Singapore Law on Cyber Crime eg. Hacking, Legal activity & Defamation

INTRODUCTION

The agencies created to fight computer crime in Singapore include the Computer Crimes Branch of the Criminal Investigation Department, the Computer Forensics Branch of the Singapore Police, and the Singapore Computer Emergency Response Team. The creation of these specialized units was deemed necessary as a result of the ever more sophisticated nature of the technology involved in such crimes.


What is computer crime and cyber crime?

Computer crime involves acts that attack the functions of a computer, access to a computer or the Internet, and similar items. They might be called cyber-trespass?. They are viewed as crimes against a computer. Examples of these crimes are hacking, denying another access to Internet usage, and sending unsolicited or virus-causing electronic mail. Cyber crime, on the other hand, is traditional crime such as fraud, theft, extortion, and the like in which the computer is used as an instrument of the crime. These acts are traditional crimes that are facilitated through the use of a computer.


How has Singapore addressed these two types of crime?

In 1993, Singapore passed the Computer Misuse Act (Chapter 50A of the Singapore Statutes), which it has amended four times, as recently as 2005. This Act addresses computer crimes and provides for stiff penalties for the violation of the law. It has applied its existing Penal Code provisions for activities that are deemed cyber crime. For example, the release of a virus would fall under the jurisdiction of the Computer Misuse Act, whereas an economic crime (e.g. extortion or securities fraud) would fall under the aegis of the Penal Code.


What are the penalties for conviction of computer crime in Singapore?

Most of the provisions of the Computer Misuse Act carry a maximum fine up to $10,000 Singaporean dollars and/or imprisonment up to three years for a first offense. For the second and subsequent offenses, the penalty is a fine up to $20,000 Singaporean dollars and/or imprisonment up to five years. If there was damage caused as a result of the crime, the penalty is a fine up to $50,000 and/or imprisonment up to seven years. If the crime involved a threat to Singapore?s security, or to the banking or other financial, communications, or transportation industries, or to public services including utilities, safety, police, civil defense, or medicine, the penalty is a fine up to $100,000 Singaporean dollars and/or imprisonment up to 20 years.


In what other manner is Singapore fighting computer crime?

Singapore has created new law enforcement agencies with specially trained personnel to keep pace with the rapid advances in technology and the resulting proliferation of computer-based crimes. It has given its police force additional powers, including extra-territorial jurisdiction to aid in their efforts at apprehending computer-based criminals.


COMPUTER MISUSE ACT (OF SINGAPORE)
PART I
PRELIMINARY

1. This Act may be cited as the Computer Misuse Act.
Interpretation
2. --(1) In this Act, unless the context otherwise requires --
"computer" means an electronic, magnetic, optical, electrochemical, or other data
processing device, or a group of such interconnected or related devices, performing
logical, arithmetic, or storage functions, and includes any data storage facility or
communications facility directly related to or operating in conjunction with such
device or group of such interconnected or related devices, but does not include --
(a) an automated typewriter or typesetter
(b) a portable hand held calculator
(c) a similar device which is non-programmable or which does not contain any data
storage facility or
(d) such other device as the Minister may, by notification in the Gazette, prescribe
computer output or output means a statement or representation (whether in written,
printed, pictorial, graphical or other form) purporting to be a statement or
representation of fact --
(a) produced by a computer or
(b) accurately translated from a statement or representation so produced
"computer service" includes computer time, data processing and the storage or
retrieval of data
"damage" means, except for the purposes of section 13, any impairment to a computer
or the integrity or availability of data, a program or system, or information, that --
(a) causes loss aggregating at least $10,000 in value, or such other amount as the
Minister may, by notification in the Gazette, prescribe except that any loss incurred or
accrued more than one year after the date of the offence in question shall not be taken
into account
(b) modifies or impairs, or potentially modifies or impairs, the medical examination,
diagnosis, treatment or care of one or more persons
(c) causes or threatens physical injury or death to any person or
(d) threatens public health or public safety
"data" means representations of information or of concepts that are being prepared or
have been prepared in a form suitable for use in a computer
"electronic, acoustic, mechanical or other device" means any device or apparatus that
is used or is capable of being used to intercept any function of a computer
"function" includes logic, control, arithmetic, deletion, storage and retrieval and
communication or telecommunication to, from or within a computer
"intercept" , in relation to a function of a computer, includes listening to or recording
a function of a computer, or acquiring the substance, meaning or purport thereof
"program or computer program" means data representing instructions or statements
that, when executed in a computer, causes the computer to perform a function.
[21/98]
--(2) For the purposes of this Act, a person secures access to any program or data held
in a computer if by causing a computer to perform any function he --
(a) alters or erases the program or data
(b) copies or moves it to any storage medium other than that in which it is held or to a
different location in the storage medium in which it is held
(c) uses it or
(d) causes it to be output from the computer in which it is held (whether by having it
displayed or in any other manner),
and references to access to a program or data (and to an intent to secure such access)
shall be read accordingly.
(3) For the purposes of subsection (2) (c), a person uses a program if the function he
causes the computer to perform --
(a) causes the program to be executed or
(b) is itself a function of the program.
(4) For the purposes of subsection (2) (d), the form in which any program or data is
output (and in particular whether or not it represents a form in which, in the case of a
program, it is capable of being executed or, in the case of data, it is capable of being
processed by a computer) is immaterial.
(5) For the purposes of this Act, access of any kind by any person to any program or
data held in a computer is unauthorised or done without authority if --
(a) he is not himself entitled to control access of the kind in question to the program
or data and
(b) he does not have consent to access by him of the kind in question to the program
or data from any person who is so entitled.
(6) A reference in this Act to any program or data held in a computer includes a
reference to any program or data held in any removable storage medium which is for
the time being in the computer and a computer is to be regarded as containing any
program or data held in any such medium.
(7) For the purposes of this Act, a modification of the contents of any computer takes
place if, by the operation of any function of the computer concerned or any other
computer --
(a) any program or data held in the computer concerned is altered or erased
(b) any program or data is added to its contents or
(c) any act occurs which impairs the normal operation of any computer,
and any act which contributes towards causing such a modification shall be regarded
as causing it.
[S 92/97]
(8) Any modification referred to in subsection (7) is unauthorised if --
(a) the person whose act causes it is not himself entitled to determine whether the
modification should be made and
(b) he does not have consent to the modification from any person who is so entitled.

(9) A reference in this Act to a program includes a reference to part of a program.

PART II
OFFENCES

Unauthorised access to computer material

3. --(1) Subject to subsection (2), any person who knowingly causes a computer to
perform any function for the purpose of securing access without authority to any
program or data held in any computer shall be guilty of an offence and shall be liable
on conviction to a fine not exceeding $5,000 or to imprisonment for a term not
exceeding 2 years or to both and, in the case of a second or subsequent conviction, to
a fine not exceeding $10,000 or to imprisonment for a term not exceeding 3 years or
to both.
[21/98]
(2) If any damage is caused as a result of an offence under this section, a person
convicted of the offence shall be liable to a fine not exceeding $50,000 or to
imprisonment for a term not exceeding 7 years or to both.
[21/98]
(3) For the purposes of this section, it is immaterial that the act in question is not
directed at --
(a) any particular program or data
(b) a program or data of any kind or
(c) a program or data held in any particular computer.
Access with intent to commit or facilitate commission of offence
4. --(1) Any person who causes a computer to perform any function for the purpose of
securing access to any program or data held in any computer with intent to commit an
offence to which this section applies shall be guilty of an offence.
[21/98]
(2) This section shall apply to an offence involving property, fraud, dishonesty or
which causes bodily harm and which is punishable on conviction with imprisonment
for a term of not less than 2 years.
[21/98]
(3) Any person guilty of an offence under this section shall be liable on conviction to
a fine not exceeding $50,000 or to imprisonment for a term not exceeding 10 years or
to both.
[21/98]
(4) For the purposes of this section, it is immaterial whether --
(a) the access referred to in subsection (1) is authorised or unauthorised
(b) the offence to which this section applies is committed at the same time when the
access is secured or at any other time.
[21/98]
Unauthorised modification of computer material
5. --(1) Subject to subsection (2), any person who does any act which he knows will
cause an unauthorised modification of the contents of any computer shall be guilty of
an offence and shall be liable on conviction to a fine not exceeding $10,000 or to
imprisonment for a term not exceeding 3 years or to both and, in the case of a second
or subsequent conviction, to a fine not exceeding $20,000 or to imprisonment for a
term not exceeding 5 years or to both.
[21/98]
(2) If any damage is caused as a result of an offence under this section, a person
convicted of the offence shall be liable to a fine not exceeding $50,000 or to
imprisonment for a term not exceeding 7 years or to both.
[21/98]
(3) For the purposes of this section, it is immaterial that the act in question is not
directed at --
(a) any particular program or data
(b) a program or data of any kind or
(c) a program or data held in any particular computer.
(4) For the purposes of this section, it is immaterial whether an unauthorised
modification is, or is intended to be, permanent or merely temporary.
Unauthorised use or interception of computer service
6. --(1) Subject to subsection (2), any person who knowingly --
(a) secures access without authority to any computer for the purpose of obtaining,
directly or indirectly, any computer service
(b) intercepts or causes to be intercepted without authority, directly or indirectly, any
function of a computer by means of an electro-magnetic, acoustic, mechanical or
other device or
(c) uses or causes to be used, directly or indirectly, the computer or any other device
for the purpose of committing an offence under paragraph (a) or (b),
shall be guilty of an offence and shall be liable on conviction to a fine not exceeding
$10,000 or to imprisonment for a term not exceeding 3 years or to both and, in the
case of a second or subsequent conviction, to a fine not exceeding $20,000 or to
imprisonment for a term not exceeding 5 years or to both.
[21/98]
--(2) If any damage is caused as a result of an offence under this section, a person
convicted of the offence shall be liable to a fine not exceeding $50,000 or to
imprisonment for a term not exceeding 7 years or to both.
[21/98]
(3) For the purposes of this section, it is immaterial that the unauthorised access or
interception is not directed at --
(a) any particular program or data
(b) a program or data of any kind or
(c) a program or data held in any particular computer.
Unauthorised obstruction of use of computer
7. --(1) Any person who, knowingly and without authority or lawful excuse --
(a) interferes with, or interrupts or obstructs the lawful use of, a computer or
(b) impedes or prevents access to, or impairs the usefulness or effectiveness of, any
program or data stored in a computer,
shall be guilty of an offence and shall be liable on conviction to a fine not exceeding

$10,000 or to imprisonment for a term not exceeding 3 years or to both and, in the
case of a second or subsequent conviction, to a fine not exceeding $20,000 or to
imprisonment for a term not exceeding 5 years or to both.
[21/98]
--(2) If any damage is caused as a result of an offence under this section, a person
convicted of the offence shall be liable to a fine not exceeding $50,000 or to
imprisonment for a term not exceeding 7 years or to both.
[6A
[21/98]
Unauthorised disclosure of access code
8. --(1) Any person who, knowingly and without authority, discloses any password,
access code or any other means of gaining access to any program or data held in any
computer shall be guilty of an offence if he did so --
(a) for any wrongful gain
(b) for any unlawful purpose or
(c) knowing that it is likely to cause wrongful loss to any person.
[21/98]
--(2) Any person guilty of an offence under subsection (1) shall be liable on
conviction to a fine not exceeding $10,000 or to imprisonment for a term not
exceeding 3 years or to both and, in the case of a second or subsequent conviction, to
a fine not exceeding $20,000 or to imprisonment for a term not exceeding 5 years or
to both.
[6B
[21/98]
Enhanced punishment for offences involving protected computers
9. --(1) Where access to any protected computer is obtained in the course of the
commission of an offence under section 3, 5, 6 or 7, the person convicted of such an
offence shall, in lieu of the punishment prescribed in those sections, be liable on
conviction to a fine not exceeding $100,000 or to imprisonment for a term not
exceeding 20 years or to both.
[21/98]
(2) For the purposes of subsection (1), a computer shall be treated as a “protected
computer” if the person committing the offence knew, or ought reasonably to have
known, that the computer or program or data is used directly in connection with or
necessary for --
(a) the security, defence or international relations of Singapore
(b) the existence or identity of a confidential source of information relating to the
enforcement of a criminal law
(c) the provision of services directly related to communications infrastructure,
banking and financial services, public utilities, public transportation or public key
infrastructure or
(d) the protection of public safety including systems related to essential emergency
services such as police, civil defence and medical services.
remedy for the recovery of damages beyond the amount of compensation paid under
the order.
(3) An order of compensation under this section shall be recoverable as a civil debt.
[10
Saving for investigations by police and law enforcement officers
14. Nothing in this Act shall prohibit a police officer, a person authorised in writing
by the Commissioner of Police under section 15 (1) or any other duly authorised law
enforcement officer from lawfully conducting investigations pursuant to his powers
conferred under any written law.
[11
[21/98]
Power of police officer to access computer and data
15. --(1) A police officer or a person authorised in writing by the Commissioner of
Police shall --
(a) be entitled at any time to --
(i) have access to and inspect and check the operation of any computer to which this
section applies
(ii) use or cause to be used any such computer to search any data contained in or
available to such computer or
(iii) have access to any information, code or technology which has the capability of
retransforming or unscrambling encrypted data contained or available to such
computer into readable and comprehensible format or text for the purpose of
investigating any offence under this Act or any other offence which has been
disclosed in the course of the lawful exercise of the powers under this section
(b) be entitled to require --
(i) the person by whom or on whose behalf, the police officer or investigation officer
has reasonable cause to suspect, any computer to which this section applies is or has
been used or
(ii) any person having charge of, or otherwise concerned with the operation of, such
computer,
to provide him with such reasonable technical and other assistance as he may require
for the purposes of paragraph (a) or
(c) be entitled to require any person in possession of decryption information to grant
him access to such decryption information necessary to decrypt data required for the
purpose of investigating any such offence.
[21/98]
--(2) This section shall apply to a computer which a police officer or a person
authorised in writing by the Commissioner of Police has reasonable cause to suspect
is or has been in use in connection with any offence under this Act or any other
offence which has been disclosed in the course of the lawful exercise of the powers
under this section.
[21/98]
(3) The powers referred to in paragraphs (a) (ii) and (iii) and (c) of subsection (1)
shall not be exercised except with the consent of the Public Prosecutor.
(4) Any person who obstructs the lawful exercise of the powers under subsection (1)
(a) or who fails to comply with a request under subsection (1) (b) or (c) shall be guilty
of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to
imprisonment for a term not exceeding 3 years or to both.
[21/98]
(5) For the purposes of this section --
"decryption information" means information or technology that enables a person to
readily retransform or unscramble encrypted data from its unreadable and
incomprehensible format to its plain text version
"encrypted data" means data which has been transformed or scrambled from its plain
text version to an unreadable or incomprehensible format, regardless of the technique
utilised for such transformation or scrambling and irrespective of the medium in
which such data occurs or can be found for the purposes of protecting the content of
such data
"plain text version" means original data before it has been transformed or scrambled
to an unreadable or incomprehensible format.
[14
[21/98]
Arrest by police without warrant
16. Any police officer may arrest without warrant any person reasonably suspected of
committing an offence under this Act.

What Are Defamation, Libel and Slander?

Generally speaking, defamation is the issuance of a false statement about another person, which causes that person to suffer harm. Slander involves the making of defamatory statements by a transitory (non-fixed) representation, usually an oral (spoken) representation. Libel involves the making of defamatory statements in a printed or fixed medium, such as a magazine or newspaper.

Typically, the elements of a cause of action for defamation include:

1.A false and defamatory statement concerning another
2.The unprivileged publication of the statement to a third party (that is, somebody other than the person defamed by the statement)
3.If the defamatory matter is of public concern, fault amounting at least to negligence on the part of the publisher and
4.Damage to the plaintiff.
In the context of defamation law, a statement is "published" when it is made to the third party. That term does not mean that the statement has to be in print.

Damages are typically to the reputation of the plaintiff, but depending upon the laws of the jurisdiction it may be enough to establish mental anguish.

Most jurisdictions also recognize "per se" defamation, where the allegations are presumed to cause damage to the plaintiff. Typically, the following may consititute defamation per se:

•Attacks on a person's professional character or standing
•Allegations that an unmarried person is unchaste
•Allegations that a person is infected with a ***ually transmitted disease
•Allegations that the person has committed a crime of moral turpitude
While actions for defamation have their roots in common law, most jurisdictions have now enacted statutes which modify the common law. They may change the elements of the cause of action, limit when an action may be filed, or modify the defenses to an action for defamation. Some may even require that the defendant be given an opportunity to apologize before the plaintiff can seek non-economic damages.

What Defenses Are Available To People Accused of Defamation?

The most important defense to an action for defamation is "truth", which is an absolute defense to an action for defamation.

Another defense to defamation actions is "privilege". For example, statements made by witnesses in court, arguments made in court by lawyers, statements by legislators on the floor of the legislature, or by judges while sitting on the bench, are ordinarily privileged, and cannot support a cause of action for defamation, no matter how false or outrageous.

A defense recognized in most jurisdictions is "opinion". If the person makes a statement of opinion as opposed to fact, the statement may not support a cause of action for defamation. Whether a statement is viewed as an expression of fact or opinion can depend upon context - that is, whether or not the person making the statement would be perceived by the community as being in a position to know whether or not it is true. If your employer calls you a pathological liar, it is far less likely to be regarded as opinion than if such a statement is made by somebody you just met. Some jurisdictions have eliminated the distinction between fact and opinion, and instead hold that any statement that suggests a factual basis can support a cause of action for defamation.

A defense similar to opinion is "fair comment on a matter of public interest". If the mayor of a town is involved in a corruption scandal, expressing the opinion that you believe the allegations are true is not likely to support a cause of action for defamation.

A defendant may also attempt to illustrate that the plaintiff had a poor reputation in the community, in order to diminish any claim for damages resulting from the defamatory statements.

A defendant who transmitted a message without awareness of its content may raise the defense of "innocent dissemination". For example, the post office is not liable for delivering a letter which has defamatory content, as it is not aware of the contents of the letter.

An uncommon defense is that the plaintiff consented to the dissemination of the statement.

Why Commencing A Defamation Action Is Not Aways A Good Idea

While people who are targeted by lies may well be angry enough to file a lawsuit, there are some very good reasons why actions for defamation may not be a good idea.

The publicity that results from a defamation lawsuit can create a greater audience for the false statements than they previously enjoyed. For example, if a newspaper or news show picks up the story of the lawsuit, false accusations that were previously known to only a small number of people may suddenly become known to the entire community, nation, or even to the world. As the media is much more apt to cover a lawsuit than to cover its ultimate resolution, the net effect may be that large numbers of people hear the false allegations, but never learn how the litigation was resolved.

Another big issue is that defamation cases tend to be difficult to win, and damage awards tend to be small. As a result, it is unusual for attorneys to be willing to take defamation cases on a contingent fee basis, and the fees expended in litigating even a successful defamation action can exceed the total recovery.

Another significant concern is that, even where the statements made by the defendant are entirely false, it may not be possible for a plaintiff to prove all of the elements of defamation. Most people will respond to news that a plaintiff lost a defamation lawsuit by concluding that the allegations were true.

In other words, the plaintiff in a defamation action may be required to expend a considerable amount of money to bring the action, may experience significant negative publicity which repeats the false accusations, and if unsuccessful in the litigation may cement into the public consciousness the belief that the defamatory accusations were true. While many plaintiffs will be able to successfully prosecute defamation actions, the possible downside should be considered when deciding whether or not such litigation should be attempted.