Powers to investigate and prevent cybersecurity incidents, etc.
Open ↗19.—(1) Where information regarding a cybersecurity threat or incident has been received by the Commissioner, the Commissioner may exercise, or may authorise the Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer or an authorised officer to exercise, such of the powers mentioned in subsection (2) as are necessary to investigate the cybersecurity threat or incident, for the purpose of —(a)
assessing the impact or potential impact of the cybersecurity threat or incident;
(b)
preventing any or further harm arising from the cybersecurity incident; or
(c)
preventing a further cybersecurity incident from arising from that cybersecurity threat or incident.
(2) The powers mentioned in subsection (1) are the following:(a)
require, by written notice, any person to attend at such reasonable time and at such place as may be specified by the incident response officer, to answer any question or to provide a signed written statement concerning the cybersecurity threat or incident;
(b)
require, by written notice, any person to produce to the incident response officer any physical or electronic record, or document, or a copy of the record or document, that is in the possession of that person, or to provide the incident response officer with any information, which the incident response officer considers to be related to any matter relevant to the investigation;
(c)
without giving any fee or reward, inspect, copy or take extracts from such record or document or copy of the record or document mentioned in paragraph (b);
(d)
examine orally any person who appears to be acquainted with the facts and circumstances relating to the cybersecurity threat or incident, and reduce to writing any statement made by the person so examined.
(3) The incident response officer must specify in the notice mentioned in subsection (2)(b) —(a)
the time and place at which any record, document or copy is to be produced or any information is to be provided; and
(b)
the manner and form in which it is to be produced or provided.
(4) A statement made by a person examined under this section must —(a)
be reduced to writing;
(b)
be read over to the person;
(c)
if the person does not understand English, be interpreted for the person in a language that he or she understands; and
(d)
after correction (if necessary), be signed by that person.
(5) If any person fails to comply with a written notice under subsection (2)(a), the incident response officer may report such failure to a Magistrate who may then issue an order for the person to attend before the Commissioner, at a time and place specified in the order, to answer any question or provide a signed written statement concerning the cybersecurity threat or incident.
(6) Any person examined under this section or to whom a notice under subsection (2) or an order under subsection (5) is issued is not obliged to disclose any information that is subject to any right, privilege or immunity conferred, or obligation or limitation imposed, by or under any law or rules of professional conduct in relation to the disclosure of such information, except that the performance of a contractual obligation is not an excuse for not disclosing the information.
(7) The person examined under this section or to whom a notice under subsection (2) or an order under subsection (5) is issued, is not treated as being in breach of any contractual obligation mentioned in subsection (6) for doing or omitting to do any act, if the act is done or omitted to be done with reasonable care and in good faith and for the purpose of answering any question asked during the examination or complying with the notice or order.
(8) Any person who —(a)
wilfully misstates or without reasonable excuse refuses to give any information, provide any statement or produce any record, document or copy required of the person by an incident response officer under subsection (2); or
(b)
without reasonable excuse, fails to comply with an order issued by a Magistrate under subsection (5),
shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 6 months or to both.
(9) In this section and sections 20, 21 and 22, “incident response officer” means the Commissioner, the Deputy Commissioner or any Assistant Commissioner, cybersecurity officer or authorised officer exercising the powers under this section or section 20, as the case may be.
Powers to investigate and prevent serious cybersecurity incidents, etc.
Open ↗20.—(1) Where the Commissioner receives information regarding a cybersecurity threat or incident which satisfies the severity threshold in subsection (3), the Commissioner may exercise, or may authorise the Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer or an authorised officer to exercise, such of the powers mentioned in subsection (2) as are necessary to investigate the cybersecurity threat or incident, for the purpose of —(a)
assessing the impact or potential impact of the cybersecurity threat or incident;
(b)
eliminating the cybersecurity threat or otherwise preventing any or further harm arising from the cybersecurity incident; or
(c)
preventing a further cybersecurity incident.
(2) The powers mentioned in subsection (1) are the following:(a)
any power mentioned in section 19(2)(a), (b), (c) or (d);
(b)
direct, by written notice, any person to carry out such remedial measures, or to cease carrying on such activities, as may be specified to the person, in relation to a computer or computer system that the incident response officer has reasonable cause to suspect is or was affected by the cybersecurity incident, in order to minimise cybersecurity vulnerabilities in the computer or computer system;Examples
Examples of remedial measures include —
(a)
the removal of malicious software from the computer;
(b)
the installation of software updates to address cybersecurity vulnerabilities;
(c)
temporarily disconnecting infected computers from a computer network until paragraph (a) or (b) is carried out; and
(d)
the redirection of malicious data traffic towards a designated computer or computer system.
(c)
require the owner of a computer or computer system to take any action to assist with the investigation, including but not limited to —(i)
preserving the state of the computer or computer system by not using it;
(ii)
monitoring the computer or computer system for a specified period of time;
(iii)
performing a scan of the computer or computer system to detect cybersecurity vulnerabilities and to assess the manner and extent that the computer or computer system is affected by the cybersecurity incident; and
(iv)
allowing the incident response officer to connect any equipment to the computer or computer system, or install on the computer or computer system any computer program, as is necessary for the purpose of the investigation;
(d)
after giving reasonable notice to the owner or occupier of any premises, enter those premises if the incident response officer reasonably suspects that there is within the premises a computer or computer system that is or was affected by the cybersecurity incident;
(e)
access, inspect and check the operation of a computer or computer system that the incident response officer has reasonable cause to suspect is or was affected by the cybersecurity incident, or use or cause to be used any such computer or computer system to search any data contained in or available to such computer or computer system;
(f)
perform a scan of a computer or computer system to detect cybersecurity vulnerabilities in the computer or computer system;
(g)
take a copy of, or extracts from, any electronic record or computer program contained in a computer that the incident response officer has reasonable cause to suspect is or was affected by the cybersecurity incident;
(h)
subject to subsection (5), with the owner’s consent, take possession of any computer or other equipment for the purpose of carrying out further examination or analysis.
(3) A cybersecurity threat or incident satisfies the severity threshold mentioned in subsection (1) if —(a)
it creates a risk of significant harm being caused to a provider-owned critical information infrastructure;[Act 19 of 2024 wef 31/10/2025]
(b)
it creates a risk of disruption to the provision of an essential service;
(c)
it creates a threat to the national security, defence, foreign relations, economy, public health, public safety or public order of Singapore; or
(d)
the cybersecurity threat or incident is of a severe nature, in terms of the severity of the harm that may be caused to persons in Singapore or the number of computers or value of the information put at risk, whether or not the computers or computer systems put at risk are themselves provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
(4) An incident response officer exercising the power mentioned in subsection (2)(e) may require any assistance the incident response officer needs to gain such access from —(a)
any person whom the incident response officer reasonably suspects uses or has used the computer or computer system; or
(b)
any person having charge of, or who is otherwise concerned with the operation of, such computer or computer system.
(5) Where the owner of the computer or other equipment does not consent to the exercise of the power mentioned in subsection (2)(h), the power may be exercised if the Commissioner is satisfied that —(a)
the exercise of the power is necessary for the purposes of the investigation;
(b)
there is no less disruptive method of achieving the purpose of the investigation; and
(c)
after consultation with the owner, and having regard to the importance of the computer or other equipment to the business or operational needs of the owner, the benefit from the exercise of the power outweighs the detriment caused to the owner,
and the Commissioner has issued to the incident response officer a written authorisation to exercise the power.
(6) The incident response officer must, immediately after the completion of the further examination or analysis on the computer or other equipment which was taken into possession in exercise of the power mentioned in subsection (2)(h), return the computer or other equipment to the owner.
(7) Any person who —(a)
in relation to an investigation under this section, wilfully misstates or without reasonable excuse refuses to give any information, provide any statement or produce any record, document or copy required of the person by the incident response officer under section 19(2);
(b)
in relation to an investigation under this section, without reasonable excuse, fails to comply with an order issued by a Magistrate under section 19(5);
(c)
without reasonable excuse, fails to comply with a direction or requirement of an incident response officer under subsection (2)(b) or (c); or
(d)
without reasonable excuse, fails to comply with a lawful demand of an incident response officer made in the discharge of the incident response officer’s duties under this section,
shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $25,000 or to imprisonment for a term not exceeding 2 years or to both.
Production of identification card by incident response officer
Open ↗21. Every incident response officer, when exercising any of the powers under this Part, must declare the incident response officer’s office and must, on demand, produce to any person affected by the exercise of that power such identification card as the Commissioner may direct to be carried by the incident response officer when exercising such power.
Appointment of cybersecurity technical experts
Open ↗22.—(1) The Commissioner may in writing appoint any of the following as a cybersecurity technical expert for a specified period to assist any incident response officer in the course of an investigation under section 19 or 20:(a)
a public officer or an employee of a statutory body;
(b)
an individual (who is not a public officer or an employee of a statutory body) with suitable qualifications or experience to properly perform the role of a cybersecurity technical expert;
(c)
a full-time national serviceman enlisted in any force constituted under the Singapore Armed Forces Act 1972 or in the Special Constabulary constituted under section 66 of the Police Force Act 2004.
(2) The role of a cybersecurity technical expert is to provide such advice of a technical nature, as the incident response officer may require in the course of an investigation under section 19 or 20.
(3) The Commissioner may, for any reason that appears to the Commissioner to be sufficient, at any time revoke an individual’s appointment as a cybersecurity technical expert.
(4) The Commissioner must issue to each cybersecurity technical expert an identification card, which must be carried at all times by the cybersecurity technical expert when performing the role of a cybersecurity technical expert.
(5) A cybersecurity technical expert whose appointment as such ceases must return any identification card issued to the cybersecurity technical expert under subsection (4) to the Commissioner.
Emergency cybersecurity measures and requirements
Open ↗23.—(1) The Minister may, if satisfied that it is necessary for the purposes of preventing, detecting or countering any serious and imminent threat to —(a)
the provision of any essential service; or
(b)
the national security, defence, foreign relations, economy, public health, public safety or public order of Singapore,
by a certificate under the Minister’s hand, authorise or direct any person or organisation specified in the certificate (called in this section the specified person) to take such measures or comply with such requirements as may be necessary to prevent, detect or counter any threat to a computer or computer system or any class of computers or computer systems.
(2) The measures and requirements mentioned in subsection (1) may include, without limitation —(a)
the exercise by the specified person of the powers in sections 39(1)(a) and (b) and (2)(a) and (b) and 40(2)(a), (b) and (c) of the Criminal Procedure Code 2010;
(b)
requiring or authorising the specified person to direct another person to provide any information that is necessary to identify, detect or counter any such threat, including —(i)
information relating to the design, configuration or operation of any computer, computer program or computer system; and
(ii)
information relating to the cybersecurity of any computer, computer program or computer system;
(c)
providing to the Minister or the Commissioner any information (including real‑time information) obtained from any computer controlled or operated by the specified person, or obtained by the specified person from another person pursuant to a measure or requirement under paragraph (b), that is necessary to identify, detect or counter any such threat, including —(i)
information relating to the design, configuration or operation of any computer, computer program or computer system; and
(ii)
information relating to the cybersecurity of any computer, computer program or computer system; and
(d)
providing to the Minister or the Commissioner a report of a breach or an attempted breach of cybersecurity of a description specified in the certificate under subsection (1), relating to any computer controlled or operated by the specified person.
(3) Any measure or requirement mentioned in subsection (1), and any direction given by a specified person for the purpose of taking any such measure or complying with any such requirement —(a)
does not confer any right to the production of, or of access to, information subject to legal privilege; and
(b)
subject to paragraph (a), has effect despite any obligation or limitation imposed or right, privilege or immunity conferred by or under any law, contract or rules of professional conduct, including any restriction on the disclosure of information imposed by law, contract or rules of professional conduct.
(4) A specified person who, without reasonable excuse, fails to take any measure or comply with any requirement directed by the Minister under subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 10 years or to both.
(5) Any person who, without reasonable excuse —(a)
obstructs a specified person in the taking of any measure or in complying with any requirement under subsection (1); or
(b)
fails to comply with any direction given by a specified person for the purpose of the specified person taking any such measure or complying with any such requirement,
shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 10 years or to both.
(6) No civil or criminal liability is incurred by —(a)
a specified person for doing or omitting to do any act if the specified person had done or omitted to do the act in good faith and for the purpose of or as a result of taking any measure or complying with any requirement under subsection (1); or
(b)
a person for doing or omitting to do any act if the person had done or omitted to do the act in good faith and for the purpose of or as a result of complying with a direction given by a specified person for the purpose of taking any such measure or complying with any such requirement.
(7) The following persons are not considered to be in breach of any restriction upon the disclosure of information imposed by law, contract or rules of professional conduct:(a)
a specified person who, in good faith, obtains any information for the purpose of taking any measure under subsection (1) or complying with any requirement under that subsection, or who discloses any information to the Minister or the Commissioner, in compliance with any requirement under that subsection;
(b)
a person who, in good faith, obtains any information, or discloses any information to a specified person, in compliance with a direction given by the specified person for the purpose of taking any measure under subsection (1) or complying with any requirement under that subsection.
(8) The following persons, namely:(a)
a specified person to whom a person has provided information in compliance with a direction given by the specified person for the purpose of taking any measure under subsection (1) or complying with any requirement under that subsection;
(b)
a person to whom a specified person provides information in compliance with any requirement under subsection (1),
must not use or disclose the information, except —
(c)
with the written permission of the person from whom the information was obtained or, where the information is the confidential information of a third person, with the written permission of the third person;
(d)
for the purpose of preventing, detecting or countering a threat to a computer, computer system or class of computers or computer systems;
(e)
to disclose to any police officer or other law enforcement authority any information which discloses the commission of an offence under this Act or any other written law; or
(f)
in compliance with a requirement of a court or the provisions of this Act or any other written law.
(9) Any person who contravenes subsection (8) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 12 months or to both.
(10) Where an offence is disclosed in the course of or pursuant to the exercise of any power under this section —(a)
no information for that offence may be admitted in evidence in any civil or criminal proceedings; and
(b)
no witness in any civil or criminal proceedings is obliged —(i)
to disclose the name, address or other particulars of any informer who has given information with respect to that offence; or
(ii)
to answer any question if the answer would lead, or would tend to lead, to the discovery of the name, address or other particulars of the informer.
(11) If any book, document, data or computer output which is admitted in evidence or liable to inspection in any civil or criminal proceedings contains any entry in which any informer is named or described or which may lead to the informer’s discovery, the court must cause those entries to be concealed from view or to be obliterated so far as may be necessary to protect the informer from discovery.
Source: Singapore Statutes Online (Attorney-General's Chambers), © Government of Singapore.
