Cybersecurity Act · 2024 Revised Edition · Part · Responses to Cybersecurity Threats and Incidents
22. Powers to investigate and prevent serious cybersecurity incidents etc.
Official textFrom Attorney General's Chambers, unchanged
Where the Commissioner receives information regarding a cybersecurity threat or incident which satisfies the severity threshold in subsection (3), the Commissioner may exercise, or may authorise the
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer or an authorised officer to exercise, such of the powers mentioned in subsection (2) as are necessary to investigate the cybersecurity threat or incident for the purpose of —
Deputy Commissioner
“Deputy Commissioner” means the Deputy Commissioner of Cybersecurity appointed under section 5(3);
assessing the impact or potential impact of the cybersecurity threat or incident;
eliminating the cybersecurity threat or otherwise preventing any or further harm arising from the cybersecurity incident; or
preventing a further cybersecurity incident.
The powers mentioned in subsection (1) are the following —
any power mentioned in section 21(2)(a), (b), (c) or (d);
Cybersecurity 32
direct, by written notice, any person to carry out such remedial measures, or to cease carrying on such activities, as may be specified to the person, in relation to a computer or computer system that the incident response officer has reasonable cause to suspect is or was affected by the cybersecurity incident, in order to minimise cybersecurity vulnerabilities in the computer or computer system;
Examples
Examples of remedial measures include —
the removal of malicious software from the computer;
the installation of software updates to address cybersecurity vulnerabilities;
temporarily disconnecting infected computers from a computer network until paragraph (a) or (b) is carried out; and
the redirection of malicious data traffic towards a designated computer or computer system.
require the owner of a computer or computer system to take any action to assist with the investigation, including but not limited to —
preserving the state of the computer or computer system by not using it;
monitoring the computer or computer system for a specified period of time;
performing a scan of the computer or computer system to detect cybersecurity vulnerabilities and to assess the manner and extent that the computer or computer system is affected by the cybersecurity incident; and
allowing the incident response officer to connect any equipment to the computer or computer system, or install on the computer or computer system any computer program, as is necessary for the purpose of the investigation;
after giving reasonable notice to the owner or occupier of any premises, enter those premises if the incident response officer
Cybersecurity 33
reasonably suspects that there is within the premises a computer or computer system that is or was affected by the cybersecurity incident;
access, inspect and check the operation of a computer or computer system that the incident response officer has reasonable cause to suspect is or was affected by the cybersecurity incident, or use or cause to be used any such computer or computer system to search any data contained in or available to such computer or computer system;
perform a scan of a computer or computer system to detect cybersecurity vulnerabilities in the computer or computer system;
take a copy of, or extracts from, any electronic record or computer program contained in a computer that the incident response officer has reasonable cause to suspect is or was affected by the cybersecurity incident;
subject to subsection (5), with the consent of the owner, take possession of any computer or other equipment for the purpose of carrying out further examination or analysis.
A cybersecurity threat or incident satisfies the severity threshold mentioned in subsection (1) if —
cybersecurity threat
“cybersecurity threat” means an act or activity (whether known or suspected) carried out on or through a computer or computer system that may imminently jeopardise or affect adversely, without lawful authority, the cybersecurity of that or another computer or computer system;
it creates a risk of significant harm being caused to a critical information infrastructure;
it creates a risk of disruption to the provision of an essential service;
it creates a threat to the national security, defence, foreign relations, economy, public health, public safety or public order of
Brunei Darussalam; or
the cybersecurity threat or incident is of a severe nature, in terms of the severity of the harm that may be caused to persons in
Brunei Darussalam or the number of computers or value of the information put at risk, whether or not the computers or computer systems put at risk are themselves critical information infrastructure.
Cybersecurity 34
An incident response officer exercising the power mentioned in subsection (2)(e) may require any assistance the incident response officer needs to gain such access from —
any person whom the incident response officer reasonably suspects uses or has used the computer or computer system; or
any person having charge of, or who is otherwise concerned with the operation of, such computer or computer system.
Where the owner of the computer or other equipment does not consent to the exercise of the power mentioned in subsection (2)(h), the power may be exercised if the Commissioner is satisfied that —
owner
“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
the exercise of the power is necessary for the purposes of the investigation;
there is no less disruptive method of achieving the purpose of the investigation; and
after consultation with the owner, and having regard to the importance of the computer or other equipment to the business or operational needs of the owner, the benefit from the exercise of the power outweighs the detriment caused to the owner, and the Commissioner has issued to the incident response officer a written authorisation to exercise the power.
The incident response officer shall, immediately after the completion of the further examination or analysis on the computer or other equipment which was taken into possession in exercise of the power mentioned in subsection (2)(h), return the computer or other equipment to the owner.
computer
“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
Any person who —
in relation to an investigation under this section, wilfully misstates or without reasonable excuse, refuses to give any information, provide any statement or produce any record, document or copy required of the person by the incident response officer under section 21(2);
Cybersecurity 35
in relation to an investigation under this section, fails, without reasonable excuse, to comply with an order issued by a Magistrate under section 21(5);
fails, without reasonable excuse, to comply with a direction or requirement of an incident response officer under subsection (2)(b)
or (c); or
fails, without reasonable excuse, to comply with a lawful demand of an incident response officer made in the discharge of the duties of the incident response officer under this section, is guilty of an offence and liable on conviction to a fine not exceeding $25,000, imprisonment for a term not exceeding 2 years or both.
Terms defined in s 2
Assistant Commissioner
Defined · s 2“Assistant Commissioner” means any Assistant Commissioner of Cybersecurity appointed under section 5(3);
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
computer
Defined · s 2“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
computer program
Defined · s 2“computer program” means data representing instructions or statements that, when executed in a computer, causes the computer to perform a function;
computer system
Defined · s 2“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes — (a) an information technology system; and (b) an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system or a distributed control system;
critical information infrastructure
Defined · s 2“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
cybersecurity incident
Defined · s 2“cybersecurity incident” means an act or activity carried out without lawful authority on or through a computer or computer system that jeopardises or adversely affects its cybersecurity or the cybersecurity of another computer or computer system;
cybersecurity officer
Defined · s 2“cybersecurity officer” means any cybersecurity officer appointed under section 5(5);
cybersecurity threat
Defined · s 2“cybersecurity threat” means an act or activity (whether known or suspected) carried out on or through a computer or computer system that may imminently jeopardise or affect adversely, without lawful authority, the cybersecurity of that or another computer or computer system;
Deputy Commissioner
Defined · s 2“Deputy Commissioner” means the Deputy Commissioner of Cybersecurity appointed under section 5(3);
essential service
Defined · s 2“essential service” means any service essential to the national security, defence, foreign relations, economy, public health, public safety or public order of Brunei Darussalam and specified in the Schedule;
owner
Defined · s 2“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
Part