Singapore: Computer Misuse and Cybersecurity Act (Part II)

This is part II of my post on the proposed changes to the Computer Misuse Act (which will be known as the Computer Misuse and Cybersecurity Act after the changes). 

Active Defence

The move by the Singapore Government to make changes to the Computer Misuse Act parallels the moves of other governments. The Washington Post reported that US President Obama signed Presidential Policy Directive 20 which set out "a broad and strict set of standards to guide the operations of federal agencies in confronting threats in cyberspace". There are other pieces of cyber-security legislation winding their way through both the US House of Representatives and the US Senate which would permit the deployment of countermeasures. I also previously highlighted a UK parliamentary commission suggesting that proactive first-strike measures be taken in the event of a cyber attack. 

The issue of active defence is controversial mainly because of an expansion in its scope and the challenges in implementing such measures. For example, the US Secretary of Defence Leon Panetta suggested the possibility of pre-emptive strikes, and a former FBI official suggested that companies should be allowed to take more aggressive action to defend themselves.

The Bill provides the legal cover for persons and companies in Singapore (at the direction of the Singapore Government) to potentially walk down that path (that is, if the Singapore Government ever decides that it is necessary to do so).

As the Bill does not limit the type of measures which the Singapore Government can direct a person to take, it could conceivably range from reactive defensive measures to proactive defensive measures to offensive measures. While no one can doubt the right to adopt reactive defensive measures within the perimeters of one's own network, the complications start to arise when measures are of a pre-emptive or intrusive nature.

To put this into context: if a hacker manages to steal proprietary information from your computer system, a reactive defensive measure would be to identify and close off the vulnerability or exploit that was used by the hacker to access your system. An example of a proactive and intrusive defensive measure could be the gaining of entry into the hacker's system to delete only the proprietary information which was stolen. An example of an offensive measure would be to deploy software within the hacker's systems to disrupt the systems of the hacker (think Stuxnet) or to conduct surveillance on the hacker's activities. 

I am reminded by what Chief Justice Menon mentioned in his response to my question on amending the Computer Misuse Act. He said that while it was easy to say that we could have a carefully constructed exception to the general prohibitions against unauthorised access or use of a computer in the Computer Misuse Act, the practicalities of such an exception would be more complex. The upshot was that it would not be that easy to apply active defence measures in practice. I agree with him. 

So, what could be the challenges of requiring the deployment of active defence measures (which are pre-emptive, intrusive or offensive in nature) in the context of the Bill?

What would constitute a threat to the national security, essential services or defence of Singapore or foreign relations of Singapore? 

The term "foreign relations" is not defined and could also mean a host of things like espionage to Wikileaks.

The term "essential services" is defined as services "directly related to communications infrastructure, banking and finance, public utilities, public transportation, land transport infrastructure, aviation, shipping, or public key infrastructure, or emergency services such as police, civil defence or health services".

That definition covers a large swarth of companies (both domestic and foreign). I am not sure how many companies in these sectors are aware of this Bill (coverage in the mainstream media of the Bill was not prominent) but they should take note of it given the broad powers granted to the Singapore Government and the measures or requirements which they may be asked to implement or comply with, and the mere fact that all that is needed is a certificate from the Minister of Home Affairs that the Minister is satisfied that there is a threat to the national security, essential services or defence of Singapore or foreign relations of Singapore.

Are there limitations on the scope of measures which the specified person can take? 

The Bill refers to “any measure or … requirement”. There is no restriction in the Bill on the type of measure which may be deployed. As mentioned earlier, these could take the form of both offensive (whether pre-emptive or retaliatory) and defensive (both reactive and proactive) measures.

The procedures and standards which will be applied by the Singapore Government in any particular cyber attack or exploitation will undoubtedly be highly classified (and rightfully so). These procedures and standards would probably need to address a range of issues: 

• What are the standards that will be adopted to pass the test of being satisfied that the measures are necessary for preventing, detecting or countering a threat to national security, essential services, defence or foreign relations of Singapore?

While every person has the right to exercise self-defence, what about a pre-emptive strike in anticipation of an attack? How imminent must a threat be? How many threats or attacks must there be (a single threat or repeated attacks)?

• A question of attribution. Who is the attacker? It is not always possible to identify who the attacker is.

For example, there is still speculation as to which country or organisations were behind the Stuxnet virus (although many people point towards the U.S and Israel). Even if investigators are able to discover evidence within a virus, the investigators have to be circumspect as well given the possibility of false flags being embedded in the software code to throw investigators off the scent.

What if attackers have commandeered layered systems of innocent third parties (bot-nets) for the purposes of launching distributed-denial-of-service attacks?

What is the threshold of proof of the identity of the attacker which is required before a retaliation is warranted? Also, will the active defence measure be limited to the attacker's systems?

As a cyber attack can be launched from hijacked systems, retaliatory  attacks may not be effective in situations where it is difficult to attribute responsibility and to limit the collateral damage.

• Assuming the attacker can be identified, what type of measures will be directed at the attacker? What would constitute a proportional response to the attack or the prospective attack? 

• If the aggressor is a state or a state-backed actor (assuming that can be proved), could a pre-emptive action be viewed as an act of war? What is the potential for a cyber war triggering a hot war (i.e with missiles and guns)? For a brief discussion on the application of the Law of War to cyber threats, one can read this article. 

• As the specified person has civil and criminal immunity if he does anything in good faith for the purpose of complying with any measure directed by the Minister, I think that the direction must contain very detailed and limited parameters so that specified persons (i) have the necessary comfort that they are able to execute with clear instructions and (ii) do not go act beyond the measures identified, and potentially result in escalation of hostilities or unnecessary collateral damage. 

These parameters could include identifying the measure, the target, the resources to be used to execute the measure, timing, supporting agencies, co-ordinating instructions with other agencies, command and communication including reporting structure, and the desired outcome. It would certainly would not suffice if the direction was merely an instruction to "counter attempts by XYZ to gain unauthorised access to your system". 

The proposed changes to the Computer Misuse Act and the broad powers granted onto the Executive are a reflection of where we are in this quickly evolving and dangerous world of multiple threats and actors, and where the cost of developing and delivering these threats is low compared to other physical/kinetic weapons. 

Some may argue that in addressing threats (physical or otherwise), it would be unfair for the target of the attack to be constrained in the fight with one hand tied behind his back. The option of throwing a punch from a defensive crouch instead of merely taking body blows should be made available as new methods of delivering a focused punch can be developed in the future (and it would take too long for the legislative process to legalise that attempt).

However, the difficulties in taking the offensive suggests that the appropriate focus should be to establish and maintain a good defensive crouch first. As such, active defence measures should be considered as options to be considered further down the line of defence. Arguably, the hardening of systems and security by design are equally, if not, more important than active defence. If active defence measures are directed, it should be done with circumspection, clear direction and objectives, oversight and supervision as would be the case with all intrusions into unfamiliar ground. It is hoped that the Singapore Government has developed the procedures and standards for moving into that unfamiliar territory.