COMPUTER MISUSE (AMENDMENT) BILL

Column: 3321

COMPUTER MISUSE (AMENDMENT) BILL: Order for Second Reading read.

The Senior Minister of State for Home Affairs (Assoc. Prof. Ho Peng Kee): Mr Speaker, Sir, I beg to move, "That the Bill be now read a Second time."

Introduction

Sir, this Bill proposes to create a new section 15A in the Computer Misuse Act. This new section will enable the Minister to empower any person or organisation to take necessary measures to prevent or counter any threat to a computer system, which can affect the national security, essential services, defence or foreign relations of Singapore. This is part of Government's efforts to establish a robust defence

Column: 3322

against cyber attacks. In doing so, we join other countries such as the US, UK and Australia which have also strengthened their legislative framework against cyber attacks. In addition, MHA is taking the opportunity to amend the Act to allow certain minor offences to be compounded.

Singapore's vulnerabilities

Like many other countries, our essential and critical services such as water, electricity, gas, telecommunications and transportation are increasingly dependent on computer networks and information systems. This dependence is unfortunately something that terrorists and criminals can exploit. Any attack on our critical infrastructure and essential services will severely disrupt the economy and threaten our national security. Instead of a backpack of explosives, a terrorist can create just as much devastation by sending a carefully engineered packet of data into the computer systems which control the delivery of an essential service, say, for example, a power station, thus causing it to malfunction. The extensive blackouts in northern part of United States, London, Sweden, Denmark and more recently in Italy, underscore the consequences that can occur when there is a failure of essential services. It was fortunate that terrorists and criminals were not behind those incidents. Otherwise, the consequences would have been far worse.

With an increasingly computer-literate population and widespread availability of user-friendly hacker tools, more people around the world now have the necessary skills to carry out cyber attacks. Hackers and computer viruses can flood network connections, steal or tamper with information, and disrupt essential services. The susceptibility and vulnerability of infocommunications infrastructure is illustrated by the damage wreaked by the recent SoBig.F and Blaster worm attacks that occurred in August this year. The damage caused by these attacks is estimated at US$800 million.

Column: 3323

Financial networks, government operations, online businesses and even emergency services were disrupted. Another case which highlights the vulnerability of national infocommunications infrastructure is the denial-of-service attack on the White House Website in July 2001. In that case, the Code Red worm was used to cause infected computers to flood the server hosting the White House website on a specific date and time with a massive amount of data, overwhelming it to the point where it could not be accessed.

Closer to home, the Criminal Investigation Department (CID) and the Info-Communications Development Authority (IDA) have noted a marked increase in the number and sophistication of hacking activities and cyber attacks in the last few years. Instances of successful computer hacking cases and unauthorised access with intent to commit an offence rose from 10 cases in 2000 to 19 cases in 2001 and 41 cases last year. In the first half of this year, there were already 24 cases. The number of unsuccessful attempts is probably many times more. Our analysis of website vulnerabilities showed that, in one case, as many as 6,000 hacking attempts were made on the website over a three-month period.

Singapore's current counter cyber-threat capabilities

Sir, the threats are therefore real. What we need to do is to further safeguard our information and communications networks from harm and degradation. As of now, we do have a framework to deal with cyber threats. In the public sector, the Government IT Security Incident Response Team (GITSIR), set up under IDA, coordinates responses to a cyber intrusion. The Technology Crime Investigation Branch (TCIB) of the Singapore Police Force carries out the necessary investigations. As for the private sector, the Singapore

Column: 3324

Computer Emergency Response Team, established under the purview of IDA, will assist affected organisations to respond to cyber attacks.

New section 15A

But, these measures by themselves are not enough as they focus primarily on dealing with a cyber attack after it has occurred. We need to empower our security agencies to take pre-emptive steps to prevent a cyber attack on our systems because once it happens, the consequences are dire. The Computer Misuse Act currently does not allow our security agencies to take such pre-emptive measures in the face of an imminent cyber threat. Clause 3 of the Bill corrects this by creating a new section 15A which allows the Minister to authorise any person or organisation to take necessary measures to prevent or counter any threat that may endanger the national security, essential services, defence, or foreign relations of Singapore. The new section 15A would be invoked to deal with situations of an outright cyber attack or where there is specific intelligence received of an imminent cyber attack against our critical infrastructure such as power stations or water filtration plants. An example of a pre-emptive counter-measure would be the use of real-time intrusion detection system to counter any attack on our critical infrastructure. Other common methods to identify vulnerabilities in our computer networks include pre-emptive scanning activities as opposed to investigative scanning after an attack.

Safeguards

The powers given to the Minister under the new section 15A will not be used indiscriminately. The measures that may be taken are restricted to those aimed at preventing or countering any threat to a computer or computer service,

Column: 3325

or any class of computers or computer services. The powers would be invoked only to avert threats that may endanger national security, essential services such as any service directly related to communications infrastructure; banking and finance; and defence and foreign relations of Singapore. The powers under the new section 15A would not be invoked to prevent or investigate a criminal offence that does not threaten our national security or essential services. This is unlike the provisions under the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act or, as many of us know it, the US PATRIOT Act, for short, and which is also the case under the Council of Europe Cybercrime Convention, both of which allow the wide-ranging new powers to be used in areas other than threats to national security. So ours has a narrower focus. Our security agencies will also be required to satisfy the Minister that the cyber threats are imminent before the powers provided by the new section 15A can be invoked. Relevant industry and security experts would be consulted on the implications before the Minister takes a decision.

Composition of offences

Sir, let me now move to the topic of composition of offences. Currently, none of the offences under the Computer Misuse Act can be compounded. Clause 2 of the Bill creates a new section 12A to empower Police to offer composition for prescribed offences under the Regulations for amounts up to $3,000. Examples of prescribed offences, which MHA is considering, are minor computer offences such as unauthorised access to computer material and unauthorised disclosure of access code.

Column: 3326

In allowing composition of offences under the Computer Misuse Act, we are not softening our stand on computer crimes. By amending the Act to allow composition for certain offences, we extend the range of options available to the prosecution. For example, it may not be desirable to prosecute a young offender who has committed unauthorised access where no harm or damage has been done. On the other hand, letting him off with just a stern warning may be too light a punishment. If composition is offered, the offender can be fined instead of being let off with a warning. This way, the offender will realise the seriousness of the offence he has committed. Composition amounts would be stipulated in the Regulations to reflect the seriousness of the offence.

Conclusion

Mr Speaker, Sir, given the prevailing security climate, this Bill will greatly enhance our security agencies' capabilities to counter cyber threats, in particular, cyber terrorism.

Sir, I beg to move.

Question proposed.

Assoc. Prof. Chin Tet Yung (Sembawang): Mr Speaker, Sir, I rise to support the Bill as a necessary measure against threats made to the electronic infrastructure in Singapore. It has been said that the pen is mightier than the sword and indeed it was the case, and probably still is. In the information age, however, the keyboard is now mightier than the pen. A knowledgeable terrorist can literally hack his or her way into critical networks and cause billions of dollars of damage, as well as cause death and serious injury if, for instance, air or land traffic systems or hospital databases are tampered with. The security services may have to deal with electronic terrorists that are not in Singapore at all. It is an awfully difficult task to perform and the security services must be provided with the means to prevent such attacks. We

Column: 3327

would want to support our security services in ensuring that Singapore is safe from such attacks.

However, it is a tough call to draw the line between respecting the privacy of ordinary people and preventing a terrorist attack on critical networks. Where national security and public safety are concerned, hardly anyone, I think, would object to the enactment of strong, even draconian, laws that would allow security services to stop such perpetrators. But because such laws are wide-ranging, open ended and, if used indiscriminately, may be an instrument of oppression, it is necessary that this House must scrutinise such extension of State powers very closely and that would mean asking the Minister to assure the House how such powers would be used.

I, therefore, seek clarification on the following matters.

Clause 3, which contains the proposed new section 15A provides the Minister to certify "any person or organisation" to take such measures as necessary to prevent or to obviate the threat, and these persons can exercise the powers under section 15, already in the original section 15, but not restricted to them. The powers conferred in the original section 15 are extremely wide. What, may I ask, are the additional powers that are contemplated which are not within section 15 and why they cannot be specified? For example, it has been said just now by the Senior Minister of State, in explaining the Bill, that the Minister must be satisfied that the cyber-threat must be clear and imminent before the certification will take place. Why cannot such guidelines be contained and included in the Bill? It would prevent the misuse of the Computer Misuse Act.

Secondly, what are the objections to providing the defendant, if any, with the first information report, when we are dealing, as the Bill provides, with civil as well as criminal proceedings? Usually the

Column: 3328

provision of the first information report allows an accused person to access how to answer charges against him, or in the case of a civil proceeding, to allow a plaintiff to plead his claims properly.

Thirdly, it is provided in the proposed section15A(3)(b) that "no witness shall be obliged" to disclose the name, address, or other details of an informer. In other words, the informer's identity will be secret. However, may I ask the Senior Minister of State to confirm that it is permissible under this formulation that a witness can still voluntarily disclose the name of the informer, ie, he has the privilege to divulge the identity of the informer. So is this intended?

Fourthly, in civil proceedings, there is always pre-trial discovery. But in the proposed section 15A(4) the situation contemplated is that the book or database or records admitted in evidence "or liable to inspection" can be subject to judicial order to obliterate or conceal the informer's name, but this may be a little bit too late because the document or otherwise may already be disclosed under normal civil procedures, eg, in a demand for further and better particulars. Again, is this intended?

Mr Speaker, Sir, in general, where there is an open trial, and where the liberty or property of a subject is at stake, there should be as little prohibition on the disclosure of information as possible, otherwise it may hamper defences or cause real injustice. Are there special justifications for this provision as to why informers' identities should be kept so confidential? It may, as the Senior Minister of State has already pointed out, raise the spectre of State surveillance on a grand scale in order to combat the electronic terrorists. And where one can be accused by unknown persons, what are the safeguards that can be taken to

Column: 3329

ensure that an accused person can conduct a proper defence in open court when there is no chance of knowing one's accuser, let alone confront him?

Sir, I strongly support this Bill, but hope that the Minister can address these issues and assure the House that the powers conferred by this Bill would be used with great care and circumspection.

Mr Ravindran: Sir, I support the passing of the Bill. The Bill aims to take proactive steps to ensure that the security agencies here take preventive and, if necessary, pre-emptive measures, to counter any threat to a computer system which can affect national security, essential services, defence or foreign relations of Singapore. That the threat is real can be seen in various reports emanating overseas, which indicate that there are constant probings by foreign intelligence agencies. On top of that, we have hackers and crackers who tried to infiltrate key infrastructure computer systems on a regular basis.

My concern is how do we ensure that there are adequate safeguards to protect the privacy of law-abiding citizens. The proposed provision gives the decision-making power to the Minister without any external vigilance. In the US, it is the Attorney-General who authorises such power to the investigating agencies. In some cases, a written authorisation has to be obtained from a US Judge. I would like to ask the Minister as to whether he could consider setting up a supervisory committee, comprising at least a High Court Judge, to approve, if not, to review the use of such powers. In addition, I would like to ask the Minister as to how they would handle sensitive, private or corporate information which is innocent at the point of time the investigation is launched, but which is brought to their attention. What happens to such

Column: 3330

information subsequently after the investigations are completed? Is such information discarded or will it be kept away for future use?

Perhaps the Minister could share with us how other countries approach these issues or challenges that are faced by their security agencies and also what safeguards are in place to prevent abuse. Sir, whilst I support the Bill, I hope the Minister can assure me that there is in place some checks and balances to ensure that such powers are not abused by our security agencies.

Mr Steve Chia Kiah Hong: Thank you, Mr Speaker, Sir, for allowing me to participate in this debate. I support the amendments in this Bill, Sir.

Computers have now become one of our very essential tools for our daily work, business and leisure. Together with the Internet, it has changed the way we communicate and do business. Everybody, from students, CEOs and businesses, relies on computer technology as a core means of communication, work and social life. It is therefore imperative that this important tool of our modern lifestyle be well protected against hackers, threats, viruses and spammers. As I understand it, this current amendment does not address a minor but growing computer misuse problem, namely, email spamming, that is rising at an increasing and alarming rate, hampering business efficiency and work productivity.

Spamming emails are junk emails sent into our mailboxes, like what we receive in our normal letterboxes. It takes up bandwidth, space, time and computer resources. It also clogs up the personal mailboxes of the intended recipients with unwarranted advertisements and sales pitch that the intended recipient most often does not want to read. While most junk mails come from outside Singapore, I

Column: 3331

see an increasing number of unsolicited junk emails coming from within Singapore businesses. The law in this area must be tightened, in Singapore and also internationally, so as to make it compulsory for email marketing companies to set up an easy opt-out option for those who do not want to receive such unwanted marketing in future. More importantly, the opt-out emails must not be allowed to be collated and resold to other marketers as an active mailbox, as it will surely defeat the purpose of opting out in the first place. This area of law must be clearly established if we want Singapore to continue to thrive as an efficient business and communication centre. As I speak in support of this current amendment, I hope the Ministry will look into establishing new laws on this matter of spam and junk emails as part of the Computer Misuse Act.

Mdm Ho Geok Choo: I support the amendments in this Bill but I would like to raise four points with regard to the Bill.

First, I refer to the new section15A of the proposed Bill. Indeed it sounds very much like the cyber-space equivalent of the Internal Security Act. As in the ISA, the Minister is empowered to act pre-emptively against imminent attacks on our telecommunications infrastructure and those parts of our networks that may compromise our national security.

While the intent behind this Bill is to be lauded, there are a number of questions that immediately come to mind. Like my hon. colleagues before me, I seek clarifications on how far "far back" would the Minister's power extend and what constitutes an imminent attack. In other words, how does the police cyber crime unit intend to differentiate between a real intent to compromise our national computer networks from those that are merely "wild" talk?

Column: 3332

I am inclined to think that perhaps there is other recourse besides the proposed Bill. For example, we could pass a piece of legislation which obligates our enforcement officers to seek warrants of arrest against potential mischief makers or those who harbour a malicious intent to disable or compromise our national computer databases or our telecommunications networks.

Could the Minister also clarify what "proactive preventive" measures mean in the context of the amendment? Does it extend to the powers of arrest? Or is it merely confined to measures like denying potential criminals access to the networks?

Sir, my second point refers to section 12A(1). The proposed power of composition for prescribed minor computer offenders provides for an amount of up to $3,000. Given that the scale and destructive powers of these attacks are often-times vast and extensive, one wonders if $3,000 is too low a level of deterrence. Besides the power of composition, would the Minister consider other measures that may be adopted to rehabilitate and caution minor offenders against such anti-social acts?

Sir, on my third point, I would like to submit that the proposed Bill include a proviso that specifically defines both the acts of those adults who support, train, as well as fund minor offenders, and the stipulated punitive measures that would be meted out against these adults should such an incident occur.

On the fourth point, Sir, I would like to know how does the Minister propose to deal with an act against violations of non-security criminal offences. Would the Bill incorporate a proviso to empower the relevant authorities to act against violations of non-security criminal offences?

Column: 3333

Many of us would recall that about a year or so ago, a hacker tried to disable the website of MediaCorp. That act alone cost MediaCorp a few million dollars worth of advertising revenue.

Perhaps the Bill should empower the relevant authorities to act against such offences. I urge the Minister to re-look at such non-security criminal offences and beef up the legislation against such offences as well.

On this note, I support the amendment in this Bill.

Assoc. Prof. Ho Peng Kee: Mr Speaker, Sir, I thank the various speakers for speaking up in support of the Bill, many of whom strongly supported the Bill.

Sir, the points raised fall roughly into this matrix. First, the broad strokes. Mdm Ho Geok Choo asked what situations the powers under the Bill may be invoked. Mdm Ho and Prof. Chin asked what measures are contemplated under the new provision and, indeed, Prof. Chin asked whether these can be specified. In particular, Prof. Chin also mentioned the existing section 15, saying that the powers there are quite wide already. So why do we need this new section 15A? Then Mr Ravindran asked about safeguards under this new section. These are the broad strokes. Specifically, Prof. Chin, Mdm Ho and Mr Steve Chia made specific points - Prof. Chin about section 15(3), in particular, the evidentiary process. Mdm Ho asked about the new section 12, in particular, description of composition fines, and Mr Steve Chia asked whether we would introduce laws on spamming.

First, let me address Prof. Chin's point on the new section 15. Sir, the powers under the new section 15A are indeed much wider than the existing powers

Column: 3334

under section 15. Really the focus of the two sections are different. The powers under section 15A are narrower because they are basically investigative powers. They can only be exercised by a police officer or a person authorised by the Commissioner of Police and only for the purpose of criminal investigations, subsequent to the commission of an offence.

This is more the traditional approach to crime solving. Moreover, the powers are limited as they can only be applied to a computer that is reasonably suspected or has been used in connection with an offence under the Act or any other criminal offence. Hence, contrary to what Mdm Ho thinks and I am sure Prof. Chin will agree by now, the existing powers that we have, both under the Computer Misuse Act and also other legislation, are definitely inadequate to deal with cyber threats against our national interests. That is why we need this new section.

As I have mentioned earlier in my speech, we need also to be able to take pre-

Column: 3335

emptive steps to prevent a cyber attack on our system to safeguard Singapore's national interests. And we do this when we have information of an imminent cyber attack. Mdm Ho asked what constitutes an imminent attack. Essentially, it is an attack which is coming and likely to take place if steps are not taken to avert it. In this very globalised interconnected world, our security agencies are in touch with Interpol and their counterparts in other countries. This is something which all countries face. And as I have mentioned earlier, many other countries have, in fact, enacted laws which are similar to and, indeed, some wider than ours.

Sir, Prof. Chin is indeed correct. The powers are wide. In fact, he asked why the persons who may be asked to take measures should not be prescribed or mentioned. We need a wide approach because it is necessary to take pre-emptive steps. And when these steps are taken, they may be directed not only at law enforcement agencies such as the Police or the Internal Security Department but also regulatory ones such as the MAS, the IDA or indeed also directed at systems and infrastructure owners, such as our banks, the stock exchange, the power supply or our transport operators. I think it is better to give the latitude to the Minister, by certificate under his hand, to set out what the measures are. But the bottom line will be that before the Minister authorises this, there must be grounds to believe that such systems, if attacked successfully, would result in a disruption of Singapore's critical infrastructure and essential services. So that is the focus, and I am sure we will keep this focus in mind. This Bill and the powers enumerated in this Bill will be welcomed not just by this House but all our constituents and residents living in Singapore.

Sir, let me take this opportunity to also assure the House that the powers under this new section 15A will not be invoked lightly or indiscriminately. The section itself circumscribes its use to situations where national security, essential services, defence or foreign relations are threatened. And under section 15(5), essential services are further defined. So the focus is very clear. Hence, these are possible threats at the highest level affecting our national interest, not fanciful or imagined threats and certainly not just threats against the Government. I think Prof. Chin captures this very well in his speech when he says that the keyboard has become mightier than the pen. How true that is. So it is better to be forewarned and prepared, as we are now doing to gear up.

The situation that Mdm Ho mentions are lower level criminal offences which, in fact, can already be dealt with under our existing laws, including existing provisions in the Computer Misuse Act. In fact, in

Column: 3336

1998, we beefed up the provisions to tackle some of the offences Mdm Ho mentioned. Indeed, any criminal offence that is disclosed in the course of taking measures under the new section15A will be prosecuted separately.

Prof. Chin asked whether the powers are too wide, and can the measures not be specified. Let me say this. Given the nature of the threats we are facing, I think it is a better approach for the section to be crafted to be as broad as possible without prescribing specific measures or setting out guidelines, as suggested by Prof. Chin. Indeed, what we say in this House will already be guidelines in interpreting the provisions of the Act.

We must not forget that the cyber world is a fast moving one where threat scenarios can change rapidly. I think that is a very basic point. And terrorists are also thinking of new ways to launch attacks. Hence, our security agencies should be given the latitude to take the most appropriate and effective means to mitigate and counter any cyber attack. Having said this, there are safeguards, and that is the point of Mr Ravindran's speech. I am sure all of us in the House want to know what are these safeguards.

Mdm Ho asked whether wild talk could lead to the invoking of section 15A. Essentially, she wants to know when the section will be invoked. Here is where the professionalism and objectivity of our security agencies come into play, and on this, they stand on their record. They must first submit a report to the Minister to convince him that there is an imminent threat to a particular computer system or network that would endanger the national security, essential services, defence or foreign relations of Singapore. The report would have to spell out in detail how and why they came to such a conclusion, and specify the measures they would require. The Minister will then have to, by a certificate under his hand,

Column: 3337

authorise these measures which must be practical and reasonable, and he will do this only after careful scrutiny and evaluation. As part of this process, relevant industry and security experts would be consulted on the implications of taking these measures before the Minister makes his decision. So it is a very considered process. Therefore, I think it is not necessary for a supervisory committee that Mr Ravindran suggests. Perhaps he took a leaf from the ISA. I think Mdm Ho does say that there is some parallel there. But unlike the ISA where the liberty of a person is at stake, here it is not quite so. And given the nature of the threat, I think it is better to move fast and decisively, because the threats can also be changing all the time. Indeed, if the threat is imminent, I think the Minister must have the latitude to act decisively and in the best interest of Singapore; of course, supported by the professionalism and objectivity of his security officers. Hence, ultimately, the safeguard must be the judgment of the Minister and the professionalism and integrity of the entire system and especially of the players, the actors, the people working the system.

Prof. Chin and Mdm Ho asked what measures are contemplated. Sir, the measures could be technical, operational and procedural in nature. They could include, for example, perimeter defence devices such as firewalls, vulnerability scanning tools, real time intrusion detection systems as well as systems designed to combat computer viruses, worms and trojan horse programmes. All these form part of the multi-layered defence we have against cyber attacks. These measures will be non-intrusive in nature. For example, any scanning programme deployed would not intrude a subscriber's PC. It would only scan the Internet passively to determine vulnerabilities in the affected network.

Column: 3338

Let me assure Mr Ravindran that it has never been our intention to intrude into the privacy of law-abiding citizens. So law-abiding citizens should have no fear. If at all our security agencies come across any private information in the course of taking measures under this new section, such information is protected under the Official Secrets Act. The security agencies do not reveal such private information. And this is indeed no different from the current situation where our law enforcement officers abide by their code of professionalism, and do not reveal or make use of any private information obtained in the course of their duties.

Let me now address the points Prof. Chin mentioned on section 15(3). He referred to that subsection and asked what are the objections to providing the defendant with a first information report when we are dealing with civil as well as criminal proceedings. Sir, this subsection will be invoked when civil or criminal proceedings ensue in relation to an offence disclosed by any measure taken under section 15A. This is intended to protect the identity of the informer and, more importantly, the circumstances in which the measures were invoked. Information on the threat and the specific measures taken cannot be disclosed for obvious reasons, as it will hinder or even jeopardise the very operations taken to neutralise the threat. We may even unwittingly alert the perpetrator or attacker and he could change his plan, divert his tactics or even frustrate the efforts of our agencies. He could also take steps to cover his tracks. We will then have to start afresh, something we can ill afford to do in such dire circumstances of an imminent threat to our national interests.

Having said this, let me assure Prof. Chin that section 15A(3) does not absolve the Police from conducting proper investigations and gathering sufficient

Column: 3339

evidence to prove all the elements of the offence. I am sure he is aware of that. For example, the first information report might alert Police to the fact that a certain offender has been hacking into the Internet banking account of bank customers. The Police will, separately, still need to gather the necessary evidence, such as particulars of the hacking, particulars of the victims and any loss or damage suffered. What will be protected from disclosure is the fact that the security agency alerted the Police to the Internet banking hacking offence in the course of taking preventive measures authorised by the Minister. In any case, section 15A(3) is not new. I am sure Prof. Chin knows that there are parallel provisions in the Misuse of Drugs Act and the Prevention of Corruption Act.

Prof. Chin also asked whether section 15A(3)(b) will allow a witness to voluntarily disclose the identity of the informer. Sir, the intention behind this provision is that a witness cannot be compelled to answer any question which may lead to the disclosure of sensitive information or the identity of the informer. The witness in such circumstances is likely to be the investigation officer who received the first information report from the security agency. The investigation officer will be instructed not to disclose the information unless he is authorised to do so by the relevant authority after consulting the security agency. So no other witness is likely, in practice, to be in possession of the sensitive information in question, unless it is received in contravention of the Official Secrets Act.

Prof. Chin also asked whether in civil proceedings the identity of the informer could, in fact, be revealed in pre-trial discovery, thus circumventing section 15A(4). Sir, let me, first, explain that civil proceedings are included, because there is a possibility of the victim in a criminal prosecution commencing a civil suit

Column: 3340

against the offender for loss and damage suffered as a result of the offence. In such a case, parties may subpoena documents as evidence in a civil suit which may inadvertently disclose the identity of the informer. As I have just mentioned, it is highly unlikely that private parties in civil proceedings will be in possession of sensitive information leading to the discovery of informers. Hence, Prof. Chin's suggestion that pre-trial discovery can be used to ask questions relating to the identity of the informer, whilst technically possible, is, in practice, highly unlikely. But let me assure him that we will consider how this works in practice and fine-tune it, if necessary.

Mdm Ho asked whether the composition fine limit of $3,000 is too low. To put things in context, I think those of you in this House, at this year's Committee of Supply debate, will know that the Ministry of Law is working with other Ministries to see how we can decriminalise minor offences, in particular, regulatory ones. So this is part of this process. Where we can, we will enable the authorities administering Acts to impose composition fines.

Sir, I think all of us will agree with this approach, because there will be more flexibility given to the agencies and, definitely, on a case-by-case basis, eg, if a young offender is involved and it is only a minor offence under the Act, to impose a composition fine. But, as Mdm Ho has mentioned, if an adult is behind that minor's defalcation, then he cannot hide behind that veil. He possibly can be charged for abetting. So, there is no automatic application of this process. This composition fine will also not be used for the new situation that is covered under section 15A. It is for existing offences in the Computer Misuse Act and the less serious ones.

Column: 3341

Mdm Ho also suggested beefing up the Act to cover other non-security offences. I have mentioned very briefly just now

that we have done this. In 1998, we amended and beefed up the Act, putting in new sections and also giving the Police more investigative powers. But we will still look at the Act all the time and, if need be, we will further beef it up.

Finally, Mr Steve Chia has mentioned spamming, and asked whether we can introduce laws to make spamming an offence. MITA and IDA are currently reviewing the position with AGC. They are studying how other countries deal with the problem of spamming. We note that in many of these countries, for example, United States, Australia, United Kingdom, a multi-pronged approach is adopted that encompasses, besides legislation, consumer awareness and education, consumer opting-in or opting-out to receive unsolicited mail, anti-spam technical solutions and industry's self-regulation as well. For those countries which have introduced laws against spamming, we are monitoring the efficacy of these laws. Indeed, there are reports that countries with laws against spamming have found that these laws are not entirely effective in eliminating spamming. Thus, in the US, for example, despite the laws, successful suits against spammers are rare and the instances of spamming have not decreased. Therefore, we will study and then choose the way forward that is best suited for Singapore.

Question put, and agreed to.

Bill accordingly read a Second time and committed to a Committee of the whole House.

The House immediately resolved itself into a Committee on the Bill. - [Assoc. Prof. Ho Peng Kee].

Column: 3342

Bill considered in Committee; reported without amendment; read a Third time and passed.

Mr Speaker: Order. I propose to take the break now. I suspend the Sitting and will take the Chair again at 4.25 pm.

Sitting accordingly suspended

at 4.02 pm until 4.25 pm.

Sitting resumed at 4.25 pm

[Mr Speaker in the Chair]