Notes from the IAPP Asia Managing Director, 3 March 2017

As a follow-on to China's cybersecurity law, adopted on 7 Nov. 2016 (effective on 1 June), draft measures for network products and services security reviews have been issued for public comment. The draft measures will be open for comments until 4 March 2017. The measures bring China a step closer to implementing a security review regime with respect to network products and services (and their providers) and potentially edges China closer to a much tighter regime in the name of national security.

On the theme of national security, the big news in Singapore this week has been the theft of the personal information of 850 national servicemen and staff at the Ministry of Defence in what the Ministry described as a "targeted and carefully planned" cyberattack. Security experts said that the assault had the hallmarks of a state-sponsored attack aimed at official secrets, which was thwarted thanks to internal controls, even though personal data was compromised.

This got me thinking about geopolitical cyberwarfare and even #fakenews, in a week where freedom of the press seemed under attack. There is an apparent growing desire to control the information space. According to the Kommersant business newspaper, Russia spends $300 million annually on its “cyber army” of about 1,000 people. Quoted in the Financial Times, Andrei Soldatov, co-author of "The Red Web," said that the Kremlin has long seen cybersecurity as part of a broader concept of information warfare. He added that the Russians believed that “they lost the first Chechen war thanks to journalists, so when they are in a crisis, the first thing they need to do is control the information space.” Journalists have been blamed for a lot of things lately, and evidently, this is not a new phenomenon.

The upshot of all this is that it is naïve to think you can’t be spied on, especially if your information controls are weak. We should be shocked by the lackadaisical approach to personal data protection by the manufacturer of a certain smart teddy bear (in which the personal data and conversations of up to 800,000 users were compromised and held for ransom). Or maybe there is something even more sinister in the name of the alleged APT28 group called “Fancy Bear”? 

At the same time, it was revealed in the Australian Senate that the attorney general had apparently issued warrants to the Australian Security Intelligence Agency  to search “a small number” of journalists’ records. The nature of Asio’s enquiries is unknown but there were concerns raised about the protection of journalists investigating sensitive cases in the public interest.

All of this makes me think of a quote from Friedrich Hayek's "Law, Legislation and Liberty": "Freedom can be preserved only if it is treated as a supreme principle which must not be sacrificed for particular advantages.”