Cybersecurity Act · 2024 Revised Edition · Part · Responses to Cybersecurity Threats and Incidents
25. Emergency cybersecurity measures and requirements
Official textFrom Attorney General's Chambers, unchanged
The Minister may, if satisfied that it is necessary for the purposes of preventing, detecting or countering any serious and imminent threat to —
the provision of any essential service; or
the national security, defence, foreign relations, economy, public health, public safety or public order of Brunei Darussalam, by a certificate under the hand of the Minister, authorise or direct any person or organisation specified in the certificate (referred to in this section as the specified person) to take such measures or comply with such requirements as may be necessary to prevent, detect or counter any threat to a computer or computer system or any class of computers or computer systems.
The measures and requirements mentioned in subsection (1) may include, without limitation —
the exercise by the specified person of the powers in section 18(1) of the Computer Misuse Act (Chapter 194);
requiring or authorising the specified person to direct another person to provide any information that is necessary to identify, detect or counter any such threat, including —
information relating to the design, configuration or operation of any computer, computer program or computer system; and
information relating to the cybersecurity of any computer, computer program or computer system;
Cybersecurity 37
providing to the Minister or the Commissioner any information (including real time information) obtained from any computer controlled or operated by the specified person, or obtained by the specified person from another person pursuant to a measure or requirement under paragraph (b), that is necessary to identify, detect or counter any such threat, including —
information relating to the design, configuration or operation of any computer, computer program or computer system; and
information relating to the cybersecurity of any computer, computer program or computer system; and
providing to the Minister or the Commissioner a report of a breach or an attempted breach of cybersecurity of a description specified in the certificate under subsection (1) relating to any computer controlled or operated by the specified person.
Any measure or requirement mentioned in subsection (1) and any direction given by a specified person for the purpose of taking any such measure or complying with any such requirement —
does not confer any right to the production of, or of access to, information subject to legal privilege; and
subject to paragraph (a), has effect despite any obligation or limitation imposed or right, privilege or immunity conferred by or under any law, contract or rules of professional conduct, including any restriction on the disclosure of information imposed by law, contract or rules of professional conduct.
A specified person who, without reasonable excuse, fails to take any measure or comply with any requirement directed by the Minister under subsection (1) is guilty of an offence and liable on conviction to a fine not exceeding $50,000, imprisonment for a term not exceeding 10 years or both.
Any person who, without reasonable excuse —
obstructs a specified person in the taking of any measure or in complying with any requirement under subsection (1); or
Cybersecurity 38
fails to comply with any direction given by a specified person for the purpose of the specified person taking any such measure or complying with any such requirement, is guilty of an offence and liable on conviction to a fine not exceeding $50,000, imprisonment for a term not exceeding 10 years or both.
No civil or criminal liability is incurred by —
a specified person for doing or omitting to do any act if the specified person had done or omitted to do the act in good faith and for the purpose of or as a result of taking any measure or complying with any requirement under subsection (1); or
a person for doing or omitting to do any act if the person had done or omitted to do the act in good faith and for the purpose of or as a result of complying with a direction given by a specified person for the purpose of taking any such measure or complying with any such requirement.
The following persons are not considered to be in breach of any restriction on the disclosure of information imposed by law, contract or rules of professional conduct —
a specified person who, in good faith, obtains any information for the purpose of taking any measure under subsection (1)
or complying with any requirement under that subsection, or who discloses any information to the Minister or the Commissioner, in compliance with any requirement under that subsection;
a person who, in good faith, obtains any information, or discloses any information to a specified person, in compliance with a direction given by the specified person for the purpose of taking any measure under subsection (1) or complying with any requirement under that subsection.
The following persons, namely —
a specified person to whom a person has provided information in compliance with a direction given by the specified person for the purpose of taking any measure under subsection (1) or complying with any requirement under that subsection;
Cybersecurity 39
a person to whom a specified person provides information in compliance with any requirement under subsection (1), shall not use or disclose the information, except —
with the written permission of the person from whom the information was obtained or, where the information is the confidential information of a third person, with the written permission of the third person;
for the purpose of preventing, detecting or countering a threat to a computer, computer system or class of computers or computer systems;
to disclose to any police officer or other law enforcement authority any information which discloses the commission of an offence under this Act or any other written law; or
in compliance with a requirement of a court or the provisions of this Act or any other written law.
Any person who contravenes subsection (8) is guilty of an offence and liable on conviction to a fine not exceeding $10,000, imprisonment for a term not exceeding 12 months or both.
Where an offence is disclosed in the course of or pursuant to the exercise of any power under this section —
no information for that offence may be admitted in evidence in any civil or criminal proceedings; and
no witness in any civil or criminal proceedings is obliged —
to disclose the name, address or other particulars of any informer who has given information with respect to that offence; or
to answer any question if the answer would lead, or would tend to lead, to the discovery of the name, address or other particulars of the informer.
If any book, document, data or computer output which is admitted in evidence or liable to inspection in any civil or criminal proceedings
computer
“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
Cybersecurity 40
cybersecurity
“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
contains any entry in which any informer is named or described or which may lead to the discovery of the informer, the court shall cause those entries to be concealed from view or to be obliterated so far as may be necessary to protect the informer from discovery.
Terms defined in s 2
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
computer
Defined · s 2“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
computer program
Defined · s 2“computer program” means data representing instructions or statements that, when executed in a computer, causes the computer to perform a function;
computer system
Defined · s 2“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes — (a) an information technology system; and (b) an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system or a distributed control system;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
essential service
Defined · s 2“essential service” means any service essential to the national security, defence, foreign relations, economy, public health, public safety or public order of Brunei Darussalam and specified in the Schedule;
Part