In this digital age, the internet has become an integral part of our daily lives, providing us with countless opportunities for communication, information access, and entertainment.
However, the online world is not without its dark side, and the rise in cybercrime has prompted governments worldwide to create laws to combat these emerging threats. One notable example is the Online Criminal Harms Act (OCHA), which represents a significant step in Singapore’s efforts to protect its citizens from online criminal activities.
This article will cover:
What is the Online Criminal Harms Act (OCHA)?
The OCHA was passed in Parliament on 5 July 2023. The legislation aims to protect the public from harms in the online space and introduces mechanisms for authorities to more effectively tackle online criminal activity.
While the OCHA itself does not define “online criminal harm”, the OCHA targets criminal activities such as scams and malicious cyber activities, as well as all mediums of online communication (e.g. websites and apps) through which criminal activities can be conducted. The harm that OCHA seeks to prevent includes illegal moneylending, unlawful gambling as well as drug-related offences.
Issuance of Government Directions Under the OCHA
When might Government Directions be issued?
The OCHA allows the government to issue directions to any online service (Facebook, TikTok, WhatsApp and WeChat) where there is a reasonable suspicion that the service is being used to conduct criminal activity (known as Government Directions).
In particular, a Government Direction may be issued if a designated officer either:
- Reasonably suspects that a specified offence has been committed and that any online activity is carried out with a view to carrying out the offence; or
- Suspects or has reason to believe that any online activity is being carried out in preparation of or with a view to committing the scam or malicious cyber activity.
A “designated officer” may be either a public officer from any Ministry or department of the government or an employee of a public authority.
The list of “specified offences” is set out in Schedule 1 of the OCHA. It includes, amongst others, offences under the Computer Misuse Act (e.g. unauthorised access to computer material) and Part 2 of the Protection from Harassment Act (POHA). For instance, if threatening, abusive or insulting communication is directed at someone under section 3 of POHA, this online communication can be addressed through an appropriate Government Directive.
Scams and malicious cyber activities
Because scams and malicious cyber activities tend to unfold with great speed and scale, the threshold to pass for the government to issue Government Directions is lower. This enables them to act quickly to tackle such criminal activity.
The list of scams and malicious cyber activities is set out in Part 2 of Schedule 1 of the OCHA. They include:
- Offences under the Computer Misuse Act;
- Offences related to extortion, gang robbery, criminal breach of trust and fraud by fraudulent representation under the Penal Code; and
- Abetment, or a conspiracy or an attempt to commit an offence.
Here, a designated office could issue directions even before an offence is committed if there is suspicion that any online activity is being carried out in preparation for or as part of the commission of a scam or malicious cyber activity offence.
To whom are Government Directions issued against?
Government Directions can be imposed against 4 categories of persons:
- Those who have control or ownership of the online criminal content
- Provider of an online service e.g. Facebook, TikTok, WhatsApp and WeChat
- Provider of an internet access service and;
- Provider of an app distribution service.
Types of Government Directions
Under the new law, five types of directions can be issued against the above persons when there is reason to believe an offence has been committed online. These directions can be issued to persons whether in or outside of Singapore.
- Stop communication direction. This requires persons who first posted the online criminal content to stop communicating the specific online material to people in Singapore, either by stopping the posting, storing or transmission of any online material similar to the relevant material, or disabling access to the relevant online location. The aim is to ensure that the post is not accessible in Singapore. For example, a designated officer could issue a stop communication direction to someone who posts text or images inciting violence against people of a certain race.
- Disabling direction. This requires online service providers (excluding internet access service or app distribution service) to disable access to specified content (e.g., a post or page) on their service to people in Singapore. This includes disabling access to such material, any identical copies of the relevant material or any relevant online location.
- Account restriction direction. This requires online service providers to disallow or restrict interaction of an account from communicating with people in Singapore (either by termination, suspension or restriction of one or more functionalities of the online service). For instance, an account restriction direction may be issued by a designated officer if he has reasonable justification to suspect that an online account publishes the residential address of another person so as to facilitate unlawful violence against that person.
- Access blocking direction. This requires internet service providers to block access to an online location, such as a web domain, from people in Singapore. Scammers create thousands of blank websites in advance, with domain names that resemble those of legitimate organisations. The scammers activate these websites with scam content and push it out to the public who fall prey to them. Access blocking directions may prevent such websites from being accessed by users in Singapore, and in some cases, even before they are activated by scammers.
- App removal direction. This requires app stores to stop distributing the app to people in Singapore and to stop further downloads of the app by people in Singapore. For example, if there is an app being used to commit scam offences, the government could issue an app removal direction.
Issuance of Code of Practice Under the OCHA
The code of practice is intended to promote good practices by a designated provider against committing offences or it may also require that said provider to implement appropriate systems, processes or measures. For instance, a provider may be required to improve its online security measures to protect against scammers from infiltrating its website.
Though the code of practice lacks legislative effect (i.e. not being legally binding), the designated provider must take all reasonably practicable steps to comply with every code of practice applicable to the designated provider’s service.
Issuance of Implementation Directive Under the OCHA
In addition to the code of practice, the competent authority may give a designated provider a directive to implement any system, process or measure, within the permitted time. This is if the competent authority is satisfied that the system, process or measure is necessary to prevent or counter the commission of offences.
The implementation directive is more prescriptive and specific than a code of practice. It sets out details of the system, process or measure to be implemented. For instance, an implementation directive could require a designated online service to put in place a specific form of multi-factor authentication to protect against the misuse of accounts to commit crimes. The implementation directive is intended to complement the code of practice.
Can Government Directions, Codes of Practice and Implementation Directives be Challenged or Appealed Against?
In the event a party wishes to challenge a Government Direction, it may first apply for reconsideration by a designated officer. The party who can apply for this reconsideration includes the recipient of the direction, proprietor of the online location or originator of the online material.
The application must be made in the prescribed manner and no later than 30 days after being given the government direction. If the direction is affirmed or substituted and the party still wishes to appeal, his or her appeal may be taken to the Reviewing Tribunal. Neither reconsideration nor the appeal affects the operation of the government direction.
The Reviewing Tribunal is made up of a District Judge or Magistrate appointed by the President on the advice of the Cabinet. The role of the Reviewing Tribunal is to consider and determine any appeal brought before it. It may decide an appeal by affirming or cancelling the Government Direction. The decision of the Reviewing Tribunal is final.
On the other hand, appeals against Codes of Practice and Implementation Directives will be heard by the Minister for Home Affairs.
Extra-territoriality of OCHA
OCHA has an extraterritorial effect. This is when a state extends its legal power beyond its territorial boundaries. In other words, the state maintains jurisdiction over its citizens when they are overseas. If they have committed what would be considered a criminal offence in their home country, they would face criminal prosecution in their home country.
OCHA recognises that perpetrators of scams and malicious cyber activities may be based overseas. For example, if a Facebook page run by an overseas user publishes content endangering public health or content facilitating vice and organised crime, the appropriate Government Directive, e.g. disabling direction, might be issued.
As such, the issuing of directions, notices, directives and orders can be made to entities and individuals even if they have no presence in Singapore. If these individuals/entities choose not to comply, further steps could be taken. Prosecution of these individuals/entities is one option, or issuing orders to restrict access to the non-compliant online service to prevent the criminal activity from being accessed in Singapore. For example, an access blocking order can be issued to Internet access service providers to prevent non-compliant online services from continuing to reach users in Singapore and do them harm.
OCHA Interplay with Current Legislation
Since OCHA is still new, much remains to be seen as to how it can be enforced and how the Codes of Practice will be developed. The government did acknowledge in Parliament that there was other legislation that might overlap with OCHA. For instance, the Broadcasting Act, amended in 2022, currently covers only social media services. OCHA however, covers all mediums of online communication through which criminal activities can be conducted.
OCHA also complements existing laws like the Computer Misuse Act and the Protection from Harassment Act to effectively address a wide range of online criminal harms. Under these existing legislation, civil and criminal penalties may be imposed against parties guilty of causing online harm.
OCHA represents a significant milestone in Singapore’s efforts to protect its citizens from the negative aspects of the digital world. By addressing issues such as online harm and harassment, OCHA aims to create a safer and more responsible online environment. As Singapore continues to adapt to the evolving digital landscape, OCHA serves as a notable example of legislative efforts to balance the benefits and potential harms of the internet in the 21st century.
For questions relating to OCHA, do consider engaging a criminal lawyer to help you navigate the OCHA, and if you are faced with a Government Direction and what steps to take in such an event.