Regulatory Approaches in Digital Security (OECD Global Forum on Digital Security).pdf

0:00 Introduction and Definition of Digital Security
2:55 Areas of Digital Security Regulation in Singapore
7:40 Systems of Temporary Concern (Cybersecurity Act 2024, Singapore)
10:05 Entities of Special Cybersecurity Interest (Cybersecurity Act 2024, Singapore)
11:42 Foundational Digital Infrastructure (Cybersecurity Act 2024, Singapore)
12:34 Singapore's Cybersecurity Labeling Scheme
13:27 Regulation of Digital Media - POFMA, OCHA (Protection from Online Falsehoods Act, Online Criminal Harms Act, Singapore)
13:55 Does Self Regulation work?
15:06 Balance between Regulating and Not Regulating
15:51 Best Practices and Strategies

Video at https://www.youtube.com/watch?v=hYITY4cNVLU

In which areas is digital security regulation already the norm? In which areas should it become the norm? (e.g., critical infrastructure, IoT, cloud, certification/labels)
In which areas has self-regulation proven to be effective but sometimes ineffective, too?
What is the right balance between compulsory regulation, voluntary regulation, and autonomy?
What are the best practices and examples from different countries/ stakeholders/ sectors that could be put forward to enhance collaboration?
What are the strategies for strengthening collective efforts in favour of digital security?

Digital security risk encompasses economic and social risk rather than solely technical risk stemming from cyber incidents

0:00 Introduction and Definition of Digital Security
2:55 Areas of Digital Security Regulation in Singapore

1. Regulatory Approaches in
Digital Security
Presented to
OECD Global Forum on Digital Security
By Benjamin Ang, Senior Fellow
Head/CENS, FIT, and DIR
Centre of Excellence for National Security
Future Issues in Technology
Digital Impact Research

2. Key Questions
1.In which areas is digital security
regulation already the norm? In
which areas should it become the
norm? (e.g., critical infrastructure,
IoT, cloud, certification/labels)
2.In which areas has self-regulation
proven to be effective but
sometimes ineffective, too?
3.What is the right balance
between compulsory regulation,
voluntary regulation, and
autonomy?
4.What are the best practices and
examples from different
countries/ stakeholders/ sectors
that could be put forward to
enhance collaboration?
5.What are the strategies for
strengthening collective efforts in
favourof digital security?

3. Definitions of Digital Security
OECD Definition
•Digital security risk encompasses
economic and social risk
rather than solely technical risk
stemming from cyber incidents
Singapore Definition
•Digital security in Singapore
involves creating a safe, secure,
resilient, and trusted digital
environment

4. 1. Areas with Digital Security Regulation in
Singapore
Law / Regulation Area Covered
Cybersecurity Act 2018 11 Critical Sectors: Energy, Water, Banking and Finance, Healthcare,
Transport (Land, Maritime, Aviation), Infocomm, Media, Security and
Emergency Services, Government
Cybersecurity Act 2024 -CII outside the country
-STCC: Systems of Temporary Cybersecurity Concern
-ESCI: Entities of Special Cybersecurity Interest
-FDI: Foundational Digital Infrastructure
Internet of Things Cybersecurity Labelling Scheme
Social media Protection from Online Falsehoods and Manipulation Act (POFMA)
Online Criminal Harms Act (OCHA)
Protection from Online Harassment Act (POHA)

5. STCC:
Systems of
Temporary
Cybersecurity
Concern

6. ESCI: Entities of
Special
Cybersecurity
Interest

7. FDI:
Foundational
Digital
Infrastructure

8. Singapore’s Cybersecurity Labelling Scheme
What is covered
All categories of consumer IoT devices
(“smart devices”) e.g.
•IP cameras
•smart door locks
•smart lights
•smart printers.
•Wi-Fi routers and smart home hubs
Mutual recognition
•Finland
–With Transport and Communications
Agency of Finland (Traficom)
•Germany
–With Federal Office for Information
Security of Germany (BSI)
•Smart Cameras, TVs, Speakers,
Toys, Garden and Household
Robots, Home Automation, Health
Trackers, Lighting, Power Socket,
and Thermostats.

9. Regulation of Digital Media
Protection from Online
Falsehoods and Manipulation Act
•Covers false statements of fact
(not opinion) with public impact
•Can issue Correction Directions
–Compulsory posting of fact check
–NOT takedown
•Can issue Disabling directions
•Can take action against inauthentic
accounts (trolls and bots)
Online Criminal Harms Act
•Covers
–Online child sexual exploitation,
–Drug transactions on chat apps
–Scams
•Can issue directions to Stop
Communication, or Disable, or
Block Apps

10. 2. When does self-
regulation work for
digital security?
It works until it doesn’t
Example: Laws requiring car
makers to install seat belts

11. 3. The Balance
Depends on the
society, culture,
political situation
Note: It is NOT
PROVEN that
“regulation always
stifles innovation”

12. Best Practices and
Strategies
•Build trust among digital
stakeholders
–Transparent
communication
–Honest and fair
exchanges
•Eliminate (or reduce)
special interest lobbies
•Get buy in from society