The Hon. Eranga Weeraratne

¶ 01 Hon. Speaker, currently there is no legal framework in the country which mandates the reporting of cyberattacks on government institutions relating to the financial law and other related matters. Currently, it is under the purview of that particular institution or it is their discretion whether to report it or not. That is why a new legal framework — the Cybersecurity Bill of Sri Lanka — is currently being drafted to form the National Cyber Security Regulatory Authority, which would mandate what sort of reporting should be made on such crimes and what sort of cybersecurity guidelines should be followed. So, the Bill would mandate all that. Thereafter, we would be able to enforce that.

¶ 02 Currently, if there are any cybersecurity incidents at any particular institution, it is on their own that they will have to report it to SLCERT to get their assistance to do the investigations. Thereafter, if there had been any crime, then, they would report it to the Computer Crimes Investigation Division of the CID for further investigations. So, again, I would say that, currently, it is not mandatory to report such incidents. And, the new Bill that is being drafted would resolve the issues that are currently there in the legal system. So, we are hopeful that in the course of the year, we would be able to establish the National Cyber Security Regulatory Authority.