ECONOMYNEXT – Sri Lanka will introduce new cyber security legislation in 2023 and also unveil a framework for a digital economy in November, State Minister of Technology Kanaka Herath said.
According to the state minister, the proposed cybersecurity act, which has been on the cards for some years now and subjected to repeated delays, is aimed at protecting personal data and will also serve the wider national security interest.
President Ranil Wickremesinghe, in his capacity as Minister of Technology, will introduce a new framework for digitalisation with a view to turning Sri Lanka into a digital economy, Herath said at a meeting on Tuesday June 19.
“As we go into digitalisation, we must also ensure cybersecurity. We may face problems different to what we face today. Protecting data is very important,” he said.
The attorney general has already reviewed the draft bill which, upon translation, will be presented to parliament within the year, said Herath.
The state minister also dismissed concerns that the proposed cybersecurity act could curb media freedom, not unlike the proposed broadcast regulatory commission.
“Some are asking if the cybersecurity bill is being brought to curb the media. No, this is to ensure national security and personal data,” he said.
In August 2022, Sri Lanka’s cabinet of ministers approved a proposal by President Ranil Wickrememsinghe to implement an ‘Information and Cyber Security policy’ in all state bodies listed under public authorities.
The policy, formulated by the Sri Lanka Computer Emergency Readiness Team (SLCERT) in line with the Information and Cyber Security strategy 2019-2023, was given approval to be implemented in all public authorities listed in the Right to Information Act No 12 of 2016.
A cabinet statement in August said though there is a trend of state owned enterprises (SOEs) being digitalised, there is a threat to information and the security of data due to outdated technology and a shortage of qualified staff to supervise systems.
During the administration of former President Gotabaya Rajapaksa, too, cabinet approval was given to a ‘Defence Cyber Commands’ bill and for a separate bill of cybersecurity laws outside the defence purview,
The two bills, proposed by President Rajapaksa in his capacity as then minister of defence and minister of technology, are expected to keep criminal and terrorism related activity online in check.
A statement from the government information department in October 2021 noted that “electronic communication across cyber space has been recognised as a crucial factor that can directly affect national security”.
The statement also noted a purported need for new laws to strengthen the individual cybersecruity units currently being operated by Sri Lanka’s security forces, police and other agencies
The second bill proposed by Rajapaksa was intended to create a regulatory framework for “national information” and a national cybersecurity strategy. This bill will also provide for the establishment of a Sri Lanka Cyber Protection Agency to work in conjunction with other agencies.
Other objectives include dthe “introduction of legal provisions required for protecting infrastructure facilities related to decisive and essential information within the country, prevention of risk activities that affect the cyber security as well as creating a formal cyber protected environment within the country.”
The October 2021 cabinet decision came amid investigations into a controversial deletion of sensitive data maintained by the National Medicines Regulatory Authority (NMRA).
Local media reported in August that year of a loss of an estimated two terabytes—or 2,000 gigabytes—of classified information from the Lanka Government Cloud (LGC), which risked endangering the business relationships of local drug companies with their foreign principals. (Colombo/Jun20/2023)