saying goes: "garbage in, garbage out". Thus, all the persons involved, from the initial stage of design to data entry and users, play a critical role.

The National Computer Board (NCB) has played a very important role as a catalyst and master planner for the use of IT in Singapore. Its master plan - the IT 2000 Master Plan - will touch and improve the quality of life of every Singaporean. We should congratulate the NCB, the EDB and all its partners in this ambitious plan. However, as critical data will be stored, both for business and for individuals, it is timely that this Bill is introduced to provide protection in the following areas: (a) to have unauthorised access to a system; (b) to modify computer material without proper authorization; (c) to intercept computer service without authority, and (d) to abet these acts.

Sir, any person who has access to the computer - and he does not have to be a systems analyst - actually has access to data which, if used as it was planned for, will be positive. But he can also tap the information for ill-intentions, eg, crime, personal embarrassment, or business sabotage. For example, the data entry clerk or programmer can sell the list of the names and addresses of a financial institution to a direct mailing company. This would result in voluminous junk mail for all of us. Worse still, a disgruntled employee or business competitor may be tempted to alter or erase programs or data, or make copies of the data. If this happens, for example, to a trading house or financial institution, just imagine the damage or havoc that can be caused. Thankfully, the industry can build in safeguards, for example, security levels into a system, but the integrity of the persons who have access to the computer terminal is the only and final safeguard to the system. I thus welcome the provisions of this Bill and congratulate the Minister on its timeliness and thoroughness. This will provide all users the necessary infrastructural confidence to go IT, and protect the individual Singaporean whose very personal data will sometimes be stored in the system. More professionals, businesses and Government agencies will then turn to IT to make their operations more efficient.

Sir, deterrence is a very important part of the safeguard. In the case of these crimes, each and everyone of them must be premeditated or may even be master-minded by a professional. I am satisfied with most of the punishments prescribed in Part II, and I accept the explanation of the Minister regarding the two-tier approach to punishment. However, I would like to seek the Minister's clarification on Part II, clauses 3(1) and 5(1). Clause 3(1) deals with "securing access without authority". This is the first step to any mischievous or criminal intentions. Clause 5(1) deals with "unauthorised modification of the contents" -the first step towards what one calls in layman's terms "sabotage of a system". These are serious offences, and potentially can be very damaging. Although the Bill allows for judicial discretion in allowing a jail sentence not exceeding two years (which recognises the potential seriousness of these offences), I believe that the fine prescribed (not exceeding $2,000) is inadequate. To be an effective deterrent to the first step of worse things to come, this fine should be $5,000 or even $10,000. I hope that the Minister will reconsider this and, with experience of this Bill, perhaps this could be revised at a later stage.

Sir, I would like to close by asking the Minister if there are plans to form a self-regulatory body for the computer or IT industry, like we have for other professionals, eg, lawyers, accountants, doctors and engineers. As we invest and depend more on IT, and as IT will affect the life of every Singaporean, having such a body will help ensure high standards of practice and a high ethical code to enhance the status of IT professionals and protect the customer or individual. Thus, just as one can make a complaint to the Law Society or Medical Council, one has recourse to complain to a similar body in the IT industry, for example, an IT Council. This IT Council can also set standards, for example, it can make audit trails a compulsory feature of computer systems. The National Computer Board could be the body to spearhead this. However, as with the Law Society or Medical Council, to be effective, they must be given statutory powers by this House to deal with complaints, set up disciplinary committees, and ultimately to de-register the unethical or recalcitrant.

The challenge to the IT industry is indeed great. But I have great confidence that they will be able to meet this. 2.30 pm

Mr Kenneth Chen Koon Lap (Hong Kah GRC): Sir, I support the Bill.

Recently, there were a number of cases of computer misuse in the United Kingdom. They are being highlighted in the press, although, interestingly enough, all of them are not criminally motivated. Nevertheless, the damages caused were quite considerable. Take, for example, one case, as reported in the Straits Times dated 9th May 1993, where a school boy was acquitted for breaking into a computer around the world and caused havoc. The other case reported in the Sunday Times dated 23rd May 1993 was where two British computer hackers hacked into thousands of computers around the world causing an estimated o123,000 in chaos. Astonishingly, the school boy was acquitted, giving the reason that he was a "compulsive" hacker, while the other two offenders were subsequently jailed for six months - a very light sentence for such a serious offence. It is apparent that these hackers do not realise the seriousness of their actions nor does the court consider hacking a serious enough offence to deserve more severe punishment. This is a dangerous trend and we must arrest it immediately.

Let me demonstrate a scenario whereby these hackers were to be made used of by master criminals or crime syndicates. The result can be very disastrous and costly or, worse still, if these hackers were to be forced to break into our defence system by some unfriendly nations, then our whole nation's security would be at risk. Therefore, although these hackers may not have any criminal intent for their actions, nevertheless, they should be made aware of the seriousness of their actions and be punished in accordance with the magnitude of their crime to prevent them ever attempting to engage in these activities.

I would now like to comment on Part II of the Bill under "Offences". I notice that the punishment is being fixed according to the value of the damage done. However, in computer offences, sometimes the damage cannot be measured in pure monetary terms. Take, for example, if someone disrupts the nation's defence system or by simply introducing computer virus into the computer system, the actual value of damage might be difficult to ascertain. Or, in the case of these two British computer hackers, the damage to the computer hardware may only be over o120,000, but the hidden potential of damage can be much more than that.

Imagine hacking into the computer system of the US Space Agency (NASA), the British Foreign Office or the European Cancer Research Organisation. The consequence can be quite mind-boggling. In cases like these, perhaps the punishment specified in the Bill under Part II may not be sufficient to reflect the seriousness of their action or the crime, and the limit set would constrain the court in imposing the appropriate sentence.

I hope the Minister can enlighten us on this.

Dr Ho Tat Kin (Toa Payoh GRC): Sir, I support this Bill.

With the strong Government's drive for computerisation, more and more organisations in Singapore are storing their information in computer systems. According to the latest National Computer Board's survey, the percentage of firms, with more than 10 employees, which are computerised hit a new high of 84% in 1992, compared to 68% in 1989. The NCB expects the level of computerisation to reach 95% by the end of this decade when the Singapore IT 2000 Plan is fully implemented and Singapore becomes an "intelligent" island.

Sir, not only are more companies using computers, but more computers are also being used. There is now one personal computer or computer terminal for every 3.8 employees, compared to one for every five in 1989. With so widespread use of computers and so much information stored in computerised database, the information assets need to be protected from computer-related abuse. But current laws, as the Minister says, are still inadequate to specifically deal with computer-related crimes.

Sir, in the last few years, we saw a new twist to computer abuse - the computer virus. Businesses today market globally. There is international electronic mail which allows anyone to send and receive orders by electronic data interchange (or EDI) within minutes. With world business moving to instant global communications controlled by computers, computer viruses have become more than the letter bomb of the late eighties. They are in fact a global threat. Computer virus attacks are not limited to individual personal computers or personal computer networks. Larger networks are also vulnerable. Mainframe users in Europe and in the United States have reported a considerable increase in the frequency of virus attacks. Research carried out in the United States indicated that of the 35.5% of mainframe sites in 1992 that had reported disasters, 60% had been caused by virus. This compares with 44% in 1991 and 23% in 1990.

Sir, this Bill before this House today will allow computer virus offenders to be prosecuted. The Bill also seeks to give legal redress and compensation to victims of virus attacks.

Sir, both developed nations and developing nations are tightening their Acts on computer abuse. The United States Department of Justice had recently circulated a proposal to expand the reach of the 1984 Computer Fraud and Abuse Act. This will give Federal agents broad authority to investigate computer crimes, allowing them to intercede in any situation involving a computer linked to a network. Creating a computer worm or virus could become a felony act with no questions asked.

Over in Britain, in spite of the presence of the Computer Misuse Act 1990, the UK Public Accounts Committee noted that security problems occurred in the main areas of fraud and virus and had called for tougher measures to ensure the security of Government information systems.

Sir, the US congressional testimony had also shown that Dutch teenage hackers were responsible for breaking into US military systems during the Gulf War. Yet the lack of legislation in the Netherlands means that they cannot be prosecuted for hacking. As a result, the Dutch Parliament is currently working on legislation to forbid unauthorised entry to computers.

Sir, developing nations in Africa, notably Egypt, Ghana, Tanzania, are taking concrete steps to secure the computer systems by implementing similar computer crime legislations. The Bill is therefore appropriate and timely. I support this Bill.

Sir, going into the Bill itself, I would like to seek some clarifications from the Minister. Under clause 3, subclause (2), there is no mention of the definition or the computation of "damage". People in the computer industry are asking: how will the damage be measured? Is it the cost of re-constructing data files destroyed? Or is it the market value of files that were destroyed?

Sir, regarding clause 7(1), I would assume the Bill considers acts such as trading in passwords as preparatory acts. But there are many computer security literatures which openly discussed methods of password breaking. Some even disclosed actual codes of breaking into computer systems. Will such literatures be considered undesirable once the Bill is passed? Will the sale of such technical literatures be controlled?

Sir, many people in the computer community are concerned with clause 15 of the Bill which allows any police officer to arrest without warrant any person reasonably suspected of committing an offence under the Act. Their concern is that the introduction of this Bill may lead to Police misuse of power. The concern here is whether police officers, any police officer, would have the knowledge or expertise to notice a computer crime being committed. Even in the United States, not many of the local police agencies are adequately prepared to investigate instances of computer crime, especially where they are of a trans-border nature. With the exception of the FBI and the US Secret Service, only a handful of other local US police agencies have the requisite training and resources to investigate instances of computer crime.

In a recent report dealing with computer misuse, prepared for the UK Department of Trade and Industry, it was reported that the lack of awareness of the Computer Misuse Act and difficulties in identifying reliable expert advice are the major barriers for firms seeking to bring cases forward. The question I would like to ask is: how well prepared are our police officers in carrying out this aspect of their duty?

Computer virus is a very technical subject which even computer users themselves are not quite clear. I would suggest the Police set up a Special Task Force to enforce this law.

Finally, Sir, how will this Bill deal with offenders who are minors? Many hackers today are in their teens. They may lack the maturity and experience to fully appreciate the consequences of their action or the reasons why people are concerned about protecting information. For many, it could be just testing their own skills to see how good they are in breaking into systems, more for the thrill rather than do damage.

Dr Wang Kai Yuen (Bukit Timah): Mr Speaker, Sir, I support the Bill.

As the Minister has said in his introduction, computers and network systems, be they banking system, import/export system, EDI network, stock exchange, CDS system, have become an essential and important part of our industry and commerce. Any misuse or breach of security could cause major disruption to our life.

Fortunately in Singapore, such occurrences are rare but nonetheless they do exist. Often times, under our existing laws, companies would rather swallow their pride than prosecute the offenders, and keep silent about it. I am very glad to note that the Minister has introduced this Bill to make all these acts criminal offences prosecutable under the new law. Most of the computer professionals I consulted have supported this Bill. The consensus is that it addresses a real need and it is timely. However, like my colleague who has spoken, some of us feel that the punishment prescribed is on the low side, basically $2,000 or two years' imprisonment or both if the damage caused does not exceed $10,000.

Like my colleague who has spoken, I feel that the damages normally caused in computer crimes are difficult to identify and track, and the cases are difficult to prosecute. Once identified, the damages are also very difficult to rectify. Furthermore, individuals who intentionally break into a computer system, especially Government computer system, for malicious mischief are no different from vandals, albeit these are the white-collar kind. What is worse, of course, is that the damages would take a long time to rectify. So I believe that the punishment prescribed for such cases should be no lower than those prescribed for vandalism under the Vandalism Act (Chapter 341). For people convicted for vandalism, it prescribes a fine not exceeding $2,000 or to imprisonment for a term not exceeding three years and shall also, subject to section 231 of the Criminal Procedure Code, be punished with caning of no less than three strokes and no more than eight strokes. I feel perhaps that the Minister can also, in his reply, indicate whether he supports my view and whether this view can be interpreted under the new Interpretation Act to be brought up in the case when they are prosecuted.

Dr Ho has also asked how this Bill deals with a perpetrator who is a minor, because most popular literatures portray the computer hacker as a minor out for fun and adventure. I think the current law should also address this issue.

Dr Toh Keng Kiat (Nominated Member): Mr Speaker, Sir, I rise to speak in support of this Bill.

By its enactment, Singapore will join a growing number of countries which have similar laws which will bring into focus computer-related crimes. High technology offences have come about as a result of coupling the computer to the telephone through the use of the modem, resulting in rapid electronic transfer of data. As the Minister says, computer crimes in Singapore are still extremely low, but it is timely that we should have in place a law for us to deal with perpetrators of this type of criminal offences and to use it as a deterrent against would-be offences. Such an act will also bring Singapore within the league of nations, which have similar legislation, which are now engaged in establishing extradition as well as mutual assistance programmes. Computer abuse criminal activity is international and cross-territorial. A misdemeanour initiated in a far away country would have devastating results here and vice versa. And because of its cosmopolitan nature, the fight against these crimes also requires international cooperation.

Sir, a speaker before me has already referred to reports of computer criminals who have escaped prosecution. The same British schoolboy he spoke about managed to hack the computer systems of the British Ministry of Defence and the US military establishments in Britain. Again in Straits Times of 14th May 1993, an Australian student was reported to have successfully hacked the NASA computers in the US causing a 24-hour stoppage. He not only decoded highly sensitive and secret computer files but passed on the technical know-how to other computer buffs. That is how the "technorat", or hacker, operates.

Dr Beng has spoken of the increasing wave of computer crimes being part of an international network. But when it comes to hacking, the scenario is different. A study of the computer hacker's profile reveals an identical thread that runs through all of them. The typical hacker is a middle-class teenaged student, very often highly intelligent but introverted, and with an intense need to boost his self-esteem.

Within the bounds of the territory known as cyberspace, within which these hackers work, they communicate with each other, although they have never met, for several hours of the day. And when the breakthrough comes, it is the paragon of achievement for the hacker.

Sir, our Computer Misuse Bill provides for custodial and pecuniary punishment of computer criminals and hackers but I doubt that when the audit trail of a computer misdeed, particularly one that deals with security matters, leads to such a teenaged hacker, we will be prepared to surrender him to a foreign country for prosecution, extradition and mutual assistance arrangements notwithstanding. Vice versa, I doubt that a foreign country will also readily give up one of its citizens for trial here for a similar offence. Computer skill of this quality is often tacitly condoned as invaluable in fifth column activity as well as industrial espionage. But things are changing, for in the Sunday Times of 23rd May 1993, we read of a report of two British hackers being prosecuted for a computer crime for the first time under the British Computer Misuse Act of 1990.

Several speakers have drawn our attention to deficiencies in this Bill. I agree with them. Clause 2(4) of the Bill states that the form in which any program or data is output is immaterial. There is also a provision that there should be an intent to commit further offences as indicated in clause 4(1). The British Computer Misuse Act 1990, with which we share many similar clauses, appears to be more defined in these areas. It makes it an offence to access computers "even though the facts are such that the commission of further offences is impossible." Again, the interpretation in our Bill on stealing of computer information is that the act of stealing itself becomes an offence. Sir, to steal means to take illegal possession of something which belongs to another person and, in the process, deprives the original owner of its use. Today, all of us are inundated with junk mail, the result of all kinds of mailing lists being compiled from computer databanks. No doubt, some of these are the result of illegal access to computer storage data but their mere compilation and use has not, in many instances, led to any loss for the original possessor of that information. Does this constitute stealing? The law needs to be more clear-cut on this.

There is also some ambiguity in clause 5(2) where a fine of $20,000 is imposed for damages to computers beyond $10,000. Without the damage being defined. The British Computer Misuse Act 1990 is again more definite in this area as it relies on the British Criminal Damage Act 1971 where a modification of a computer program is not regarded as doing damage to the computer or the computer storage medium unless its effect on that computer or the storage medium impairs its physical condition.

Sir, computer crimes in Singapore, as I have said earlier, are fortunately few and far between. I have asked the Minister for Law and Minister for Home Affairs in a previous sitting of the House and he has replied that there have only been four cases prosecuted from 1988 to 1992. All the offenders were prosecuted under the Penal Code and none under the Official Secrets Act. All cases have involved financial corporations with a total amount, in terms of money lost, of only $985,000.

Despite the paucity here, the Government has wisely put in place legislation to deal with this advancing tide of high technology crime. With this Bill, we now join a long list of countries, Australia, Germany, France, Canada, United States, Switzerland, Netherlands, Iceland and the UK which all have computer crime legislation.

Sir, I support the Bill.

Prof. Jayakumar: Mr Speaker, Sir, I wish to thank the Members who have spoken. Quite a number of Members have commented on the provisions with regard to penalties. It would appear that most of them are more hawkish than me in this regard. But I would like them and, in particular, Dr Wang Kai Yuen who, at one end of the spectrum, wants the penalties under the Vandalism Act, including mandatory caning, to be imposed, and that also, through the process of interpretation, the courts will listen to what I say here and then they will say, "Well, the punishment must be caning." Of course, that cannot be done. I would like them to note that when crafting penalties in the Bill, we have got to bear in mind that, firstly, a certain amount of jurisdiction and discretion must be given to our courts. Secondly, we must bear in mind the circumstances which will present themselves to the courts in various cases will differ vastly, eg, age of the accused, cited by Dr Ho Tat Kin, whether there are mitigating circumstances, the entire context in which the offence took place, the motives, the intentions, the damage caused, and so on and so forth. And because the circumstances can be so varied, it is not desirable to straitjacket the Bill with a narrow or very heavy penalty and leave very little room for the courts to exercise jurisdiction, particularly in an area where we are charting a new territory in Singapore.

We have, in fact, very few computer crimes prosecuted so far, as Dr Toh has mentioned. I think it is safe to say that there may be more which will come over the years ahead. But we should not assume that the types of cases will be so clear-cut and so stereotype that we can have a fixed penalty of a narrow nature or of a very heavy nature which does not allow the courts to have some discretion.

But, in any case, I wish to point out to them that if you look at the penalties, do not just focus on the $2,000 fine because it may be possible for an accused person to pay up the fine. But there is a discretion vested in the courts to also inflict the penalty of a jail sentence which, I think, for any accused person, is very important, or a combination of both fine and jail. And there is a two-tier approach which has been taken in several other countries, for example, Switzerland and Australia, depending on the damage. So the penalties are not that light if you look at them in the way I have suggested.

Some have commented quite correctly that computer crimes can result in invisible, intangible damage which cannot be quantified. That is true. But in so far as crafting offences is concerned, the courts will have to require proof and evidence to be adduced. And what is more easy and practical a measure is to have damage, which of course must mean physical damage. This is not to say that the victim of a computer crime who has suffered other kinds of damage, eg, loss of earning, loss of income, and so on, has no other remedy. He will still have remedies in civil law to bring about suit for damages in terms of earnings lost, income gone, and so on. So while I note the general sentiment for tougher penalties, there are these points which I would like them to note.

Dr Arthur Beng also asked if there should not be a self-regulatory body for information technology. Actually, that is quite outside the scope of this Bill and I would not like to speak on behalf of the other Ministers who are in charge of the computer industry as a whole, like the Minister for Trade and Industry. I am sure he will take note of the comments. I would like to point out that it is not a single discipline kind of industry and, unlike doctors and lawyers, I do not think one needs to have a licence or professional registered qualification in order to write a computer program or to engage in a computer software business. But, nevertheless, I am sure my colleagues in the other Ministries will take note of the comments that he has made.

Dr Ho Tat Kin asked if the sale of passwords, for example, will be considered as a preparatory act. I think it very much depends on the nature of the case. In some cases, it could very well be that the Police can make a case out that, in that particular set of circumstances, the sale of the passwords is an essential prior step to the commission of an offence, in which case, I have no doubt that the Police will treat it so and bring about a prosecution.

He asked about the capability of the Police to enforce this Act, bearing in mind the complexities of the problem and the need for expertise. Let me say that the legislation will actually be enforced by the Commercial Crime Division (CCD) of the CID Department, which is a rather specialised investigative body. The CCD has investigators who are computer-literate and several of them are graduates who have completed university courses in programming and have computer-based information or systems knowledge. Several of them have been trained locally and overseas and particularly for the purpose of conducting computer crime investigations. I take his point that computer technology is complex and fast changing. Therefore, I have encouraged the CCD to adopt an approach of working with external computer experts depending on the nature of the case. I want to assure him that the CCD will have adequate qualified manpower resources to conduct computer crime investigations in the foreseeable future. Some foreign police forces, for example, the Scotland Yard in England, have created specialist units in their organisation to enforce such legislation. I am not sure whether it is necessary for us to do that at this stage because the volume of cases may not justify the establishment of such an unit. For the time being, I think the approach of having this specialised unit in the CCD is sufficient.

As for minors, there are no special provisions here. Obviously, this will be one of the factors to be taken into account by the court in the imposition of the sentence which, incidentally, is another answer why you need to have a range of penalties as set out in the Bill. But I do not think that it is the intention of this Parliament that minors and teenagers should get away scot-free. As was pointed out, they can cause considerable damage and inconvenience as has happened in other countries. So they are obviously within the ambit of these provisions.

Dr Toh Keng Kiat has made some specific points about the detailed drafting of the provisions. I do not think I can give chapter and verse here as to why on a particular provision we departed from the exact wording of the United Kingdom legislation. But in answer to him, let me say that when drafting this Bill it went through several stages. First, the Commercial Crime Division worked on it, then the Attorney-General's Chambers, and before final casting it was carefully studied by an expert committee known as the Law Reforms Sub-Committee of the Academy of Law, headed by the Dean of the Law Faculty. They not only looked at the United Kingdom legislation but also other legislation. When they looked at the legislation, they also looked at critiques of the other legislation and whatever experiences have taken place in that overseas country in the enforcement and implementation of their law. So I may not be able to give a specific answer to his detailed query, but to say that careful consideration has been given. In other words, it has not been blind copying or adoption of the foreign provisions. We have to amalgamate and take what we consider were the best provisions. We will have to see, in the light of experience, how these provisions work. I am sure that as the years go by we may need to fine-tune or improve these provisions. We are really creating here a novel legislation. We have to learn from the experiences of other countries. We hope that what we have put to Parliament is adequate. But if it is not adequate, we shall not hesitate to refine and modify the legislation in the light of experience, as other countries have done.

Question put, and agreed to.

Bill accordingly read a Second time and committed to a Committee of the whole House.

The House immediately resolved itself into a Committee on the Bill. - [Prof. S. Jayakumar].

Bill considered in Committee; reported without amendment; read a Third time and passed.