The Hon. Ravi Karunanayake

¶ 01 Hon. Speaker, I thank the Hon. Deputy Minister for giving a very comprehensive answer. My cybersecurity knowledge is at infancy state compared to your knowledge, Hon. Deputy Minister. But still, on behalf of the country, there is a necessity to check on certain matters that are happening. Theoretically, you did explain, covering certain areas. And, I asked this question on the 23rd of October, 2025 because there was an apparent cyber threat at that time.

¶ 02 Firstly, I am astonished that there is no legal base to take any legal action on matters relating to cybercrime and cyberattacks. But, there must be a general law which could be taken into consideration when a breach of law takes place. So, I am sure that there must be some law covering these malpractices that are going on, even though there is no specific law which covers cybercrimes. Also, unlike under the traditional accounting system, there is no audit trail left behind in manual form. So, that makes it much more difficult for things to be tracked. In auditing the annual accounts of government institutions and others, how does the Auditor-General go into the cybercrimes that are happening? They are still in the dotage doing manual auditing. And, that process has not gone into further, which is certainly a very concerning area because there is a huge digital gap between what they are performing now and what they are expected to perform in the world.

¶ 03 Hon. Deputy Minister, the UN Global Dialogue on Artificial Intelligence Governance is scheduled for 06 and 07th July, 2026. I hope you or someone from your Ministry would attend that session because I am made to understand that this is the first time an international arm is looking into digital frauds that are going on and there are a lot of cyberattacks taking place in the world. So, I am sure you would look into that, Hon. Deputy Minister.

¶ 04 In your answer, you did mention about three specific cyberattacks. One was in 2023. Then, the cyberattack on the Ministry of Finance happened just about two months ago. How do you basically reconcile what has been revealed and what has not been revealed? At the moment, it has been revealed that about Rs. 80 billion had been siphoned, hacked or whacked, whatever the terminology that is used for that. How do you assess what has not been reported? Now, it is also said that US Dollars 600,000 had been paid to the US Postal Service and that there are some other incidents involving French and Australian documents, et cetera. So, I would appreciate if you would brief the House.

¶ 05 The most important thing is the financial system, Sir. The NDB has basically got attacked. We still do not know what had happened. It is said that it is an internal attack on the general ledger. Then, out of the 30 banks in the country, three big banks, which have over three trillion rupees in asset reserves, have got attacked. The Digital Manager of one bank had gone to Negombo and reported that there had been a cyberattack on almost Rs. 900 million of their assets.