Hansard, Monday, 5 February 2018

1 Mr Seah Kian Peng asked the Minister for Social and Family Development what is the Ministry's position on the dating platform TheSugarBook which targets young females and whether the Ministry will be taking steps to address the possible harm and exploitation that such young females could be subjected to.

2 Ms Tin Pei Ling asked the Minister for Social and Family Development what measures are in place to protect teenagers and young persons from online platforms, such as TheSugarBook, that aim to capitalise on their emotional or financial vulnerabilities and exploit them sexually.

3 Ms Tin Pei Ling asked the Minister for Social and Family Development whether online platforms, such as TheSugarBook, are legal in Singapore and what actions will be taken to ensure vice activities do not proliferate through such a channel.

Mr Speaker, may I have your permission to take Question Nos 1 to 3 together, please?

Please do.

Mr Speaker, Sir, sugar dating platforms like The SugarBook commoditise and devalue relationships under the cover of a "mutually beneficial arrangement". Relationships become transactional: an exchange of money and gifts in return for companionship and "other" services.

But what is of greater concern is that the site targets young people who are in their late teens and early 20s, even while they are still students at polytechnics or universities, exposing them to the risks of being exploited and abused. These transactions are fundamentally imbalanced in favour of older and wealthier people. Young women, for instance, may feel pressurised to comply with their wishes or demands and risk physical or sexual harm if they reject them.

The Police will keep a close eye on The SugarBook, as well as the individuals who use its services. For instance, if there is any procurement of sexual services for payment, the Police will take enforcement action under the Women’s Charter, including possibly against the website and its owners.

While we collectively object to such websites, the more effective and enduring solution lies in increasing the awareness of young people to such dangers, so that they exercise discretion and good judgement when navigating the online world. Students in the Ministry of Education's schools are taught to establish boundaries for personal safety, discern risks and exercise sound judgement when going onto online platforms and managing relationships, both online and offline. In addition, during Cyber Wellness lessons, they learn about safe and responsible use of technology and cover topics, such as danger with cyber contacts. They will also link up with our universities and polytechnics to help raise awareness of such risks. At the same time, parents play a critical role in guiding their children and helping them to stay away from undesirable online content.

At the end of the day, while we recognise that these websites undermine families and society, our best defence is for society, communities and our families to reinforce values that anchor us so that we do not to succumb to such influences.

Mr Seah Kian Peng.

I thank the Minister for his answer. I am very heartened by the Ministry's views. I just have two supplementary questions. First, building on what the Minister has said that the Police and the Ministry will take a closer look at these sites, I hope that this can be done very proactively and decisively, when it is very clear that what the Ministry is advocating is not adhered to. My second question is a broader question, which is how do we balance the need between freedom of young adults to do as they wish, whilst curbing the platforms of these activities which are not aligned to our social norms.

I thank Mr Seah for his concerns, well-expressed. I give the Member the assurance that as we had responded to in the Parliamentary Question answer, we will keep an eye on the site and other like sites, and take action if laws are violated. In terms of finding the right balance between the freedom of people, including young people to make moral choices within the realm of what is legally permissible, and acting as a regulator to curb sites both online and, of course, in the real-world platforms to protect, we need to strike the right balance.

Certain sites, for example, Ashley Madison, if the Member recalls, in 2013, the Info-communications Media Development Authority's predecessor, the Media Development Authority, acted decisively to ban the site because the site explicitly advocated, through its portal, extramarital affairs and infidelity. They had proposed to set up the site in Singapore and for the founder to fly in and launch the site. That ran right up against our core values on protecting the family and preserving family values. So, we acted decisively then.

But the Member would know that in the online realm, it is very broad. There are many aspects of the online world that are very troubling. And yet, locking and banning every such site, whatever its subject matter may be, is not the most enduring way in which to protect Singaporeans, including young Singaporeans, from such risks.

The key is to put in a lot of effort educating children from young and continuing well into the teenage years and beyond, so that they are aware of these risks. The key is that families, individuals, communities and society as a whole need to continuously recognise the values that hold us together. With that kind of internalisation of values, we put each and every individual in as best a position as possible when making his or her moral decisions.

Ms Tin Pei Ling.

I thank the Minister for clarifying the Ministry's position on this. I have two supplementary questions. The first is, I understand the Minister's point, but on this particular website TheSugarBook, it was featured in a mainstream teenager magazine just earlier this year. I would like to ask what is the Ministry's position on this. The concern is whether by being featured in such mainstream teenager magazines, the wrong signal will be sent that this is a mainstream channel or platform for teenagers to make use of. This is also taking into consideration that we collectively object to such websites.

The second question is: the more important thing is to address the root cause. I would like to ask the Ministry whether there will be any effort to be taken to understand the reasons why young people are taking to such websites as one of the options to finance whatever their endeavours are, including studies. So, whether the Ministry will be taking a proactive effort to reach out and help these young people so that they become less susceptible to such lures?

Mr Speaker, I agree with the Member that we need to work with all aspects of society, including the private sector, to see whether it is appropriate for them to be advocating or advertising for such platforms and activities. This is an ongoing conversation. As I had said earlier in my reply, we will keep a very close eye on TheSugarBook and other like sites.

In terms of the root cause, this is something that we continually study. People, including young people, make moral choices based on the internal sense of what is right, what is wrong, what is white, what is black and what is grey. What is important is that from a young age and all through life, we give individuals the opportunity to be exposed to good moral values. The role of family is critical and that is why the Ministry of Social and Family Development provides programmes in which parents can pick up and strengthen parenting skills. We work very closely with schools on such curriculum. We have social networks, such as Family Service Centres and other voluntary welfare organisations that partner us in supporting families that run into crises. For example, when the children present certain behavioural issues, it is a whole-of-community effort.

I thank the Member for her concern. We will continue to keep an eye on such developments.

4 Ms Rahayu Mahzam asked the Minister for Social and Family Development (a) in the past five years, what is number of maintenance applications submitted to the Tribunal for the Maintenance of Parents; (b) whether there has been any significant increase or decrease in the number of applications made over the years; and (c) what percentage of the applications are resolved by mediation.

Mr Speaker, there were 262 new maintenance applications submitted to the Tribunal for the Maintenance of Parents in the last five years. There is no clear trend in the number of applications. It has ranged from a low of 36 in 2015 to a high of 70 in 2016.

Applicants who file maintenance applications have to attend mediation before their case is heard by the Tribunal. In 2017, our mediators resolved half, that is, about 51%, of the maintenance applications filed, an increase from 39% in 2013.

Ms Rahayu Mahzam.

I thank the Senior Parliamentary Secretary for the answer to the question. First, I would like to declare that I am a mediator with the Tribunal for the Maintenance of Parents (TMP). I would like to seek specific information on numbers that have applied and where there had been settlement.

Also, if the Senior Parliamentary Secretary could give comments on the effectiveness of the process in place, including mediation, in resolving the issues raised at TMP. Further, whether there is any scope of review of the role of TMP, perhaps in providing and enhancing services to the families, for example, in counselling or allowing for financial planning classes for the families.

Sir, I thank Mdm Rahayu for the supplementary questions. Looking at the details and numbers, as I had said earlier, we cannot see any trend. Nevertheless, from 2013 to 2017, numbers have gone down. In 2013, it was 63 new applications; 2014 saw 55 new applications; 2015 saw 36 new applications; 2016 saw 70 new applications and 2017 saw 38 new applications. So, as a whole, we feel that the Commissioner for the Maintenance of Parents (CMP) has been able to help in facilitating to resolve the issues amicably. The number of applications at TMP has dropped since 2011. We feel that this can be attributed largely to the CMP's success in resolving maintenance disputes through conciliation.

Since 2011, CMP has resolved eight out of the 10 cases, with 90% of these cases being resolved within three months. We feel that with better upfront conciliation, fewer applications are being filed at TMP. The applications fell from 63 in 2013 to 38 in 2017. It is not only about conciliation or about how we can help them. If along the way, we find that there are efforts that we can carry out at the Social Service Offices level by community agencies, we will do our best to refer. We want to promote filial piety; we want families to be able to support one another. And the community can play a part in this.

Mr Seah Kian Peng.

I thank the Senior Parliamentary Secretary for the answers. As the one who, together with the Work Group, led the changes to the last amendment to this Bill, I am heartened to see that the conciliation rate has increased significantly.

What I would like to ask the Senior Parliamentary Secretary is whether, given that these are encouraging results and, indeed, we want more conciliations rather than going through the Tribunal per se, that more efforts, more focus, even more attention and more publicity be given. We do know that there are strains for many families in this day and age, and every family that we can help, first publicise this avenue and how conciliations can result in success. I will urge the Ministry to consider putting more efforts into this.

Sir, we will certainly take in Mr Seah's suggestion.

5 Mr Kwek Hian Chuan Henry asked the Minister for the Environment and Water Resources (a) whether the flood prevention systems will be able to prevent flash floods similar to those that occurred on 8 January 2018 after the completion of the drainage upgrades in 2019; (b) what are the guiding principles used to determine the drainage capacity needed in an area; and (c) whether these include balancing the potential collateral damage versus the investment cost.

6 Miss Cheryl Chan Wei Ling asked the Minister for the Environment and Water Resources with regard to the flash flood on 8 January 2018 at Bedok North Avenue 4 (a) whether the ongoing enhancement drainage works at Bedok Canal was one of the reasons that limits the water capacity that can be stored or discharged through the canal during heavy downpours and high tides; (b) if so, what are the interim measures to prevent potential flash floods at this area until enhancement works are completed in 2019; and (c) what measures are in place to ensure the public living and working near any canals are alerted before possible water overflow occurs.

7 Miss Cheng Li Hui asked the Minister for the Environment and Water Resources (a) what current mechanisms are in place to notify motorists of impending flash floods in order to redirect traffic from affected areas; and (b) whether such mechanisms can be further enhanced to achieve broader and more effective notifications.

8 Mr Dennis Tan Lip Fong asked the Minister for the Environment and Water Resources (a) what caused the heavy flooding at the nine locations in the eastern part of Singapore on 8 January 2018; (b) whether each location has a history of flooding; (c) whether existing drainage works is a cause; (d) what measures have been taken to assist members of the public who were affected by the flooding; and (e) what measures will be taken to prevent similar flooding.

9 Mr Murali Pillai asked the Minister for the Environment and Water Resources how does PUB ensure that existing drains and canals are kept free of debris that have the potential to create constrictions or bottlenecks, so as to alleviate flooding.

Mr Speaker, with your permission, may I take Question Nos 5 to 9 together, please.

Yes, please.

On the morning of 8 January 2018, the prevailing Northeast Monsoon, aggravated by the development of a Sumatra squall, gave rise to intense rainfall across several parts of Singapore. The highest recorded total rainfall on that morning was 118.8 millimetres. This means that about half of Singapore's average monthly rainfall in January fell in just over four hours.

Eight of the nine locations that experienced flash floods that morning are low-lying and, therefore, susceptible to flash floods. Two of these, Tampines Road, opposite Jalan Teliti, and Arumugam Road, have a history of flash floods. The Public Utilities Board (PUB) is already carrying out drainage improvement works in these eight locations to enable the drains there to discharge more water in a shorter time when completed.

During drainage improvement works, PUB ensures that the drainage capacity of the area is maintained at the original level before works commence. Drainage works did not cause the flash floods in these locations.

For the ninth location at Tampines Avenue 12, apart from intense rainfall which exceeded the drain's design capacity, a temporary construction access road built by the contractor had obstructed the earth drain in an adjacent worksite. This aggravated the flash flood. PUB has worked with the developer to improve the drainage at the earth drain and this will help to improve the situation at Tampines Avenue 12 in an event of an intense storm. The longer-term measure is the permanent drainage system which will be built in tandem with the upcoming development project at the adjacent worksite.

The flash floods were caused by the intense rainfall temporarily exceeding the existing design capacity of the drains. Although the flood waters affected only certain stretches of the roads, and subsided within 15 to 60 minutes, we acknowledge that members of the public were inconvenienced and a number of cars were stalled.

When flash floods occur, we urge members of the public to exercise caution and avoid traversing in submerged areas even if they appear safe. Flash floods are usually of short duration and it is better to take a detour or wait for them to pass before continuing the journey. To aid the public, PUB, together with Traffic Police and the Land Transport Authority (LTA), will help divert vehicles at the earliest possible.

Let me go back to drain design. PUB takes into account terrain, the extent and type of developments in the area, catchment area served by the drain, as well as the design rainfall intensity over the catchment. This is standard international practice. However, with climate change, we can expect more intense rainfalls to be the norm in the future. A study by the Potsdam Institute for Climate Impact Research found that flood risks from rainfall changes will increase in the next two to three decades, due to global warming from greenhouse gases already emitted into the atmosphere. The need for adaptation is significant, even in countries with good infrastructure, such as Singapore.

To prepare for this, PUB has raised the drainage design standards since 2011, so that our drains can handle up to 45% higher rainfall intensities. These new standards were endorsed in 2012 by a Drainage Expert Panel comprising local and international specialists.

Since 2012, PUB has commenced and completed drainage improvement works at 327 locations. There are another 73 locations undergoing similar works, with 22 more planned this year. The Government has invested $1.2 billion on these works and has set aside another $500 million for the next two to three years.

However, it is not feasible to build our drains to accommodate every extreme rainfall event as this would require massive land take and much higher costs. Let me just take one example. Bedok Canal, which serves some of the affected areas, is being widened at a cost of $128 million to expand its width from 38 metres to 44 metres, wide enough to accommodate an expressway of 10 lanes, five lanes each way. Even with this widening, we cannot guarantee that there will be no floods in future, as rainfall events of even higher intensity could still occur that exceed the design capacity. This is especially so with climate change. To deal with the most extreme historical rainfall events, the Bedok Canal would need to be widened to at least 62 metres, displacing the Bedok Park Connector and community spaces adjacent to the canal, and possibly even affecting the surrounding residential areas.

This will look like a 16-lane expressway. Given competing needs for other land uses, such as housing, parks and roadsides, we have to be practical in our drainage expansion in Singapore. We have to design with practical considerations and not for extreme conditions all the time for all places. Building our drains for extreme conditions would mean that much of the capacity would be extremely costly but not needed most of the time. We will, however, ensure our critical infrastructure is well-protected from such extreme rainfalls. This is achieved through the "source-pathway-receptor" approach which was developed based on the recommendation of the Drainage Expert Panel to implement a holistic range of interventions.

Let me elaborate on the "source-pathway-receptor" approach. Under this approach, other than improving the pathways, or the drains, we also manage the source, which refers to where the rain falls. Measures include detention tanks to slow down surface runoff and reduce the amount of storm water entering the drains during peak rainfall. For instance, the Stamford Detention Tank and the Stamford Diversion Canal are constructed to protect Orchard Road against floods. These are still under construction. Built beneath a nursery and coach bay of the Tyersall Learning Forest, the Stamford Detention Tank will temporarily hold excess storm water from the drains. After the rain subsides, the storm water will be pumped back into the drains for subsequent discharge into Marina Reservoir.

For areas that are most at risk of flooding, PUB stipulates that buildings must have receptor features, such as higher platform levels, crest protection and flood barriers to prevent floodwaters from damaging them.

Apart from structural interventions, PUB places equal emphasis on non-structural measures, such as the maintenance of drains. PUB and the National Environment Agency's (NEA's) Department of Public Cleanliness carry out regular inspections to remove debris, litter and leaves from the drains. We encourage everyone to keep our environment litter-free. Any obstruction in the drain reduces its capacity and impedes water flow, which could lead to or aggravate a flash flood. We urge developers and contractors to ensure that the drains in and around their work sites function well. Members of the public are encouraged to provide feedback on drain conditions through PUB's MyWaters app or the Municipal Services Office's (MSO's) OneService App or call PUB's 24-hour Call Centre.

Mr Speaker, as flash floods cannot be completely eliminated, PUB seeks to help members of the public better cope with a flash flood by warning them and providing alerts and timely situation updates. Members of the public can subscribe to NEA's and PUB's short message service (SMS) alerts or mobile apps for updates on impending heavy rain and the water level in drains at designated locations.

While PUB strives to give early warning to the public, the weather systems in our equatorial region pose a forecasting challenge. These weather systems comprise mainly convective thunderstorms which tend to be localised, develop rather suddenly, and are of short duration. This limits the lead time of our warnings of heavy rain and consequently of the flash floods.

During flash floods, members of the public can stay updated through radio broadcasts, PUB's Facebook and Twitter pages, mobile apps as well as LTA's Expressway Monitoring Advisory System (EMAS).

Our approach to flood management is a comprehensive one that seeks to alleviate flood risks while minimising disruption to the public. We will continue to take all necessary steps to enhance flood resilience in Singapore and keep the public informed of flash flood incidents.

Mr Dennis Tan.

I thank the Minister for his answer to the question. Just one supplementary question. In respect of the measures for the eight out of nine locations in the eastern part of Singapore that the Minister mentioned will be taken or undergoing, how soon will these measures be completed?

Before I answer that question, I would like Members to recognise that PUB must also manage extremities of weather in both directions. We have to take care of intense drought, prolonged drought, that challenges or may affect our water supply. At the same time, we have to take care of extreme weather, such as rain of higher intensity and frequency, which will bring about floods.

Therefore, when we talk about floods, we must also remember to ask questions about the other extreme. What should we do and how much resources do we have for both extremities?

Climate change actually has brought extreme weather conditions in many parts of the world. Many of us would have read that Paris has just experienced one of the worst floods because of the rising Seine River, prolonged rain for two weeks that recently has closed even the Louvre Museum. At the same time, down south, Cape Town is experiencing drought condition for three years, just like us. But they were not ready. They did not put in the right things at the right time and now may run out of water within two to three months. Cape Town is now racing to look at solutions to solve their water problem.

Therefore, when we look at our problems, we have to look at conditions of what we need to do and how fast we can do what, and which we should put priorities on. We have 8,000 kilometres (km) of drains, canals and rivers. If you put this end to end, from the surface of the earth, it will go through the centre of the earth with 2,000 km to spare. That is how long our drains, canals and rivers are.

So, we have to be cautious about making commitments that everything will be settled quickly. We also have to ensure that drains are not the only ones that will solve the problem. We have to ensure at the source or the receptor of where this rainfall happens, the developers and the people who own this part of land, must also play their part.

So, it is not easy to answer just because the drains will be ready by this time, the flash floods will be gone. For example, right now, there are about 500 submissions for plans to do retention tanks for those developments above 0.2 hectares. Of this, only 158 have been completed. Now, together with the drain and the receptor, source and completion of all the projects there, we will have a better chance of avoiding the flash floods. But like I said, it is impossible to totally eliminate them because this will occur. It is more important for us to give as much timely warning as possible to our public to ensure that they do not traverse these flash floods, which will usually go away within 50 minutes to 60 minutes. Perhaps, take a detour.

Mr Murali Pillai.

I thank the Minister for his comprehensive response to my question. May I ask the Minister how does his Ministry propose to exercise oversight over the developers and the construction companies, so that their activities would not block the drains and canals and keep them free of debris?

Contractors, in preparing the site, have to submit to PUB their plans for diverting drains, for keeping the original drain design, for taking away the water from the site intact so that rainfalls or the design capacity of the drain will not affect the surrounding areas. This has worked most of the time.

Where we have found flash floods occurring in areas where we know do not frequently occur or rarely occur, it is usually because the contractors have not implemented what they are supposed to do or implemented something else in order to make their worksite either accessible or easier to work on. When this happens, as in the recent case of Tampines Avenue 12, we will take action against the contractor, bring them to Court and fine them.

The following question stood in the name of Dr Intan Azura Mokhtar –

10 To ask the Minister for Transport whether there are plans to make it a requirement for bicycle-sharing companies to collectively invest in and construct bicycle docking stations, particularly around housing estates, to mitigate the current problem of having their shared bicycles strewn around untidily or causing obstruction.

11 Mr Lim Biow Chuan asked the Minister for Transport whether enforcement action will be taken against hirers of rental bicycles who dump the bicycles in an indiscriminate manner.

12 Mr Pritam Singh asked the Minister for Transport (a) whether the geo-fencing and incentive/disincentive elements in the bike-sharing operators' mobile applications have addressed the indiscriminate parking of bicycles; (b) what more can be done to compel the operators to make more investments to unilaterally clear indiscriminately parked bicycles expeditiously; and (c) whether the Ministry will consider subsidising agencies, such as Town Councils and commercial establishments, to remove or report such bicycles.

Question No 10, Sir.

(for the Minister for Transport): Mr Speaker, can I have your permission to take Question Nos 10 to 12 together?

Yes, please.

The Land Transport Authority (LTA) has been working with the other agencies to provide more parking spaces and step up enforcement. Since enforcement commenced in May 2017, LTA has issued more than 2,100 removal notices and collected about $180,000 in fines and administrative fees from the Bicycle Sharing Operators (BSOs). In October 2017, LTA, the National Parks Board (NParks) and Town Councils signed a Memorandum of Understanding (MOU) with BSOs, which sets out guidelines on the responsible operation of bicycle-sharing services in public spaces.

LTA will also be proposing legislative amendments later this month to put in place a licensing framework for BSOs. As part of the proposed licensing framework, BSOs will be required to remove indiscriminately parked bicycles on public land within a stipulated time period. BSOs will also be required to adopt schemes that will disincentivise users for indiscriminate parking. This may involve high-accuracy geo-fencing. More details of the licensing framework will be announced when ready.

Mr Lim Biow Chuan.

Mr Speaker, may I ask the Senior Minister of State what is stopping the Ministry of Transport from taking enforcement actions against hirers of bicycles from being prosecuted because of the way they dump the bicycles?

If we fine litterbugs from throwing cigarette butts, why should we not fine bicycle users for throwing their bicycles on the roadside, or expressways, flyovers, drains? Surely, these are worse litterers. They create such an eyesore for members of the public, so the entire public is put to inconvenience because of the indiscriminate littering of bicycles by some inconsiderate users.

I would like to thank Mr Lim for the supplementary question and I understand the frustration faced by the public. LTA currently adopts a five-pronged approach to managing disamenities of dockless bicycle sharing.

First, we are providing more public bicycle parking spaces. In fact, all Government agencies and Town Councils allow shared bicycles to be parked in all public bicycle parking areas. There are currently about 174,000 bicycle parking lots available, and we plan to add another 50,000 by 2020.

Secondly, through educating and guiding proper parking behaviour. LTA has been working with the BSOs to educate shared bicycle users, and we have developed educational materials on proper bicycle etiquette.

Thirdly, to shape user behaviour. Some BSOs have implemented GPS geo-fencing, and users that park bicycles within a geo-fenced parking zone are given incentives. There are also BSOs which have implemented Radio Frequency Identification (RFID) geo stations and charge a towing fee to users who do not park properly.

Fourthly, of course, we do step up enforcement actions. Currently, what we do is to fine a BSO which fails to retrieve indiscriminately parked bicycles. In fact, the fine ranges from $100 for the first offence, $200 for the second offence and $500 for subsequent offences.

Next, like I had mentioned in my reply, we did sign an MOU together with the BSOs, NParks and Town Councils. The MOU aims to encourage responsible operation of bike-sharing services in public spaces.

With regard to penalising users, under the current Street Works Act, users who indiscriminately park their bicycles on public streets and cause obstruction and inconvenience can be fined up to $2,000. However, there are challenges. It is difficult to catch users in the act of parking bicycles indiscriminately. I would like to share with Mr Lim that at this moment, we do not have users who have been caught so far.

Dr Intan Mokhtar.

Can I just check how many times have each of the BSOs been issued fines for neglecting the shared bicycles that are strewn all over the place, and are there plans to tighten this penalty mechanism imposed on the BSOs?

Based on the number of notices issued and bicycles impounded from the period May 2017 to 21 January 2018, there was a total of 2,171 removal notices issued, and the number of bicycles impounded adds up to 341. The total fines collected by LTA amounted to about $180,000. These do not include those issued by the Town Councils or NParks.

Mr Pritam Singh.

I would like to thank the Senior Minister of State for his reply. I would like a bit more information on this licensing regime that the Minister spoke about. Because it does appear that in spite of these fines that have been given to the BSOs, there is still a long way to go in terms of ensuring that the bicycles are not causing disamenity to members of the public.

Can I ask the Senior Minister of State is there a regime which LTA imposes on the BSOs to clear bicycles expeditiously? I think there is currently a four-hour timeline where they have to remove the bicycles. However, many of them still cannot make that timeline. In relation to my Parliamentary Question, even though Town Councils have signed the MOU with LTA, the reality is Town Council officers or property officers do not have that much leeway of time to go around looking for these bicycles and then monitoring whether they are cleared within four hours or not.

Is LTA going to look at the prospect of requiring the BSOs to intensify their efforts to pick up illegally or indiscriminately parked bikes? Because they are profit-making entities after all.

Indeed, I agree with Mr Pritam Singh that the BSOs are not performing up to the desired outcomes that LTA would want them to. This is the reason why we will be proposing legislative amendments to put in place a licensing framework for BSOs. I will be sharing more of this when it is ready.

Miss Cheryl Chan.

I would like to ask the Senior Minister of State a question. I think part of the issue is about the demand and supply, probably because of the cost of the bicycle. How is LTA monitoring and managing this with the BSOs in terms of the growth rate with which they are putting the bicycles out?

I would like to thank Miss Cheryl Chan for the supplementary question. LTA does have regular meetings with BSOs to discuss issues relating to their daily operations as well as the problem of indiscriminate parking. At the same time, we do discuss with the BSOs with regard to the optimum fleet size that will meet the requirements of Singaporeans. I would like to reassure Miss Cheryl Chan that we will continue to do so with the BSOs. At the same time, when we do propose the legislative amendments, this will set out the regulatory framework, the licensing framework, to control the operations of the BSOs.

Dr Tan Wu Meng.

I thank the Senior Minister of State for his answers. Can the Senior Minister of State assure the House and residents affected that in this study of the upcoming framework, his Ministry will study expedited requirements to remove a bicycle, especially in areas where access is critical? I raise this because my residents have encountered these shared bikes blocking fire exits, wheelchair ramps and other essential parts of the estate, and they are worried that the companies are socialising the costs while privatising the profits.

I would like to thank Dr Tan for the supplementary question. This is exactly the intent of the legislative amendments and the framework that we will be coming up with. We will be consulting the stakeholders as well as the industry. And we will keep all these in mind during the discussion.

Mr Lim Biow Chuan.

I wanted to ask the Senior Minister of State why are we just focusing on giving fines to the BSOs? Surely, the BSOs should be able to review the data of the last user of the bicycle who left his bicycle in an indiscriminate manner. Would the Senior of State not agree with me that we would be better able to shape user behaviour if we impose a fine on those users who park their bicycles in a manner that obstruct fire exits and wheelchair ramps?

I totally agree with Mr Lim. In fact, that is the intention. With the new legislative framework, we do want the BSOs to impose some form of disincentive with regard to renting out of the bicycles. I would just like to remind all Members of the House that while there may be interim inconveniences and disamenities, I would like to reiterate that there are actually many benefits of the bike-sharing scheme, not just the disamenities that we are currently facing, which may be transient in nature. Benefits include transport flexibility in terms of first- and last-mile connectivity. There will be reductions in vehicle emissions if we are able to bring the population of car ownership down. In addition to that, there are also health benefits of cycling. It will also reduce congestion and fuel consumption. More importantly, it complements our vision of a car-lite society.

I was particularly thrilled by a column that I read yesterday, an opinion of the day by one of our young journalists in The Straits Times. She shared her initial apprehension and scepticism of the bike-sharing scheme but later found the experience pleasing and enjoyable, and I would like to quote her:

"When the bike-sharing scheme started in Singapore about a year ago, some turned up their noses at this new sharing economy service and doubted it would last. After all, photos of bikes upended in the middle of a desolated field or abandoned in the storm drain triggered widespread outrage.

But writing here as a car-less commuter who often feels defeated by the merciless crush of people on public transport, I am all for bike-sharing as it has given commuting a new lease of life and transformed the way I experience my city."

So, I would like to urge all Members of the House and fellow Singaporeans to give the bike-sharing scheme a chance to evolve into a safe and convenient mode of transport in our daily lives. However, for this to become a reality, we need the support of everyone ‒ the authorities, the BSOs and, more importantly, you, the users of the bike-sharing scheme.

13 Er Dr Lee Bee Wah asked the Minister for Transport (a) what has been the take-up rate for the Off-peak Monthly Travel Pass for persons with disabilities and senior citizens; (b) why was it discontinued without prior notice; and (c) whether there are plans to provide cheaper off-peak or weekend travel options to encourage senior citizens to stay active.

14 Assoc Prof Daniel Goh Pei Siong asked the Minister for Transport (a) what is the reason for scrapping the $40 monthly unlimited off-peak travel pass for senior citizens; (b) how many seniors are affected by the scrapping of the pass; and (c) what percentage of seniors have switched to buying the $60 Senior Citizen Monthly Concession Pass.

Sir, senior citizens and persons with disabilities enjoy concessionary fares that are 25% off adult card fares at all times. Regular commuters among this group can also buy the monthly concession pass at half the price of the regular adult monthly pass.

The off-peak pass was introduced in July 2015 as a trial to see if we can get regular commuters to shift from peak to off-peak travel. However, the result has been disappointing. It has shifted less than 200 of the pass users to off-peak travel.

As the scheme has clearly not been effective, the Public Transport Council (PTC) recommended discontinuing it starting this year. Instead, under a new scheme, all commuters can enjoy a fare discount of up to 50 cents throughout the rail network if they tap in before 7.45 am. Senior citizens and persons with disabilities enjoy this discount on top of their regular 25% discounts. The new scheme was launched with wide publicity. PTC, the Land Transport Authority and the public transport operators have placed posters at all Mass Rapid Transit stations and buses since the middle of December last year. More than half of the senior citizens and persons with disabilities off-peak pass users have switched to buy the monthly concession pass in January this year.

Er Dr Lee Bee Wah.

I would like to ask the Minister two supplementary questions. The fact that there was quite a lot of discussion on the ground on this means that it affects these 200 users. I would like to ask whether there is a study to see whether these 200 commuters who used the old scheme were worse off or adversely affected under the new scheme. Secondly, if they need help, is there any other help that is available, such as transport vouchers or anything else?

Minister, can you also clarify whether you are taking both Question Nos 13 and 14 together?

Yes. I do not have the data that Er Dr Lee Bee Wah has asked for, except to say that when we design a public scheme, it must benefit as wide a number of people as possible. After all, we are spending taxpayers' money. When the scheme was formulated, I suppose we were optimistic that there would be many who will benefit and make the switch. Unfortunately, it did not turn out to be so. I think it is the right decision on the part of PTC to recommend disbanding this but, instead, bring out a new scheme, which is what we are enjoying today, which will benefit hundreds and thousands of commuters.

Of the handful who probably are adversely affected, how best to do it? Well, my favourite Member of Parliament (MPs) has good solutions. Good local MPs can always come up with local solutions. When we know a particular resident has been inconvenienced because of this, and yet despite the various 25% discount and so on, still could not afford their transport fares, as a local MP, we do chip in, if I discover such cases. I am quite sure Er Dr Lee will know how to do it.

Assoc Prof Daniel Goh.

I thank the Minister. Just a question about the experimental effect because it seems like people have switched from the off-peak pass to the all-day pass. Will this increase senior citizens travelling in peak periods and, therefore, actually defeating the purpose of the experiment in the first place?

I doubt it. But we would not know until it starts. So, we will analyse the impact of these various new schemes that have just been brought in. It is just a few weeks in the run and we will see whether we need to refine the scheme as we go along.

Last week, I was reading about the death of the famous founder of IKEA. He is a legend and there are many stories about him. I remember his Chief Executive Officer always related an anecdote where, in a board meeting, the founder questioned him, "What are the mistakes you have done?" Meaning that, in life, we must always experiment, try out things. If you never did, you never tried out anything, then that is your biggest mistake.

Assoc Prof Daniel Goh.

Just a quick question. Why not give the senior citizens the flexibility of choice between the off-peak pass and the all-day pass? Maybe an experiment?

We will see. But now that we have tried this experiment and found that the off-peak pass has failed miserably, why do we want to do it again? So, yes, while I encourage making mistakes, trying out new things, but when we have discovered something does not work and we keep on banging our head against the wall, why do we do that? We will get a headache.

15 Mr Desmond Choo asked the Minister for Education (Schools) (a) what is the current capacity and take-up rate of after-school student care centres; (b) how does the Ministry continuously ensure that student care remains affordable; and (c) whether there are plans to set minimum operating standards for after-school care.

Mr Speaker, over the last six years, the Ministry of Education (MOE) has increased the number of school-based Student Care Centres (SCCs) from 50 to 162. Their enrolment has increased from 3,000 in 2012 to 21,000 today, or 9% of all primary school students. Where there is demand for school-based student care services, schools will work closely with the service providers to expand their capacity at a pace that does not compromise quality. MOE is on track to have SCCs in all our primary schools by end 2020.

There are also SCCs outside of schools that provide after-school care for students. Currently, there are 261 community-based SCCs registered with the Ministry of Social and Family Development (MSF), with a total enrolment of about 11,000 students, and with some spare capacity. Together, MOE and MSF monitor the capacities and enrolment of both school-based and community-based SCCs closely.

To ensure affordability for children from lower-income families, the ComCare Student Care Fee Assistance (SCFA) scheme provides needy families with assistance to offset their monthly SCC fees. With the assistance, eligible students can pay as little as $5 per month. MSF regularly reviews the ComCare SCFA scheme to ensure that student care remains affordable for lower-income families.

All registered SCCs are required to comply with requirements covering areas like supervision, safety, health and hygiene. In addition, for school-based SCCs, the service providers are selected via a stringent and competitive procurement process and have to meet contractual requirements for quality in areas, such as programmes, staff training, level of care and environment. Schools maintain close oversight of SCC operations to ensure that quality is maintained.

Mr Desmond Choo.

Speaker, I would like to thank the Minister for his comprehensive reply. Just one point of clarification. There has been feedback from parents, especially in schools whereby there are younger parents and more children, that some schools have to prioritise the after-school student care for the lower primary students. This has caused some inconvenience, especially when they have two or more children in school and one of them has to go into the private space. Can I check with the Minister if the plan is to cater capacity for all levels of primary school students?

Mr Speaker, I thank the Member for his question. The size of the waitlist for primary schools varies for different schools. But on average, the number of waitlisted students is low. Where there is excess demand, schools will work with the SCC operators to see how we can expand the number of classrooms to cater for this enrolment demand.

Having said that, it is with the caveat that this expansion does not compromise the quality of student care. As I have said in the reply earlier, MOE has expanded the student care facilities quite tremendously in the last few years. So, while we cater to the quantity of students needing the care, we want to ensure that the quality is built up correspondingly as well.

Dr Intan Mokhtar.

May I ask the Minister whether there are plans to have a standard framework for after-school care centres, similar to what we have for childcare centres, which is the SPARK certification framework, to ensure that there are certain standards of operation, as well as standards pertaining to the personnel who take care of these student care centres?

I thank the Member for her question. Indeed, the SCC programmes are well-planned. In the midst of building up these student care centres, we ensure the quality and, therefore, the overall standards, whether it is environment, hygiene, even some of the programmes. To uplift the quality of SCC staff, MOE, MSF and Workforce Development Agency ‒ now, Workforce Singapore ‒ have introduced a 40-hour training programme for new and untrained SCC staff. This course is currently undertaken by Ngee Ann Polytechnic and was launched in 2015. So far, it has trained about 622 staff to date. With these training programmes, we hope to uplift and upkeep standards.

16 Dr Tan Wu Meng asked the Minister for Education (Schools) (a) whether the Ministry monitors the number of student activities in schools that involve co-payment by students; and (b) of such activities, what proportion is (i) compulsory, (ii) on an opt-out basis and (iii) on an opt-in basis but with 50% or more of eligible students participating.

Mr Speaker, to enhance the learning experience of our students, our schools have discretion to go beyond the core curriculum to provide richer learning experiences for different segments of students. We do not actively monitor whether such activities involve co-payment from students, nor do we stop schools from making collections for these activities, as we believe that families should play a part in supporting their children in education as part of their familial responsibility.

However, we regularly remind schools that such payments should not be excessive and should be affordable to parents. Students can also opt to pay for these activities using their Edusave accounts. For students from less advantaged backgrounds, schools can further subsidise or even fully pay the cost of their participation using specific funds provided by the Ministry of Education (MOE), such as the School-based Financial Assistance Grant and the Opportunity Fund. Most importantly, no Singaporean student will be deprived of an educational opportunity because of his or her family's financial circumstances.

Dr Tan Wu Meng.

I thank the Senior Parliamentary Secretary for her answer. Would the Ministry, at some point, as part of the ongoing review of students' socio-economic circumstances, consider conducting such a study in schools, so as to see if students may inadvertently be discouraged from such activities by perceptions that the activities might not be accessible?

I want to thank the Member Dr Tan Wu Meng for the supplementary question. I also want to take the opportunity to assure the House that schools are sufficiently resourced to run quality programmes. Our staff and teachers in schools are well-trained to observe and, in a way, sensitively, identify students' well-being and, based on their attendance and attention span, whether there are any issues troubling them.

I mentioned briefly that there are two funds that the schools can tap on – the Financial Assistance Grant and also the Opportunity Fund. The staff in the school will be able to tap on these funds to help the students whether to make the co-payment, if required, or tap on the Financial Assistance Grant to pay for textbooks, uniforms and so on. All these will be done very sensitively.

Just to give an update, in the last two years, 60% of the Opportunity Funds are used to pay for students' additional learning opportunities. So, I really want to assure the Member and the House that no Singaporean student will be denied access to quality education because of their families' financial circumstances.

17 Mr Desmond Choo asked the Minister for Home Affairs with regard to the recent theft of large quantities of fuel from Pulau Bukom (a) whether the petrochemical companies' security and governance processes require tightening, especially in sensitive areas, such as Pulau Bukom and Jurong Island; and (b) how is the Ministry working with the petrochemical companies to ensure that hazardous and flammable materials do not fall into the wrong hands.

Mr Speaker, Police's investigation is ongoing and it will be inappropriate for me to comment on it.

Generally, petrochemical companies which store large amounts of petroleum and flammable materials must obtain a licence from the Singapore Civil Defence Force (SCDF).

The licence is renewed annually and applicants must put in place security measures to prevent unauthorised access to, and unauthorised activities involving the petroleum and flammable materials. Licences that involve volatile petroleum and flammable materials are deemed to be of higher risk and are subjected to site inspections to assess the adequacy of their physical security measures. These include companies on Pulau Bukom and Jurong Island.

Licensees are also required to immediately notify the SCDF of any loss or theft of petroleum and flammable materials from their premises and put in place measures to prevent recurrence. Beyond physical security measures, companies storing petroleum and flammable materials have a duty to establish robust internal governance and oversight to safeguard their petroleum and flammable materials.

The Police and SCDF will continue to engage these companies through regular platforms, like the Jurong Island Safety and Security Watch Group, to share best practices, trends and lessons from past incidents.

Mr Desmond Choo.

Mr Speaker, I thank the Second Minister for her comprehensive reply. Just a couple of clarifications.

First, understandable that while investigations are ongoing, the Minister could not share more, but is there any reason to believe that the processes have not been thorough on the part of the companies that require the Police to enhance and tighten those processes?

Secondly, because of the large quantities that had been stolen, are there any reasons to believe that any other companies will require similar tightening processes?

Mr Speaker, I shared earlier in my response that the licensees are regularly inspected. In the case of Shell Bukom, they were, in fact, last inspected in December 2017. At that time, they were found to have met with the compliance requirements of the licensing conditions.

The matter is before the Courts, so I cannot say very much more, except that the investigations seek to reveal how the thefts occurred, and this may or may not have anything to do with the adequacy of the security measures. So, the best thing for us to do is to let the Police complete their work and then we can have a meaningful discussion on what more can be done to prevent such recurrence.

18 Mr Pritam Singh asked the Minister for Home Affairs (a) whether the Police will favourably consider an application to collect signatures for the purposes of a Parliamentary petition on any given matter in a public place; and (b) how and at which public venues other than Speakers' Corner can citizens legally make arrangements to sign a Parliamentary petition as the Parliamentary Standing Orders require a physical signature.

(for the Minister for Home Affairs): Such events can be held at the Speakers' Corner. And those who wish to hold such events outside the Speakers’ Corner will have to apply for a permit. A Police permit is not required for public assemblies at the Speakers' Corner which meets the conditions set out in the Public Order (Unrestricted Area) Order 2016.

Mr Pritam Singh.

I would like to thank the Parliamentary Secretary for his reply. I have just one supplementary question. Can he please share details on how the Police exercises its discretion in requiring some calls for signatures for the purposes of a petition to go ahead without a permit, while requiring a permit in other instances, and I am referring to episodes outside of the Speakers' Corner.

I think in those cases, it is fact-sensitive. It depends. If there are particular incidents which the Member would like clarification on, it is best to file a separate Parliamentary Question (PQ) on this, so that we can look deeply into the issue and give a comprehensive response.

Mr Pritam Singh.

I note the Parliamentary Secretary's reply. I think the specific issue was with reference to an article in The Straits Times on 20 January 2018 referring to a public petition that was conducted for the purposes of the Sungei Road Flea Market. It was organised without a permit, and the Police did not intervene in that case. So, the point of the supplementary question really was to understand how the Police assesses when a permit is required and when it is not required.

On when the permit is or when the permit is not required is clearly set out in the Act provisions. As I mentioned, the Police will generally act on information received and conduct investigations before deciding on what actions to take. If there are specific cases – the Member mentioned about the issue of the Sungei Road Flea Market – it is best that he files a separate PQ so that we can look into the incident and give him a comprehensive response.

19 Ms K Thanaletchimi asked the Minister for Health (a) whether all the public healthcare institutions have adopted skills, experience and competency-based remuneration rather than one based primarily on academic qualification; and (b) whether there is a willingness by these institutions to have a timeline to break away from the existing glass ceiling, with human resource policies driven by skills recognition, especially for new recruits, instead of academic qualifications alone.

Public healthcare institutions are progressively moving beyond academic qualifications to skills and competencies in the recruitment, remuneration and promotion of staff. Academic qualifications are commonly used as a reference for new recruits who usually have little or no work experience. For mid-career recruits, their relevant experience is taken into account when determining their salaries. Beyond the entry grade, salary and career progression are now mostly performance- and competency-based. For example, nurses' remuneration and promotion depend primarily on their job performance and acquisition of specialised skills, rather than their previous academic attainment or grades.

To further strengthen the competency-based human resource system, the Ministry of Health is partnering SkillsFuture Singapore to develop the Skills Frameworks for Healthcare for the healthcare workforce, including nurses, allied health professionals, pharmacy technicians and support care staff. The Skills Framework will articulate the roles, skills, competencies and training required for each job role. We also hope to work with the unions to implement the Skills Framework when it is ready by the end of this year.

The following question stood in the name of Dr Lim Wee Kiak –

20 To ask the Minister for Health with the introduction of the National Electronic Health Record (NEHR) (a) how will the Ministry safeguard the confidentiality of the records as data leaks can affect a patient's employability and career prospects; (b) what security measures will be put in place to ensure that not every employee in a clinic has access to the records; and (c) what measures are put in place to prevent data breaches.

Question No 20.

Mr Speaker, data security and protection are key considerations in the design and operation of the National Electronic Health Record (NEHR) system. This is achieved through a combination of legislative measures, data management policies, system features and public education.

All access to the NEHR system will be governed and authorised by the Ministry of Health (MOH). For example, when a general practitioner (GP) applies for an account to the NEHR, the application will be subjected to MOH’s review and approval before access is granted. Access to individual health records through the NEHR is meant for purposes of direct patient care. Beyond that, any access to individual health records, such as for purposes of coroner’s investigation, will only be granted if it is enabled by the relevant legislation. NEHR information will not be revealed to third parties like insurers and employers.

To deter unauthorised access, a two-factor authentication system has been incorporated, together with features to detect suspicious access and usage. In addition, all access to the NEHR is captured in audit logs and patients will be able to view a record of accesses made to their NEHR records so that they can report unauthorised access.

When suspicious access is detected or reported, we will carry out investigations and those found to have misused the system will be dealt with under the law, in accordance with the penalties under the Cybersecurity and Computer Misuse Act and the proposed Healthcare Services Act.

Mr Speaker, to protect against cyberattacks, the NEHR system has a multi-layered cybersecurity defence. Security penetration tests and independent cybersecurity audits are conducted regularly. While measures have been put in place, we need to continue to remain vigilant.

21 Mr Zainal Sapari asked the Minister for Manpower (a) how is retirement adequacy determined and what are the cost indicators that are used to determine it; (b) how many Workfare Income Supplement (WIS) recipients who are above 55 years old are assessed to have retirement adequacy; and (c) whether the WIS has helped low-wage workers to have retirement adequacy.

Mr Speaker, the Central Provident Fund (CPF) Retirement Sums provide a measure of retirement adequacy and they take into account retiree household expenditure patterns, as recommended by the CPF Advisory Panel. The Basic Retirement Sum (BRS) for the cohort turning 55 this year is $85,500 and that amount will provide a lifelong monthly payout of $720 to $770 from the age of 65.

In 2016, 58% of active CPF members at age 55 met the BRS. Ten percent of this group were Workfare Income Supplement (WIS) Scheme recipients.

Of the remaining 42% of active CPF members at age 55, 55% were WIS recipients. From that perspective, the WIS Scheme is going towards those who need it more for building up retirement adequacy. On average, these members received a total of $5,500 in WIS top-ups to their CPF up to age 55. For members who do not have the BRS at age 55, they can continue to work over the next 10 years and make up for this shortfall in their BRS through CPF contributions and WIS top-ups.

Mr Zainal Sapari.

I thank the Second Minister for her reply. Every retiree will be concerned with inflation. Most low-wage workers may, at best, opt only for the BRS plan which gives a stagnant payout. What can the Government do to protect the real value of their savings against an inflation for this group of people to ensure that the payout will be sufficient to meet their basic retirement needs?

Mr Speaker, I thank the Member for his supplementary question. In fact, we are not depending on the WIS Scheme alone to help low-wage workers build up retirement adequacy. Aside from WIS, we have taken various steps to help low-wage workers. This includes higher interest rates of up to 6% on the first $30,000 of CPF balances for members age 55 and above. We have also liberalised our CPF transfer rules to enable members who have met their BRS to support their spouses and parents with lower balances through CPF transfers. So, in other words, if you are a WIS recipient, you can also get help from other members of the family.

In 2016, we introduced the Silver Support scheme to supplement the retirement incomes of the bottom 20% of the elderly who earned lower wages through life and currently have little or no family support.

Overall, it is an approach that encourages individual effort, as well as family support, supplemented by Government top-ups and schemes which strengthen social protection.

As to the Member’s concern about inflation, under the CPF LIFE Scheme, CPF members, not just those who do not meet the BRS, can opt for the CPF LIFE Escalating Plan. What that would enable them to do is to accept a lower monthly payout when they start but, over time, to have the payouts increase to meet their spending needs. The CPF LIFE Escalating Plan started on 1 January 2018.

Mr Ang Hin Kee.

A supplementary question for Second Minister: what advice would she have for younger freelancers to start preparing for retirement adequacy before they reach 55 years old?

It is a very good question. I believe Mr Ang, together with colleagues from the Ministry of Manpower, are part of a tripartite workgroup that have been looking into this issue for the past eight to nine months, if I am not wrong. In fact, I am very much looking forward to the recommendations from the tripartite workgroup. But since the Member has asked the question, I would like to point out that, today, freelancers or self-employed persons can also make use of the CPF scheme to help build up their healthcare and retirement adequacy.

For healthcare adequacy, they are already required to make annual contributions to their CPF MediSave accounts. There is no such requirement for freelancers to contribute to their Ordinary Accounts or to their Special Accounts. But there is nothing to prevent them from making their own cash top-ups to the Special Account and to enjoy the benefits of doing so, for example, the very attractive interest rates.

What more can we do? I think we can have a meaningful discussion once the tripartite workgroup provides its recommendations. I believe we would not have to wait much longer for that.

22 Mr Png Eng Huat asked the Minister for Manpower (a) as of December 2017, what is the number of residents placed under the Silver Support Scheme (SSS); and (b) what is the number of SSS recipients who are also receiving financial aid from the Social Services Offices.

Mr Speaker, the Silver Support Scheme (SSS) was introduced in 2016 to support the bottom 20% of elderly Singaporeans aged 65 and above, with a smaller degree of support extended to up to the next 10% of seniors. The scheme is targeted at seniors who had low incomes through life and who currently have relatively little or no family support. It complements the comprehensive range of Government schemes that help seniors with various needs, such as housing, healthcare and retirement.

Over 152,000 seniors received Silver Support payouts in 2017. Of these, around 6,100 were also recipients of ComCare financial assistance.

Mr Png Eng Huat.

Mr Speaker, Sir, just a supplementary question. Some SSS recipients who are also Social Services Office (SSO) recipients shared with me that their financial aid from SSO was reduced by a corresponding monthly amount equal to their SSS payout. So, I would just like to ask the Second Minister, do the officers of SSS and SSO work together to determine the final quantum of financial aid paid out to these selected recipients?

Mr Speaker, I thank the Member for his question. It really depends on what kind of support they are getting from the SSO.

For example, if they are receiving ComCare long-term assistance, then, in fact, it would not affect their eligibility for a Silver Support payout and vice versa. But there are recipients of ComCare Support who are receiving the support for only an interim period, for the short term. This is temporary relief. As a result, the SSO will take into account all of the incomes that they have, including what they may be receiving under SSS. So, it really depends on the individual circumstances.

The best way, if Mr Png has encountered specific residents with such a question, is that they can refer the question to the SSO, who would be quite happy to explain to the ComCare recipient the circumstances that are unique to him and how the payouts are determined.

23 Ms Joan Pereira asked the Minister for National Development in light of the recent cases of falling trees (a) whether NParks will consider increasing the frequency of tree inspections, particularly in high density population areas; and (b) what action does NParks recommend pedestrians and motorists take when they become victims of fallen trees.

Mr Speaker, the National Parks Board (NParks) already does more frequent checks for trees located in areas with high human and vehicular traffic. More specifically, NParks has increased its tree inspection frequency to address unpredictable and severe weather conditions. For example, trees along expressways and major roads used to be inspected every 12 to 18 months. Since 2012, trees in these locations have been inspected every six to 12 months. Since 2016, NParks has also instituted an annual second-level inspection for older trees of more than four metres in girth.

Besides increasing the frequency of inspections, NParks has introduced other measures to prevent tree fall incidents. First, NParks prunes trees to improve their structure and balance, especially before monsoon seasons. Second, NParks is developing new modelling techniques to understand the impact of adverse environmental conditions like strong winds and heavy rainfall on the structural integrity of trees. These ongoing studies will inform future improvements in tree risk management. With these checks and measures, the number of tree failure incidents in 2017 was the lowest on record at 406, having declined by 60% since 2012.

NParks is also supporting other stakeholders, like the Housing Development Board and JTC, which manage trees in Singapore by providing technical training on tree health and maintenance.

If members of the public are affected by a fallen tree, they can use the OneService mobile app to report the incident or call the NParks hotline. NParks and the relevant agencies will do whatever they can to render assistance to those affected.

24 Mr Liang Eng Hwa asked the Minister for National Development what are the causes of the recent sharp rises in the popping and cracking of floor tiles at some HDB flats and how does HDB assist residents faced with such situations.

Mr Speaker, Sir, tiles, like all fittings, fixtures and finishes in a flat, are subject to wear and tear over time. They may dislodge due to various reasons, such as differential thermal expansion and contraction of tiles, or the natural deterioration of the bond between the tiles and the screed surface. All these can cause a loss of adhesion between the tiles and the screed surface, and the dislodgement of tiles.

We have observed a higher number of reported dislodged tiles cases in the first half of January 2018. This was likely due to the unusually cold weather over a prolonged period and temperature fluctuations. The weather changes could have caused the tiles and the substrate to contract and expand at different rates, resulting in the loss of adhesion between the tiles and the substrate. This phenomenon is not unique to Singapore and has also occurred in countries, such as Taiwan and Hong Kong. Among the cases reported in Housing and Development Board (HDB) flats, close to half involved tiles installed by the flat owners during their own renovations.

Flat owners are responsible for maintenance of their own flats, including repairs for general wear and tear. In private developments, developers generally only rectify dislodged tiles during the one-year defects liability period (DLP). Some developers may offer repair for dislodged tiles for a slightly longer period, for example, three years, but those are generally done on a goodwill basis.

HDB’s practice has been more generous. Besides helping flat owners repair dislodged tiles originally provided by HDB during the one-year DLP, it also offers goodwill repairs for such dislodged tiles for up to 15 years. For cases beyond 15 years, flat owners will need to do their own replacement of tiles. Nonetheless, HDB will do its best to assist, for example, by helping the owners with the removal and disposal of the affected tiles and, if necessary, laying protective sheets over the affected areas.

HDB has also worked with the Renovation Contractors and Materials Suppliers Association to compile a list of contractors whom residents can choose to engage on a private basis. These are contractors who are able to repair the dislodged tiles at reasonable rates.

Grassroots organisations and Community Development Councils (CDCs) can also make use of existing local schemes to assist local residents who need financial help in this regard.

Mr Liang Eng Hwa.

Mr Speaker, Sir, first and foremost, I want to thank HDB for extending the Goodwill Repair Scheme to flats up to 15 years. In all fairness, this is a generous goodwill offer.

I have two further questions for the Second Minister. I do have higher reported cases as well in the first two weeks of January. In fact, it was more than 30 cases reported. I do notice that certain clusters of flats have more cases. I want to ask the Second Minister if, indeed, it is a batch problem, whether it is a problem with quality or workmanship. Therefore, if that is the case, would HDB be flexible to extend that goodwill repair to those cases, even though it is after 15 years?

Secondly, I hope the Second Minister can understand that when residents see the tiles popping up on the floor, it can be quite a traumatic experience. And the next shocking truth is, of course, to know the costs of repair, which can range from $5,000 to $10,000. For a three- to four-room flat, with a household income of $2,000 to $4,000 a month, that is a major outlay. If they are not lucky enough to have the tiles pop up before 15 years, they have to go and find ways to find cash to pay for it.

So, would the HDB look at other ways to assist residents who are faced with such problems, because we do not want them to resort to licensed or unlicensed moneylending to fix the tiles. Can HDB facilitate some kind of financing scheme, very much like how other agencies have done, like the small and medium enterprises financing or the Study Loan where we work with the financial institutions to do it?

Can the Member keep it succinct, please.

Given that HDB does have the flat as a collateral, would the Second Minister consider this?

Mr Speaker, Sir, for the first question, if the Member can flag out the specific blocks, we will get HDB to look at the causes or look at the popping tiles and see what might have caused it and we will then follow up appropriately.

On second question, as I said earlier, if local residents face financial difficulties in dealing with popping tiles beyond the 15-year period, then they can approach their local CDCs and their local Grassroots Advisors to see if there are schemes that can assist them. There are some CDCs that already have such schemes in place and these have been of great help to residents.

Order. End of Question Time.

[Pursuant to Standing Order No 22(3), provided that Members had not asked for questions standing in their names to be postponed to a later Sitting day or withdrawn, written answers to questions not reached by the end of Question Time are reproduced in the Appendix.]

Thank you, Mr Speaker, for allowing me to make this Statement.

The Attorney-General's Chamber (AGC) made a Reference to the Court of Appeal on the City Harvest Church Case. Two questions were asked. On 1 February 2018, last week, the Court of Appeal released its decision on the Reference.

I want to set out the Government's position, now that the Court of Appeal has said what the law is.

The key question is related to the liability of company directors, governing board members, key officers of charities and officers of societies. When they commit criminal breach of trust (CBT) or property which belongs to the organisation, what happens?

The Court of Appeal ruled that such officers are liable to be punished under section 406 of the Penal Code that provides for a maximum sentence of seven years’ imprisonment, or fine, or both.

The Court of Appeal also ruled that these officers do not come within the term, the meaning of a professional “agent”, and therefore, they were not liable for the more serious penalties under section 409 of the Penal Code for CBT. Section 409 provides for a maximum of life imprisonment.

The Government's policy is clear. If you are a senior officer, director in the organisation, you are in a position of greater trust. You have considerable authority to make decisions in relation to the organisation’s assets. If you abuse that trust, you should be more culpable and should be liable for more severe punishments, compared with an ordinary employee. That is really common sense and there can be no question about that.

For the last 40 years, the law, as applied by the Courts, reflected this principle. In 1976, the High Court ruled so in the case of Tay Choo Wah. It said that directors are liable for the aggravated offence provided under section 409. After that decision, the position was clear, settled law. The law was applied in that way for over 40 years, by Courts in other cases. There are at least 16 decisions – reported – applying this principle and there must be many other unreported decisions.

In April last year, however, the position changed. The High Court ruled that directors cannot be liable under section 409. That was contrary to the decision in 1976 and the way the Courts have applied section 409 over these 40 years.

The Government asked AGC what should be done, what further steps ought to be taken after the High Court's ruling. AGC advised that a clarification should be sought from the Court of Appeal by way of a Reference. We now have two conflicting positions from the High Court. One, Tay Choo Wah and the line of cases that applied Tay Choo Wah. And second, the City Harvest Church case where the Court disagreed with Tay Choo Wah. The Court of Appeal gave its decision, as I said earlier, last Thursday in response to the two questions of law submitted by AGC.

The Court of Appeal's decision means that there is now a lacuna in the law. As it stands today, ordinary employees can be charged under section 408 of the Penal Code. That provides for more serious penalties for CBT compared with section 408. It is punishable by mandatory imprisonment for up to 15 years, and an optional fine. Directors, however, can only be charged under section 406 – which provides for a lesser punishment up to seven years’ jail or fine or both. The Court of Appeal itself acknowledged this gap in the law and it said that there was no "good policy reason" to ignore the “heightened culpability” of directors and key officers of charities, societies and companies who commit CBT. The Court of Appeal also pointed out that the obligation of the Court is to set out the legal position correctly on what the law says, and to leave it to Parliament to amend the law as it deems fit.

It is now up to Parliament to amend the law, and that we should do soon. We will ensure that legislation provides for higher penalties for directors and other senior officers who commit CBT. We hope to make the amendment, together with the other wide-ranging amendments to the Penal Code, which I have spoken about.

To the House, let me make one final comment – we are aware that many have expressed their dissatisfaction with the outcome.

Expressing one’s unhappiness with Court decisions is fine, but it should not sink to the level of abuse, insults and contempt. We have seen comments online that the judges let off those who are rich; that some judges were lenient because they were Christians, and so on.

That is not right. Judges should not be personally attacked and their integrity impugned, just because people do not agree with their decision. There may be unhappiness. People are entitled to disagree with their decision. But let us not attack the judges.

The Government believes that the sentences are too low but the sentences reflect the law, as it stands, after the High Court's decision last year and confirmed by the Court of Appeal. The Courts decide these matters. All of us have to respect the decision, regardless of whether we agree or disagree with it. Thank you, Mr Speaker.

Mr Gan Thiam Poh.

I thank the Minister for the clarifications. As rightly pointed out, I also personally received a lot of feedback. On the ground, people are commenting that the Court let those who are rich go lightly and also those who can get off for religious reasons. The worst is they also commented that, for this particular case, it was handled by a so-called lawyer who is also a Member of Parliament (MP) from the People's Action Party (PAP). So, may I know what is the Minister's stand on this and a clarification on his comments? Also, what can the Government do about all these comments and also how should we proceed from here?

I thank the Member for the question. I think Mr Edwin Tong would not be entirely happy to be called "a so-called lawyer and MP". I think he is a qualified lawyer and a Senior Counsel. I said earlier that it is entirely legitimate to express one's unhappiness about Court decisions. But some statements have, indeed, gone too far, abusing the judges personally, ascribing improper ulterior motives to their decision. And it is, really, a clear case of abusing the anonymity of the Net or anonymity to the extent that it exists. Just because you do not agree with the judges does not mean that you have the right to abuse them and challenge their integrity. People who abuse judges, challenge their integrity will be prosecuted if a case for contempt can be made out. I will set out later some factors which will be relevant in this context.

The Courts should not be pressured by public opinion. They should be free to decide in accordance with what they believe the law to be. Criminal cases must be tried in a Court of law, not in the court of public opinion.

A few years ago, I already expected that there would be more and more of such scurrilous attacks on the judiciary. If left alone, they will become the norm. That is why we legislated into law the Administration of Justice (Protection) Act. One of those opposing it, I think, it was Mr Leon Perera who asked me in this House why the need for this law. This is one relatively small illustration. If we do nothing, it will get much worse and become unsolvable. We do not want to end up like the United Kingdom (UK) where the press freely attacks the judiciary. You get newspaper headlines screaming banner headlines labelling judges as "enemies of the people", "you fools" because the courts have the temerity to decide in a way that the media did not like. If we are not careful, we will easily go down that route.

Let me give Members a current example. There is a public Facebook group with a Chinese name which I understand can be translated as a "policy discussion forum". I was informed that a copy of a news article was posted on 2 February, last week, on this Facebook. The article had appeared in the Chinese news daily Wanbao on the same day. It was a report on the City Harvest Church matter. The title of the news article, the banner headlines had, however, been faked in the Facebook post. The original title translated was, and I quote, "Outdated laws saved the accused from harsher penalties". Someone appeared to have faked the title into, and I quote, "PAP lawyer saved the accused from harsher penalties", making it look as if a mass circulation newspaper had done so, probably to give more credence to the headline.

AGC takes the view that the suggestion from the fake title is that the PAP MP was responsible for an unfair, unjust outcome and the Courts have let off the defendants lightly because of him. AGC's view is that this is a case of contempt by scandalising the Courts. I do not want to go into the meanings of the fake title because the matter is with AGC and it will be dealt with in accordance with the law. Whatever the meaning of the statement and regardless of whether or not it is in contempt, one can see that this sort of attack based on deliberate faking is quite unacceptable. I cannot see how any reasonable person will justify such faking as a legitimate expression of free speech.

I have asked the Police to take a serious view of those who scandalise the Court. Not only for this case. If there are other comments which cross the threshold and are in contempt of the Court, our approach is that action will be taken. That has been so before the Administration of Justice (Protection) Act, or AOJP, and it remains so after the AOJP.

In coming to a decision whether to prosecute for scandalising the Courts, the factors will include assessing who said it, how seriously is the statement likely to be taken, how wide was the publication, other relevant factors. That has always been the case, even before the AOJP. AGC will assess the various statements that have come to their notice in this context.

And quite apart from whether the fake headlines scandalised the Court, there is another point.

Defendants are entitled to get a lawyer of their choice. Rule of law, a civilised system of having trials in Court depends, amongst other things, on lawyers being able to act for defendants, whatever offences the defendants are accused of. As I have said before several times, even a child rapist is entitled to his day in Court and to be defended. It does not mean that we or the lawyer defending the person approves of child rape. But the defendant has a right to choose a lawyer to defend him, and we must not take that away from him. Lawyers should not be made to feel that they will be hounded online if they take up cases.

Let me share a personal example with Members from when I was in practice. I am probably in the unique position in Singapore of someone who has both acted for the three Prime Ministers of Singapore and also of having acted against all three of them. In 1995, Prime Minister Goh, Senior Minister Lee and Deputy Prime Minister Lee, as they were then, sued the International Herald Tribune (IHT) for libel. The IHT came to me. The conversation as to whether I would act for them took about two minutes. I told them they must know I was a PAP MP, and were they comfortable that they would get the best possible advice from me, given my position? They knew that I was a PAP MP. They said it was okay with them, if it was okay with me. It was okay with me. I did not see any need to clear with the Party or anyone connected to the Party or Government.

By taking on the case, I was simply doing my professional duty. I did not need to take on the brief. I was very busy with other work but I thought the IHT had a right to counsel of its choice. They were faced, obviously, with particularly formidable plaintiffs who could get counsel of their choice, and so, I should help the IHT.

The import of my acting for the IHT, when it went to Court, did not escape Senior Minister Lee Kuan Yew. In Court, after his evidence was over and before he stepped out of the witness box, he said he had to point out the situation. He said that I was close to the three of them, meaning the Prime Minister, Senior Minister and Deputy Prime Minister. I was a PAP MP. The decision by the IHT, despite the situation, to instruct me was, and I quote "the highest tribute to the integrity of the counsel" and "possibly reflected also on the integrity of the Government".

Over the years, I also acted for various others whose conduct will not be approved of by the general public and some of whom were impecunious and could not pay fees. I acted for them whenever I could, based on certain principles which I do not need to go into here.

The fake headline that I referred to earlier in the Facebook page is part of a mob mentality, to hound the lawyers, to intimidate them into not acting in cases which the mob disapproves of. It is quite shameful. Supposing no action is taken when public Facebook pages do this, then what is there to prevent the media itself from publishing such articles in the future? By action here, I do not necessarily just mean contempt action. If we accept such faking as normal, then you can see that the line between that and the current position of the UK almost disappears. You will then get in the mainstream media the headlines I earlier spoke about – about judges, abusing them and other similar sorts of things. We should not get there and it will be a sad day for Singapore if we do get there. Thank you, Sir.

Miss Cheng Li Hui.

I would like to ask the Minister this: the Court of Appeal noted that the review of the law is long overdue. Why did the Government not amend the law earlier?

I said earlier that since 1976, the position has been settled, clear law from the time the Tay Choo Wah case was decided. I mentioned that there are at least 16 reported decisions in the books confirming that decision over the years. There must be many others which are unreported. So, the position has been consistently applied by the Courts over 40 years. No doubts or uncertainty were expressed by our Courts; prosecution, defence, everyone proceeded on that basis. There was no suggestion that the law was in need of any review. There was, therefore, no reason for Parliament to review the position or amend the law. Parliament does not legislate in vain.

Mr Yee Chia Hsing.

I would like to thank the Minister for the Ministerial Statement and I am very happy to note that the law is under review. One key fact of this whole City Harvest case is that a key beneficiary, which is, the wife of Kong Hee, was not charged for any offence. In reviewing the law, would the Ministry also look at whether to put in some penalties where the beneficiary of a CBT case can also be charged under the law?

I think one has to be careful about this. A beneficiary who receives proceeds without the appropriate knowledge does not automatically become a criminal. Supposing the person took the money and donated it to another charity, does the recipient commit a criminal offence?

I think we need to be careful. The law, as drafted, is wide enough to deal with people who act with criminal intention, conduct, misuse property. There is a lacuna in that section 409 does not apply to directors, senior officers in the way the Court of Appeal has construed it, and we should fix that lacuna. But knowing receipt of property to the extent that it needs to be criminalised, you will find it in the law.

Mr Vikram Nair.

I thank the Minister for the clarifications. Will this case have a big impact on future cases, especially between now and the time the law is changed?

For the cases involving directors, or similar sorts of senior officers, where the cases are already before the Courts, obviously, you will now have to apply the law as determined by the Court of Appeal. For the cases which are being investigated, where AGC is considering the charges, again obviously, the AGC would have to take into account the decision by the Court of Appeal. If there are any charges to be brought in respect of actions that have taken place before any legislative changes, I am sure AGC will take into account what the appropriate charge is. It does not automatically mean that any changes will not apply. I do not want to go into those things but I think we identified a lacuna. I mean, it has been identified for us. And we need to deal with it.

Mr Gan Thiam Poh.

I have additional clarifications. I also hear comments. Since it has been practised for so long, it has been consistently practised, why did the Court suddenly change the precedent? We should follow the precedent and change should be thereafter.

Order. Can I just remind Members, we are not here to question the specific decisions of the Court.

I will send the copy of the judgment to Mr Gan offline because it is 150 pages or more. The judges explained their thinking.

In summary, they feel that when the law was drafted, when section 409 was drafted, it was some time ago. It could not have been the intention of the drafters to deal with the directors, because Company Law had not been developed to the extent that it has now. And therefore, it could not have been within the minds and the drafting intention. Therefore, you would need new provisions which deal with it. There are different approaches to interpretation. The other approach is to say, "Well, you take those words and you apply it as circumstances evolve". They also explained why they did not want to do that here. That is in two lines; I am probably not doing full justice to it but that is the sense.

Order. End of Ministerial Statement. If I may just remind Members, do read the Standing Orders with regard to comments, especially Standing Orders 21(1)(h) and 59, in future, on any discussions relating to issues like this.

The Clerk will now proceed to read the Orders of the Day.

[(proc text) Order for Second Reading read. (proc text)]

Mr Speaker, I beg to move, "That the Bill be now read a Second time."

The Economic Expansion Incentives (Relief from Income Tax) (Amendment) Bill 2018 puts into legal effect the income tax changes introduced in Budget 2017, as well as other amendments arising from the regular review of our tax incentive regime. Let me draw Members’ attention to the two key legislative changes contained in the Bill.

The first change is to exclude Intellectual Property Income from Pioneer Service Companies, and Development and Expansion Incentive. To encourage the use of intellectual property (IP) arising from taxpayer’s research and development (R&D) activities, the Minister for Finance had announced in Budget 2017 that an IP Development Incentive (IDI) will be introduced. Accordingly, IP income will be removed from the scope of the Pioneer Service Companies (PSCs) and Development and Expansion Incentive (DEI) schemes, which currently provide for tax exemption or concessionary tax rates respectively on income from qualifying activities, which may include IP income. Clauses 2, 5 and 9 amend sections 3 and 19M, and introduce section 19A to give legislative effect to this change.

The second change is to enhance the Integrated Investment Allowance (IIA). The IIA scheme provides additional allowance to a taxpayer who has incurred fixed capital expenditure on qualifying equipment used abroad by an overseas company for approved projects. Currently, to qualify for the allowance, the overseas company is required to use the qualifying equipment wholly for the approved projects. As announced in Budget 2017, this will be liberalised to only require the qualifying equipment to be primarily used for the approved project by the overseas company. In addition, the IIA scheme will be extended till 31 December 2022. Clauses 10 to 13 give legislative effect to this change.

The remaining legislative changes arising from our periodic review of the income tax system are either administrative or technical in nature.

Mr Speaker, the proposed changes to the Economic Expansion Incentives Act (EEIA) seek to encourage economic activities in Singapore. These changes also reflect the Government’s commitment to keep Singapore competitive and relevant as a place for investment as our external economic conditions change. Mr Speaker, Sir, I beg to move.

[(proc text) Question proposed. (proc text)]

Mr Thomas Chua.

Mr Speaker, Sir, in Mandarin.

(In Mandarin): [Please refer to Vernacular Speech.] Mr Speaker, I support the amendment of the Economic Expansion Incentives Bill. Timely changes in tax incentives would enable Singapore to maintain its global competitiveness and attract even more multinational companies (MNCs) into Singapore to contribute to our national economy. Today, I would like to share my views regarding the proposed amendments from two perspectives – that of the business community, as well as of taxpayers.

MNCs and local enterprises are the two large engines which steer Singapore’s economic development. MNCs which come to Singapore, besides directly creating employment opportunities, also spur the development of related industries. Some local companies have leveraged the opportunities of collaborating with MNCs to improve the technology content of their products and services and have gradually become world-class companies. This win-win collaborative model is the outcome businesses look forward to most.

After going through the Bill, I would like to focus on one new content in particular: the new section 97ZHA states that after companies have successfully applied for the IIA, in the event that they fail to comply with any term or condition as specified, or the outcome indicators, not only will the tax incentive be terminated, the Government can also recover this particular investment allowance already given. This amendment is very timely.

Recently, the Government has mentioned many times that Government expenditure would steadily increase, and that we need to explore new sources of income and curb expenditure. One of the ways is to strengthen the supervision of tax incentives and guard against abuse. The amended Bill would enable stronger auditing and oversight of the tax incentives. This is good for our taxpayers. Also, I would like to ask the Minister if the current amendment to the Bill was spurred by an increase in the number of errant cases in recent years.

Of greater concern to businesses is that the value-add effect on local companies brought about by such tax incentives to attract foreign investment seems to have waned. Quite a number of businesses have told me that they miss the Local Industry Upgrading Programme (LIUP) which was phased out in 2010. The programme, extremely useful then in promoting win-win collaboration between foreign investors and local enterprises, continues to be well-regarded today.

In the earlier years, foreign companies which invested in the traditional sectors here could generate significant opportunities and value-add for related or supporting local companies both downstream and upstream and create direct and indirect employment opportunities for Singaporeans.

However, in recent years, most of the MNCs attracted to Singapore are in the emerging sectors which establish their regional headquarters or R&D centres here. The activities which can create value-add for local companies, such as product design, manufacturing, industry supply chain and distribution are, however, located in other countries in the region. It is no longer easy for local enterprises to take the local advantage in becoming service providers for the MNCs like before.

Therefore, our small and medium enterprises (SMEs) should step up venturing overseas, in line with the Government policy to encourage businesses to internationalise. They can then continue to service the MNCs which have established production bases in the region.

I also urge the Government agencies under the Ministry of Trade and Industry (MTI), namely, the Economic Development Board (EDB) and Enterprise Singapore (ESG), to continue to work closely with local industries. We hope that EDB, whilst continuing to attract high quality foreign investors into Singapore, would also make capability upgrading of local enterprises a key objective – to provide MNCs and local enterprises with a win-win collaborative model to become the driving force of Singapore’s future economic development.

Mr Louis Ng.

Sir, I stand in support of this Bill. It is encouraging that the Government continues to support companies through tax reliefs. However, I would like to seek some clarifications and offer some suggestions.

First, clause 2 of the Bill amends section 3 of the Act by inserting a new definition of "Intellectual Property Income". This is defined as "any intellectual property income prescribed by the Minister under section 102". Section 102 of the Act, amongst other things, empowers the Minister to make regulations that may be necessary or expedient for purposes of carrying out provisions of the Act.

Can the Minister clarify why the meaning of IP Income is not specifically defined within the Bill? What are the assessment criteria that will be considered by the Minister in prescribing a particular income as IP Income? Will this be based on quantitative or qualitative data?

The reason I am asking is because greater transparency and less ambiguity in the legislation itself will only enable Pioneer Service Companies and Development and Expansion Companies to better understand what constitutes IP Income and, correspondingly, whether their activities will fall under the tax incentive scheme.

I understand that EDB does publish guidelines from time to time on its website, such as guidelines related to the Pioneer Certificate Incentive (PC) and DEI. However, if the principle behind the Act and this Bill is to encourage companies to grow capabilities, develop high-value and substantive economic activities, through tax reliefs, then it is crucial for companies to have a clear understanding of what the parameters are for them to qualify for tax reliefs. A clear understanding will allow companies to better plan their business and growth strategies.

I raised a related point in 2016 during the previous iteration of the Economic Expansion Incentives (Relief from Income Tax) (Amendment) Bill on the need to have clearer qualifying criteria for PC and DEI. Then, Minister Lim Hng Kiang replied that it is a balance between clarity, transparency and ensuring we remain flexible and responsive to the increasingly complex economic environment. I understand the Minister's point, but I have two follow-up queries.

One, I think responsiveness can be achieved through the mechanism of legislative amendments, which allows the Government to continually review the incentives and schemes to maintain their relevance. This possibly explains why we are legislating amendments to the Act via this Bill within a relatively short period of time from the last amendment in March 2016.

Two, flexibility may also be achieved through the actual operative provisions in the Bill, instead of relying on broad definitions of a key term. To my mind, it is a tenuous argument to rely on flexibility to justify why the definition of an important term, such as IP Income, should be left to the Minister to prescribe. Hence, will the Minister consider including a specific clear definition of IP Income within the Bill?

Second, can the Minister clarify how the amendments relating to the exclusion of IP income as stated in clause 5 of the Bill fit into the new IP regime administered by EDB, named IDI announced during the 2017 Singapore Budget?

I note that the Inland Revenue Authority of Singapore (IRAS) published a table stating that IDI incorporates the Organisation for Economic Cooperation and Development's (OECD's) Base Erosion and Profit Shifting reports (BEPS)-compliant modified nexus approach and it is meant to encourage the exploitation of IP arising from R&D activities. Can the Minister clarify how the IDI works in practice with the legislative amendments in this Bill?

On the point of BEPS, I understand from a Facebook feedback by Mr Gregg Fong that as a result of the BEPS framework, tax authorities globally have put in place more stringent rules to ensure taxpayers pay their fair share of taxes. Therefore, it is unwise to assume that tax incentives remain attractive for MNCs in this post-BEPS era, and now, more so than ever, tax incentives need to make business sense for MNCs and economic sense for Singapore.

In this context, the queries raised by Mr Fong are: how do these Bill amendments and the existing broader tax incentive schemes fit in with Singapore's broader strategic goals? Mr Fong pointed out that, historically, the initial intention of tax incentives was to attract top MNCs to invest in Singapore, and this worked very well. The tax incentives were then gradually tweaked as Singapore’s economy grew.

Can the Minister explain how the current amendments adjust the tax incentives such that they remain relevant and are aligned with Singapore's current strategic goals? And can the Minister clarify what these amendments will mean for companies which did invest and are continually investing in Singapore?

Also, do the existing tax incentive schemes and these amendments ensure fair employment opportunities for Singaporeans in managerial positions? Can the Minister provide data over the past three years on the relationship between the number of foreign MNCs with a regional office in Singapore which are enjoying such tax incentives and the percentage of Singaporeans in managerial positions in these MNCs?

Mr Fong clarified that this query is not coming from a place of an anti-foreigner sentiment, but it is taking a practical approach as, logically, MNCs would enjoy significant costs savings, from such tax incentive schemes and general manpower costs savings, if they are able to upskill Singaporeans over a period of time and transfer these skills from expatriate foreigners to Singaporeans.

Third, on a broader practical level, how do these legislative amendments and various schemes and incentives from Government agencies, such as EDB and the Standards, Productivity and Innovation Board (SPRING) Singapore, all work together from the perspective of an SME which wishes to take advantage of these available tools?

From the Minister's reply in 2016, I understand that for the current PC Incentive scheme, between 2011 and 2015, only two out of 71 PCs were awarded to SMEs, of which only one was a local SME. The explanation then was that PC application requires companies to commit to economic contributions of a substantive scale. Hence, it is natural that bigger companies qualify.

Keeping in mind that the principle behind this Bill and the Act is to put in place tax incentives to encourage innovation, I wish to ask whether there are ways in which our SMEs can benefit from these amendments. Smaller companies are able to respond and react to market conditions and remain agile and flexible. Thus, it appears that SMEs, by their very nature, are better placed to embrace innovation and position their businesses to adapt to changes rapidly, in line with the principles of the Bill. If we are structuring the tax incentives to largely allow for bigger companies to meet the criteria, can the Minister clarify how this is in line with the principles of the Bill? Sir, notwithstanding the above clarifications and suggestions for the Minister's consideration, I support the Bill.

Mr Azmoon Ahmad.

Mr Speaker, good afternoon, and to all hon Members.

The Economic Expansion Incentives Act, which was introduced by the Government in recent years, was meant to encourage companies to continue introducing high value-added activities in Singapore. As mentioned by Minister Lim Hng Kiang, between 2011 and 2015, similar companies had been awarded final certificates, of which, only two were SMEs, which is of concern to me.

The overarching objective of such incentive schemes was not just to serve as an encouragement to the targeted industries and companies, but also to encourage companies to stay relevant in this fast-changing knowledge-based and technology-driven economy and being able to provide economic value to Singapore.

The technologies developed should be able to make them more competitive and simultaneously create new higher value-added skilled jobs for our local workforce. This will, in turn, enable the workforce to move upstream, thereby creating higher value at work and increase productivity. This symbiotic relationship between the industry and the Government is highly commendable.

The proposed six amendments to the Economic Expansion Act are reasonable in my opinion. The removal of the prescribed IP Income from the tax incentives scheme of both Pioneer Service Companies and Development and Expansion Companies under Part III section 19A and Part IIIB section 19M are questionable. However, I believe it is apt as Singapore's economic landscape has moved from a labour-intensive to a knowledge-intensive one, with a high skills-based platform.

Thus, after many years of investing and working with the industry, it is reasonable to expect that IP should be one of the main activities of the affected companies. Thus, it is also reasonable to consider income from IP as a source of revenue in the current context in Singapore.

While this change may be able to get absorbed by larger companies like the PSCs and larger-sized SMEs, I am very concerned over smaller ones which have not been able to capitalise on incentive schemes. I believe there are pockets of local SMEs which are stuck in their business activities in the old and traditional way. While they may not be seen as high-tech, but they do serve the need of the larger Singapore labour workforce by providing jobs. Thus, I would like to suggest that the incentive as previously prescribed should be extended to the smaller SMEs and perhaps, more should be done to assist them to move up the ladder in implementing technology in their business activities. As an example, I would like to highlight the cleaning industry and the small public works contractor industry.

Mr Speaker, disruptions seem to be a constant parameter in our lives. Smaller SMEs are hardest hit with the constant disruption which is prevailing at smaller intervals, from financial technology (fintech) to augment the reality. Smaller SMEs find it harder to cope as they do not have the muscle and capacity to spend in R&D work, less IP work. And when they do, it will be a strain on their business operations. Hence, the extension of the prevailing scheme to smaller SMEs will go a long way. I plead with the Government to consider and review this. With that, Mr Speaker, notwithstanding the suggestion I made, I support the Bill.

Minister Lim Hng Kiang.

Mr Speaker, I thank Mr Thomas Chua, Mr Louis Ng and Mr Azmoon Ahmad for their support of the Bill.

As all three of them mentioned, these amendments are very important, and we have to see how these amendments fit in with our overall strategic goal for Singapore, which is to encourage companies to continue to undertake investment, expand their capabilities and create new jobs. To do so, our economic agencies require a suite of tools to engage our companies and, therefore, our Government regularly reviews our incentives and schemes, be it tax incentives or non-tax incentives, to ensure that they continue to be relevant and effective as our economic and operating environment continues to evolve.

To be in line with international standards and, in particular, to align ourselves with BEPS guidelines, this Bill will, therefore, amend the legislation to exclude IP income from PSC and DEI companies. Companies that are committed to undertake substantive economic investments and create good job opportunities in Singapore can continue to benefit from the PSC and DEI schemes.

Meanwhile, we will continue to encourage the use of IPs arising from a taxpayer’s R&D activities under the new IDI. Taxpayers can apply for IDI regardless of whether they are currently on PSC and DEI or not. As for IDI itself, the Government is currently in consultation with companies and the incentive will be legislated in the Income Tax Act consequently.

Secondly, in response to Mr Louis Ng’s point about the definition of IP Income, I agree that companies need clarity to plan their businesses and to execute their growth strategies. In this regard, the Government has proactively reached out to the companies and consulted them on the draft legislation. This, among other things, includes the definition of IP Income, which will be made clear in the subsidiary legislation. As I mentioned in the earlier debate in 2016, it is better and more effective for us to define IP Income in the subsidiary legislation than in the main legislation so that the objective is still achieved. You have transparency, clarity and, at the same time, you have more responsiveness and flexibility by doing so in subsidiary legislation.

So, these amendments in this Bill will help to provide our companies that have invested in or are continuing to invest in Singapore with more certainty. This is because our incentives have been reviewed by the international community and they meet international tax standards ahead of many other countries and jurisdictions, which are still in the midst of reviewing their tax regimes. We remain committed to being a competitive location for anchoring substantive economic activities and will continue to monitor global developments.

On Mr Louis Ng’s point about fair employment practices, we support that and we agree that companies recognise the commercial value of having such practices in place. This is because by hiring fairly and based on merit, companies would have access to a wider talent pool and reap the benefits from increased productivity. The Singapore Government, of course, helps our companies to develop the career of Singaporeans in their employment. In our engagements with companies, we work with them to develop training and career development programmes for their employees, for example, the SkillsFuture Leadership Development Initiative (LDI) is one such schemes that employers registered or incorporated in Singapore can leverage to create and enhance in-house leadership development programmes. These programmes, which are company-centric and sector-specific, can also be implemented through collaborations with external training providers.

Mr Thomas Chua has accurately pointed out the value of having both MNCs and local enterprises in our ecosystem to drive our economic growth. Mr Louis Ng and Mr Azmoon Ahmad have asked how SMEs can benefit from these amendments. In general, our tax incentives, including the ones in EEIA, are open to application by all companies, regardless of size, as long as they are able to commit to making significant contributions to our economy. In this instance, with the liberalisation of IIA, SMEs can enjoy more flexibility in their business arrangements with their foreign counterparts.

I would also like to clarify one of the points that Mr Thomas Chua mentioned regarding LIUP. I would like to clarify that LIUP was not phased out but was rather subsumed under the Partnerships for Capability Transformation (PACT) scheme. As Members would remember, the LIUP scheme essentially caters to the relationship of our local SMEs who are suppliers to the multinational or the large companies. But we think the relationship can go beyond that of just a supplier relationship and, therefore, we have expanded the LIUP scheme to the PACT scheme which encompasses different forms of collaborations and partnerships, beyond just a supplier relationship.

The second point that Mr Thomas Chua mentioned about the new section 97ZHA, it has always been our practice that if the companies do not adequately meet up to their commitments set out in the incentives, we will withdraw the incentives and recover the incentives made to them. So, this is nothing new. This section is just to regularise our practice. The Government will continue to recover the IIA awarded if the company fails any conditions or breaches the legislative amendments. I would like to highlight that there are no errant cases in the last five years for IIA and the current amendments are, therefore, not reactionary in nature, but are being made for legislative clarity.

Mr Speaker, the Government will continue to review our incentives and schemes regularly to ensure that they remain relevant and support capability development and the needs of companies. Mr Speaker, Sir, I beg to move.

[(proc text) Question put, and agreed to. (proc text)]

[(proc text) Bill accordingly read a Second time and committed to a Committee of the whole House. (proc text)]

[(proc text) The House immediately resolved itself into a Committee on the Bill. – [Mr Lim Hng Kiang.] (proc text)]

[(proc text) Bill considered in Committee; reported without amendment; read a Third time and passed. (proc text)]

[(proc text) Order for Second Reading read. (proc text)]

Mr Speaker, Sir, I beg to move, “That the Bill be now read a Second time.”

Digitalisation has opened up new possibilities to enhance our modern lives, but they have also exposed us to cybersecurity threats. In recent years, we have not only seen an increasing number of cyberattacks worldwide, but also a wider range of targets, including individuals, large organisations like Equifax, and Government agencies.

Singapore remains an attractive target to attackers because of our high dependence on Internet-based transactions. In 2017 alone, we saw attacks against our Government agencies, universities, financial institutions, both large and small enterprises, and individuals who had their computers locked by ransomware.

Protection against cyberattacks needs to start with organisations and individuals taking responsibility for the cybersecurity of their own computer systems. However, it is also important for us to work collectively, especially in protecting our essential services, against cyberattacks. As we have seen in other countries, such cyberattacks can have a debilitating impact on the economy and society: (a) last year, the United Kingdom's (UK’s) National Health Service (NHS) had to cancel at least 6,900 appointments due to the WannaCry ransomware attack; (b) in the Ukrainian capital of Kiev, the power grids were hacked twice by cyberattackers in 2015 and 2016, leading to power disruptions that affected over 200,000 citizens during winter; and (c) in 2015, a massive cyberattack that reportedly intended to destroy important national communication channels took the French television (TV) network, TV5Monde, off the air for several hours.

Computer systems directly involved in the provision of essential services are termed Critical Information Infrastructure (CII). There is an urgent need for the Government to be more actively involved with the CII owners in defending against cyberattacks.

We have identified CII in 11 sectors: Energy; Water; Banking and Finance; Healthcare; Transport which includes Land, Maritime, and Aviation; Infocomm, Media and Security and Emergency Services, and Government.

Even with efforts to protect CII, we cannot expect to detect and foil every cyberattack. This is why it is also necessary to investigate cybersecurity threats and incidents, and to mitigate the consequences of successful attacks.

Currently, section 15A of the Computer Misuse and Cybersecurity Act (CMCA) empowers the Minister for Home Affairs to issue a certificate to authorise or direct a person or an entity to take measures to comply with requirements necessary to prevent, detect or counter a threat to any class of computers or computer services, if the Minister is satisfied that it is necessary to do so for the purpose of preventing, detecting or countering any threat to the national security, essential services, defence or foreign relations of Singapore. However, CMCA, which mainly deals with cybercrimes, such as the unauthorised access of computer material, does not provide a regulatory framework for the routine and proactive protection of CII.

Therefore, the Cybersecurity Bill seeks to establish a legal framework for the oversight and maintenance of national cybersecurity in Singapore, with an emphasis on the proactive protection of CII against cyberattacks. The Bill has three key objectives: (a) to strengthen the protection of CII against cyberattacks; (b) to authorise the Cyber Security Agency of Singapore (CSA) to prevent and respond to cybersecurity threats and incidents; and (c) to establish a licensing framework for cybersecurity service providers.

Parts 3 and 4 of the Bill set out a framework for CSA to request for cybersecurity information on CII and during investigations of cybersecurity threats and incidents. The Bill protects such information by requiring specified persons who obtain it when performing their functions or discharging their duties to keep it confidential, and by specifying the circumstances where it can be disclosed.

The Cybersecurity Bill does not provide powers to prosecute cybercriminals. CMCA and other relevant legislation will continue to govern the investigation and the prosecution of cybercrime perpetrators and the detection and apprehension of such offenders.

The Bill is intended to apply concurrently with other laws and regulations enacted in Singapore, including existing sectoral laws. In formulating this Bill, the Ministry of Communications and Information (MCI) and CSA studied cybersecurity legislation which other countries, such as Germany, Estonia, the United States (US), Thailand and Vietnam, have implemented or are considering. These laws cover areas, such as imposing obligations on CII owners to protect their CII, requiring cybersecurity audits to be conducted, making the reporting of cybersecurity incidents mandatory, encouraging companies to share cybersecurity information with the Government, prevention of cybersecurity attacks and, finally, industry regulations. Our Bill is in line with these international developments.

We also consulted industry associations, cybersecurity professionals, sector regulators, potential key CII stakeholders and the general public. In response to requests for more time to provide feedback, we extended our public consultation to six weeks. Respondents were generally supportive of the Bill. They shared the Government’s concerns on cybersecurity threats and the impact of cyberattacks on Singapore. Respondents also provided useful feedback that allowed us to identify aspects of the Bill that could be refined when drafting the Bill, including simplifying the licensing framework. I would like to thank all respondents for their feedback and suggestions.

Sir, allow me now to go through the key proposals of the Bill.

Clause 4 of the Bill allows the Minister-in-charge of Cybersecurity to appoint a Commissioner of Cybersecurity to administer the Bill. This appointment will be held by the Chief Executive of CSA. Today, CSA works with sector regulators to coordinate cybersecurity efforts to protect CII within their respective sectors. The sectors have varying levels of cybersecurity readiness, and sector regulators have varying legislative powers to regulate CII within their sectors on cybersecurity matters. The Cybersecurity Bill will provide CSA with the necessary powers to proactively protect our CII and respond to cybersecurity threats and incidents.

Clause 4 allows the Minister to appoint Assistant Commissioners (ACs) to assist the Commissioner to oversee and enforce cybersecurity requirements on the CII owners. The intention is to appoint senior officers from sector regulators as ACs to perform this role in respect of CII in their respective sectors. This is because such officers understand the unique contexts and complexities of their sectors and will be best placed to advise the Commissioner on the necessary requirements so as to strike a balance between their sectors’ operational needs and national cybersecurity considerations.

Clause 7 allows the Commissioner to designate as a CII, any computer or computer system that is necessary for the continuous delivery of an essential service set out in the First Schedule, and the loss or compromise of the computer or computer systems will have a debilitating effect on the availability of the essential service. This clause also requires the Commissioner to inform the CII owner how he can submit representations against the designation.

CSA has worked closely with sector regulators to identify the list of essential services as set out in the First Schedule. An essential service is defined in clause 2 as any service essential to the national security, defence, foreign relations, economy, public health, public safety or public order of Singapore. New essential services may be added from time to time to the First Schedule by the Minister exercising powers under the Bill if necessary.

The Bill will require CII owners to comply with statutory obligations to ensure the cybersecurity of their CII. All owners of CII, whether from the public or private sector, will be subjected to the same statutory obligations under the Bill. These obligations include furnishing primarily technical information relating to CII (clause 10); complying with codes of practice and standards of performance (clause 11); complying with written directions (clause 12); informing the Commissioner of the change in the ownership of CII (clause 13); reporting cybersecurity incidents in respect of CII (clause 14); conducting cybersecurity audits and risk assessments of CII (clause 15); and finally, participating in cybersecurity exercises (clause 16).

No action under the Bill will be taken against CII owners for cybersecurity breaches so long as they comply with their obligations thereunder. Non-compliance with CII-related obligations under Part 3 of the Bill will be an offence. The maximum penalty is $100,000, or two years’ imprisonment, or both.

CII owners who disagree with particular decisions of the Commissioner, such as the CII designation, may appeal to the Minister. This is provided for in clause 17.

To strengthen CSA’s ability to prevent and respond effectively to cybersecurity threats and incidents, Part 4 of the Bill empowers the Commissioner to investigate cybersecurity threats and incidents. These powers in clauses 19 and 20 are calibrated according to the severity of the cybersecurity threat or incident and measures required for response. The Commissioner may authorise incident response officers to exercise these investigation powers. In addition, the Minister has powers to require cybersecurity measures under clause 23 for the purpose of countering serious and imminent threats.

The key intent is to provide for powers to respond to cybersecurity threats or incidents affecting CII. But because of the interconnected nature of computer systems, the powers will also be used for investigating major cybersecurity threats and incidents on computer systems that are not CII, for example, large-scale cyberattacks affecting multiple sectors. It is not our intent to use these powers to respond to each and every cybersecurity threat or incident in Singapore, as computer owners are ultimately responsible for the cybersecurity of their own computers.

Clause 19 allows the Commissioner to request persons to furnish specified information that is necessary for the investigation of cybersecurity threats or incidents, for the purpose of: (a) assessing their impact or potential impact; (b) preventing any or further harm arising from the same cybersecurity incident; and (c) preventing a further cybersecurity incident.

The maximum penalty under clause 19 is $5,000 or six months’ imprisonment or both, for offences, such as willfully misstating information or refusing to provide required information without reasonable excuse.

Clause 20 allows the Commissioner to authorise incident response officers to exercise more intrusive investigative powers as are necessary to investigate and prevent serious cybersecurity threats or incidents. For example, the Commissioner may require the owner of a computer to scan the computer for cybersecurity vulnerabilities. Clause 20(3) prescribes a set of criteria for determining what constitutes a "serious" cybersecurity threat or incident, such as when it creates a risk of significant harm being caused to a CII.

The Commissioner may, under clause 20(5), take possession of any computer or equipment without the owner’s consent for the purpose of further examination and analysis, if the Commissioner is satisfied that: (a) this is necessary for the purpose of the investigation; (b) there is no less disruptive method of achieving the purpose of the investigation; and (c) after consultation with the owner, and after considering his business and operational needs, the benefit from doing so outweighs the detriment caused to him.

Such powers are necessary given the potential impact from serious cybersecurity threats and incidents, which can disrupt our essential services, potentially cause physical damage and harm, and affect our economy and our way of life. The Bill clearly spells out how these powers may be exercised. These powers are calibrated and there are safeguards built into the Bill, such as what I have just described.

The maximum penalty under clause 20(7) is $25,000 fine or two years’ imprisonment or both, for offences, such as failure without reasonable excuse to comply with a direction or requirement of an incident response officer, under clause 20(2)(b) or (c).

Clause 23 allows the Minister to authorise or direct any person or organisation to take measures for the purpose of countering serious and imminent threats. Clause 23 is a re-enactment with slight modifications of section 15A of CMCA. This section will be repealed. CMCA will correspondingly be renamed as the Computer Misuse Act, or CMA in short, at the same time that the Cybersecurity Bill is passed. The offences and penalties under clause 23 are the same as those under section 15A of CMCA.

The Bill recognises that information disclosed to CSA under the Bill is often confidential. Information disclosed to CSA may be used to determine if a computer system is a CII (clause 8), technical information relating to a CII (clause 10), or information given pursuant to an investigation into a cybersecurity threat or incident (clause 19 or 20).

Therefore, under clause 43, the Commissioner and other specified persons must preserve the secrecy of information that may come to their knowledge as a result of performing their functions or discharging their duties under the Bill. Such information includes matters relating to a computer system, as well as the identity of persons who furnished the information. It will be a criminal offence under clause 43(4) if specified persons fail to preserve the secrecy of such information or unlawfully discloses such information. The maximum penalty is $10,000, or one year’s imprisonment, or both.

However, clause 43 provides for the sharing of information in certain circumstances, such as for the purposes of prosecution under the Bill, or to disclose to the Police any information which discloses the commission of an offence under CMA.

We recognise other persons may have information on whether CII owners are complying with their obligations specified in Part 3 of the Bill, and we want to encourage the disclosure of such information to the Commissioner. Clause 45 provides for the protection of these informers in relation to proceedings for an offence under Part 3 of the Bill.

As cybersecurity risks become more widespread, the demand for credible cybersecurity services will grow. Some cybersecurity services can be sensitive because the service providers performing them can have significant access into their clients’ computer systems and networks and gain a deep understanding of the cybersecurity vulnerabilities. Such services, if abused, can compromise and disrupt the clients’ operations even after the service provider’s job has been completed. Furthermore, there is asymmetry of information; many organisations, especially smaller ones, may not know which cybersecurity service providers are ethical or offer reliable services.

Part 5 of the Bill provides for a licensing framework for cybersecurity service providers that service the Singapore market. For a start, the licensing framework will be a light touch in view that this is a new initiative and there is a need to strike a good balance between industry development and cybersecurity needs. Only providers of two types of cybersecurity services will be licensed, namely, penetration testing and managed security operations centre (SOC) monitoring. These providers have access to sensitive information from their clients, and the services are also relatively mainstream in our market and, hence, have a significant impact on the overall cybersecurity landscape.

Clause 24 requires providers of licensable cybersecurity services that are specified in the Second Schedule to apply for a licence. It will be an offence to provide such services without a licence. The maximum penalty is a $50,000 fine, or two years’ imprisonment, or both.

We do not intend to require companies to be licensed for providing licensable cybersecurity services to their related companies. In addition, the term "cybersecurity service", as defined in clause 2, only covers a service provided by a person for a reward to another person, and excludes a service provided in-house to an employer.

Financial penalties may be imposed under clause 32 for non-compliance with licensing conditions or for other regulatory breaches that are not an offence, such as the failure to keep and retain proper records. The maximum penalty is $10,000 for each non-compliance but not exceeding, in the aggregate, $50,000.

The licensing officer is required under clause 33 to give licensees an opportunity to submit representations before the imposition of financial penalties. Under clause 35, cybersecurity service providers may appeal to the Minister against specific decisions of the licensing officer, such as the refusal to grant a licence and licensing conditions.

Sir, the Government cannot achieve a more secure cyberspace alone. We will partner public and private sector stakeholders in the journey to strengthen the protection of CII. CSA will adopt a deliberate process for the designation of CII across the different sectors, in consultation with their owners and the relevant sector regulators where possible. CSA will also implement programmes to help the sector regulators assist CII owners in getting ready to fulfil their obligations under the Bill.

We will also engage the industry further on the licensing conditions for licensed cybersecurity service providers under clause 27 of the Bill. The licensing framework will be operationalised at a later stage, after the rest of the Bill.

Sir, the Cybersecurity Bill is one part of Singapore's Cybersecurity Strategy to strengthen the nation's cybersecurity posture. With cyber threats growing globally, this Bill is timely to empower CSA to safeguard essential services from disruptions by cyberattacks, prevent and respond to cybersecurity threats and incidents, and to establish a licensing framework to improve the credibility of cybersecurity services in Singapore. Sir, I beg to move.

[(proc text) Question proposed. (proc text)]

Mr Zaqy Mohamad.

Thank you, Mr Speaker, for allowing me to speak on this important Bill. I first have to declare my interest. I work for a firm that provides cybersecurity and risk services.

Mr Speaker, the Cybersecurity Bill is timely, given its focus to strengthen the defences of our essential services and CII from cybersecurity threats from both private and state players.

We have seen growing evidence of how countries are being threatened by digital sabotage which targets essential services to cause disruption to the economy, as well as to confuse and demoralise citizens.

The Ukraine experience, as the Minister has shared earlier on, was one that is almost becoming a cyber-hacking "testbed" for other foreign state actors. On 23 December 2015, the control centres of three Ukrainian electricity distribution companies were taken control of, where malicious hackers opened breakers which caused more than 200,000 households to lose power. Nearly a year later, on 17 December 2016, a single transmission substation in northern Kiev lost power. These instances of sabotage took place on the tail of a political revolution in Kiev and the annexation of Crimea.

While similar attacks have not shown to be highly-motivated acts of sabotage in Singapore, in September last year, CSA had reported that several critical sectors were subjected to cyberattacks, and that the Singapore Government had been subjected to a malware attack by state-sponsored hackers. We have been fortunate that the recent Wannacry, Meltdown and Spectre malware attacks have not disrupted our essential services.

Nonetheless, these attacks are a clear and present danger to a compact nation like Singapore, where a politically or militarily motivated actor can use cyber warfare to sabotage our critical infrastructure and economy. Current international laws have not been effective to address cross-border hacking and state-sponsored attacks. In most cases, agencies have had difficulty to pin down hacking incidents to individuals or governments.

I believe the Cybersecurity Bill is a good start for Singapore to ensure that our essential services and sectors are well-protected and defended to prevent criminals or state players from threatening our economy and our way of life.

I welcome that this Bill looks into proactive measures to have owners of CIIs to be more accountable for reporting and the security readiness of their CIIs. It is important that relevant stake players provide timely reports of attacks and I fully support that the CSA drive industry-wide knowledge sharing and push for effective cyber defence measures.

Countries, such as Germany, Japan and the US, have already enacted cybersecurity legislation. In the Association of Southeast Asian Nations (ASEAN), Thailand and Vietnam are also considering similar legislation. Thus, this Bill is a timely reflection of our commitment to securing our nation and our status as a top-tier international hub and financial hub.

From the view of the industry, one of the key concerns will be whether the cost of compliance and the costs of systems upgrades will be significant. Consumers will also be concerned if these additional costs will be passed on to them, as many of these CII owners provide essential services, such as transport, water, electricity and communications.

We must strike a balance to protect our national and citizens' interests but yet be clear on what security standards and architectures that CIIs need to comply with, so that the costs incurred in upgrades and security operations will not overburden industry and consumers. The cyber arms race is not about to recede and will only intensify and hackers will continue to try to find weaknesses in systems to exploit. In this regard, I would like to make some suggestions.

One, it will be ideal if CSA can take the lead, together with the sector regulators, to set industry-wide leading practices, shared services and threat intelligence, so that CII players can achieve security readiness in a cost-efficient manner and yet be effective in deterring and responding to security threats.

Two, this Bill will drive greater accountability from the CII owners, and failure to comply with this new law will be criminal in nature. I support the need to make the owners of the CIIs accountable, but I hope that CSA be very clear on the benchmarks or, if appropriate, security architectures that CII owners need to comply with upfront. This will also help the relevant CIIs to plan their security roadmap effectively and better understand the investments they need to make. Otherwise, the industry risks putting in piecemeal measures that could be costly. It would also not be good if CII owners take a reactive approach to only wait for audit results and taking action only when told that they need to comply to them from time to time. Under the law, they will only be criminally penalised when they have not complied with a directive from the Commissioner. This may be too late if an incident happens. So, will the Ministry be providing the CIIs with specific benchmarks they need to achieve or a checklist of cybersecurity measures that need to be in place?

Three, I would like also to suggest that the Ministry and the sector regulators consider funding R&D for cybersecurity technology and operations centrally or within sectors. The involvement of CSA and sector regulators can catalyse CII operators to share findings and insights to accelerate cybersecurity enhancements. There are many common insights that could be derived from research and leading practices within specific sectors. This will help CII operators develop quicker and more effectively.

Mr Speaker, since 2015, the Ministry has been doing public and closed door consultations. I would like to ask the Minister, through the consultation exercises, whether the Ministry has performed an assessment of the readiness of the current CIIs in the various essential services sectors to comply with CSA's security requirements. Has the Ministry estimated how much it will cost for the CIIs to comply with the Cybersecurity Bill's requirements? What is the timeline that CIIs have come back that they need to get fully ready and compliant?

Under the Cybersecurity Bill, the Minister, the Commissioner and his deputies are given the authority to investigate and get CIIs to disclose information to assist with investigations. Citizens will be concerned that, as part of investigations, the authorities may need to access data residing within the CIIs and this may breach the privacy of individuals. What are the safeguards put in place to ensure that the broad investigation powers under this Bill do not invade the privacy of individuals and consumers?

Mr Speaker, under this regime, the Cybersecurity Bill will complement CMCA, which will be renamed CMA. What is the rationale of keeping the Acts separate as they both deal with essentially cybercrime? How would enforcement operations be divided across the two pieces of legislation to deal with cybercriminals involved in attacks, such as Ransomware, Malware or Distributed Denial of Services (DDOS) attacks? The same crime can technically be applied across both critical infrastructure and non-critical, and common information technology (IT) systems. So, is there a duplication of effort or duplication of resources? What features under the new Bill will enable our agencies to better address as well crimes arising from overseas actors?

Currently, the CIIs are defined based on systems located here in Singapore. Given that some CII operators may use technologies, such as cloud services or outsourced managed services based overseas, how does the regulator plan to designate these systems as CII, as the data and application may not reside, wholly or in part, in Singapore?

Mr Speaker, the Bill will put in place a licensing regime to providers of penetration testing and managed SOC monitoring services. I support this initiative as it will put in place a credible ecosystem to support our CIIs. This will also promote our service providers to be better trained and specialised to meet the standards required by the regulators. However, I would like to seek clarity from the Minister why does CSA only register companies and not allow for the licensing or registration of individuals. In this emerging field of cybersecurity, there are many global experts, or even white-hat hackers, whose expertise may be useful as freelancers to advise CII owners. Why does the Ministry not consider allowing individuals to be contracted by the CII owners?

From a manpower perspective, Mr Speaker, cybersecurity resources are in demand today. How is the Ministry planning to uplift the capabilities that we have to fulfil demand once the Bill comes into force? Do we have a significant capability gap today and how long does the Ministry estimate for us to fulfil this gap?

I would like to suggest that the Ministry put in more resources to build up cybersecurity capability that will help CIIs fund training and international exposure for their personnel for security training. The Ministry may also wish to facilitate manpower exchanges with leading technology research labs or CIIs overseas with leading practices. Some of the CIIs named are in sectors that are facing slowdown and may find it difficult to prioritise funds for this in the short term. Such a capability fund can help adoption, especially within the immediate future.

Mr Speaker, the defence of our nation, our people and its economy needs a new approach in this digital age. Countries have the ability to combine conventional and cyber tactics to weaken an opponent's defence by disrupting its essential services and its economy, and also to maximise confusion and uncertainty using both simple and sophisticated technologies in innovative ways.

This Bill is timely to stress the importance of strengthening our CIIs in the interest of national security. We have been developing our Total Defence capabilities across five pillars – military, civil, economic, social and psychological defence. It has worked for us for several decades. In this digital era and considering the emerging threat of hybrid warfare, it may be time for the Government to update our approach. Perhaps, it may be time to add a sixth pillar to our Total Defence framework in the area of cybersecurity or digital defence to counter the new threats in this digital era. Mr Speaker, I support this Bill.

Mr Pritam Singh.

Mr Speaker, this is a significant Bill which establishes a framework for the oversight and maintenance of cybersecurity in Singapore. Its ambit and reach are understandably wide in view of the reliance both the public and private sectors, including individuals, place on computer programmes, systems and services, and the devastating prospect of debilitating cyberattacks on critical sectors of the economy.

More specifically, the loss or exposure of private information may also erode trust in the Government, statutory agencies and private companies as the release of such information in the public realm can seldom ever be completely reversed.

I understand the Bill has received significant feedback from industry with an excess of 60 companies, many of them large corporates, and separately, a healthy number of industry associations – not forgetting civic-conscious and interested individuals – providing feedback to the Ministry on this Bill. For that reason, my clarifications will be limited to the Bill's broad principles and impulse, centring on queries that pertain to the operation of the envisaged Cybersecurity Act in practice.

The first clarification pertains to clause 7 of the Bill covering companies and entities that host CII that are partly located overseas for business reasons or simply logistical convenience. As a part of a Singaporean entity's CII ecosystem may be located overseas, how does the Bill ensure that this bifurcation does not render a particular CII susceptible to compromise or cyberattacks since CII computers and computer systems based overseas are not covered by this Bill?

Separately, in light of the feedback received, how common are such hybrid arrangements amongst public and private sector CII owners and is the Ministry concerned that some entities may seek to locate some elements of their CII overseas to hedge against the reach of the Act and, as a consequence, compromise its regulatory reach?

I have a similar clarification with regard to ownership of a CII, particularly if the owner is an offshore entity or individual. What regulatory oversight will the Bill realistically have over CII owners who operate outside our jurisdiction, and would this not represent a loophole?

Secondly, I seek some clarity on the compliance costs that are likely to result for both public and private sector entities as a result of this Bill. Feedback on such costs were received by the Ministry and there was a suggestion that grants should be extended to help organisations offset these costs. Can the Minister give us some sense or an estimate of the dollar value of the compliance costs of the Cybersecurity Bill with regard to, for example, CIIs in sectors referred to in Schedule 1 of the Bill – perhaps those covering the Civil Aviation Authority of Singapore (CAAS), the Public Utilities Board (PUB) and some public hospitals? Finally, how much would be set aside in the Budget for grants arising out of an increase in such compliance costs?

Thirdly, I understand from feedback to the Ministry that there was some concern about what constituted a significant security incident. The language of the Bill in clause 14 focuses on prescribed incidents suggesting that subsidiary legislation will clarify such words and terms. As the Bill imposes a duty on owners of CII to report incidents, can the Minister give the House a general sense, with examples of the specific thresholds of hypothetical incidents which may require reporting under the Bill.

With this as a backdrop, can the Minister also share with Parliament what punishment would be effected by this Bill against a company like Uber – assuming it is a CII – which caused the compromise of personal information, such as names, email addresses and personal contact numbers, of close to 380,000 Singaporeans and tried to conceal the same, as reported in November last year? How far does this Bill go to take a CII owner to task for non-reporting should a similar Uber-like episode occur after this Bill becomes law?

What other actions would the Government consider against entities that are negligent in securing their computer systems, particularly if such an incident is aggravated through willful concealment?

Fourthly, clause 19 of the Bill gives extraordinarily broad powers to the Commissioner of Cybersecurity and his officers to investigate cybersecurity threats and incidents against companies, entities and even individuals with respect to any computer or computer system in Singapore, not just CIIs. The ambit of these powers is best exemplified by clause 19(1)(a) of the Bill, which gives the Commissioner and any authorised officer the power to remove or make copies of a hard disk, for example, even if it is only to assess the impact or potential impact of a cybersecurity threat. Non-compliance carries with it a fine of up to $5,000 and/or an imprisonment term of up to six months.

For avoidance of any doubt, notwithstanding the remarks in the Report on Public Consultation on the draft Cybersecurity Bill where it was stated that such powers are to be applied in a calibrated manner and, more importantly, in response to major cybersecurity incidents against non-CIIs, can the Minister confirm the envisaged threshold of what qualifies as a major incident, so that the House is reassured that the Commissioner's powers will be used very judiciously and not against Government critics and individuals?

Coming back to the Uber example, does the Government foresee using such powers against foreign companies that operate in Singapore?

To conclude, Mr Speaker, I am concerned about how much Singaporeans are actually aware of their online signature and the importance of cybersecurity. While we seek to protect key infrastructure against cyberattacks, every Singaporean, who uses his or her smartphone to pay for goods and services or uses it as a social engagement tool, is susceptible to cyberattack or hacking. This prospect is likely to increase as Singapore undertakes its Smart Nation drive with more focus and coordination.

The CSA is in a privileged position to educate Singaporeans on security tips as we transition to a more cashless economy and live online, as many of us already do. What measures can Singaporeans look forward from the Government to protect them from cybersecurity threats in our Smart Nation journey? Mr Speaker, notwithstanding the clarifications sought, I support this Bill.

Mr Christopher de Souza.

Mr Speaker, Sir, the Cybersecurity Bill is a forward-looking piece of legislation that ensures that our laws keep pace with the threats that we face as a nation.

The year 2017 has been called the Year of the Data Breach. Even within the first six months of 2017, the number of records stolen in breaches numbered almost two billion – even more than the whole of 2016, which was 1.4 billion. New malware samples reached an all-time high of 57.6 million in the third quarter of 2017, according to McAfee Labs Threat Report December 2017.

This is not just a matter of privacy or lost personal data – there are financial, security, proprietary interests at stake. A class action suit was initiated in the US last year against Equifax for data breach. They alleged that criminals used the stolen data to "apply for mortgages, credit cards, student loans, tap into bank debit accounts, file insurance claims and rack up substantial debts." Stolen identity also poses an international problem, a terrorist problem. Last month, Thai police arrested a man who allegedly forged passports, including Singapore passports, for groups, including a terrorist group.

Furthermore, breaches in cybersecurity can have debilitating effects on essential services. WannaCry, the first ransomware worm, crippled the healthcare system in England. It "shut down computers in more than 80 NHS organisations in England alone", cancelling almost 20,000 appointments in an appointment-based healthcare system, five hospitals resorted to diverting ambulances, unable to handle any more emergency cases. So, what we are debating today is serious.

Wannacry was a ransomeware worm and, by "worm", we are talking about a malware programme that is able to self-replicate to infect other computers and infiltrate through the connections in a computer network. The NotPetya in Ukraine, which utilised a hacked version of a major accounting programme widely used in Ukraine, affected companies in many different sectors, from shipping to pharmaceuticals and to outside Ukraine through multinational companies. Worse still, NotPetya encrypts files with no chance of recovery, that is, it was not a ransomeware.

Stuxnet, a different computer worm, caused a proportion of machinery in Iran’s nuclear facility to spin out of control in 2010. This cyberattack was executed through infected Universal Serial Buses (USBs), overcoming the "air gap". Since then, new methods to jump over an air gap has emerged. No sector has been spared cyberattacks, with commercial and healthcare sectors targeted the most.

This threat is not something remote to Singapore. The threat is real and palpable. Although Singapore’s critical infrastructure was not hit by Wannacry, Singapore malls were among the victims of that ransomware.

Within the past five years, there were notable occasions of security breaches. In 2014, Singapore’s Ministry of Foreign Affairs' IT system was breached. One thousand and five hundred SingPass users' IDs and passwords were reported to be potentially compromised and illegally accessed. In 2017, 850 Ministry of Defence (MINDEF) personnel’s National Registration Identity Card (NRIC) numbers, birth dates and telephone numbers were stolen following a cyberattack. Additionally, the National University of Singapore (NUS) and the Nanyang Technological University (NTU) reported an attack by "advanced persistent threat" (APT) actors that sought to "steal research and Government-related information."

These and many other instances are like red, flashing lights warning us to be vigilant. So, I concur with Minister Yaacob Ibrahim's point that we need to act and we need to act now.

Cybersecurity threats are nearer than we think. They could hit us faster than we can react and they could hit us harder than we can imagine. Therefore, this forward-looking Bill goes upstream to secure our information infrastructure through preventive and reactive compliance, so as to give us the upper hand and arsenal we can deploy against those who seek to do us harm.

Some key features of this Bill’s regulatory framework include: (a) reporting and investigating of breaches to facilitate damage control and prevent future occurrences under clauses 14, 19 and 20; (b) licensing of cybersecurity service providers in Part 5; and (c) regular auditing under clause 15 to ensure compliance and accountability. To facilitate accountability and promote compliance, clause 45 protects informers’ identities.

In today's age of technology, more infrastructure is being built, not from concrete and steel but, rather, in the realm of intangible cyberspace. This trajectory is bound to continue as Singapore moves toward being a "Smart Nation". Some of the future initiatives announced recently include digitalising of healthcare records even at the level of a private general practitioner (GP) through the National Electronic Health Record (NEHR) and the promoting of cashless payments.

As we seek to increase leveraging the conveniences and prowess of modern technology, it is critical that we protect and prevent attacks and crises from threatening our cyber infrastructure. The important place they have in the running of our country is reflected in this Bill’s designation of CII. This designation spans 11 broad areas of essential services set out in its First Schedule.

Cybersecurity in a computer network would only be as strong as the weakest link. A single vulnerability may be exploited to infect other areas and other computers in the network. Since computer networks extend beyond territorial boundaries and cyberattacks know no physical boundaries, clause 3 of this Bill extends regulation to computer networks that are wholly or partly in Singapore.

This Bill has been carefully calibrated for a consistent framework over the different sectors yet providing space for flexibility for purpose-oriented, sector-suited rules and practices. For example, the Commissioner’s written directions may be issued to a class of CII owners under clause 12(1); the Commissioner to direct more frequent audit above the two years "in any particular case" under clause 15(1)(a).

The Bill also provides for flexible codes of practice under clause 11 to be promulgated to promote best practices in cybersecurity. It is important that this regulatory skeleton provides sufficient flexibility to accommodate for changes in the realm of cyberspace and allow for careful calibration of regulation in the future. If there are too many regulations, the higher threshold to entry may perhaps shrink our well of cybersecurity expertise to draw from, harming our cybersecurity resilience, for example, through an over-reliance on a single provider which may multiply knock-on effects of a breach. Hence, the regulatory framework, in my view, needs to remain flexible for future refinement of regulatory controls.

This flexibility is especially crucial because technology is an ever-evolving landscape. Cybersecurity depends on innovation to keep up, keep ahead and remain effective. Recently, MINDEF invited white hat hackers to hack into MINDEF’s Internet-facing domains. This method of exposing vulnerabilities maximised the talent pool available locally and overseas. The non-prohibitive cost estimated at $100,000, compared to up to a million dollars for hiring a dedicated vulnerability assessment team. This is attractive fiscally. Would the Minister clarify how this Bill would affect non-mainstream methods of strengthening cybersecurity, such as white hats?

In this fast-changing technology-connected world, this Bill provides the preventive complement to the deterrent CMCA. It is a complement to that Act. It places our country to better respond to, prevent and secure the integrity of our computer systems through a strong, yet flexible, regulatory framework. For these reasons, Mr Speaker, I strongly support the Bill.

Ms Thanaletchimi.

Mr Speaker, Sir, I stand in support of the Bill. It is, indeed, a step in the right direction in light of more and more sophisticated cyber threats which have crippled a country's CII, such as that which happened to NHS in the UK, as the Minister has alluded to. The terrible impact of the cyberattack devastated hospitals and GP clinics in the UK. Its Cyber Security Centre was working round the clock to bring its systems back online when this attack resulted in surgeries being cancelled, ambulances being diverted and patient records missing after it became the highest-profile victim of a global ransomware attack and was faced with renewed concern about the strength of its infrastructure. This malware blocks access to any files on PC until a ransom is paid.

This could have been a situation in Singapore if we are not better prepared. The concern over cybersecurity becomes more imminent with the Ministry of Health’s (MOH's) direction to move into NEHR for patients, which is an excellent initiative. With access to one patient record across public and private healthcare sectors, framework, structure, audits, cybersecurity governance and oversight, including educating the stakeholders and providing relevant continuous training, becomes paramount.

Our country’s information infrastructure has to be protected and well-preserved from infiltration and attack in the name of cyber-terrorism. The special focus of the 11 key sectors, such as Government, security and emergency, healthcare, telecommunications, banking and finance, energy, water, media, land transport, air transport and maritime, demonstrates the critical nature of the sector that could cripple the entire Singapore in terms of economy and threaten our lives to its devastation.

With this as backdrop, I am, indeed, heartened to see the Government’s inclusive effort to garner stakeholder’s feedback and support on the Cybersecurity Bill. It is, indeed, notable that the public consultation on the Bill, which was originally scheduled from 10 July to 3 August 2017, was extended to allow respondents more time to provide feedback on such an important Bill that is pertinent to safeguard the people of Singapore in all aspects.

The importance of working with the various stakeholders cannot be over-emphasised and it is equally pertinent to ensure the relevant sectors work closely with one another to implement the intricacies of the Bill and to ensure the proposed requirements are adhered to. I believe implementing it would be more challenging than enforcing the Bill.

Licensing cybersecurity service providers may not be a popular move but a necessary one to ensure that they meet the security needs. In this regard, I would like to propose the following suggestions for consideration.

There needs to be a structured means of briefing the companies, especially small and medium enterprises (SMEs), on guidelines to encourage them to adhere to the cybersecurity measures. SMEs may not have the resources and capabilities to adhere to the measures, unless they are given the impetus and financial support to put in place the necessary requirements. They may also need borrowed expertise to put in place the secured means of protecting information as they serve as a third-party vendor to some clients. It would be good for the Government to grow and provide a pipeline of those talents to assist these companies which will need them.

In the areas of training, the Government may consider grants to encourage individual personnel to take up cybersecurity courses or programmes to refresh their knowledge and to be updated on the latest advancements, as the industry transforms rapidly. This can be tied to SkillsFuture cybersecurity upskilling grants.

To enhance governance and oversight, it would be worthy to introduce an accredited framework for auditors to perform checks and provide guidance or advice on what companies can do to have a more secured portal. Establishing a national cybersecurity audit to check on the stakeholders of the 11 sectors will provide a high level of assurance for those who engage in services in the specific sector.

Effective communication mechanism or efficient connectivity to promptly inform stakeholders and companies of the specific sector or sectors that could be potential target and how to take timely precaution will serve to act as preventive means.

Companies or individuals who proved to have unintentionally violated the requirements in the Bill, should be made to go through relevant cybersecurity programmes and this should be made compulsory. In fact, it would be useful to ensure that all staff of the industry be made to attend awareness programmes in this field, so as to better protect the critical information.

Sir, I fully support the Bill that raises the level of resilience in our efforts to prevent and combat global cybersecurity attacks that periodically threatens us, especially when we least expect.

Assoc Prof Daniel Goh.

Mr Speaker, Sir, this is an important Bill that sets up the regulatory framework to protect Singapore from the increasing threat of cyberattacks. The extensive commentary and feedback received during the public consultation for the Bill show that the public recognises the importance of cybersecurity. In the responses to the feedback, we can also see the Government trying to balance the compliance burden on business with the necessary measures to protect the economy from cyberattacks.

Singapore’s cybersecurity strategy is a correct approach taken for a global city that depends on openness and connectedness to the world for its proper functioning. This approach can be described as a whole-of-Government approach that places public-private collaboration at the heart of the strategy with a strong future-oriented plan for capacity development and for value addition to the economy. This Bill is an integral part of the strategy and expresses the strategy’s approach.

I have three sets of clarifications for the Minister. The first set is more general and has to do with the strategy and its implementation; the second, on the scope of the Bill; and the third, on the specific provisions of the Bill.

The Paper setting out Singapore’s Cybersecurity Strategy was published more than a year ago in October 2016. The strategy has four pillars: building a resilient infrastructure, creating a safer cyberspace, developing a vibrant cybersecurity ecosystem and strengthening international partnerships.

I was rather surprised that there is very little mention of MINDEF in the Paper. It was mentioned once in the Paper when it was noted that MINDEF formed part of the National Cyber Incident Response Teams with CSA, the Government Technology Agency (GovTech) and the Ministry of Home Affairs (MHA). These teams are part of the plan to respond to Tier 1 cyber campaigns threatening national security and Tier 2 cyberattacks on a sector.

MINDEF is a 4G military force reliant on secure communications and information networks. It should already have well-developed cybersecurity infrastructure and capabilities. It would be a terrible waste if the military applications are not adapted for civilian use. Could the Minister share whether there are plans to synergise and share military cybersecurity knowledge and technology to develop and deepen our civilian cybersecurity infrastructure?

Afterall, as it is stated in the strategy Paper, cybersecurity is a way of putting Total Defence into action and everyone has a role in creating a safer cyberspace for everyone, and this must include the military. There are two other specific ways that the military could play a key role to realise our cybersecurity strategy objectives. These are already observed in public commentary on the strategy and many have pointed to the Israeli military as a successful example.

First, our military has a peculiar asset: the commitment of tens of thousands of full-time and operationally-ready National Servicemen. This represents a potentially significant investment of time, not only of manpower, but of brainpower, by our highly educated workforce. The time invested could be harnessed to serve both military and civilian cybersecurity needs.

A cybersecurity corps could be formed to train budding IT professionals when they are serving full-time National Service. Deferment could also be considered for these young men to obtain degrees in cybersecurity first, so that they would hone their classroom skills in the military. They could then enter the cybersecurity industry when they become operationally-ready and return to the military with enhanced knowledge and skills during their NSmen call-ups. This is a win-win method to develop a vibrant cybersecurity system for Singapore.

Second, our unique military institution could also be used to foster startups to develop Singapore’s cybersecurity industry. Israel is already ahead of everyone in this game and there are an estimated 420 cybersecurity companies in Israel today, many of which are at the forefront of innovation and exporting their technology. It is now well-known that the Israeli Defence Force acted as the incubator for the startups. We have similar institutional features here, so there is no reason why the Singapore Armed Forces (SAF) cannot also serve as such an incubator. It would be a win for the military and a win for our entrepreneurship sector and economy, too.

I move on now to the second set of clarifications on the scope of the Cybersecurity Bill. The Bill defines "critical information infrastructure" in section 7 as the computer system "necessary for the continuous delivery of an essential service", the compromise of which would lead to a serious effect on the availability of the essential service. Essential service is defined in section 2 as "any service essential to national security, defence, foreign relations, economy, public health, public safety or public order of Singapore, and specified in the First Schedule". I am surprised that higher education and research institutions are not listed as essential service in the First Schedule and would like the Minister to clarify why this is so.

There are three reasons why I am surprised. First, it was reported that the NUS and NTU both suffered separate cyberattacks in April last year. It appeared to be the work not of casual hackers but of carefully planned, sophisticated cyberattacks that might be aimed at stealing information related to the Government and research. This is an extreme cyberattack scenario which this Bill is aimed at defending against. If our top public universities are being targeted by organised hackers, who could not be named by CSA for operational security reasons, and they were going after some precious information which, again, CSA could not reveal for security reasons, then there must be critical information residing in our universities and research institutions.

Second, of course, a sophisticated, targeted cyberattack on our universities does not mean that the service provided by the universities is essential, as defined in the Bill. I am, however, inclined to argue that there is a lot of research that is going on in our universities and other associated research institutions that have to do with the continuous delivery of essential services. The theft of information related to these research projects could lead to cyberattacks or other forms of attack that could seriously affect the availability of essential services. I would like to ask the Government, therefore, to review whether the computer networks for research-related to essential services, especially Government-linked research projects, should also be considered as CIIs.

Third, our universities are central to cybersecurity innovation and training. In the Paper outlining Singapore’s Cybersecurity Strategy, four of our six autonomous universities are named as playing key roles in fostering cutting-edge research and development (R&D) and talent development. It is in the vision that each of the six universities would become a "cybersecurity centre of excellence" developing its own area of specialisation. The training of our cybersecurity workforce is also entrusted to the universities. The Singapore Institute of Technology (SIT) and the Singapore University of Technology and Design (SUTD) offer Bachelor and Master's programmes in cybersecurity. What this means is that there is a lot of meta-information on cybersecurity residing in our universities. The theft of this meta-information could compromise the general resilience of our cybersecurity infrastructure or that of specific CIIs.

I move on finally to the third and last set of clarifications that have to do with the duty to report cybersecurity incidents, as specified in section 14. I have two points of clarifications for this. The first is specific to section 14, and the second has to do with cybersecurity incident reporting in general. First, section 14(1)(b) specifies that the owner of a CII must notify the Commissioner of a cybersecurity incident in any computer or computer system under the owner’s control that is interconnected with or that communicates with the CII. This seems onerous, and yet, limiting.

It is onerous because it enlarges the scope of regulation beyond the CII into a far larger field of secondary computer systems. For the owner of a CII, this would mean the requirement of detection mechanisms in secondary computer systems. Yet, section 14(2) is not clear whether it is a legal requirement.

Would the Minister clarify whether it is a requirement for the owner of a CII to install detection mechanisms in secondary computer systems interconnected with the CII? Would the Minister also clarify whether this reporting requirement is, indeed, onerous, especially since MCI and CSA’s response to feedback during the consultation on the draft Bill stated that "computer systems in the supply chain supporting the operation of a CII will not be designated as CIIs", implying that the regulation would be more narrowly scoped.

Yet, section 14(1)(b) is limiting, if the intention is to protect the CII from cyberattacks in adjacent interconnected computer systems, as the clause is now worded to limit regulation to only secondary computer systems under the owner’s control.

I would like to ask the Minister to clarify what does "owner’s control" mean in real operational terms? What if the secondary computer system interconnected to the CII is not under the control of the CII owner? Does it mean that such a computer system would not pose a risk to the CII? If a secondary computer system not under the control of the CII would still pose a risk to the CII, then why limit reporting to secondary computer systems under the CII owner’s control? If the risk is the same regardless, then why not remove the need to report cybersecurity incidents in secondary computer systems altogether?

My final point has to do with the reporting of cybersecurity incidents beyond the CIIs. Threat reports issued by cybersecurity firms often point to the problem of under-reporting, as many companies and organisations often choose not to report or to reveal the full extent of cyberattacks and data thefts. This is understandable, as sensational news reports of major data breaches would undermine trust in these organisations and affect the bottom line of businesses.

At the same time, it is not viable for these organisations to hide such incidents from view, as it would erode the general resilience of cybersecurity infrastructure in the long run. Afterall, large-scale organised cyberattacks would likely begin with trial runs of mini attacks on non-critical computer systems. The only way forward might be to legislate mandatory reporting of all cybersecurity incidents to CSA with the assurance of confidentiality and indemnity.

Mr Speaker, Sir, the Cybersecurity Bill is a significant step forward in putting Singapore’s Cybersecurity Strategy into action. I support the Bill. It is an expression of our Total Defence culture. As such, I believe there is a greater role to be played by MINDEF to develop our cybersecurity capabilities and enhance our cybersecurity enterprises.

I also believe that the Government should look more closely at our Institutions of Higher Learning (IHLs) as they have already come under a severe cyberattack and their computer systems contain crucial information related to our essential services and meta-information related to our cybersecurity infrastructure.

Finally, I believe that we need to get the reporting of cybersecurity incidents right and there are kinks in this area in this Bill that the Minister could do well to straighten out.

Ms Joan Pereira.

Mr Speaker, Sir, the Cybersecurity Bill is an important one. It will enhance the oversight and protection of cybersecurity for our CII sectors.

I am heartened to note that we are building up our cybersecurity capabilities on a solid foundation and that the Government has been investing in developing a robust system. Last year, we ranked third globally in terms of cybersecurity spend as a percentage of gross domestic product (GDP) with 0.22%, behind Israel (0.35%) and the UK (0.26%).

However, we can do better to raise our cybersecurity standard. Just last month, the Public Accounts Committee (PAC) reported IT control problems in our public sector due to "agencies not complying with the controls put in place". I agree with the Committee’s assessment that these lapses, which cut across agencies, are significant in view of the IT security threats today.

PAC noted that the Ministry of Finance (MOF) has taken steps to deal with this problem on a whole-of-Government level, including the establishment of an interagency work group. At least one of the lapses originated from an IT vendor, which had been warned.

CSA had clarified in its report on the public consultation on the draft Cybersecurity Bill that "computer systems in the supply chain supporting the operation of a CII will not be designated as CII". However, CSA noted that CII owners have the option to impose cybersecurity requirements contractually on their vendors.

On one hand, I am concerned that this option may result in vulnerabilities. If CII owners choose not to impose cybersecurity requirements on their vendors, how robust will our systems be? Even if they do, will there be checks or audits to ensure our cybersecurity requirements are being met by the engaged vendors?

On the other hand, vendors, some of which are SMEs, may find it difficult to cope with added costs, for example, third-party costs, should they be bound by contractual cybersecurity obligations. Although reporting is compulsory, vendors, especially small ones, may not want to report as that means taking staff away from work to attend to investigations. Small companies are most vulnerable and their vulnerability may impact the CIIs which engaged them due to the sharing of data.

I would like to suggest that the Ministry assist such small companies upstream by providing a pool of trained personnel to look at how their systems can be strengthened. We have to be absolutely thorough to ensure that our systems are not being compromised through such weak links.

I now move on to the point on licensing of individual cybersecurity professionals. Due to concerns that this will pose practical difficulties for global cybersecurity service providers since they deploy employees from different parts of the world to deliver urgent services at short notice, CSA has decided to work with industry and professional association partners to establish voluntary accreditation regimes instead. But I am worried that, without licensing, we may be exposing ourselves to greater risks in the future. How do we minimise such exposures and ensure accountability and traceability?

Similarly, for personnel responsible for cybersecurity, especially senior staff, do we have checks in place to ensure that we recruit suitable persons to make sure that they are of good character with adequate proper training and who upgrade their knowledge continuously?

The cybersecurity sector is evolving rapidly and we must be careful not to compromise Internet and system hygiene in our enthusiasm to support developments and innovations in this area. While interconnectivity provides greater efficiency and productivity, in a way, we have also become more vulnerable and greater care must be taken across all networks. I conclude with my support for the Bill.

Mr Ganesh Rajaram.

Mr Speaker, Sir, I speak in support of this Bill.

Singapore has had its fair share of cybersecurity breaches these past few years. We have heard in this House about the attacks on MINDEF, as well as our two major universities, NUS and NTU. While any cyberattack is of concern, to me, what is most worrying is that the attacks, the likes of those on the Singapore universities last year, were, as the authorities have depicted, carefully orchestrated and specifically targeted. It was not the work of casual hackers.

Mr Speaker, Sir, so far, Singapore has been spared from, at least from what we know publicly, serious breaches that could undermine trust and confidence in our financial systems and national security. But for how long? "We were just lucky", said Mr David Koh, Chief Executive Officer (CEO) of CSA, to explain why Singapore escaped the brunt of global malware attacks like the WannaCry ransomware attack. According to Mr Koh, had these attackers targeted Singapore specifically, the consequences could have been quite disastrous.

This is why this Bill is so important. In a world where nation-state actors are becoming bolder in their cross-border activities, we must ensure that our national security, including cyber defence, can withstand these cyberattacks by enemies we cannot see. Cyber defence has to be a whole-of-country approach. It is not just the Government’s responsibility. It is the responsibility of every single person in this community, from the home owner to the business leader.

Singapore is one of Asia’s major technology hubs. We are very highly connected and, as a result, very vulnerable to cybercrime. Our Smart Nation aspirations will bring many benefits but also many vulnerabilities if we are not vigilant and prepared.

In a recent newsletter, cyber technology company Apvera put Singapore at the top of the list of countries from which cyberattacks could be launched. Just to clarify, this does not mean that Singaporeans are becoming hackers, but rather, we have become the No 1 potential launchpad for cybersecurity attacks because of our location, digitalisation, IT savviness as a people, and the increasing number of cloud-based and virtual servers.

Beyond the provisions of this Bill, Mr Speaker, public education has to be enhanced and ramped up. Last year, CSA commissioned a survey to find out about Singaporean attitudes to cybersecurity and cyber hygiene. Here are some findings.

One in three respondents did not manage their passwords securely. They store them on our computers and they write them down. They also use the same passwords for multiple accounts, for work and personal accounts. One in three respondents did not enable their two-factor authentication. Despite widespread use of cloud storage, mobile and other storage devices, almost half the respondents did not conduct virus scans on their devices and files. More than six in 10 respondents connected to open, non-password protected wi-fi networks in public places. Practices, such as these, pose a substantial risk to the security of their personal information and, ultimately, the cyber communities they are part of.

Mr Speaker, Sir, I would like to commend CSA for launching the "Live Savvy with Cybersecurity" campaign last year, where people from all walks of life learned about cybersecurity threats and cybersecurity hygiene. I would strongly encourage the Government to make these roadshows and campaigns a part of school curriculums right from the first time children use computers in schools. Grassroots clubs and community centres should use this campaign to reach out to the elderly, too.

Businesses should also play their part in bolstering their cybersecurity defence. Too often, CEOs are happy to invest in IT systems only when it adds to their bottom line. Few realise, until it is too late, that IT security will actually protect this bottom line. According to a commentary on channelnewsasia.com last December, the cost of security failure because of cybercrime is projected to grow to over US$2 trillion globally in 2018.

Mr Speaker, Sir, the Government can also do more. Last month, in its review of the Auditor-General’s (AG's) Report for financial year (FY) 2016/2017, PAC cited recurring weaknesses in IT controls as a major weakness. Some of the lapses pointed out by PAC included: user accounts not being properly removed when required, and staff given access to accounts and data that they should not have access to.

What is alarming is that these weaknesses and lapses were pointed out in the past by the AG, and they were still recurring. Though the Ministries concerned have made arrangements to ensure that such lapses do not happen again, this is yet another timely reminder that cybersecurity should not be taken lightly. All we need is just one lapse to bring down the entire system.

Mr Speaker, Sir, let me conclude my speech by reaffirming my strong support for the Bill. We cannot take our security for granted and, in today’s digital world, cybersecurity is as important, if not more important, than military security, as the enemy is invisible and can strike anytime and anywhere.

Mr Darryl David.

Mr Speaker, Sir, advancements in information and communications technology (ICT) have transformed our society and the way we live, work and play. We are living in an increasingly interconnected world enabled by digital technology, and the inadvertent rise of Internet of Things (IoT) will accelerate our dependency on technology to an unprecedented level in the near future.

Singapore remains one of the most connected country in the world. Internet penetration rate in Singapore is at 82.2%, much higher than the global average, and 70% of Singaporeans are active on a social media platform, more than double the global average of 34%.

The explosive growth of ICT has ushered in a golden age of digitalisation and has been instrumental in enabling research, applied science, healthcare, transportation and urban development, just to name a few areas. Building upon a robust ICT infrastructure is also the vision of transforming Singapore into a Smart Nation.

Yet, the exponential growth of ICT and our increasing dependency on digital systems have heightened our vulnerability to cyber incidents. These cyber incidents can take the form of cybercrime aimed at siphoning money from corporations and individuals; cyber terrorism and espionage aimed at crippling Government systems and pilfering sensitive information; or even seemingly innocuous cyber pranks that could lead to widespread havoc and social disruption.

In Singapore, our Government systems were also not spared from such incidents. We have heard various Members in the House already referring to the incidents and the attacks carried out against MINDEF and also our IHLs. What is more foreboding is the CSA warning that there has been a consistent and concerted effort to penetrate our Government’s IT system. Thus, the introduction of the Cybersecurity Bill is not only much needed, it is also timely. I do, however, have some points that I would like to raise for discussion and consideration.

Clause 4 of the Bill has vested the Minister with the authority to appoint a Cybersecurity Commissioner and a team of high-ranking cybersecurity officials who have a wide range of duties pertaining to the cybersecurity efforts in Singapore. Although the appointment of the team will help ensure that efforts across Ministries and Statutory Boards are coordinated and policies are implemented consistently, greater clarity perhaps needs to be given on how this jurisdiction will be established.

With the recently established GovTech taking on the role of the Chief Information Officer (CIO) of the Government, and CSA already monitoring cybersecurity, how will the newly established centralised cybersecurity office work alongside these agencies? How can we ensure that there is no duplication of duties and, more importantly, what is the unique value-add that the centralised cybersecurity office will bring to our cybersecurity ecosystem that GovTech and CSA are not already doing?

Part 3 of the Bill has vested the Cybersecurity Commissioner with the authority to designate computers and computer systems as CIIs and empower the cybersecurity office with greater oversight over these systems.

While the Bill has set out some guidelines regarding the criteria of designating CIIs, perhaps more consideration needs to be given also on how the status of a CII is designated and what constitutes the phrase, "essential services". For example, clause 1 in Part 3 of the Bill suggests that a CII can be defined as a computer or computer system that is necessary for the continuous delivery of essential services in Singapore.

Although some services might not be regarded as "essential", they could be considered significant, and any disruption of these entities could have a serious socio-economic impact. Moreover, there could also be private organisations that would require the appropriate assistance, advice and, more critically, protection in this area, too.

On a related note, if an organisation’s computer system, especially a commercial or private one, is designated as a CII, how much access to its database would the cybersecurity office have? For example, if the computer system contains sensitive personal data like health records from insurance companies or investment portfolios from private banks and private organisations, how would cybersecurity be balanced with the intrusion into the privacy of the individual?

I noted that the Minister earlier mentioned that cybersecurity officers are going to be bound by certain very clear guidelines and perhaps even legislation or laws with regard to ensuring confidentiality when they access such information. But I think we cannot deny that there are some potential ethical dilemmas that could arise when cybersecurity officers, in the course of their work, gain access to personal data that contains identifiers when the providers of that information did not give explicit consent for the information to be used or accessed.

While it might not fall strictly under the rubrics of the proposed Bill, how can we provisionally use the Bill to manage the issue of "fake news"? I am aware that the Parliamentary Select Committee will, no doubt, present its views on how the issue of fake news can be tackled in due time but, until then, can we utilise the provisions in this Bill to take action against the perpetrators of fake news?

If someone were to hack into a Government agency’s system and issue falsehoods via the agency’s website or automated broadcast system, then can the Government take issue with the perpetrators for committing a cybercrime and also prosecute them for what their hacking resulted in? For example, if someone hacks into the Singapore Police Force (SPF) website or creates a fake SPF site to spread fake news of terror acts, how would the Government deal with the perpetrators and the ensuing chaos that possibly could result from this cybercrime?

Fake news, as we all know, can lead to widespread panic that erodes the trust in public institutions. So, can the cybersecurity office hold the perpetrators of such cybercrimes responsible for the consequences of their crimes? Or will the crimes fall under other legislation, such as the CMA? And, if so, how can the Cybersecurity Bill complement the legislation under CMA?

Mr Speaker, Sir, advancements in science and technology have always benefited humanity by enhancing conveniences in our daily lives and enabling us to do things that once existed only in our imagination.

At the same time, there will always be deviant individuals who will use science and technology for criminal activities or subversive purposes. Consider how nuclear power has allowed humanity to make significant progress, yet that same nuclear power and capability, in the hands of the wrong individual, can have catastrophic consequences for humanity.

Digitisation and Internet technological advancement are no different. As much as they have tremendous benefits for humanity, there is a dark side to this as well. At best, cyber pranksters can cause widespread inconvenience. At worst, cyber terrorists can cause the deaths of hundreds of thousands, if not, millions of innocents.

I thus believe that it is timely that the Government is taking steps to address the critical issue of cybersecurity and I stand in firm support of this Bill.

Mr Azmoon Ahmad.

Mr Speaker, good afternoon. The Internet has undoubtedly been part of our life, be it at home, at work, or while we play. We use the Internet directly or indirectly, so much so it is almost impossible to live without it – doing research for education, dynamic navigation while driving, exploring new recipes for the next party meal, or even searching for that box office movie. The Internet is now becoming an indispensable part of our daily lives. Our high dependency on the Internet has made it a part of us.

Like many things which are a part of us, it can also be deemed to be private, until when it is violated. Violation of privacy leads to dire consequences. This could mean loss of business, loss of self-esteem for an individual or even loss of life. While we want to believe that the Internet is safe and secure, however, a dark side of it exists and must be managed and controlled.

Mr Speaker, please allow me to share my own personal experience as a victim who was held ransom by a ransomware called "Locky". It happened in April 2016, where my work computer was attacked by a software virus which eventually encrypted and locked all my data files. This resulted in me not being able to open or run any of my files. It was a complete disaster as all my work was stored in the computer. It was also unfortunate that the virus attacked the backup files, both in my computer and the main server.

This eventually rendered me helpless as I could neither provide all the required information, nor could I prepare any information for my potential business acquisition. I felt intruded and my personal space had been violated. Mentally, I felt no difference than a person who had been physically violated.

At this juncture, I wished the authorities could have acted and the culprit be apprehended and be dealt with according to the rule of law. However, this never happened. Eventually, I managed to recover all the attacked files through a third-party overseas service provider, but with a fee for a few thousand US dollars. I felt that I was held ransom and the only way to recover all my files was to pay that ransom fee. This is not right and should never happen at all. However, the truth is: it did not stop. Not only did it not stop, in fact, more and bigger cyberattacks occurred in the preceding years.

Just to give Members some examples. I believe that some of my colleagues had already shared this. In October to December 2013, a cyberattack called "The Messiah" created havoc as several systems and portals were compromised. Users were redirected to suspicious and unknown websites and this undermined the confidence of Internet users. However, fortunately, the culprit was eventually apprehended.

We always thought that our military should be the last place and institution for a cyberattack to occur. Unfortunately, our MINDEF was hacked on 1 February 2017 where details of some of our Servicemen and personnel, including their Singapore NRIC numbers, telephone numbers, and birth dates were leaked.

On 14 May 2017, ransomware "WannaCry" crippled the world for three consecutive days and compromised more than 3,000 systems globally. This was considered as one of the major cyberattacks of the decade.

On 28 June 2017, "Petya", which was considered more dangerous than previously known ransomwares, created havoc as it encrypted the Master File Tree Tables for New Technology File System (NTFS), overwriting the Master Boot Record. It spread through malicious emails with booby-trapped Microsoft (MS) Office document. From there, it downloaded and ran the installer and released the software virus and spread unknowingly. This had a devastating effect as it attacked the purported highly secured Master Files which are the basis of the file structure system.

Mr Speaker, in all the cases highlighted, the cyber intrusion and cyberattack were uninvited and unlawful. It was made with malicious intent with the objective to create havoc and misery to all parties, including individuals, agencies and institutions. It undermined the confidence of everyone. Such acts must never be condoned as it will only lead to unhappiness, anger and loss of faith.

I regard such acts as similar to any physical attack on a person, as the consequence from such attack is dire, if not even more. From mental anxieties for having felt violated in their personal space to loss of valuable data and information on one’s Internet-linked devices, such as a computer, mobile phone and others, becoming a victim of a cyberattack can lead to serious consequences. It could even be far-reaching as the outreach from a cyberattack can be wide and endless.

Mr Speaker, it is always hoped and wished that the relevant authorities would be able to act appropriately and accordingly when such things happen. Thus, the Cybersecurity Bill, which is aimed at establishing a working framework in the management of and in response to cybersecurity threats, is very much welcome. In addition, a regulatory framework over the owners of CIIs and cybersecurity service providers will provide an added boost in ensuring that Singapore has a robust cybersecurity framework overall. It is my hope that the regulatory framework be regularly reviewed with higher frequency and in tandem with the fast-changing Internet landscape. With that, Mr Speaker, I wholeheartedly support the Bill.

Mr Henry Kwek.

Mr Speaker, I stand in support of the Bill. Members of this House have talked about the possibilities, as well as the dangers, offered by the Internet and we talk a lot about cybersecurity threats. So, I would not repeat those other than to point out the fact that Singapore is no less exposed to such threats.

On the contrary, as the financial services hub and a regional hub to many global corporations, we are among some of the most exposed countries in the world, making us an attractive proposition to hackers from around the world. It is key to see how vulnerable we are.

In a survey done last year by security services provider Quann of 150 senior IT professionals from Singapore, Hong Kong and Malaysia, it showed that 40% do not have an incident response plan when they are facing cyberattacks and 67% of those who had those plans admitted to not practising their incident response plans.

This stands to impact our reputation, credibility and position as a global corporate hub and a regional e-commerce platform. As Chair of ASEAN this year, Singapore has identified our aspirations to push for an ASEAN-wide e-commerce platform. For such an ambitious project, and to protect our business hub status, we need to make sure we have a strong cybersecurity framework and regime. In this regard, I am very supportive of this Bill. However, I would like to ask our Government to share more on an important issue which is: how do we keep watch on the guards?

First, how about the companies we are entrusting to protect the cyber world here? While we have certification regimes to manage such companies and ensure that they meet desirable quality standards, do we know enough about the people who are working in these companies? Do these professionals, who are certified, have a vested interest in Singapore? And what if they have interests that are contradictory to Singapore's? It is certainly not a stretch of imagination that we have foreign interests among our cybersecurity professionals here who may leverage their positions in having access to secret and confidential platforms. As such, I call for three things.

One, more thorough due diligence checks by our cybersecurity agencies on professionals. Two, re-examine the penalties for misuse of access to data, especially if the perpetrators are members of the cybersecurity industry who are supposed to guard the industry. Three, create a certification system that favours cyber professionals who have a vested interest in Singapore, people who have some real roots and deep roots in Singapore, rather than fly-by-night experts who drop by for ad hoc projects whom our laws have difficulty to reach and deter.

In addition, cybersecurity could be promoted as an engine of growth. Singapore has emerged as a trusted business hub because of our trusted regulations, our strict regulations and because of our people's trusted reputation. Properly executed, Singapore could naturally become a premier trusted business hub for Asia and for the region with regard to cybersecurity.

Can the Government share our plans to grow and internationalise the industry? Can the Government also share more about our manpower plans to prepare Singapore to take part in this exciting development?

In conclusion, while this Bill helps to create a strong cybersecurity regime for Singapore, we must also ensure that we are not caught blind-sided by any unforeseen circumstances, for doing so would be a risk that could prove very costly for Singaporeans in many ways. But if we get this right, it can also create many opportunities for Singapore. Mr Speaker, I fully support the Bill.

Order. I propose to take a 20-minute break now. I suspend the Sitting and will take the Chair at 3.20 pm.

Sitting accordingly suspended

at 3.00 pm until 3.20 pm.

Sitting resumed at 3.20 pm

[Mr Speaker in the Chair]

[(proc text) Debate resumed. (proc text)]

Mr Speaker, Sir, I rise in support of this Bill.

In Singapore, there has been a reported increase in the proportion of cybercrimes to overall crimes from 7.9% in 2014 to 14% in 2016. Cases reported under the Computer Misuse and Cybersecurity Act (CMCA) more than doubled from 280 in 2015 to almost 700 in 2016, with ransomware, hacking and the compromise of online accounts, such as Facebook, SingPass and Internet banking accounts, figuring most prominently amongst these. In 2016, the National Cyber Security Command (NCSC) saw cyberattacks of varying impacts across many sectors, including the defence, Government, banking and finance, and healthcare sectors. I, therefore, welcome this Bill.

The omnibus Cybersecurity Bill allows the Minister to appoint a Commissioner of Cybersecurity. The Commissioner is, in turn, empowered to designate a CII.

There have been tweaks, Mr Speaker, since an early draft of this Bill was first released in July last year for consultation. Conducted between 10 July 2017 and 24 August 2017, the public consultation exercise garnered close to a hundred submissions from a diverse range of stakeholders. I must disclose at this point that I was together with other scholars and students of the Singapore Management University, one of the respondents of this consultation exercise. I am, therefore, pleased, Mr Speaker, with what has followed, with the refinements that have been made to this draft Bill and now the Bill before us. In particular, I am pleased in relation to the regime that now governs cybersecurity licensees.

Beyond this, clause 19(6) also suggests and clarifies that a person is no longer obliged to produce to the incident response officer an email infected by a malicious programme or malware if that email contains information that is subject to legal professional privilege. A distinction is made between a non-disclosure agreement which would be a contractual document of privilege, but there is a distinction now being made with legal professional privilege.

Importantly, Mr Speaker, the Bill acknowledges that a compliance-driven approach to cybersecurity should not only be focused on a box-ticking exercise, of getting all the boxes ticked, but one that solves cybersecurity problems creatively and proactively, thereby instilling a risk-management culture. Behind laws, Mr Speaker, it is this creative approach that will be our shield against cybersecurity threats and incidents; it is this risk-management culture that will see CII owners taking swift and appropriate measures to prevent, manage and respond to cybersecurity threats and incidents. In this vein, permit me to pose a few further questions to the Minister.

Most importantly, or chief amongst them, I would say, are businesses that are involved in this sector. What perhaps is the Ministry and CSA's plan to minimise additional compliance costs? I know that compliance costs for audits, reporting and risk assessments can be exorbitant, and these costs are, unfortunately, likely to be passed down to the consumers, not to the owners themselves.