Sri Lanka is preparing to establish a National Cyber Security Regulatory Authority at a time when international cybercrime networks, online financial scams and increasingly sophisticated hacking operations are exposing dangerous weaknesses in the country’s ability to protect its digital infrastructure. But behind the Government’s proposed legislative initiative lies a disturbing institutional failure: despite having a Computer Crimes Act since 2007, the country has managed to pursue remarkably few cases successfully.
The proposed legislation, now revised for the second time following Cabinet instructions, is expected to reach Parliament shortly. Digital Economy Ministry Secretary T.R. Waruna Sri Dhanapala says the new Authority will concentrate on preventing cyberattacks, protecting Government information and regulating cybersecurity service providers.
The initiative is necessary. However, the Government must explain why existing legislation has produced such limited enforcement results and what institutional failures the new Authority is expected to correct.
A 19-year-old law, but limited prosecutions
The Computer Crimes Act, No. 24 of 2007, was introduced to provide a legal framework for addressing computer-related offences. Yet the Ministry Secretary’s admission that only a handful of cases have been pursued, with one or two attempts failing to progress, exposes a serious weakness in the country’s criminal justice response.
The problem appears to extend beyond the absence of regulatory powers. Investigations require specialised knowledge, digital forensic facilities, trained personnel, international evidence-sharing arrangements and prosecutors capable of handling technically complex cases.
The Police explanation reveals another disturbing dimension. According to Police Media Spokesman ASP F.U. Wootler, many foreign nationals operating scam networks conduct their criminal activities from overseas. Consequently, there may be no local complainants, making it difficult to establish the necessary evidence for prosecution.
Even when Police raid suspected locations and seize laptops and mobile phones, investigators face difficulties accessing information protected through sophisticated encryption and concealment techniques.
This creates a dangerous enforcement gap in which suspected criminal operations can be uncovered without necessarily producing evidence sufficient for prosecution.
Regulation cannot replace investigative capacity
The proposed Authority’s power to certify cybersecurity service providers could introduce much-needed professional standards. Requiring organisations to employ appropriately qualified cybersecurity personnel could strengthen the industry’s credibility and improve protection against cyberattacks.
However, certification alone cannot protect national infrastructure. The Authority will need sufficient technical expertise, forensic laboratories, secure information-sharing systems and clearly defined responsibilities to prevent overlapping mandates with the Police, telecommunications regulators and other Government institutions.
Equally important is the protection of citizens’ personal information. Strong cybersecurity regulations must establish clear accountability for organisations handling sensitive data, including appropriate safeguards against unauthorised access, misuse and disclosure.
The proposed regulation of SIM cards and internal network facilities also requires careful attention. Telecommunications infrastructure must not become an instrument for facilitating organised criminal activity.
International cooperation remains the missing link
Sri Lanka’s signing of the United Nations Convention against Cybercrime and its intention to pursue ratification could strengthen investigations involving foreign nationals and criminal operations conducted overseas.
But international cooperation must translate into practical results, including timely access to electronic evidence, identification of financial beneficiaries and effective cross-border investigations.
The Justice Ministry has also acknowledged the need to consider amendments to existing legislation.
The Government must therefore publish a clear implementation strategy alongside the proposed Bill, explaining how the Authority will coordinate with law enforcement agencies, protect individual rights and measure its performance.
Parliament should also examine whether existing laws have failed because of inadequate investigative resources, institutional fragmentation or weaknesses in prosecution.
Sri Lanka cannot afford another regulatory institution whose powers remain largely theoretical. The real test will be whether cybercriminals can be identified, investigated, prosecuted and deprived of the financial benefits of their operations.
Without prosecutions, a new Authority will offer little more than institutional reassurance while the country’s digital vulnerabilities remain exposed.
The post Cybercrime Crackdown Faces a Crisis Of Enforcement And Accountability appeared first on LNW Lanka News Web.
