COMPUTER MISUSE (AMENDMENT) BILL

Order for Second Reading read.

The Minister for Home Affairs (Mr Wong Kan Seng): Mr Speaker, Sir, I beg to move, "That the Bill be now read a second time."

Introduction

With the implementation of the IT2000 Master Plan formulated by the National Computer Board in 1991, Singapore is rapidly being transformed into an "Intelligent Island". The uses of information technology have become pervasive in every aspect of a society - at work, at home and even when we play. Indeed, the reliance on computers in areas such as government, business and public services has increased significantly in Singapore over the past few years.

The increased use of computers has given Singaporeans a wide range of communication means and access to services. With the increased use of computers in work and at home, Singaporeans have been able to tap into a wide network of electronically stored information and services on the Internet. This has increased their productivity at work and enhanced their personal and social lives. For example, increasingly, people have been able to handle transactions with government agencies or private businesses electronically. This includes paying bills, submitting applications, booking tickets for sports and cultural events, communicating with friends and shopping. In the business arena, transactions are also increasingly done via electronic means, eg, various banks have already commenced some banking transactions through the Internet. The pace of expansion of usage of computers is phenomenal over the past few years and this pace is likely to speed up in the years to come.

With greater use of computers at home and at work, not only have the number of computer related crime cases risen, but the level of sophistication has likewise increased. Computer crime today spans a wide spectrum and computer criminals are of various sorts and have different levels of technical know-how. Apart from this, another category of computer criminals are the hackers who break into computer systems to create mischief or make illegal gain. CID has investigated cases where students hacked into local and overseas systems in the United States and Europe. There was a case involving a hacker who hacked into local and overseas systems to obtain programmes for his Internet Relay Chat channels and free Internet access accounts. This hacker did not even pass his "O" level, so it does not mean that only those with higher education are good at computer hacking. Between 1993 and 1995, there were only three reported cases of computer crime. All were related to cloning of mobile phones. In 1996 alone, the number of reported cases increased to 14. More significantly, these cases included two cases of computer hacking and four cases of unauthorised access. In 1997, the number of cases rose to 39. In the first five months of this year, 25 cases have already been reported. There may be other cases that were unreported.

The increase in the number of computer crimes and the serious implications of these offences necessitate a review of the Computer Misuse Act. Computer crime can be as serious as traditional crimes. For example, CID had investigated a case in 1997 where a technician at Motorola accessed the company's human resource system, adjusted the data base, resulting in him getting extra money or salary for a period of about two years. He also amended the salary data relating to his fiancee resulting in her getting more pay and other remuneration. In such crimes involving fraud and dishonesty, the culprits were usually employees of the victim companies who were entrusted with computer access or were able to access the computer systems due to poor security practices or through illegal means.

The increasing use of computers for various purposes in Singapore would mean that this rising trend in computer crimes would continue. It is therefore necessary and timely to update the Computer Misuse Act (CMA) to deal with an increasingly complex environment.

In addition, crimes committed through the electronic medium and through use of computers are difficult to detect but they are just as serious as traditional crimes and we must equally protect our population against such crimes. To ensure that Singapore remains an attractive place for investors and businesses to operate effectively and securely, computer crimes must be treated as seriously as other criminal offences. The proposed Bill therefore addresses three areas:

(1) Enhanced security. Firstly, it strengthens the legislative framework to ensure that the use of computers and conduct of E-commerce are made more secure. It will ensure that the law is adequate to cover the various types of computer-related offences which have emerged.

(2) Stronger deterrence. It aims to enhance the deterrent effect of the penalties for computer crimes. The proposed penalties will also be proportionate to the damage caused, and distinguish between first time and repeat offenders.

(3) Up-to-date enforcement powers. It will give Police up-to-date powers of investigation and evidence gathering to deal with complex computer crimes. Enhanced Computer Security for `Protected Computers'

Sir, like other countries, Singapore has become more reliant on computers over the years. This reliance is apparent in various essential public and private services. For instance, computer systems are used in the provision of essential day-to-day services such as telecommunications, public utilities and transportation. The telephone, mobile telephone and the paging networks which we take for granted in our daily life rely on computer systems to operate. Our land and air traffic control systems and the road traffic light control systems which ensure smooth transportation are examples of systems using computers. Even our water treatment system to ensure that our water is potable depends on a computerised process. In the business sector, banking services are also highly computerised - cheque clearance, money transfers and fund management are areas which depend on computer systems. Other areas where computers are widely used are in the military and security-related activities and in the provision of emergency services (such as medical, police and civil defence).

The integrity of these systems must be safeguarded to ensure that essential services do not become the target of computer crimes. Such crimes, if perpetrated, could lead to major disruption and financial loss to the economy or even loss of life. For example, if a perpetrator overcomes security measures, accesses and alters programmes in the telecommunication computer systems causing the telephone network to crash, this would create major social and economic disruption to the country. Another example, if a perpetrator accesses the emergency call handling system of the Police or of the Singapore Civil Defence Force and modifies the programme to create problems in receiving and dispatching resources, then it will cause delay in response which may result in loss of lives or property.

My Ministry therefore proposes that the Act be amended to protect these computer systems. Clause 7 introduces a new section 6C to enhance the penalties for offences committed against "protected computers". "Protected computers" are defined as those systems used in connection with national security, banking and finance, emergency services (such as police and ambulance services), and essential public services (such as public utilities, telecommunications, communications and transport). The punishment under this section is comparable to provisions under present legislation dealing with criminals committing offences against the State, serious mischief offences, and serious bodily harm cases. In this information age, crimes against `protected computers' could have the same detrimental effect on national security, public safety and integrity of the economic system. The Amendment Bill therefore proposes that offences committed on "protected systems" or "protected computers" be liable to enhanced penalties of up to $100,000 or imprisonment of up to 20 years.

Differentiating Penalties for First and Repeat Offenders/Graduating Penalties according to Severity

Sir, my Ministry also proposes to make a differentiation in the penalties imposed on first time offenders and repeat offenders. Currently, there are three basic offences in the CMA, namely:

(a) An offence of unauthorised access under section 3;

(b) An offence of unauthorised modification to computer material, such as introducing computer virus, under section 5; and

(c) An offence of unauthorised use or interception of computer services, such as phone cloning offences, under section 6. The existing punishment for these three offences is a fine of up to $2,000 or imprisonment of up to two years or both. Where the offence causes a loss of above $10,000, the punishment is a fine of up to $20,000 or imprisonment of up to five years or both.

To enhance the deterrent effect of the law as well as ensure that repeat offenders are treated more severely than first offenders, clauses 3, 5 and 6 of the Bill propose to enhance the penalties, and to differentiate the penalties for first and repeat offenders. Clauses 3, 5 and 6 also ensure that the penalties are commensurate with the severity of the offence. This addresses a shortcoming in the current Act, where offences under section 3, that is, unauthorised access to computer material, section 5, that is, unauthorised modification to computer material and section 6, that is, unauthorised use or interception of computer services attract the same degree of penalty, even though the offences under sections 5 and 6 are more severe than those under section 3.

Offences committed under section 3(1) can be compared to certain offences in the physical world, eg, that of trespassing into someone's garden or backyard instead of housebreaking. With greater use of the Internet in our society, such offences are likely to increase, based on the experience of the United States and other developed countries. For example, a person surfing on the Internet may gain access into someone's web server or personal computer out of curiosity. The penalty for the first offender is revised upwards from a fine of up to $2,000 or two years imprisonment or both, to a fine of up to $5,000 or two years imprisonment or both. The imprisonment term is kept at two years as this offence is less severe compared to the other offences in the CMA. As repeat offenders under section 3(1) of the CMA should be dealt with more severely, they would also face a more severe penalty of a fine of up to $10,000 or three years imprisonment or both.

The penalties under section 5(1) (unauthorised modification) and section 6(1) (unauthorised use or interception) will also be increased to address increases in such offences. In 1997, there were about 25 such cases. In the first five months of this year, there were already 23 cases reported.

Examples of offences under section 6(1) are cloning of mobile phones/pagers or when a person uses someone else's account and password to obtain free Internet usage. Recently, two persons were charged in court for using illegally obtained Internet accounts not belonging to them to gain access into the Internet. The accused persons deceived the victim into revealing to them her password. The amendment proposes to increase the penalties considering the consequences and the losses suffered by the victim. Clauses 5(1) and 6(1) propose to raise the penalties for first time offenders from the current fine of up to $2,000 or up to two years imprisonment or both, to a fine of up to $10,000 or up to three years imprisonment or both. Repeat offenders would face a fine of up to $20,000 or up to 5 years imprisonment or both.

Clauses 3, 5 and 6 will also increase the penalties for offences under sections 3(2), 5(2) and 6(2) where damage is caused, to a fine not exceeding $50,000 or imprisonment not exceeding 7 years or both. The penalties for these offences, where damage is caused, can be compared with the more serious property offences in the Penal Code such as criminal breach of trust where the penalties could extend to 7 years imprisonment.

Let me cite a case to illustrate the damage that could be caused by such an illegal act. In 1996, in a case involving section 5(2), a systems administrator who was unhappy with the management of his company, inserted a Trojan horse programme into the computer system. This programme would replace the original system files with damaged files while backing-up of the system was done. He also timed the process to occur when he was away on holiday. As a result of this, the company's system crashed and the entire production line came to a standstill. After his dismissal, he called a production operator and instructed her to access the system on the pretext that he wanted to erase his personal files. The production operator followed his instruction and a set of system files was deleted. The system thus crashed for a second time. The accused eventually was charged for two counts under section 5(2), but was only sentenced to a maximum fine of $20,000, although the company's computer system and production were badly affected.

Definition of Damage

Mr Speaker Sir, there is also a need to recognise that the impact of computer crime goes beyond just financial terms. It is necessary to widen the definition of "damage" to cover damages beyond financial loss. Clause 2 of the Bill therefore proposes to widen the definition of "damage" to include any impairment to a computer or the integrity of data or program that:

(a) causes loss aggregating at least $10,000 in value. (This is the estimated cost of restoring or repairing the damaged computer system. Economic loss such as business opportunities forgone due to the downtime of the computer could be considered if the prosecution could make out a case that the loss was attributable to the damage caused to the computer system);

(b) modifies or impairs, or potentially modifies or impairs, the medical diagnosis or treatment of persons. (For example, this could involve hacking into a medical record database to change or falsify the diagnosis on medical records, resulting in the wrong treatment being administered);

(c) causes or threatens physical injury or death. (This could include hacking or threatening to hack into a pharmaceutical plant to change the composition of the chemicals used in the manufacturing of certain drugs); or

(d) threatens public health or safety. (This could involve hacking into the public utilities systems).

Addressing New Offences

Accessing computer with or without authorisation

Mr Speaker, Sir, under section 4 of the current CMA, it is an offence for a person to access a computer without authority in order to commit a crime. However, it is uncertain whether authorised users of a computer who abuse their authority to access computers to commit an offence are currently liable under the CMA.

An example is the recent case involving Golden Village Cinemas. In December 1996, the management of Golden Village Cinemas reported a case of fraud involving usage of their Smart Cards. Four accused persons were eventually arrested in February 1997 in connection with the case. Investigations revealed that they had exploited the weakness of Golden Village Cinema computer and Smart Card system for monetary gains. The staff who had authority to access the cinema cash card top up computer system used it to top up the cash value of unused cards for subsequent sale and covered their tracks by altering computer records. Although this offence was perpetrated through the use of a computer, the offenders were prosecuted under the Penal Code for criminal breach of trust which carried a punishment of fine or up to 7 years imprisonment, instead of a fine of up to $50,000 or imprisonment of up to 10 years if they were to be prosecuted under the amended provisions of the CMA.

To clarify this uncertainty, clause 4 of the Bill will amend section 4 to make it an offence for anyone to access a computer to commit a crime, regardless of whether access has been authorised. The punishment is retained at a fine of $50,000 or imprisonment not more than 10 years or both, as it is already sufficiently severe.

Acts of Interference or Obstruction of Lawful Use of a Computer

Mr Speaker, there is currently no law against acts of interference or obstruction of lawful use of a computer or impairment of the usefulness of a computer. An example of such an act is E-mail bombing where enormous amounts of E-mail are sent to a victim. When the victim checks his mailbox for mail, he may find hundreds of them each time. The process of downloading the mail would take a long time. As the subscriber is entitled to a certain amount of memory for E-mail, the victim's mailbox may crash. Currently, Police could not take further action on such cases as there is no law against such act. Victims have to seek help from other organisations such as the Internet Service Providers (ISPs) in order to seek civil recourse.

To deter such acts, clause 7 will introduce a new section 6A to make it an offence for the unauthorised obstruction of use of a computer. The proposed penalty is a fine of up to $10,000 or imprisonment of up to 3 years or both for a first offender, and a fine of up to $20,000 or imprisonment of up to 5 years or both for repeat offenders. If damage is caused, then the offender would face an enhanced penalty of up to $50,000 fine or 7 years imprisonment or both.

Unauthorised Disclosure of Passwords or Access Codes

Clause 7 will also introduce a new section 6B to make it an offence for unauthorised disclosure of passwords or other access codes by any person if he does so for any wrongful gain or for unlawful purpose or to cause wrongful loss. It is possible for a system administrator to sell passwords to unauthorised users to enable free access and usage. Passwords and other access codes are also used to enhance computer security and such acts would compromise security. The proposed penalties for such offences are similar to the penalties applicable to interference or obstruction of lawful use of computer.

Necessary Powers for Enforcement Agencies

The Bill also amends the CMA to provide the Police with the additional powers of investigations. In the course of investigation, Police may require persons to provide necessary assistance. For example, the Police may require persons who are in charge of or involved in the operation of computers under investigation to help to retrieve data from those computers. Under the current Act, it is not an offence if a person, whose assistance the Police requires, refuses to do so. Clause 9 of the Bill proposes to make it an offence if a person refuses to provide assistance or obstructs the Police in the course of investigation. The penalty is a fine of up to $10,000 or up to 3 years imprisonment or both. There are similar sections like that in the Penal Code, eg, section 179 - refusing to answer a public servant authorised to question -which carries a penalty of imprisonment which may extend to 6 months or fine which may extend to $1000 or both, or section 186 - obstructing public servant in discharge of public functions - which carries a penalty of imprisonment which may extend to 3 months or fine which may extend to $500 or both.

Sir, the existing provision in section 14 will also need to be widened to allow Police to gain access to encrypted data for the purpose of investigation. Clause 9 of the Bill also proposes to amend section 14 to widen the provisions to allow lawful access to data and encrypted material in the course of investigations of offences under the Act, or other offences disclosed in the course of such investigations. As a safeguard, such powers of access can only be exercised with the consent of the Public Prosecutor. Without the consent of the Public Prosecutor, the Police will not be able to obtain access to encrypted data or material. In practice, an arrangement will be put in place for the Police to secure the consent of the AG's Chambers without compromising operational efficiency.

Conclusion

In conclusion, Sir, this Bill is intended to send a strong signal that computer crimes will be treated and dealt with seriously in Singapore. As Singapore positions itself to be an intelligent island and a global centre for E-commerce, the legislative framework must keep pace with the developments to ensure the integrity of our computer systems against would-be cyber criminals and hackers. With the Bill, banks, commercial institutions, foreign investors and businesses can rest assured that Singapore would be a good and safe place where E-commerce can flourish. Singaporeans can also rest assured that the law provides adequate coverage for the safe operation of essential computer systems in Singapore.

Sir, I beg to move.

Question proposed.

Assoc. Prof. Chin Tet Yung (Sembawang): Mr Speaker, Sir, I rise to speak in general support of this Bill. I also support the enhanced penalties for the offences as outlined in the very comprehensive speech by the Minister. However, there are certain proposed amendments that I think merit reconsideration.

The Computer Misuse Act was enacted to criminalise any misuse of computers. Its original targets were hackers who seek unauthorised access to computers and having gained such access, either damage the computer systems or steal data from them. The behaviour this Act was intended to control is unauthorised access. Today, we are considering a curious amendment to section 4 that would change the general approach for controlling unauthorised access. We are actually going to criminalise authorised access to a computer when the authorised user uses it to commit another specific crime. In other words, the original intent of the Computer Misuse Act to punish unauthorised access is going to be changed.

Let me use an illustration to highlight these proposed changes. If a man either orally or write out a note extorting money from his neighbour, he is, of course, liable to be charged for extortion. If he uses an old typewriter to type out the same note, he can still be charged for extortion. If he uses his computer at his place of work to print out such a note, being a high-tech criminal, he can be charged not only for extortion but he will in addition be liable to a charge of computer misuse under the proposed section 4.

Sir, I have difficulty understanding why this should be the case. Under the original provision, the man would be liable for an additional charge under the Computer Misuse Act only if he uses the computer without authority. That is the mischief that the Computer Misuse Act was directed at. What is the mischief that this new section is intended to overcome? The man is already liable to be charged for what I should call the principal offence. Why is it necessary to charge him for another computer related offence? Does it not amount to punishing people for using a computer in addition to whatever other crime he has committed? If so, how do we distinguish such a case from one that makes use of other instruments such as a pen or an old typewriter in the commission of a crime? In the illustration I have given, can one really distinguish between using a computer from one of using the pen or the typewriter? The main question is: is it necessary or desirable to introduce a provision that criminalises what is otherwise legitimate behaviour, ie, using a computer with authority? The deletion of the words "without authority" from section 4 is, in my view, unjustified. I would strongly urge that these words be retained. The amendment is unnecessary, and not defensible.

It is likely that the proponents for this provision may argue that many crimes, as the Minister has pointed out, are committed by employees using their employers' computers, ie, computer users committing crimes through proper use of their computers, and that this is the mischief that the amendment is supposed to control.

I have to say that I remain unconvinced about the need to cover this situation for two reasons. First, the employee will already be charged with the principal offence, be it cheating, falsification of accounts, fraud, criminal breach of trust or what have you. Second, it remains open for the public prosecutor to argue that if an employee uses a computer for a purpose that is not within the scope of his employment, that should be treated as unauthorised access and, therefore, within the law as it now stands. This issue remains to be decided by case law, and it is much better to allow such a development to take place rather than to amend the law as suggested. I strongly urge Members and the Minister to reconsider whether it is necessary to amend section 4.

I turn to section 6A. This is a new section referring to "unauthorised obstructioin of use of computer". The language of the section appears to be unduly open-ended and wide. I refer in particular to the proposed section 6A(1)(b) where it states, and I quote:

`Any person who knowingly and without authority or lawful excuse - (b) impedes or prevents access to, or impairs the usefulness or effectiveness of, any program or data stored in a computer, shall be guilty of an offence .'

The phrase "impairs the usefulness or effectiveness of any program or data" is really very open-ended and imprecise, particularly in relation to computer usage. Again, it is difficult to imagine what the mischief the section is intended to cover. Impeding and impairing the usefulness or effectiveness of a program is really a matter of degree. Once you turn on a computer and access a program, you are really in a way using the program, taking up the memory of the computer and, therefore, maybe impairing the effectiveness of other programs. Is it intended that this section be applied, for instance, only to aggressive businessmen who e-mail bomb potential customers with their advertisements? Or is there some more serious problem that this section is intended to cover? It is not very clear in the section itself as to what the problem is.

I turn to new section 6C which contains a new provision prescribing enhanced punishment for offences involving protected computers. Such computers are determined according to the knowledge of the person alleged to have committed the offence. Does he know or ought reasonably to have known that the computer is one that is used for certain specific purposes, such as the security, defence or international relations of Singapore? Aside from these purposes, the section also includes computers dealing with other purposes such as the protection of informers, banking and financial services, communications and so on.

While I agree with the purpose of the section, it is difficult to see why the nature of a protected computer should depend on the state of knowledge of the accused. For example, it is provided in subsection (3) of section 6C that the requisite knowledge shall be presumed if there was an electronic warning drawing attention to the section. Such a presumption would obviously not operate if, for instance, a person does not understand the language of the warning, or the computer is so fast that the warning simply flashes through too quickly for the reader to appreciate. To take an extreme example. A foreigner gaining access to a protected computer, not understanding English or Chinese, may on this basis have more scope to avoid enhanced penalties than a local in the same situation. One would have thought that in such cases, it would be better to stipulate that once the warning is given, the accused will be liable to the enhanced punishment. His understanding or knowledge of the warning or lack of it may be a factor to be taken into account in sentencing, and it should not be, in other words, an element deciding whether a computer is protected or not.

I turn finally to section 14 - the proposed amendments to police powers. This includes specifically the requirement that the police are to be given assistance in the case where the information is encrypted. Once again, while I agree that the police should be provided with powers to require information from suspects in their investigation, I do not think that a change to the existing provision is necessary.

Sir, the original provision does not provide specifically for the situation of encrypted information. But the language of the original section is wide enough to cover such situations. Under the existing section, the police can require the suspect to "provide him with such reasonable assistance as he may require." This is wide enough for the police to require a suspect to give assistance with regard to encrypted information and the like. There has not been any case concerning this subject. It seems to be too early to suggest that this encrypted information element is not within the existing law. My submission is that the existing provision is more than enough for this purpose.

Sir, I hope that enough has been said to persuade the Minister and Members of this House that it may be expedient to reconsider whether some of the amendments are actually necessary or desirable. I hope that there will be a further opportunity to review the desirability of enacting some of these provisions into law, bearing in mind that the Computer Misuse Act, as it is appropriately named, is to control computer misuse, ie, unauthorised access to computers.

Mr Chuang Shaw Peng: Mr Speaker, Sir, as the Minister has pointed out, the rapid development of computer technology and fast falling prices of hardware and software have led to the extensive use of computers for all purposes. From the largest corporations, Government ministries to schools to households, we can always see the computer at work. Increasingly, we are enjoying the convenience and improvement in productivity through the use of computer networks. However, the lightning speed of changes in computer technology and its indispensability are imposing strains on all social and legal systems. As Prof. Chin has just pointed out and given examples, laws may not be enacted fast enough or realistic enough to regulate without complication the activities carried out in the virtual world or, in-between, from the real to the virtual world.

A recent CIA report says that nowadays the scientists' ability to network the computers is faster than the ability to protect them, and given the kind of money they have spent on the security of the computer systems, they still say that the national security of the United States of America can still be at risk if there is an electronic warfare whereby the attack is targeted to cripple the vast network of computers that is used to control its power plants, transportation, financial institutions, defence systems, etc, as the Minister has pointed out.

Having said this, Sir, I support this Computer Misuse (Amendment) Bill, which will impose enhanced penalties on all categories of offences related to the misuse of computers, particularly the important part is on protected computers in new section 6C. This section carries a maximum penalty of $100,000 or imprisonment of a term not exceeding 20 years or to both. While the 20 years' imprisonment term seems like a just punishment, the $100,000 maximum fine appears low for actions that can cause millions of dollars in damage to the public and is definitely mild compared to the $50,000 maximum fine for a repeat offence in breeding mosquitoes or $200,000 fine for damaging an underground cable.

The Bill has also introduced a new definition on the word "damage" in clause 2. Clause 2 mentions a loss aggregating at least $10,000 in value, but it does not explain how the loss is assessed. The reason why I think the calculation of the damage should be spelt out in the Bill is that the section differentiates between offences where the damage is $10,000 and above, and those which are below $10,000, with the effect that in the former case, the penalties are greatly enhanced. An accused will have no way of knowing whether he will receive a lower or higher charge because the law does not state how the damage is assessed. Under the same clause 2(b), paragraphs (c) and (d) are probably too wide because it raises the question whether a perceived threat to public health or safety or death or physical injury is subjective or objective. Can the Minister describe the circumstances under which the controlling authority or the court has the subjective power to decide on the damages?

Sir, since this Bill touches on everybody's life, like the Electronic Transactions Bill, there should be more public education on the Bill. I have conducted some personal surveys with companies and individuals, professionals such as lawyers, engineers and architects, and to my surprise most people are quite ignorant of the existence of the 1994 Computer Misuse Act. Now with these enhanced penalties and, of course, more pervasive use of computer networks these days, it is imperative that public awareness must be raised for the new Bill to be effective. Many computer owners are not computer literate enough to protect their computers. I once heard that somebody hacked into a banking network system although no harm was caused.

Individual users also do not know that their usual behaviour, such as revealing passwords, loading illegal software to play games or to do their own work, to delete the database or even leaving the computer logged on but unattended during lunch time, can lead to serious consequences. Like all crimes, prevention is the best way to avoid it. It is quite late to alert the public about this law by putting somebody behind bars for 20 years after a major havoc has been caused by his hacking into protected computers and causing huge damage. Hence, I urge the Government and the public institutions to enhance their efforts to protect their computer networks. At the same time, a major effort must be put in to find ways to communicate in plain language to the public about the effects of the law, just like the one we had on speeding 60 km above the speed limit. The potential penalties must be firmly registered in everybody's mind. Hence, I suggest that seminars and public lectures be conducted at community centres, educational institutions and trade associations to prepare our people for law and order in the real world as well as in the virtual world.

Other than those points which I have sought clarification, Sir, I support the Bill.

Dr Toh See Kiat (Aljunied): Mr Speaker, Sir, when I was studying in America, I took the opportunity to visit Harvard University where there is a museum of all the first computers, and I saw this computer made in 1943, a huge room-size thing, which seems to have hundreds of metres of wires in it. And I am told that such a computer actually has less power than one of our little desktop things we have today. The use of computers has become so pervasive that everything we have either has a computer operating it or a micro-chip which is as good as a computer, such as in our watches, microwave ovens, cars, and washing machines. As a matter of fact, under the definition of this Act, microwave ovens and washing machines being programmable devices are actually also computers. So if you misuse them, you also get charged. But, Sir, jokes aside, I think the subject is serious enough when we talk about computers per se. In other words, it is important that when we use computers, being so pervasive these days, we should be careful how people use and misuse them. I think it would have been actually incomprehensible even for the computer makers in the early 80s, for example, to expect that computers would be so well used. In fact, in 1980, a CEO of one of the computer makers dismissed the idea that there would actually be a computer in every house. But look at where we are today.

Sir, I think it is important that we catch up with the time and make misuse of computers something that people must take note of and prevent when we can with the law. I have always been of the view that where computers are used to commit an offence and other offences, for example, extortion, blackmailing or stealing something from employers or the company and so on, there is actually an ultimate offence that can be chargeable. As a matter of illustration, we do not have a special knife misuse law. Neither do we have a typewriter misuse law. Because it is actually the result of that misuse that we criminalise, whether it be extortion, murder or causing hurt. This is where I support Prof. Chin, ie, where we create new criminal offences, we have got to be particularly careful that we do not go overboard. In the Computer Misuse (Amendment) Bill, the new section 4 talks about authorised use of the computer to commit an offence. If there is an offence of stealing or misappropriation of funds, I think that itself is chargeable under existing law. It is good, of course, if we can say that if you use a computer because of the way the computer works, how fast it is, and how difficult it is to detect that we enhance the penalties, I am supportive of that.

But I do want to take note, as Prof. Chin has urged Members and the Minister to do, that if we criminalise something that is "authorised", then basically we are talking of a situation where you have a transfer of funds, somebody is authorised to use the computer to transfer funds, for example, he is using an authorised instrument, an authorised tool, to do an unauthorised thing. If it is indeed the concern of the company that there should not be such unauthorised transfers, then I think the moment a person who has use of a computer does an unauthorised thing, then he already is using a computer in an unauthorised manner and therefore misusing it, and therefore there is no need to add the word "authorised".

I am aware that the drafters of this new section probably took a look at cases elsewhere. There is indeed a case in UK where policemen, for example, use a police computer. They were authorised to do so. And they use this computer to do things that were not authorised. I think in that sort of situation, we really are talking about a person who, having exceeded his authority, is really an unauthorised user, and so we should not add this word "authorised" which has a very serious implication.

Moving on from that point, Sir, looking again at this new section 4, I think what we are trying to catch in the Computer Misuse Act is really not the old class of criminals who do things like extortion and blackmailing and so on. But really there is a new class of misusers of computers who have been described in the literature contemptuously as computer nerds, people who are anti-social, people who are social misfits, and perhaps even teenagers out to do mischief. And we are saying, look, computers run everything in our lives, now including our airplanes and control towers and medical facilities. Therefore, we want people to be responsible in the use of computers. Hence, section 3 of the Computer Misuse Act has now been amended to enhance penalties and to add certain new concerns regarding, for example, damage in a way which was never thought of when the first Act was passed. I support that, Sir. But I would urge that when we talk about this new class of criminals who really sometimes may win the sympathy of people who say, "What? But these are teenagers. They know nothing better.", we should really say, yes, they should actually be using the computer for study, for work, and so on, but not to use to do things that will damage other people's lives and property.

So when we talk about an offence which is a true misuse of a computer, I am all for making sure repeat offences are penalised even more and if damage is caused, that greater enhanced penalties will be imposed. And this is now the scheme of things as we can see. Sections 3, 4, 5, 6 and 6A all have got a basic penalty for an offence, higher penalty for repeat offence and enhanced penalty for damage caused.

Under the new section 6C, which is my next point, we have, you might say, a higher level of enhanced penalties, and this is when a "protected computer" is used to do the crimes that are being committed. So for a protected computer, such as a national defence computer or a computer which is used by the Government for public safety and so on, it is important that we send a clear message that these computers are useful and they affect a lot of lives and we should not play around with them. This is where I support Mr Chuang's view too that we should go out with an education campaign to tell people that these are things that you should not be doing. In a private conversation with Mr Chuang, he in fact claims that some lawyers do not even know the existence of this Act. I leave my mind open to that. But I think it is important that not only do we tell people of the provisions of the law but also that these cases have happened. It is like nobody has heard of this case until the Minister mentioned earlier in his speech that there was this case. And I think it is important for people to be reminded. When these cases are charged in court, the headlines are there. But I think people need to be reminded.

I would go on to say that the new section 6C makes it an offence for anybody who commits an offence under sections 3, 5, 6 or 6A, if he does it with a protected computer. But I do believe that this new section 6C does not cover section 4 or section 6B. So what we end up with is an anomaly. In other words, a person who has access to a computer to commit a wrong thing, like transfer of funds or to switch off a computer in a medical facility so that he causes death, this person can be charged under section 4. If he does the same thing through a computer which is a protected system, he does not get any enhanced penalty. But if he accesses a computer and it is a protected computer, he gets an enhanced penalty under section 6C. I think it is more serious for a person to approach and use a protected computer to either do these offences or under section 6B where he discloses the access code. Sir, again, it is important that we not only protect computers by making sure access codes are not posted on the Net and trafficked and sold for a price and so on, we should also seriously look at the fact that if this is an access code to a protected computer, the penalty must be higher. And if the objection is that this is an enhanced penalty on top of an enhanced penalty, I think that is not a real objection because there are other offences in the Act that already have penalties upon penalties.

I would also like to point to another interesting issue which Mr Chuang has alluded to, and that is, in the new section 6A where any person who knowingly and without authority or lawful excuse interferes with a computer. The Minister has mentioned that this covers a situation of what we call spam or e-mail which is sent into a computer to just basically cram it with full of mail messages and then this causes a breakdown or a crash in the e-mail system. Here we need to be careful that we do not make illegal and illegitimate a proper marketing tool which businesses use, and that is, to use the computer to send e-mail to solicit business. I think there is quite a lot of literature on computer spam and even a lot of postings on the Internet which criticise such commercial parties from using spam. But I would say that it is important that we do not close off this avenue completely if it is reasonably and justifiably used. Therefore, a person's lawful excuse, he might say, is, "I'm trying to sell something." I think the Minister should consider whether this is something that the law would prosecute.

I have said earlier on that here we are trying to make computer misuse an offence. And we are tackling a new class of criminals who really have no concern for other people, who are anti-social and social misfits, and they have a lingo of their own, a language that they use. When you talk about programs and data, they know what it is. And when you talk about e-mail, they too know what it is. In their lingo, data is not equal to e-mail; e-mail is e-mail, data is data. Under the definitions of the Computer Misuse Act, data actually is wide enough to cover e-mail. Data is defined under the main Act as "representations of information or of concepts that are being prepared or have been prepared in a form suitable for use in a computer". This is wide enough to cover e-mail, and I hope the Minister will clarify that, so that it will no longer be an excuse for a person to say, "Oh, well, what I did was e-mail." And the Computer Misuse Act only protects programs and data on computers.

Mr Wong Kan Seng: Sir, I thank the Members for speaking on this Bill. Indeed this Bill is necessary and we are updating it to provide for a changed situation from the time of the first Computer Misuse Act some years ago. If you just look at the number of Internet users today compared to, say, January or February 1995, just the number of Internet users, without counting the access they can have through their employers, has increased 10 times, easily from 25,000 to about 270,000 by January this year. And there is an equally large number of those who have access to Internet using their own employers' computers.

Sir, we can see that the situation envisaged in 1993-94 when we first had the CMA was something that we do not see it today. There is an exponential increase in the number of computers, the usage of computers and the number of users of computers. Therefore, we need to update the Act. By updating the Act, we are not trying to put obstacles in people's path in their use of computers by making them unauthorised users just because they have been authorised to do something but, if they were to use it for some unauthorised purposes, they will be acting against the law.

Let me assure Members that anybody who uses the computer with authority for a lawful purpose will not be caught under this Bill. So have no fear if you are using it for a proper and lawful purpose, with no intent to commit a crime. You do not have to worry that even by removing the word "unauthorised", you will be caught by this new section 4. I have explained earlier on why we have this new section 4. The idea of section 4, as amended, is to remove the uncertainty that a person, who is originally authorised to access the computer, may now find himself guilty of an offence if he were to use it to commit a crime. It will, if he were to use it to commit a crime. That is what the purpose of this new section 4 is all about. So it is very clear that we can catch the person under this amendment.

Some of my colleagues asked why do we not catch them under the other laws because the primary act is that of theft, extortion, etc, and we could use the other laws to punish them. Yes, of course, we can also do that. But we feel that if a person has actually abused his authority in using the computer, we should try to use this legislation and update it so as to also catch him under it. But it does not mean that the person can be charged twice for the same offence based on the same facts. So if we were to charge a person for extortion, an example used by Prof. Chin, when he uses his computer instead of his typewriter to print the extortion letter, then of course, we will not charge him under the Penal Code. He will be charged under this particular Bill.

Section 4(2) actually narrows the offences under which we can charge a person for committing a crime. It is quite clear that it is only for certain categories of offences and not all types of offences involving the use of computers. In that sense, we have more or less narrowed the ground for which a person can be charged using a computer with intent to commit an offence, as specified in section 4. I have given the example of the Golden Village Cinemas case. There are other similar cases which the police in the past have not been able to charge a person under the CMA because there was no such provision or the provision itself was not clear.

Sir, let me say this again. If a person uses his computer for a lawful purpose, he does not have to worry that he will be charged under section 4. If he is authorised to use the computer but uses it with intent to commit a crime, as specified in section 4, then he may be charged under this Bill. But if he is charged under this Bill, based on the same facts, he cannot be charged under another Act.

Prof. Chin says that section 6A on impairing the usefulness or effectiveness of data stored in a computer seems to be a bit open-ended and imprecise. He asked, apart from e-mail, what else are we actually thinking about and he was not sure whether it is workable. I gave e-mail bombing as an example of what is meant by impeding access or use. Under section 6A(1)(b), it says that if a person "impedes or prevents access to, or impairs the usefulness or effectiveness of, any program or data stored in a computer .". That is how it is worded under section 6A(1)(b). An example of this is a person sending commands to a computer server which would cause it to perform functions which could slow down the programs or cause it to miscompute certain things without actually gaining unauthorised access or making any unauthorised modifications. This can be done by exploiting the bugs in the system or the weaknesses in the software. Repeated requests may be sent which will then overwhelm the computer and slow it down and impair the usefulness, for example, by making it to miscompute.

Examples of such offences are, in the lingo of the people who know, Ping of Death and Teardrop. Maybe I should say what are Ping of Death and Teardrop attacks. Ping commands are legitimate commands sent to check whether a server is in existence or responsive before engaging it. If Ping commands are repeatedly sent to the server and the server ends up processing and responding to the command, resulting in it not being able to perform other tasks, then such Ping of Death attacks may actually cause the computer to crash. Teardrop attacks are packets of useless data repeatedly sent to the computer and the computer has to process the data. It is, however, unable to interpret such data and this again may cause the computer to hang. So there are many examples of how one can obstruct a computer, or the use of a computer, or impedes the use of a computer, apart from just e-mail bombing.

How do we prove that an offence has taken place, ie, the system has crashed or hanged due to such an offence? The owner or the user will have to show that he indeed could not use his computer at all. If the effect of the offence was to impair the computer's effectiveness, for example, in slowing down the response to legitimate activities, then there are network management tools which could show that, technically, the computer's response has indeed been slowed down. So this can actually be easily checked.

Prof. Chin also said that the original section 14 in addressing Police powers is enough. We do not think it is enough, in particular, the Police power to access encrypted data. If a person refuses to cooperate or just play dumb and refuses to tell you how to access because he did not want to reveal his password to open up the computer, then Police investigation will be impeded. Section 14 also makes it an offence if a person obstructs the lawful exercise of power or fails to comply with the request to provide reasonable technical and other assistance to the Police. The Police may require any person in possession of decryption information to grant him access to such decryption information necessary to decrypt the data required for purposes of investigation. Of course, the Police just cannot say, "Open up and show me." It will have to get the Public Prosecutor's consent before it can actually act.

Mr Chuang talks about the definition of "damage". We think that this definition, as we have described it now, is a much more sophisticated manner to define damage so that enhanced penalties for damage can apply to serious situations which, nevertheless, would not fall within the definition of "protected computers". As more aspects of our lives are being controlled by computers, we will have to find a way of ensuring that we do not suffer as a result of it. So we have to provide for protection. Hackers can use a computer to hack into the computer system of a chemical factory, for example, to discharge toxic chemicals into the environment or to change hospital records or diagnosis, etc, as I have just explained. Therefore, we have to define section 2 and widen it to include, apart from financial loss, impairment to computers that will potentially modify or impair the medical examination, diagnosis, treatment or care of one or more persons; or causes or threatens physical injury or death to any person; or threatens public health or public safety. In that sense, we have widened it. So it does explain how damage is to be defined in the Bill.

I now come to this so-called anomaly, mentioned by Dr Toh See Kiat, in section 6C on the enhanced penalties which cover some offences but omit others, such as those in sections 3, 5, 6 and 6A but not that of sections 4, 7 and the new section 6B. Section 6C aims primarily at offences which affect the integrity of protected computers and cause adverse consequences to its operation. That is why the principal sections pertaining to hacking and other offences which could create adverse impact on protected computers are covered in sections 3, 5, 6 and 6A. The coverage does not extend to sections 4, 6B or 7. If authorised users of protected computers commit offences of unauthorised modification under sections 5, 6 and 6A, then they are also liable under section 6C. There is therefore no need to capture section 4 under section 6C. Section 4 is to address the offences where authorised users use the computers to commit a crime and not to damage the computer per se. Under section 4, if an offender has authorised access and accesses a protected computer to commit an offence under sections 5, 6 or 6A, then he would have committed an offence under section 6C and enhanced penalties would then apply. If, however, the person accesses it to commit a criminal offence without affecting the integrity of the protected computer, then the punishment under section 4 will apply. If the offender commits an offence under section 4 and he has unauthorised access to a protected computer in the course of committing the offence, then he would still be liable for enhanced penalty because he has unauthorised access to the protected computer in committing the offence under section 3.

As for section 6B, if an offender discloses the password or the recipient uses it to enter a protected computer, the recipient can be charged under section 3 to which section 6C applies with enhanced penalty. The password owner can also be charged with abetting, under section 7, the unauthorised access by the recipient, and be punished in the same manner, that is, he is subjected to the enhanced penalty. It is thus not necessary to apply section 6C to section 6B per se but to the commission of the subsequent offences which affect the protected computer.

As for section 7, that is the section relating to abetment and hence there is no need to incorporate it inside the provisions of section 6C. However, if a person abets another person in committing an offence punished under section 6C, then the abettor would be liable for the same enhanced penalty as the principal offender. So the provision of section 6C, as it is currently drafted, is adequate.

Let me come back to Prof. Chin again on the question of people getting into the protected computers that they may not know that it is a protected computer and therefore may be punished. I think all these cybernauts are rather clever people. They know what they do and as they enter into a protected computer, I am told, there will be adequate electronic signposts and other warnings put up stipulating that unauthorised access to the computer or the program or data is an offence and, therefore, it will attract enhanced penalty. So warnings will be given to the would-be culprits to try to trespass protected computer systems. The offender would have sufficient warning that he is entering into a protected computer as he would have to acknowledge that he has read the warning, for example, by clicking on a link or a button with a title, "I accept or comply" and enter before he could proceed. The intent of a person who accesses a protected computer without authority would then be taken into account when considering prosecution. So I think there will be enough signposts, warnings and, at the same time, if you still want to enter, you say, "Yes, I want to come in and see", then you are actually committing an offence.

Assoc. Prof. Chin Tet Yung: Mr Speaker, may I clarify this point with the Minister?

Mr Speaker: Yes.

Assoc. Prof. Chin Tet Yung: The section actually says that whether a computer is a protected computer or not depends on the state of knowledge of the person accessing the computer. In my view, that is not necessary. You can have a protected computer precisely because of the warning that you have indicated. Whether the person understands the warning or not should be material only in relation to how culpable he is in accessing the computer. But it should not be part and parcel of the definition of what a protected computer is. Under the present provision, it is part and parcel of the definition, which I think is wrong. Because that would depend on whether the person understands the warning or not. That is the point.

Mr Wong Kan Seng: I am glad that Prof. Chin accepts the point that there is enough warning in the protected computer. The question is whether the person needs to know that it is a protected computer or not. I have left it to the AG's Chambers to advise me on this and, as I said, no law is static. As we gain experience, we get more experience, more cases, more examples, new technology, then all kinds of changes will come about. Eventually, we will find a way to fine-tune and improve the laws that we have. That is how we conduct our business here.

Coming back to Dr Toh's worry about spaming. As he has described, spaming is like when people send you junk mail in the mail box but it is done through the computer. Sometimes it is really difficult for us to refuse junk mail other than throwing it into the rubbish bin. But in the case of the computer, if people send you junk mail, then there is very little you can do about it. As Dr Toh said, we really do not want to discourage people who want to advertise their products. But if the computer owner or user feels that he has got so much junk mail, maybe he can get in touch with the Internet Service Providers (ISPs) or the service providers to make sure that they screen off such junk mail from his mail. The intention is not really to discourage people who want to advertise, and there are other avenues of advertising.

Dr Toh See Kiat: Sir, I just wanted to make sure that the Minister assures advertisers that if they do use this system, it can be used without being criminalised by the section. But as to users themselves, if they want to stop spaming, they can. There are software mechanisms. They can also tell the ISP. That is not my concern, Sir.

Mr Wong Kan Seng: If spaming leads to obstruction and impedes the person's use of a computer, in other words, keep loading and loading the person with all kinds of junk and as a result his computer crashes, then we may have a problem. But as I said, the idea here is not to discourage people who want to advertise their wares or whatever it is they want to sell.

Dr Toh See Kiat: That is right. In other words, the act of sending the e-mail is not wrong but only when the advertiser is so insistent and persistent that he bombs out the e-mail system. Then I support that, Sir.

Mr Wong Kan Seng: E-mail is data as defined under the Computer Misuse Act. So do not think that by just sending e-mail, therefore, you are not caught by the Act. You are, if you actually use e-mail and bomb other people's computer.

Let me come back to Mr Chuang's concern about computer users or people who may be caught by the Act without knowing that they have actually offended the laws of the CMA and therefore suggesting that we need to have more publicity, more campaigns, seminars or whatever it is to tell people about the new provisions. As I said, all these computer buffs are quite well read people and, of course, we will try to post as much of this as possible on the Internet and other media, so that the people will get to know of it. And through the publicity in the media, through cases brought up in court, I think people are quite well aware of the offences committed using the computer. We do not have to do a big play of it each time we have a case. But I think those who are knowledgeable - I assume those who use the computer are knowledgeable - will be able to understand the implications of their misdeeds. And if that is still not enough, then perhaps more seminars can be conducted and maybe CASE can also help in spreading this knowledge among the consumers.

Question put, and agreed to.

Bill accordingly read a Second time and committed to a Committee of the whole House.

The House immediately resolved itself into a Committee on the Bill. - [Mr Wong Kan Seng].

Bill considered in Committee; reported without amendment; read a Third time and passed.