普华永道网络安全立法洞察研究报告

Discussion

paperCybersecuritylegislation

insightsA

comparative

study

and

considerationsfor

future

cybersecurity

legislationVVool

ul

ummee11

-

Introduction

and

study

summaryContents1.

Preface232.

National

Cybersecurity

Strategy(NCS)3.

Cybersecurity

legislation4.

Designing

cybersecurity

legislation5305.

Emerging

trends

of

cybersecurity

legislationAcknowledgements495455Endnotes1Volume1-Introduction

and

studysummary1.

PrefaceThedigital

ageis

anew

era

of

interconnectivity

andinnovation.

Peopleacross

the

world

have

integratedinformation

and

communication

technologies

(ICTs)into

their

daily

life

and

critical

operations.

Digitisationhasnow

become

an

inseparable

and

inevitable

partofglobal

socioeconomic

development.

Asaninevitable

consequence,

the

increaseddependencyon

technology

hasledto

greaterexposureto

cyberthreats

and

challenges.

In

response

to

theNational

CybersecurityStrategy

(NCS):Our

teamfirst

analysed

the

National

Cybersecurity

Strategy(NCS)documents,

which

are

the

foundation

andcornerstone

fordesigning

national

cybersecuritystrategy.

This

section

outlines

ourfindings

oncommon

structures

and

components

of

NCS

adoptedbythe

study

subjects.Nine

cybersecurity

areas:We

conductedathorough

comparative

study

on

oursubjects’cybersecurity

legislation

and

shortlisted

nine

commonareasofinterest:heightened

vulnerability

to

cyberattacks,

countriesacross

the

globe

have

established

orare

constantlyhaving

to

establish

and

update

their

domesticlegislations,

and

collaborate

with

their

internationalcounterparts

against

cyberthreats.1.

Critical

infrastructure

(CI)

protection2.

Incident

response

and

crisis

management3.

Cybercrime

lawThe

approaches

countries

have

adoptedin

designingcybersecurity

legislation

vary

from

one

to

the

otherdependingon

numerous

factors,

such

asnationalsocioeconomic

status

orhistorical

background.

Thispaperhasbeen

written

with

adetailedanalysis

of

thedifferencesand

similarities

between

differentcountries’

approaches.

We

sampled

thirteencountries

(or

called

“subjects”

hereafter)across

thedifferent

continents

and

studied

theircybersecurityenvironments,

in

particular

focusing

on

theirstrategies

for

legislation.

Thesesample

countries

areBrazil,Chile,

China,Germany,

India,

Mexico,Singapore,

South

Africa,

the

United

ArabEmirates

(UAE),the

United

Kingdom

(UK),theUnited

States

(US),Vietnam

and

the

EuropeanUnion

(EU).4.

Personal

data

protection5.

Non-personal

data

protection6.

Information

and

communication

technology

(ICT)vulnerability

management7.

Awareness

and

capability8.

International

cooperation9.

Cybersecurity

technologies

and

solutionsmarketplaceThis

section

provides

a

general

overview

ofvariations

and

similarities

insecurity

and

legislationdesign

approaches

in

the

nine

areas

ofcybersecurity.

This

section

also

highlights

notableobservations

inthose

areas.Five

considerations:

After

aggregating

theknowledgeand

insights

gathered

during

thecomparative

study,

our

team

identified

fiveconsiderations

that

countries

in

their

early

stage

ofdevelopingtheir

cybersecuritystrategy(includinglegislation)

can

take

into

consideration.This

paper

intends

to

share

observations,

analysisand

insights

from

various

stakeholders,

includingcybersecurity

and

privacy

policy

researchers.

Thispaperalso

intendsto

provide

insights

and

guidanceto

policy

makers

and

key

stakeholders

atthe

earlystage

offormulating

strategy

forcybersecuritylegislation.

In

overview,this

report

includes

thefollowing

contents.Future

trends

inlegislation:

Lastly,

the

reportshedslight

on

emerging

cybersecurity

legislationtrendsso

that

countries

may

better

preparethemselves

for

arapidly

evolving

digital

paradigm.Volume1-Introduction

and

studysummary22.

National

CybersecurityStrategy

(NCS)National

Cybersecurity

Strategy

(NCS)

is

adocument

that

highlights

the

challenges,

high-level

goals,principles

andprioritiesthatguidea

countryin

addressing

its

cybersecurityneeds.With

a

clear

vision,

policymakers

and

key

stakeholders

can

drive

a

more

comprehensive,consistent

and

coherentapproach.

NCS

shapesthe

strategic

guidelines

ofacountry’scybersecurity

approach

and

plays

acrucial

role

in

its

cybersecurity

protocol.

It

is

summative,and

its

principles

will

influence

acountry’s

cybersecurity

legislation.

One

commonality

that

allcountries

share

throughout

theirNCSis

the

goal

oftranslating

theirnationwide

vision

intoimplementable

and

coherentcybersecurity

legislation

and

regulations.

Thus,

an

NCS

shouldbe

based

on

an

all-encompassing

understanding

and

analysis

of

the

overall

digitalenvironment

while

beingtailored

to

the

country’s

specific

circumstances

and

priorities.Asmentioned

above,NCSis

astepping

stone

for

cybersecuritylegislation

to

be

developed.

It

articulates

the

cybersecurity

challenges

acountry

facesand

the

corresponding

goals

that

it

aims

to

achieve.Furthermore,

it

may

also

state

specific

cybersecurity

issuesto

beaddressedand

actions

to

be

carried

out.

Below

are

some

ofthechallenges,

goals

and

issuescommonly

found

in

the

NCS

of

our13subjects.Challenges•••Increasing

instances

ofcybercrimesIncreasing

level

ofsophistication

in

cyberattacksIncreasing

vulnerabilities

in

critical

infrastructuresGoals••••Enhance

cyberresilienceControl

cybersecurity

riskLeverage

international

cooperation

in

combating

cybercrimeBuild

open

and

connection-enabled

cyberspaceIssues

to

beaddressed••••••••Domestic

legislation

and

regulation

buildingIdentify

and

emphasise

critical

infrastructures

(CI)Combat

cybercrimeInternational

cooperationExpand

the

partnership

between

the

public

sector

and

private

sectorPromote

the

development

of

the

cybersecurity

industryRaise

national

cybersecurity

maturity

levelRaise

awareness

and

capabilitiesTosummarise,

NCSis

essentialfor

developingacountry's

cybersecurity.The

challenges,

goals

ormeasures

proposed

thereinreflectthe

overallrequirements

ofcybersecurity

development

and

can

act

asa

criticalreference

point.Volume1-Introduction

and

studysummary43.

CybersecuritylegislationThis

section

providesan

overview

and

comparative

analysis

ofthe

diverse

approaches

and

subjectsadoptedin

the

nine

cybersecurity

areas.3.1

Criticalinfrastructure

(CI)protection3.1.1

Legislative

modelCritical

infrastructure

protection

legislation

hasentered

amature

stage.Mostof

oursampled

countries

have

CIprotection

legislation

in

place;

theyare

Brazil1,

2,Chile3,

China4,

Germany5,

India6,

Singapore7,

South

Africa8,the

UAE9,

the

UK10,the

US11,Vietnam12,

and

the

EU13,14.Thereare

twolegislative

models,

one

dedicatedto

CIprotection

laws

and

the

otherincorporating

relevantrequirements

into

the

broadercybersecuritylegislation

orstrategic

initiatives.3.1.2

Legislative

frameworkWe

observedcommonalities

in

the

writing

structure

and

contentcoverageofnumerous

CIprotection

laws.

The

structure

of

the

components

is

asfollows:1.

Introduction,

definitions

and

scope

of

CI

protection

laws-it

coversthe

purpose

andscope

of

the

CIprotection

law.2.

Enforcement

bodies

and

duties

-it

describes

the

responsibility

ofgovernment

bodiesin

CIprotection,

including

‘enforcementbodies’

andthe

national

‘Computer

Security

Incident

ResponseTeam

(CSIRT)’.3.

Duties

of

operators

-it

describesthe

administrative

and

technicalrequirements

for

CIoperators,

including

their

security

and

incidentreporting

requirements.4.

Miscellaneous

-it

includes

the

terms

orarticles

that

do

not

fit

in

any

ofthe

above

sections

but

are

deemed

critical

to

the

CIprotection.

Often,

thissection

would

covercontents

relatedto

penalties,

grace

periods,transitional

measures,

gap

analysis

and

remediation,

among

others.Volume1-Introduction

and

studysummary63.1.3

Definition

and

scopeDepending

on

the

national

priorities

and

circumstances

ofindividualcountries,

CImay

encompass

awide

range

ofindustries

and

sectors.

Ingeneral,energy,transportation,

banking

and

finance

andtelecommunications

are

defined

asCIin

most

countries.Critical

infrastructure

can

have

adifferent

name

dependingon

the

countryin

question.

It

is

commonly

referred

to

as‘critical

infrastructure’,

‘criticalentity

(CE)’

or‘essential

services(ES)’.

Critical

information

infrastructure(CII)

refers

to

a

system

carried

and

operatedbasedon

CI

and

is

aconceptwith

asmaller

scope.CI,

CE

and

ES

are

collectively

referredtoasCIhereafterin

this

report.3.1.4

Roles

and

responsibilitiesofgovernmentauthoritiesTocontinuously

improve

national

CIprotection,

some

countriesimplement

the

risk

management

cycle,

including

managing

thevulnerability

ofcritical

infrastructure;

managing

critical

infrastructureincident

reports;

conducting

incident

investigation;

providing

cybersecurityadvice

and

support

for

critical

infrastructure;

imposing

disciplinary

actions;and

establishing

relevantstandards

ofCIprotection.

Thereare

twoauthority

models

in

CIprotection.

One

is

having

acentral

authorityoverseeing

the

entire

CIprotection

operation,

and

anotheris

delegatingpower

to

different

authorities.

However,

numerous

tasks

and

multiplestakeholders

are

involved

in

CIprotection,

and

many

countries

in

oursample

nominate

agenciesto

coordinate

and

be

responsible

forCIprotection.7Volume1-Introduction

and

studysummary3.1.5

Incident

reporting

mechanismMostcountries

have

specified

theircybersecurity

incident/threat

reportingrequirements

for

theirCIoperator/owner.

This

study

found

that

incidentreporting

requirements

across

most

jurisdictions

include

threeprimarycomponents:

the

reporting

path,

time

requirements

for

reporting

andreporting

content.Cybersecurity

incident

reporting

pathMostlegislation

outlines

the

reporting

path

when

security

incidents

occur,which

is

generally

reportedto

the

national

Computer

Security

IncidentResponseTeam

(CSIRT)

immediately.

While

most

countries

have

aCSIRT

asthe

bodyto

report

CIincidents,

the

US

hasset

up

CISA(Cybersecurity

&

Infrastructure

Security

Agency)to

handle

incidentreporting

from

CIoperators.Time

requirements

for

reportingThe

reporting

time

requirement

rangesfrom

6

to

72

hours,

dependingonthe

situation.

In

addition,

some

countries

do

nothave

atime

requirementorhave

one

that

is

describedin

vague

wording

such

as‘immediately’

or‘assoon

aspossible’.Cybersecurity

incident

reporting

contentCountries

with

ahigherlevel

ofcybersecurity

maturity

provide

detailedguidelines

on

whatcontent

needs

to

be

included

in

the

incident

report.The

content

should

generallyinclude:

description

ofthe

security

incident;the

time

when

the

incident

occurred;

the

duration

ofthe

incident;

thesecurity

defences

that

were

in

place;and

the

impact

and

cross-borderimpact

ofthe

incident.

On

the

otherhand,

countries

with

alowermaturitylevel

lack

specifics

in

the

content

coverageguideline.Volume1-Introduction

and

studysummary83.1.6

Security

requirementsfor

CIoperatorsCYBERSECURITYFRAMEWORKVERSION1.1Credit:

N.Hanacek/NIST15CIoperators

comply

with

many

security

requirements

in

the

CIoperationprocess.

Mostcountries’

CIsecurity

requirements

are

basedon

orderivedfrom

the

National

Institute

ofStandards

and

Technologycybersecurity

framework

(NIST

CSF)16.

The

five

core

parts

ofthe

securityrequirements

are

divided

byfunction

asfollows:•Identify

-through

assessments

such

assecurity

risk

assessmentswith

which

the

organisation

understands

the

cybersecurity

risk

toorganisational

operations

(including

mission,

functions,

image,

orreputation),

organisational

assetsand

individuals.•Protect-through

programmes

such

assecurity

awareness

andtraining

with

which

the

organisation’s

personnel,

businesspartnersand

suppliers

are

provided

with

cybersecurity

awareness

educationand

are

trained

to

perform

their

cybersecurity-related

dutiesandresponsibilities

in

line

with

relatedpolicies,

procedures

andagreements.•Detect-through

activities

such

assecurity

continuous

monitoring,during

which

information

system

and

assetsare

monitored

to

identifycybersecurity

events

and

verify

the

effectivenessof

protectivemeasures.••Respond

-through

processes

such

ascyberincident

responseprocedures,

responseplanning,

communication,

analysis,

mitigationand

improvement.Recover-through

business

continuity

management

in

cyberincidentswith

recoveryplans

orimprovement,

among

other

initiatives.9Volume1-Introduction

and

studysummary3.2

Incident

responseandcrisismanagementCybersecurity

incident

responseand

crisis

management

are

essentialcomponents

of

cybersecurity.

It

guidesall

levelsofgovernment

andnon-governmental

organisations

(NGOs)

aswellasthe

private

sector

toworktogetherto

prevent,mitigate,

respondto

and

recoverfrom

incidents.Our

study

notedaglobal

trendof

increasingly

mature

development

incybersecurity

incident

response

legislation,

with

many

countriespublishing

theircybersecurity

incident

responselaws,

including

India’sCERT-IN

directives17,

National

CyberSecurity

Incident

Plan

ofChina18and

the

US’s

CyberIncident

Reporting

for

Critical

Infrastructure

Actof202219.Studies

on

our

samples

indicated

that

the

framework

ofcybersecurityincident

response

law

usually

includes

incident

classification

and

areporting

mechanism.3.2.1

Classification

of

a

cybersecurityincidentThe

study

found

that

most

countries

have

established

legalrequirementsfor

classifying

security

incidents.

Forexample,

China’s

National

CyberSecurity

Incident

Plan

indicates

that

acybersecurity

incident

could

beclassified

into

one

offour

levels,extraordinarily

significant,

significant,relatively

significant

and

general.3.2.2

Reporting

mechanismReporting

agencyAll

researchsubjects

have

determined

the

bodyorentity

to

whomcybersecurity

incidents

should

be

reported,

e.g.,the

national

ComputerSecurity

Incident

ResponseTeams

(CSIRTs,

also

knownasCERTs).CSIRT'sresponsibilities

mainly

coverthe

following

areas:••••Security

incident

responsemanagementInformation

sharing

managementCollaborative

relationships

managementKnowledgebuildingVolume1-Introduction

and

studysummary

10However,

national

CSIRTsin

developing

countries

mainly

focus

ondealing

with

security

incident

responsesand

have

less

emphasis

onraising

public

awareness

through

regular

training

and

awarenessseminars.Reporting

contentThe

legislations

ofmost

countries

do

not

specify

the

report

contentwhenasecurity

incident

occurs.

According

to

the

requirements

ofdevelopedcountries,

reporting

information

may

include

whoreportedthe

event,

whoexperienced

the

event,

what

type

ofevent

occurred,

how

and

when

theevent

wasinitially

detected,

what

responsemeasures

have

been

takenand

whohasbeen

notified.Time

requirements

for

reportingMostof

the

legislation

describesspecific

reporting

time

requirementswhen

security

incidents

occur.

Mostcountries

expect

cybersecurityincidents

to

be

reportedwithin

48-72

hours.

However,

in

some

casesthereporting

requirements

are

relatively

shorterat

6-24

hours..

At

the

sametime,

some

countries

do

notprovide

aspecific

time

limit

for

reportingsecurity

incidents,

and

only

indicate

that

theyshould

be

reportedassoonaspossible

orimmediately

afteroccurring.11

Volume1-Introduction

and

studysummary3.3

Cybercrime

lawIn

orderto

ensurean

accurate

and

focusedanalysis,

this

paperfocuseson

cybercrimes

that

occur

exclusively

in

the

digital

space.For

example,thesecybercrimes

include

hacking

ofsystems

oruseraccounts,

systeminterference,malware,

phishing

and

ransomware,

among

others.

Ourscope

excludes

traditional

crimes,

such

ashuman

trafficking

orchildpornography,

that

occur

in

non-cyber

environment

but

uses

digital

spaceasatool.

Furthermore,

basedon

legalcharacteristics,

we

categorised

thevarious

stagesofcombating

cybercrime

into

prevention,

investigation

andrecovery.Notably,

our

analysis

ofcybercrime

legislation

noted

adiscernible

trend

wherein

many

countries

are

increasingly

prioritisingpreventive

measures

over

investigation

and

punishment.3.3.1

PreventionCybercrime

preventionis

acritical

aspectof

addressing

the

growingchallengesin

cyberspace.Cyberspace

can

be

likenedto

abattleground.Thus,

enhancingour

‘warfare’

defensivecapabilities

is

imperative.

Asawidelyacknowledgedprinciple

in

jurisprudence,

proactive

measures

aremore

effective

than

reactive

measures

in

crime

prevention.Governments

employ

various

strategies

to

preventcybercrime,

includingenforcing

the

implementation

of

preventivemeasures,

such

asthose

setoutin

the

following

documents:•China

-Guiding

Opinions

on

Promoting

the

Developmentof

theCybersecurity

Industry

(Draft

for

Comments)20

and

Measures

for

theAdministration

ofCybersecurity

ThreatInformation

Release

(Draft

forComments)21••The

US

-How

to

recognise

&

preventcybercrime22The

EU

-Europol's

cybercrime-prevention

guides23Volume1-Introduction

and

studysummary

12Additionally,

governments

can

collaborate

with

private

companies

andotherorganisations

to

share

information

and

resources,

conduct

systemaudits

and

assessments

and

implement

robust

data

protection

measures.Bytaking

proactive

stepsto

preventcybercrime,

governments

can

bettersafeguard

their

systems

and

networksand

mitigate

potential

threatsbeforetheymaterialise

into

successful

cyberattacks.

Preventionis

acrucial

pillar

in

the

fight

against

cybercrime;

it

plays

avital

role

in

ensuringthe

security

and

resilience

of

cyber

operations.Moreover,many

countries

and

regions

have

takenstepsto

enhance

theirsecurity

measures

and

preventcybercrime,

thereby

raising

the

barrier

tocybercrime

occurrence

and

effectively

reducing

it.

Forinstance,

in

2017,numerous

high-profile

cyberattacks

targetedorganisations

acrossdifferent

industries

in

HongKong,including

licensedcorporations

(LCs)that

are

regulated

bythe

Securities

and

Futures

Commission

(SFC).These

attacks

ofteninvolved

hackersgaining

unauthorised

access

tocustomers'

internet-based

trading

accounts,

resulting

in

unauthorisedtrades24.

Toaddressthis

issue,

the

SFC

issuedadirective

mandatinginternet

brokersto

implement

stricter

security

measures

to

combatcybercrime,

such

asthe

mandatory

implementation

oftwo-factorauthentication

for

logins

to

clients’

internet

trading

accounts

bylicensedorregisteredindividuals25.

These

efforts

have

reduced

significantly

thenumber

of

cyberattacks

and

the

extent

offinancial

losses.13

Volume1-Introduction

and

studysummary3.3.2

InvestigationWhile

all

ofthe

subjects

have

implemented

legislation

to

combatcybercrime,

thereare

significant

differences

in

the

legislative

approachesadopted.

While

some

countries

have

chosento

establish

standalonelegislation

dedicatedexclusivelyto

cybercrime,

some

have

optedtoaugment

the

provisions

oftheir

PenalCodebyincorporating

cybercrime-relatedcontents.

Notably,

South

Africa,

the

UAE,

the

UK,

the

US

andthe

EU

have

legislation

dedicatedto

cybercrime.

The

table

belowprovides

an

overview

of

the

dedicatedlaws

implemented

in

eachcountry.The

legislations

in

these

countries

definesthe

main

typesofcybercrimeand

their

corresponding

penalties.

This

legislative

approach

allows

forsupplementary

provisions

to

be

updatedmore

effectively

from

a

technicalstandpoint,

offering

greateradaptability

to

the

evolving

nature

ofcyberthreats.South

AfricaUAEUKUSEULaw

Cybercrimes

FederalAct

of

202026

Decree

LawNumber1.ComputerMisuse

Act1990281.ComputerFraud

andAbuse

Act2013/40/EUCybercrimeDirective335/2012272.TheDataProtectionAct

2018292.ElectronicCommunicationsProtectionAct313.TheFraudAct

2006303.Manystates

havespecialregulations,NY

PenalLaw32Volume1-Introduction

and

studysummary

14On

the

otherhand,

Brazil,China,Germany,

India,Mexico

and

Vietnamhave

not

introduced

dedicatedlegislation

for

cybercrime.

Instead,

thesecountries

have

optedto

amend

their

existingcriminal

laws

orotherrelevantlaws

to

addresscybercrime.

In

Germany,

cybercrime

offences,jurisdiction

and

application

are

governedbya

unified

German

CriminalCode34,

which

determines

the

‘place

ofcommission

ofthe

offence’

forapplication

purposes.

In

India,

cybercrimes

are

covered

bytheInformation

Technology

Act,

200035

and

the

Indian

PenalCode,

1860(IPC)36.

The

Information

TechnologyAct,

2000

dealswith

issuesrelatedto

cybercrimes

and

electronic

commerce,

and

it

includes

stringentpenalties

and

sanctions

enacted

bythe

Indian

Parliament

to

protect

the

e-government,

e-banking

and

e-commerce

sectors.

The

scope

of

theInformation

Technology

Acthasbeen

expanded

to

encompass

all

moderncommunication

devices,

including

unauthorised

accessto

and

thedamaging

ofavictim's

computer

without

due

permission.Chile

and

Singaporeadoptedboth

approaches.

In

theirearly

stagesofcombating

cybercrime,

theyamended

theirexisting

penalcodes.Subsequently,

theyenacted

standalone

cybercrime

laws

to

furtherenhancetheirefforts

in

combatting

cybercrime.3.3.3

RecoveryAfterexperiencing

cybercrime,

various

governments

would

takemeasures

to

remedy

and

repair

the

situation

to

make

up

for

the

damageassoon

aspossible

while

paving

the

wayfor

the

prevention

ofsimilarlossesin

the

future.

Usefulmeasures

include

cyberinsurance,awareness-raising

activities

and

post-mortem

review.15

Volume1-Introduction

and

studysummary3.4

Personal

dataprotectionAccording

to

data

from

the

UnitedNations37,

nearly

71%of

countrieshave

enacteddata

protection

and

privacy

legislation.

Based

on

ourstudy,all

subjects

have

enacteddedicatedpersonal

data

protection

laws,

suchasthe

EU’sGeneralData

Protection

Regulation38

(GDPR)

and

China’sPersonal

Information

Protection

Law39

(PIPL).Data

protection

and

privacy

legislation

worldwideLegislationDraft

legislationNolegislationNolegislationSource:

UNCTAD,

14/12/2021Our

study

found

that

the

pathway

for

legislative

publications

in

mostcountries

is

to

releasenational

cybersecurity

law

first,

thenpersonal

dataprotection

law.

Forexample,

the

EU’scybersecurity

law,

NetworkandInformationSystem

SecurityDirective(NISD)40,was

implemented

in

2016,while

GDPR

wasimplemented

in

2018.Bystudying

the

legislative

contents

of

oursample,

the

framework

forpersonal

data

protection

law

usually

includes

the

following:•••••Principles