Compilación de documentos presentados para los Congresos de Derecho e informática. Trabajo presentado en el I Congreso Mundial de Derecho Informático. Organizado por la Comunidad AlfaRedi y la OMDI en Quito-Ecuador. Del 15 al 18 de Octubre de 2.001. Derechos reservados a favor del autor, se prohíbe cualquier reproducción total o parcial que no sea autorizada por el titular de los derechos. THE RIGHTS OF CHILDREN AND THE INTERNET by Samtani Anil* “Making laws is not the same as enforcing them. While sufficient anti-child pornography laws exist in many nations, enforcement is weak. Furthermore, policing a global operation like the Internet involves policing citizens from countries with widely differing domestic laws, cultures and social mores. Although these obstacles appear insurmountable, it must be remembered that child pornography is a substantive and compelling problem on international, national, and local levels, and it is not a harmless crime.”1 “Children are told by parents not to talk to strangers whom they meet on the street, but they are given a contrary message by Web sites that encourage them to interact with strangers in their homes via the Web. The dangers in the Web environment are heightened by the fact that children cannot determine whether they are dealing with another child or an adult posing as a child. In sum, the immediacy and ease with which personal information can be collected from children online, combined with the limited capacity of children to understand fully the potentially serious safety and privacy implications of providing that information, have created deep concerns about current information practices involving children online.”2 INTRODUCTION One of the lasting impressions of the twentieth century must surely be the impact that technology has had in effecting a revolution in the way information is disseminated and communicated. The development and construction of the information superhighway,3 which essentially refers to the interconnected series of networks that provide the infrastructure for transporting information throughout the world, is now a global phenomenon undertaken by entrepreneurs working in isolation, in teams or with institutions or governments. Today, we are constantly bombarded with sensationalist accounts of the burgeoning information infrastructure, and its phenomenal effect on the way we live. In this respect, the Internet, the precursor of the information superhighway, heralds the beginning of a new age in communication, commerce and entertainment and is a tremendous vehicle of economic growth. It is probably not an exaggeration to say that the Internet has had, in one way or the other, an impact on all stratums of society and radically altered the way communications may be made and business may be conducted worldwide.4 The Internet is essentially made up of a shared infrastructure (usually referred to as the Internet network or the network of networks), set up by all of the parties speaking the same computer language and linking computers scattered throughout the world, thus enabling these computers to communicate in different ways.5 The Internet evolved from the “ARPANET” project of the 1960s,6 in which a few military supercomputers were connected in order to allow users in geographically remote areas to access them. The rapid development of the Internet is all the more remarkable when one observes that the commercial use of the Internet is contrary to the initial spirit of the Internet inspired by its pioneers and was once forbidden. As one commentator so aptly puts it, “the most important parts of the Net piggybacked on technologies that were created for very different purposes” and this has yielded the “accidental history of the Net”.7 Today, the Internet is a federation of networks which is constantly developing and which can now be accessed by everyone. Commercial use of the Internet has been developing steadily over the past few years. The Internet is experiencing exponential growth8 and is now a social phenomenon that has transformed social policy, politics and the diffusion of knowledge and has given rise to a whole new breed of entrepreneurs. The Internet has aptly been referred to as an “electronic El Nino” that has and will continue to transform customers, careers and relationships.9 The Internet greatly increases the ease of accessing, reproducing, and transmitting information. This ease raises a host of legal issues including the risk of copyright infringement, the protection of patent rights, and the preservation of trade secrets.10 In addition, privacy issues take on an added dimension of complexity when applied to the realm of the Internet. In addition to the plethora of legal issues created as a result of the advent of the Internet, a pressing concern which has plagued many jurisdictions worldwide is the relative ease of gaining access to offensive material (and in particular, pornography) via the medium of the Internet. In most countries, pornography is more freely available over the Internet than in other mass communications media. It is also generally true that pornographic repositories on the Internet tend to be heavily accessed. Additionally, there is a pressing need to protect children from obscene, indecent and offensive material available on the Internet. Before turning to examine the measures adopted in Singapore to deal with the issues pertaining to the availability of offensive material on the Internet as well as the position in relation to the protection of privacy online, it would be useful to deal briefly with the broader international dimension that presents itself when dealing with issues pertaining to the Internet. We will begin first begin by outlining various abuses of children’s rights that take place on the Internet. THE ABUSE OF CHILDREN’S RIGHTS ON THE INTERNET There are a multitude of ‘sins’ that can and have been inflicted upon children on the Internet, of which child pornography is probably the most visible. Children also potentially open themselves up to privacy transgressions when they participate in online communications. In addition, the Internet can be and has been used to entice children to join groups of dubious origins or with questionable aims, such as hate groups, and to perpetuate fraud on them. Quite apart from the solicitation of children into child pornography, the availability of pornographic material that can be accessed by children can also be viewed as a transgression on the rights of children. In this article, we will focus primarily on the issue of child pornography, the approach adopted in relation to the availability of obscene materials on the Internet (with a focus on the law pertaining to Internet content regulation in Singapore) and the protection of children’s privacy online. CHILD PORNOGRAPHY ON THE INTERNET An Overview Steven Hick and Edward Halpin succinctly summarizes the relevant issues in addressing child pornography on the Internet and provides a summary of the EU and American position on the matter. This is useful as a comparison when we view the Singapore position a little later in the chapter and when we examine the broader international issues that apply in the field: “Child pornography on the Internet is a growing and spreading problem. Those struggling against it are facing particular technical and legal challenges, given the rapid pace of technological change and the ability of images to move across borders. A response requires resolute international cooperation between nations, law enforcement agencies, the Internet industry, complaint hot lines, and NGOs. While it is the responsibility of each nation to ensure the application of existing laws (pertaining to criminal acts, intellectual property, and the protection of minors), the Internet's technical features, worldwide extension, and unlimited accessibility make the application and enforcement of existing rules difficult. In many cases, a concerted international effort is required. Defining child pornography on the Internet, which traverses many different legal territories, is complicated. A background paper for the 1999 International Conference on Combating Child Pornography on the Internet (1999, 15) defined child pornography as graphic material featuring naked or sexually active children that is used for sexual gratification. It also maintained that, in the online pedophile community, the images have different functions beyond that of sexual gratification. The paper reports that, in the pedophile community, child pornography, and the composition of it, is used to validate and celebrate adult interest in child sexuality as well as to seek commercial profit. The pedophile community has become expert at circumventing attempts at Internet regulation, exploiting any weakness in Internet legislation at the national or international level. There is a disjunction between the scope of the Internet and the reach of legal systems. The Internet operates internationally, while our laws function on a territorial basis. Material can be accessed locally, yet it can be housed on computer systems outside local jurisdictions. Determining the extent to which national law applies can therefore be complex. Legal liability frequently depends on the extent to which any particular party controls, or is aware of, illegal content. The concept of being aware, or knowing, has its own difficulties, given the nature of the Internet. To protect children from harmful Internet content, the international community must respond at the legal, industrial, and educational levels and must take into consideration protective measures. Any effective response will need to center on high levels of international cooperation. National responses to child pornography often empathize national (especially criminal) law, without taking into account alternative protective measures. However, even in the legal field, there are considerable problems. In fact, despite the successful efforts of international and supranational organizations, the various national laws have remarkable differences, uncertainties, and loopholes, especially with respect to the criminal law provisions on privacy infringement, hacking, trade secret protection, and illegal content. UNICEF and UNESCO have held several important meetings on Internet safety. At the International Conference on Combating Child Pornography on the Internet, a declaration and an action plan were created calling for an international task force on child pornography and pedophilia on the Internet. The action plan called for concrete actions such as universal ethics and self-regulation standards to be developed by Internet service providers and the creation of national hot lines and "electronic watchtowers" to report cases of pedophilia and child pornography on the Internet. Also, the United Nations passed a resolution proposed by the special rapporteur on child pornography, Ofelia Calcetas-Santos, calling on member states to criminalize the production of child pornography and to ensure the prosecution of those who profit from it. The effective investigation and successful prosecution of those who make child pornography available on the Internet require international collaboration. Since the technology used is global, the response must be global. This year, member states started elaborating the U.N. Convention Against Transnational Organized Crime. Many children's rights organizations hope the process will apply to groups engaged in making child pornography available on the Internet, and the full array of international cooperation measures introduced by the convention would therefore apply. Law enforcement agencies, prosecutors, and the judiciary of U.N. member states could then collaborate in collecting evidence, arresting perpetrators, and bringing them to justice (Arlacchi 1999, 3). In 1998, the United States enacted the Child Online Protection Act, which criminalizes the commercial distribution via the Internet of material considered harmful to minors. The U.S. law calls for warnings and protective screens (such as "Are you under 18? If so, click here") to discourage and warn children before they continue to a harmful Web site. The passage of this act elicited immediate protests from freedom-of-speech groups claiming that the act may be an infringement of the First Amendment, which is a constitutional rule forbidding the enactment of legislation that inhibits freedom of expression. Others claimed that the law does not go far enough, that the protective screens are only minor hurdles for persistent surfers and curious children. Also, the U.S. law primarily protects children from viewing harmful content, but it does not address the problem of child pornography more generally. The European Union (EU) countries have agreed on the need to make a distinction between illegal content and harmful content. They believe that the different categories of child pornography require different approaches, particularly regarding the use of the law to combat offenders. In the EU, illegal content will be dealt with by existing law enforcement agencies according to existing national law. Industry is also being encouraged to adopt properly functioning systems of self-regulation, such as codes of conduct and establishment of hot lines for complaints. In fact, the EU approach tends to emphasize nonlegal efforts, which enables Internet users to filter out content they themselves deem harmful. The use of content rating systems and filtering technology is encouraged. The 1998 EU action plan for promoting the safe use of the Internet provided funding for complaint hot lines and for the development of filtering systems rating systems (White 1999). Both the U.S. and EU approaches emphasize the end user and not the persons placing illegal or harmful content on the Internet. In part, this is due to the inherent difficulties of proving who actually controls content on the Internet. It also stems from fears that limits on freedom of expression will either be challenged in the courts or may be used by authoritarian governments to curtail other nonharmful speech and expression. While there are doubts as to how effective these laws can be enforced, there are also apprehensions about laws that limit the freedom of expression.”11 The problems raised in the above extract are well illustrated by an incident that took place very recently. It was announced, in early August 2001, that the FBI had arrested 100 subscribers to child pornography websites, which is understood to have around 250,000 subscribers worldwide and grossed up to $1.4 million a month.12 Authorities called it the largest child-pornography business ever discovered in the United States.13 The bulk of the material came from Indonesia and Russia, where officials believe the Webmasters operated the sites. The police in Indonesia and Russia have, however, indicated that prosecuting suspects in their countries linked to the Texas-based online child pornography ring will be difficult, due to slack laws governing the Internet and pornography. In a report on the incident, it was noted that Indonesia has no laws banning online pornography and that activists in Indonesia are concerned that cybercrime flourishes with the help of lazy policing. According to Ade Armando, of Indonesia's Anti- Pornography Society, “Indonesia is a haven for child pornography. Sadly, it is completely unregulated here. You can do anything.” Turning to the position in Russia, Dmitry Chepchugov, head of the Russian Interior Ministry's department for high technology crimes, stated that Russian law does not distinguish between child pornography and pornography involving adults, and treats the production and distribution of either as a minor crime. These comments are hardly surprising as it has generally been observed that Web-based criminals often base illegal enterprises in developing countries because of poor law enforcement14 and the lack of regulations covering the Internet.15 Enforceability of Laws in the Internet Environment – A Conceptual Examination In developing relevant laws to deal with Internet related activities, there has sometimes been a tendency to confuse the issue of applicability with that pertaining to enforceability. A legislator from any country can easily craft laws that apply to particular activities undertaken via the Internet. The true difficulty is in ensuring that the laws are enforceable in practice.16 In this section, we will examine the factors legislators have to be mindful of when developing legislation such as that which deals with the issue of pornography or privacy over the Internet.17 Laws that are practically unenforceable suffer from two major defects. Firstly, they fail to deal with the mischief sought to be remedied by the law that has been enacted. Secondly, the knowledge that they are unenforceable tends to weaken the normative force of other laws and this sometimes has the effect of weakening the entire legal system. This latter requires further elaboration and is aptly explained by one commentator in the following extract: “In discussing the enforceability of law and regulations, it is important to recognize that compliance with law is not solely dependent on that law’s enforcement through the courts. In the vast majority of instances, the law is complied with because of its normative force, ie because it is the law.18 Thus most citizens refrain from criminal behavior because they wish to act lawfully, not because of a fear of prosecution, and similarly in private law matters such as contracts the parties adhere to their bargains because that is what they have agreed. However, the ultimate enforceability of a law is important if it is to have normative force. For this reason, a system of law and regulation which is so contradictory that it is, in practical terms, impossible to obey is treated here as unenforceable.19 Because it is impossible, or excessively burdensome to act in accordance with the law it loses its normative force and ceases to be treated by citizens and businesses as binding on them.”20 The borderless nature of the Internet creates special problems pertaining to enforceability of laws. The following extract provides a useful summary of the interplay of factors and characteristics of enforceability in relation to activities conducted via the Internet: “[T]he problems of unenforceability arise largely from the trans-jurisdictional nature of Internet activities. The system of law and regulation which needs to be enforceable is not simply that of a single jurisdiction, but that of all the jurisdictions whose laws are applicable to the activity. Thus although each individual law or regulation may appear to be enforceable, it is the cumulative effect of all the applicable laws which needs to be examined.21 … [I]t is possible to deduce three fundamental characteristics of enforceability. They are similar, or at least closely related, to the characteristics of enforceability for laws which apply solely to physical world activities. The fundamental difference is that for Internet activities, these characteristics must be assessed against the complete global pattern of laws or regulations, as Internet activities are visible and potentially have an impact in every jurisdiction. The first characteristic of enforceability is that compliance with the law or regulation must be feasible, not merely in theoretical but also in practical terms. It is not practically feasible to comply with laws if: (a) They impose contradictory obligations on the person subject to that law. Such contradictions are particularly common in public order rules, where different cultural traditions conflict. (b) Compliance would remove most or all of the benefits of conducting the activity via the Internet. Financial services regulations which require authorization and supervision by multiple national authorities will be ignored by many businesses for precisely this reason. Similarly, laws which impose formalities which substantially increase the costs of doing business via the Internet without conferring any real benefit on customers, such as obligations to supply information in non-electronic form, also discourage compliance. Secondly, the law or regulation must be limited in its application to those over whom the legislator has a legitimate claim. A securities business established in Germany, advertising its services via a German language website and doing business only with German customers, is likely to take the view the US SEC has no justification for claiming an interest in its activities, and yet … the German business is almost certainly in breach of US law. Laws and regulations of this type weaken the normative force of all similar laws, and this weakening is not mitigated merely because their lack of legitimate force is recognized through selective prosecution. Finally, there must be an effective enforcement mechanism for the law or regulation in question. Without such a mechanism all but the most scrupulous electronic commerce businesses will be tempted to ignore the law, and those which initially comply may be forced by their competitors’ non-compliance to cease to do so. An effective enforcement mechanism is particularly difficult to achieve in the field of consumer rights, and it must be recognized that a practically effective but non-binding method, such as self-regulation coupled with alternative dispute resolution, may be more useful in achieving enforcement than a theoretical right which is too difficult and expensive to enforce through the courts.”22 Similar sentiments have been echoed by another commentator: ‘The questions to be asked of any law or regulation that purports to govern activity on the Internet is not whether it is applicable, but rather whether it is enforceable? Though it may be in vogue to call for regulation, the primary question that should govern whether or how a regulation should be framed is not whether it is applicable – it will almost certainly be so. The question must be whether the regulation is needed, and if so, whether it is enforceable in a coherent and satisfactory manner. If regulations are not needed or do not prove to be enforceable due to the jurisdictional or substantive issues then there is a threat that users of the Internet will hold them in contempt.’23 Criminal Jurisdiction In situations where the offender commits an offence locally, the territorial basis of jurisdiction can be easily invoked to bring criminal proceedings against the offender. A person who tries to download prohibited material can usually be brought to task under the territorial basis of jurisdiction. This is because the fact that the information is received within a territory effectively indicates that the crime is terminated within the territorial jurisdiction of that state for its courts to exercise jurisdiction.24 The difficulty arises when an alleged offender is located elsewhere. For example, how does one exert jurisdiction over the provider of the services (assuming that he comes into the territory where criminal proceedings are sought to be brought, he is successfully extradited to face the criminal proceedings or he has assets within jurisdiction against which fines can be imposed and enforced)? Most courts are now willing to exert jurisdiction on the basis that the provider of the services initiated a course of events which he desired to eventuate within the jurisdiction or, alternatively, on the basis that the conduct of the service provider had effects within the jurisdiction of the state.25 Extradition and the Obtaining of Evidence The exertion of jurisdiction over the activity concerned is, unfortunately, only the first obstacle that has to be satisfied in the attempt to prosecute the offender. Even when criminal jurisdiction exists, potential issues pertaining to the extradition of the offender and obtaining evidence of the crime may arise. Transnational cooperation is necessary in this respect and whilst there may be a degree of consensus in relation to child pornography, there is unlikely to be a similar degree of convergence in relation to issues such as the protection of children’s privacy online or the desirability or effectiveness of legislation that seeks to restrict access to pornographic or other undesirable information by children. This lack of consensus would impair any multilateral efforts in the field and may hamper efforts to protect the interests of children online. Child Pornography on the Internet vs Child Pornography Offline Katyal26 presents a compelling case that instead of treating all crime as equal, law enforcement should attempt to inflict disproportionately heavy punishments upon those crimes that create the most visible, or otherwise evident, social disorder in cyberspace. This view appears to have been implicitly endorsed by Chief Justice Yong Pung How in a recent Singapore Court of Appeal decision where he set a benchmark ruling that men who chat up under-aged girls on the Internet and have sex with them can expect a year in jail and the maximum S$10,000 fine if they are caught.27 Katyal correctly notes that a crucial variable for preventing crime is perpetration cost and that the law can and should develop strategies to make crimes more expensive. Katyal goes on to identify the facets of child pornography on the Internet that may require it to be viewed or considered differently from child pornography that takes place offline: “Whereas a piece of child pornography once might have only reached a few thousand people who bought a magazine, with the internet it can reach millions very quickly. The child pornographer in realspace is constrained by all kinds of production costs (film, printing, distribution), but these constraints do not pose the same difficulty to the pornographer in cyberspace. Ease of distribution is a standard feature of cybercrime. Even financial crimes, such as stock market manipulation, take advantage of this feature. For example, someone holding XYZ stock will announce on message boards the likelihood of a hostile takeover of XYZ, thousands will read the message and purchase XYZ, and the person who posted the messages will then quickly sell the stock at a high profit. Child pornography also underscores the international aspect of cyberspace, which permits transactions to occur when the buyer and seller are thousands of miles apart. Criminal activity is thus multijurisdictional, making law enforcement tougher. For example, in 1997 a major computer child pornography ring operating in twenty-one countries was uncovered. To bring law enforcement to bear on the ring required an unprecedented level of cooperation between the police and investigators in many different countries. Child pornographers may seek haven in countries that have no laws against child pornography or no laws against the extraterritorial distribution of such material. If so, the U.S. Government will have an increasingly difficult time trying to gain jurisdiction over such defendants, who need not even physically set foot on American soil to distribute materials here. Through computers, the way in which child pornography is produced may be altered as well. Obviating the need to find live children, producers may use their computers to draw such images from scratch or may digitally alter photographs of clothed children so that they appear nude. The question whether the law should extend to depictions that do not involve live children28 forces us to confront its very purpose: whether the law exists solely to protect minors, or, among other things, to prevent related molestation, or because child pornography is immoral. The example of child pornography also sheds light on some of the intermediate parties that exist in cyberspace. In particular, an ISP may be used to transfer child pornography from one person to another, particularly when the internet is used to create mass distribution postings. For this reason, criminal law may usefully enlist ISPs to aid in enforcement. Indeed, federal law currently requires ISPs that become aware of an apparent violation of any federal child exploitation statute to report the violation. In addition, law enforcement is currently permitted to subpoena an ISP to provide subscriber information to ascertain the identity of a child pornographer who lurks behind the veneer of anonymity.” CONTENT REGULATION Singapore’s Internet Policy and Regulatory Framework29 As aptly stated by one commentator, “[i]n developing Internet content regulations, Singapore had to resolve the obvious tension between its aggressive IT growth strategies that allowed colossal amounts of uncensored information into the country via the Internet and the government's traditional restrictions on media. In 1996, Singapore took an initial step by indicating it would make no legal distinction between the Internet and other types of media by shifting the responsibility for regulating the Internet from the Telecommunication Authority of Singapore to the Singapore Broadcasting Authority (SBA).” The approach adopted by the Singapore government is not always viewed positively by its detractors and the following extract represents one example of the type of stinging attack that is sometimes leveled against the approach taken: “True to its reputation as a totalitarian state, Singapore has instituted some of the most restrictive Internet policies anywhere. At first the only Internet sites that were blocked were newsgroups containing alt.sex in the address. This policy now has been amplified to include sites that have "discussion of politically sensitive issues and criticism of the state, religions (including any sites offered by the Jehovah's Witnesses) and races" along with pornography. "A balance must be struck between free access to information and the need to maintain the values of society," said Prime Minister Goh Chok Tong. This balance includes requiring political parties to receive government licenses for their web sites and regulators scrutinizing political and religious Internet sites. Rather than offering the customary complaints about the technical difficulties inherent in any efforts to block sites, the Singapore Internet industry is cooperating with government efforts. At SingNet, a subsidiary of Singapore Telecommunications Ltd. and one of only three national ISPs, a spokeswoman responded to the new regulations by simply saying, "It is technically possible to do this." Additionally, public facilities such as libraries, schools and cafes are required to supervise Internet use. In one of the first significant international moves to regulate the Internet, the Association of Southeast Asian Nations (ASEAN) met in September of 1996 to discuss how to create a common regional framework for policing the Internet. As the most technically advanced and most restrictive in terms of limiting information sources, Singapore is further along in its policy than its neighbors. However, Singapore sees an advantage in presenting a common Internet front and policy to keep out material it finds objectionable.”30 The Role of the Singapore Broadcasting Authority Since its formation on 1 October 1994, the SBA has been tasked with the job of developing quality broadcasting, building a well-informed and culturally rich society and making Singapore a dynamic broadcasting hub. The SBA is, in addition to its various other functions, responsible for regulating Internet Service Providers31 and Internet Content Providers.32 This is done chiefly through the Internet Class Licence Scheme33 and the Internet Code of Practice which was first introduced in July 1996 via Gazette Notification No: 2400/96.34 The Internet Code of Practice was subsequently revised to remedy some of the shortcomings and perceived inadequacies of the earlier version of the Code as well as to take into account the recommendations made by the National Internet Advisory Committee35 (“NIAC”) in its report released in September 1997.36 The revised Code of Practice came into effect on 1 November 1997 via Gazette Notification No: 3810/97. For ease of reference, all references to the new Internet Code of Practice in this write-up shall mean the revised Internet Code of Practice whilst all references to the old Internet Code of Practice shall mean the Internet Code of Practice which was introduced in July 1996. Any reference to the Internet Code of Practice shall mean both the old Internet Code of Practice and the new Internet Code of Practice. In our analysis of the subject, we will examine, briefly, the controversies and debates surrounding Internet content regulation and their application in the Singapore context. This will be followed by an examination of the key provisions of the new Internet Code of Practice as well as the old Internet Code of Practice. This will culminate in a comparison of the two codes. We will also look briefly at the policy of the SBA and its approach towards Internet content regulation and examine the case for harmonization of the laws of the different jurisdictions towards Internet content regulation, particularly amongst the Asean member states. Some suggestions will also be made on how the applicable laws in Singapore could be further fine-tuned to meet the aspirations of its citizenry and to reflect and accommodate the realities and new dynamics created as a result of the advent and development of the Internet. The New Internet Code of Practice Let us now turn to the specific provisions of the Singapore Internet Code of Practice.37 The Internet Code of Practice is, in essence, a set of guidelines on acceptable Internet content with which Internet Service Providers and Internet Content Providers are required to comply. The new Internet Code of Practice38 begins with a foreword which stipulates that the Singapore Broadcasting Authority Act (Cap 297) (hereafter referred to as “the Act”) makes it the duty of the SBA to ensure that nothing is included in any broadcasting service which is against public interest or order, national harmony or which offends against good taste or decency.39 The protection which this statement appears to afford to persons aggrieved by SBA’s failure to perform its duty is merely illusory, however, as the aforesaid Act goes on to state that “[n]othing [in the provision imposing the duty on the SBA] … shall be construed as imposing on the [SBA], directly or indirectly, any form of duty or liability enforceable by proceedings in any court.”40 The Code then goes on to direct all Internet Service Providers and Internet Content Providers licensed under the Singapore Broadcasting Authority (Class Licence) Notification 1996 to comply with the provisions contained in the Code.41 To serve as a salutary reinforcement of the direction to comply with its provisions, the Code stipulates that pursuant to the Act, the SBA has the power to impose sanctions (including fines) for any contravention of the Code.42 This stipulation in the Code, unfortunately, appears to have been based on an erroneous interpretation of the powers conferred on the SBA by the Act. Section 28 of the Act, which is presumably the provision which the SBA is seeking to rely upon to cloak itself with the power to impose sanctions, simply enables the SBA to issue directions to Internet Service Providers and Internet Content Providers requiring them to take action to comply with the Internet Code of Practice. Section 28, additionally, has the effect of making any Internet Service Provider, Internet Content Provider or any person responsible for the broadcasting of any programme prohibited by such a direction guilty of an offence, thereby rendering them liable to certain penal sanctions. From a reading of the Act, it is clear that it is the judiciary, and not the SBA, which has the power to impose penal sanctions for non-compliance of the Code (provided, of course, that the requirements set out in section 28 of the Act are satisfied). Although the SBA has the power to compound certain offences43 and the ability to modify or impose additional conditions on the licences it grants,44 this should not be misconstrued as conferring upon the SBA the power to impose penal sanctions on parties who infringe the Act or the Internet Code of Practice. The Code should, thus, be reworded to remove the reference to the SBA having the power to impose penal sanctions. The substantive portion of the Code contains a direction to all Internet Service Providers and Internet Content Providers to use their best efforts to ensure that ‘prohibited material’45 is not broadcast via the Internet to users in Singapore.46 The Code then goes on to state the manner in which the obligations imposed upon Internet Service Providers and Internet Content Providers pursuant to the Code may be discharged.47 From the general tenor of the Code and the recurrent use of the phrase “discharges his obligations under this Code” in Clause 3 of the Code, it would appear that in so far as the particular scenarios and the specific aspects of the Internet referred to in Clause 3 are concerned, compliance with the respective requirements stipulated would amount to a complete discharge of the obligations imposed upon Internet Service Providers and Internet Content Providers pursuant to the Code. In other words, in the scenarios set out in Clause 3 of the Code, the performance of the acts required in Clause 3 shall be equated to the use of “best efforts” as provided in Clause 2 of the Code. Such a reading of Clause 3 would not only achieve the aims of the Code48 and give effect to the terminology employed in Clause 3, but would also enable Clause 3 to be reconciled with Clause 2 of the Code.49 In situations which do not fall within the ambit of Clause 3, however, it is clear that the obligation set out in Clause 2 (ie., to use best efforts to ensure that ‘prohibited material’ is not broadcast) would continue to apply. Obligations of Internet Service Providers Websites Clause 3 of the Code states that in relation to programmes on the World Wide Web, an Internet Service Provider discharges its obligations when it denies access to sites notified to it by SBA as containing prohibited material. In its Industry Guidelines on the Singapore Broadcasting Authority’s Internet Policy (“Industry Guidelines”), the SBA has clarified that this limited duty imposed on Internet Service Providers would effectively mean that Internet Service Providers do not have to actively search the Internet for websites containing prohibited material. At this stage, it may be opportune to discuss the legal nature and effect of the Industry Guidelines as they contain various statements dealing with the obligations of Internet Service Providers and Internet Content Providers under the Code. The Industry Guidelines do not constitute written law and thus do not have the legal force of written law. It is unfortunate that some of the clarifications and statements made in the Industry Guidelines are not incorporated in the Code as their incorporation would have the effect of setting out more clearly the legal obligations imposed upon Internet Service Providers and Internet Content Providers. The stipulations and clarifications made in the Industry Guidelines, whilst reassuring in most part,50 do not (as stated above) have force of law and in the event of conflict between the provisions in the Code and the Industry Guidelines, the provisions in the Code will prevail. Section 9A of the Interpretation Act (Cap 1), which allows extrinsic materials to be consulted in certain situations, provides an opportunity for the Industry Guidelines to be referred to in ascertaining the meaning of provisions in the Code. It must be noted, however, that section 9A operates within narrow confines and applies only if the requirements set out in section 9A(2) are satisfied.51 Perhaps Internet Service Providers and Internet Content Providers can find some solace in the fact that they are unlikely to be prosecuted in a manner contrary to the SBA’s stated intentions as expressed in the Industry Guidelines. Nevertheless, should the SBA decide to do so, the Internet Service Providers and Internet Content Providers must be mindful of the fact that there is little they can do unless section 9A of the Interpretation Act applies in the circumstances.52 Newsgroups In relation to newsgroups, clause 3(2) states that an Internet Service Provider discharges its obligations when it (a) refrains from subscribing to any newsgroup which, in its opinion, is likely to contain prohibited material; and (b) “unsubscribes” from any newsgroup that the SBA may direct. The specific phraseology of clause 3(2) may be seen as a response to a perceived misconception held amongst some members of the public that the SBA dictates to the Internet Service Providers on the particular newsgroups to which they may subscribe.53 Nevertheless, the SBA adopts the practical view that the blocking of access to newsgroups which run counter to the intention and spirit of the Code cannot be dependent on the SBA’s directions alone as the SBA does not have the requisite manpower to police the World Wide Web continuously. Some degree of responsibility is therefore placed on Internet Service Providers to ensure that they do not subscribe to newsgroups likely to contain prohibited material. It must be appreciated, however, that in practice most Internet Service Providers are completely oblivious to what goes on during discussions in their respective newsgroups unless specific matters have been brought to their attention. Even if they so desire, the task of scrutinizing newsgroups is a daunting one which may aptly be likened to searching for the proverbial needle in a haystack. The onus placed on Internet Service Providers to refrain from subscribing from newsgroups likely to contain prohibited material does, therefore, appear to impose fairly onerous obligations on them. In addition, the phrase “likely to contain prohibited material” has not been amplified or explained in the Code. This creates some uncertainty on the matter. For instance, how does one ascertain whether a newsgroup is likely to contain prohibited material? What percentage of a newsgroup’s discussion must contain or pertain to prohibited material before the duty on an Internet Service Provider to refrain from subscribing for it arises? Would past complaints against the newsgroup, on its own, invoke this obligation? These are the questions which the Code leaves unanswered. Unfortunately, this ambiguity in the Code may have the unfortunate practical consequence of stifling on-line discussion. A conservative Internet Service Provider may take the convenient step of unsubscribing from a newsgroup at the slightest hint of trouble. A puritanical and narrowminded user of the Internet may abuse this fear by lodging complaints whenever he observes liberal views or ideologies (which do not necessarily constitute prohibited material as defined by the Code) being espoused on the newsgroup discussions, knowing that the threat of prosecution would induce the Internet Service Provider to act immediately on his complaint. It is suggested that the better way of approaching the matter would be to remove the obligation on Internet Service Providers to refrain from subscribing to newsgroups likely to contain prohibited material. Instead, Internet Service Providers should be under an obligation to refer all complaints on any newsgroup to the SBA for investigation. It would then be for the SBA to evaluate and, if necessary, investigate these complaints with a view to ascertaining if the newsgroup is one which the Internet Service Provider should refrain from subscribing. If necessary, directions should then be given to the Internet Service Providers concerned. Obligations of Internet Content Providers Although this is not made explicit in the new Internet Code of Practice,54 the SBA has clarified that Internet Content Providers do not have to seek its prior approval for content posted on the Internet. Clause 4(4) of the new Internet Code of Practice, however, stipulates that in the event of doubt as to whether any content is prohibited by the Code, such content may be referred to the SBA for its decision on the matter. Much to the relief of Internet Content Providers, no doubt, is SBA’s clarification that web publishers and server administrators do not have to monitor the Internet or precensor content. The Internet Content Providers are, however, obliged to deny access to prohibited materials when directed to do so by the SBA.55 Websites Clause 3(3)(a) of the Code stipulates that in relation to private discussion fora hosted on its service (such as chat groups), the Internet Content Provider discharges its obligation when it chooses discussion themes which are not prohibited pursuant to the Code. The Industry Guidelines clarify that Internet Content Providers are not required to monitor or censor the discussions held although they are encouraged to take ‘discretionary action against the abusers of [the] chat channels’. The Industry Guidelines do not clarify on the type of discretionary action that may be taken; nor does it proffer any guidance on the appropriate defences an Internet Content Provider may avail itself of in the event that aggrieved users decide to take action against the former for curtailing its right to carry on discussions on the chat channels. It is important to note that neither the Act nor the Code confer a right on Internet Content Providers to take appropriate action against abusers of its chat channels. In the absence of a clearly identifiable contractual term conferring a right to take appropriate action, Internet Content Providers are advised to refrain from doing so; otherwise, they face the prospect of having civil suits instituted against them by users of the chat channels. Clause 3(3)(b) goes on to state that in relation to programmes on its service contributed by other persons who are invited to do so on its service for public display (such as bulletin boards), the Internet Content Provider discharges its obligation when it denies access to contributions which contain prohibited material which it discovers in the normal course of exercising its editorial duties or which it is informed about (presumably by SBA or otherwise). In its Industry Guidelines, SBA clarifies that its focus is on discussions targetted at the general public and as such, business or professional closed usergroups which conduct professional discussions on websites will not be regulated. Clause 3(3)(c) provides that in relation to all other programmes on its service, the Internet Content Provider discharges its obligations if it ensures that such programmes do not include material which is prohibited pursuant to the Code. Read on its own, this clause may appear to impose fairly onerous obligations upon Internet Content Providers and run counter to the general tenor of the rest of the Code. Clause 3(5), however, militates against the rigour of this provision by stipulating that clause 3(3), which has been described above, does not apply to any web publisher or web server administrator in respect of programmes on its service for which it has no editorial control. Mirror Sites, Hyperlinks and Search Engines In its Industry Guidelines, SBA has clarified that the mirroring of foreign sites is encouraged. In deciding which sites to mirror or hyperlink to, Internet Content Providers should, however, make an initial assessment of whether a site contains prohibited material. SBA has assured Internet Content Providers that they will not be held responsible for mirror sites or hyperlinks which are subsequently found to contain prohibited material although they are encouraged to remove such links after these are brought to their attention. The use of the term “encouraged” in this context is puzzling. The tenor of the Code would suggest that in situations where the existence of prohibited material is brought to the attention of an Internet Content Provider or an Internet Service Provider, steps should be taken (where possible) to prevent the material from being accessed. Internet Content Providers are thus advised, after due investigation to ascertain the veracity of the information, to immediately remove links to mirror sites or hyperlinks alleged to contain prohibited material. In any event, it must be noted that in situations where the SBA has directed Internet Content Providers to deny access to prohibited materials, they are obliged to do so.56 The Industry Guidelines also clarify that broad-based search services, such as Yahoo! and Alta Vista, which base or mirror their sites in Singapore, do not have to precensor their sites. Prohibited Material Clause 4(1) defines ‘prohibited material’ broadly as material that is objectionable on the grounds of public interest, public morality, public order, public security, national harmony or which is otherwise prohibited by applicable Singapore laws. Clause 4(2) then goes on to provide some guiding factors that should be taken into account in considering what is prohibited material. These are: (a) (b) (c) (d) (e) (f) (g) whether the material depicts nudity or genitalia in a manner calculated to titillate; whether the material promotes sexual violence or sexual activity involving coercion or non-consent of any kind; whether the material depicts a person or persons clearly engaged in explicit sexual activity; whether the material depicts a person who is, or appears to be, under 16 years of age in sexual activity, in a sexually provocative manner or in any other offensive manner; whether the material advocates homosexuality or lesbianism, or depicts or promotes incest, paedophilia, bestiality or necrophilia; whether the material depicts detailed or relished acts of extreme violence or cruelty; or whether the material glorifies, incites or endorses ethnic, racial or religious hatred, strife or intolerance. Clause 4(3) goes on to stipulate that in determining whether any material is ‘prohibited material’ for the purposes of the Code, consideration of the intrinsic medical, scientific, artistic or educational value of the material may be made. Clause 4(3) appears to have been inserted into the Code to ensure that the legitimate use of material, which is otherwise prohibited in accordance with the guidelines contained in Clause 4(2), is not unduly hampered. For instance, it is likely that images featuring acts of brutality inflicted during the apartheid era in South Africa will not be considered as prohibited material if it is featured in a webpage relating to the history of South Africa. The inclusion of the phrase “homosexuality or lesbianism” within the same provision that prohibits material that depicts or promotes incest, paedophilia, bestiality or necrophilia is troubling, to say the least. This inclusion may create the impression that the Code views both sets of activities as equally reprehensible. It would have been better if the prohibition on material advocating homosexuality or lesbianism were to be listed in a separate provision. The inclusion of this prohibition is, in itself, bound to be controversial as - in the light of greater societal tolerance and acceptance of homosexuals and lesbians it is debatable whether the Code should prohibit material advocating homosexuality or lesbianism. Right of Appeal Internet Service Providers and Internet Content Providers aggrieved by any decision of the SBA or by anything contained in the Internet Code of Practice may appeal to the Minister57 whose decision shall be final.58 The aggrieved party must, however, ensure that any decision or direction made by the SBA is complied with until the determination of the appeal.59 The Internet Code of Practice does not stipulate the factors which will be taken into account by the Minister in arriving at his decision. Bearing in mind, however, the evinced intention that the regulations do not stifle the development of the Internet or place an unduly onerous burden on Internet Service Providers and Internet Content Providers, one can optimistically hope that the Minister will be fairly liberal in his treatment of appeals made to him and will give due weight to any difficulty faced by aggrieved parties in complying with the Code or in adhering to the SBA’s decisions and directions. The National Internet Advisory Committee and its Recommendations The amendments introduced by the new Internet Code of Practice are based primarily on recommendations made by the NIAC in its recent report released in September 1997.60 It is useful to look at the substantive provisions of the report in order to fully appreciate the aims and policy underlying the new Internet Code of Practice. A brief overview of the role and work of the NIAC would, in this respect, serve as a useful introduction to understanding the context in which the report was made. The NIAC was formed on 15 August 1997 to advise the SBA on the regulation of electronic information services and the development of the industry. More specifically, the NIAC was tasked to assist the SBA in the development of its regulatory framework for the Internet. Members of the NIAC are drawn from a wide cross-section of society,61 presumably as a result of SBA’s hope and desire that its regulatory framework adequately takes into account the needs and concerns of a wide cross section of society. The broadly stated Terms of Reference of the NIAC are as follows: (a) (b) (c) (d) to provide feedback and advise on SBA’s policies and regulatory framework; to advise on SBA’s content guidelines; to advise on concerns raised by the public and the industry; to advise on SBA’s public education initiatives; (e) (f) to advise on promotion and growth of the industry; and to advise on the impact of technological developments and related issues. The limited resource of the NIAC meant that it could only focus on several specific and key issues at any one time and somewhat unsurprisingly, the NIAC chose to focus on the following issues in its first year of work: (a) (b) (c) (d) (e) (f) (g) feedback on the impact of SBA’s Internet regulations; recommendations on the Code of Practice; promotion of industry self-regulation; promotion of positive sites and public education initiatives on the Internet; promotion of Internet content production in Singapore; positioning of Singapore as a major international Internet hub; and encouragement of multi-lingual content on the Internet. Through its dialogue with industry players and the Singapore Federation of the Computer Industry, the NIAC concluded that whilst the introduction of the SBA’s Internet regulations (including the Internet Code of Practice) did not pose a major hindrance to the use of the Internet, there were certain areas of concern in which improvements could be made. The relevant areas, for our present purposes, are listed below: (a) (b) (c) (d) (e) (f) improper or ineffective use of proxy servers may slow down information transfer and impede the progress of electronic commerce; individual mail and sites, and newsgroup discussions should continue to be kept out of the purview of SBA’s regulations to allow free discussion of opinions and issues; the responsibilities of Internet Service Providers and Internet Content Providers expected under the Internet Class Licence Scheme should be more clearly spelt out; there may be a need to describe the circumstances under which content providers are required to register; the inclusion of web hosts and server administrators in the definition of content provider gives rise to uncertainty on the extent to which they are liable for content provided by their customers; and the extent to which content providers are liable for material on mirrored sites and chat facilities is unclear. Amongst the proposals made by the NIAC were recommendations to amend the Internet Code of Practice. The specific recommendations made by the NIAC will, where relevant, be highlighted in the discussion below on the comparison of the old and new Internet Code of Practice. From the discussion of the new Internet Code of Practice the reader would, of course, already have seen how the new Internet Code of Practice seeks to address some of these concerns. The Old Internet Code of Practice The old Internet Code of Practice similarly begins with a foreword stipulating that the SBA has a duty to ensure that nothing is included in any broadcasting service which is against public interest or order, national harmony or which offends against good taste or decency.62 The old Internet Code of Practice also contains a similar direction to all Internet Service Providers and Internet Content Providers licensed under the Singapore Broadcasting Authority (Class Licence) Notification 1996 to comply with the provisions contained in the Code.63 There is also the same reminder to all Internet Service Providers and Internet Content Providers that pursuant to the Act, the SBA has the power to impose sanctions (including fines) for any contravention of the Code.64 Clause 1(2) of the old Internet Code of Practice, unlike clause 1(2) of the new Internet Code of Practice, contains an additional stipulation that all Internet Service Providers and Internet Content Providers must satisfy the SBA that they have taken reasonable steps to fulfill their responsibility to comply with the Code of Practice. Clause 2 of the old Internet Code of Practice begins by imposing a general obligation on Internet Service Providers and Internet Content Providers to use their best efforts to ensure that nothing is included in any programme on the Internet which is against public interest, public order, national harmony or which offends against good taste or decency. Clause 2 then goes on to particularise specific ‘Internet contents’ which should not be allowed. These are as follows: (a) Public Security and National Defence (i) Contents which jeopardise public security or national defence. (ii) Contents which undermine public confidence in the administration of justice in Singapore. (iii) Contents which present information or events in such a way as to alarm or mislead all or any part of the public. (iv) Contents which tend to bring the Government of Singapore into hatred or contempt, or which excite disaffection against the Government of Singapore. (b) Racial and Religious Harmony (i) Contents which denigrate or satirise any race or religious group. (ii) Contents which bring any race or religious group into hatred or resentment. (iii) Contents which promote religious deviations or occult practices such as Satanism. (c) Public Morals (i) Contents which are pornographic or otherwise obscene. (ii) Contents which propagate permissiveness or promiscuity. (iii) Contents which depict or propagate gross exploitation of violence, nudity, sex or horror. (iv) Contents which depict or propagate sexual perversions such as homosexuality, lesbianism, and paedophilia. A Comparison of the Old Internet Code of Practice and the New Internet Code of Practice Unsurprisingly, the old Internet Code of Practice brought howls of protest when it was first announced.65 There were calls for petitions to be sent to SBA and Internet users were encouraged to place blue ribbons in their websites as a sign of protest against the Code. In particular, the Code was criticised for being overly broad, vague and ambiguous. There were also fears that the Code would stifle online discussion and critical thinking and bring about the death of free speech on the Internet. Viewed against the backdrop of the old Internet Code of Practice, the new Internet Code of Practice can be seen to be less stifling and more specific in its approach. This has been done largely to deflect the criticisms levied against the old Internet Code of Practice. For instance, the loosely-termed ‘best efforts’ obligation imposed upon Internet Service Providers and Internet Content Providers in the old Internet Code of Practice does not accurately or adequately describe the extent of that obligation. In this respect, the NIAC noted that this obligation may be construed to imply that Internet Service Providers have a duty to exclude all prohibited material from the Internet. The new Code seeks to remedy this criticism of the old Code by stipulating precisely what Internet Service Providers and Internet Content Providers must do (in relation to the different aspects of the Internet) in order to discharge their obligations under the Code. The precise scope of these obligations has already been discussed elsewhere in this article. Although the “best efforts” obligation does play a residual role in the new Internet Code of Practice in situations not covered by Clause 3 of the Code, its application is quite limited as most conceivable situations pertaining to Internet Service Providers and Internet Content Providers in their respective roles are already dealt with by Clause 3. In dealing with the issue of material to be prohibited, Clause 2 of the old Code adopts the cumbersome practice of replicating provisions from other legislation prohibiting certain conduct. The NIAC was of the view that some of these provisions were incorrectly cited thereby causing a great deal of controversy in the press.66 The new Code seeks to remedy this by introducing a definition of ‘prohibited material’ which includes material ‘otherwise prohibited by applicable Singapore laws’.67 It is, however, not clear whether this was exactly what the NIAC meant in its exhortation to SBA to remind Internet users and Internet Service Providers that all Singapore laws, insofar as they apply to the electronic medium, are fully effective and operative in respect of acts committed in cyberspace. Perhaps an overriding stipulation that all relevant parties continue to be subject to all other Singapore laws, as applicable to the electronic medium, would have served the NIAC’s intended purpose better. This, of course, does not detract from the fact that the parties continue to be subject to all other Singapore laws whether or not the Code stipulates as such. SBA’s Internet Policy and Approach The general tenor and scope of the new Internet Code of Practice is consistent with SBA’s stated aim of adopting a regulatory regime that is not overly restrictive or overbearing. In this regard, the coverage and ambit of the new Internet Code of Practice can be seen to be consistent with the seven key principles identified by SBA in its Industry Guidelines as underlying its Internet policy. For the sake of completeness, these seven principles are reproduced below: (a) SBA fully supports the development of the Internet. The Internet is an important communication medium as well as a rich source of information, education and entertainment; (b) SBA’s framework for the Internet emphasizes public education, industry selfregulation, the promotion of positive sites and minimum regulation through a transparent licensing framework which reflects the community values; (c) SBA’s purview only covers the provision of material to the public. SBA is not concerned with what individuals receive, whether in the privacy of their own homes or at their workplace. Corporate Internet access for business use is also outside the scope of SBA’s regulation, as is private communications such as electronic mail and the Internet Relay Chat; (d) SBA’s emphasis is on issues of concern to Singapore. For instance, in the case of racial and religious material, SBA is only concerned with material which may incite racial or religious hatred among the races in Singapore; (e) SBA’s main concern is with the ease of access to pornography on the Internet,68 especially by children and minors. SBA’s regulatory focus is on mass impact websites which distribute pornography; (f) SBA takes a light-touch approach in regulating services on the Internet. For example, licensees found to be in breach of regulations will be given a second chance to rectify the breach before action is taken; and (g) SBA believes in open channels of communication with the public and the industry. The SBA encourages the industry and members of the public to continue to provide feedback to it so that the regulatory framework currently in place may be fine-tuned to reflect technological advances and society’s concerns. The new Internet Code of Practice can also be seen to be in line with SBA’s threepronged approach69 to the development of the Internet in Singapore, namely: (a) to promote public regulation; (b) to encourage industry self regulation; and (c) to implement a light touch licensing framework which is regularly fine-tuned based on consultation. In its attempts to mollify opponents of the Internet Code of Practice, SBA has taken great pains to reiterate its stance that the Code is not meant to stifle online discussion or the exchange of information. SBA has sought to reassure Internet Service Providers that in seeking to enforce the Internet Code of Practice, the context in which any allegedly offensive material is found will be taken into consideration. If it is incidental or presented in good faith or used for educational, artistic, scientific or medical purposes, it will not be in breach of the Code. SBA has also stated that it typically alerts Internet Service Providers if it comes across or receives any complaints of websites that flout its Internet guidelines. SBA has also given its assurance that a light-touch enforcement approach will be adopted, which means that an offender will be given a chance to rectify the breach before SBA takes any action. To date, SBA has not taken action against anyone for objectionable content on the Internet. According to the SBA, this is because “service and content providers have generally abided by the guidelines.”70 As can be seen from the above discussion, the new Internet Code of Practice, whilst retaining much of the original aims and flavour of the old Internet Code of Practice, is much more specific and unambiguous. Although the new Internet Code of Practice is not entirely without its faults, from the perspective of Internet Service Providers and Internet Content Providers it does present a marked improvement when compared to the old Internet Code of Practice. In particular, the SBA has taken cognizance of the constraints currently faced by existing Internet Service Providers and Internet Content Providers and has introduced revisions to clarify the ambit of their obligations. In this respect, the new Internet Code of Practice has done much to allay the fears of Internet Service Providers and Internet Content Providers that an unduly great burden has been placed upon them in relation to the regulation of the Internet. The new Internet Code of Practice can also be seen to reflect an awareness that regulation of the Internet can only go so far and that, by and large, it is not practical or wise to over-regulate the Internet. The tolerant slant of the new Code exemplifies this awareness. Nevertheless, there are some commentators who advocate complete and unfettered freedom in respect of the use of the Internet and who are of the view that there should be no regulation of the Internet whatsoever. There appears, however, to be an increasing perception that in order to promote the healthy development of the Internet some regulation (albeit one that is evolved after due consultation with all interested parties) is necessary and may even be desirable.71 In this regard, it may be observed that the new Internet Code of Practice is consonant with SBA’s aim to ‘adopt a consultative approach and fine-tune its regulations to ensure that the regulatory framework will promote and facilitate the growth of the Internet’.72 The generally warm reception73 to the new Internet Code of Practice bears testimony to SBA’s commitment to devising a regulatory framework that is not too rigid or restrictive and which seeks to assimilate the views and responses of all segments of society. Such an approach can only bode well for the industry as a whole as the development of the Internet has presented the world with a vast array of new problems and issues which it is only now beginning to grapple with. It is, thus, encouraging to see that the SBA has adopted a fluid approach in respect of the regulation of the Internet that gives an opportunity for various new ideologies, views and concerns to be reflected in its ongoing policy aims. It is only hoped that interested participants in the development of the Internet will take this opportunity to make their views and suggestions known to the SBA so that these concerns may be addressed in subsequent revisions of the Internet Code of Practice. An Asean Internet Code of Practice? It is perhaps timely to ask ourselves if the time has come for a uniform Asean regulatory framework to apply to content regulation of the Internet. Recent initiatives to harmonize the electronic commerce laws of the various Asean member countries74 may provide an impetus for a similar framework to be considered in respect of Internet content regulation. It is this author’s view that, at the present moment, such an initiative is unlikely to succeed. Despite sharing some common goals and, to a certain extent, a shared heritage, the different Asean member countries have very different outlooks on issues pertaining to censorship. What is permissible in say, the Philippines, could potentially flout Singapore’s censorship laws. Moreover, the censorship laws of many countries are based, to a large extent, on the social mores and values of the people in those countries. These laws would, therefore, differ from country to country.75 In the foreseeable future, however, the position may change and one could then optimistically hope for a common charter on Internet content regulation. This is because in this age of globalization, there appears to be a higher degree of confluence in the mores and values of the younger generation in the different Asean countries and, for that matter, in countries in other parts of the globe. This is, no doubt, due in part to the pervasive impact of the popular media and the greater “global interconnectedness” experienced by youngsters today as a result of the advent of new technologies such as the Internet. Needless to say, a global charter on Internet content regulation is highly unlikely to find favor in the near future as the differences in the cultural attitudes and social norms that prevail in the various countries will be even more marked than that which exists in the Asean context. As noted earlier, different countries may adopt different standards over the same material. What one jurisdiction might regard as reasonable material another might regard as obscene. The Censorship Debate It has been said that censorship76 is as old as language itself. One needs to look no further than the Bible to observe ancient examples of censorship. For instance, the third commandment that Moses, a leader of the Jews, presented to his people around 1250 B.C., forbade the speaking of the name of God, except in prayer or during a religious ceremony. This ancient law is still observed by devout Jews, Christians and Muslims, who consider this to be part of their religious obligations. Greek history provides us with a resounding illustration of how censorship can be abused. Socrates, one of the greatest thinkers and teachers of ancient Greece, was censored by the government in 399 B.C. He was charged with corrupting the youth of Athens. This arose as a result of his teachings that encouraged his students to challenge conventional thinking. Socrates refused to renounce his teachings or accept the punishment of exile from the city. Socrates was sentenced to death and given a cup containing the deadly juice of the hemlock plant which he drank without fear.77 It comes as no surprise that the death of Socrates remains one of the most historically stirring protests against censorship. Any legal framework that seeks to censor the flow of certain types of information is bound to be controversial and the Internet Code of Practice is no exception. The Internet Code of Practice, along with other similar initiatives elsewhere, has received widespread condemnation from advocates of free speech who decry what they see as a violation of free speech guarantees enshrined in democratic institutions and international law.78 The following extract, taken from a 1999 Report by the Human Rights Watch on “Freedom of Expression on the Internet”, is reflective of the type of stinging criticism often leveled against attempts to regulate content on the Internet: “Despite growing acknowledgment during 1998 among governments around the world that the Internet promotes participation in civil and political life within countries and beyond, legislative proposals continued to threaten free speech on the Internet. While dissidents in authoritarian countries continued to take risks using the Internet to seek help and information, regulators in these parts of the world were quick to refine screening and other controlling technologies. As a result, in a half-dozen countries, Internet access providers (including public libraries) were implementing filtering technologies and other voluntary measures to make prior censorship of on-line communications a reality. The trend is towards extending these technologies more broadly, with global implications for free expression. On-line content providers may soon be forced to start rating their content; those failing to rate their content may find their material blocked from public access. As local rating criteria are used to define ratings, the danger is that these restrictive criteria will limit the diversity of expression on the Internet, where content is as diverse as human thought.”79 Calls for a hands off approach to the Internet continue almost unabated today. AT&T Corporation’s Chairman and Chief Executive Michael Armstrong recently called on telecommunications regulators to refrain from adopting “patchwork regulation” to the Internet. These views have been mirrored elsewhere.80 In a controversial conference held in Munich recently, the creation of an international rating and filtering system for Internet content has been proposed as an alternative to national legislation regulating online speech. Civil liberties advocates argue that if a single rating system is broadly adopted, it will be easier both technologically and legally for governments to mandate ratings regimes or the use of filters, or to ban controversial sites altogether. Moreover, prominent news organizations such as MSNBC, the Wall Street Journal, and CNN have stated in the past that they will not comply with ratings. It has also been suggested that contrary to their original intent, such systems may actually facilitate governmental restrictions on Internet expression. Additionally, it has been argued that rating and filtering schemes may prevent individuals from discussing controversial or unpopular topics, impose burdensome compliance costs on speakers, distort the fundamental cultural diversity of the Internet, enable invisible "upstream" filtering, and eventually create a homogenized Internet dominated by large commercial interests.81 The debate on whether there should be content regulation of the Internet is a multi-faceted one and this paper does not attempt to answer the question of whether content regulation of the Internet, per se, is good or bad. It should be noted, however, that regulation of the Internet in the various countries have tended to take on different forms that may well reflect the unique cultural norms and concerns of the respective countries. Viewed from this perspective, Internet content regulation may even be seen to be desirable. Despite widespread condemnation from international organizations that advocate an unfettered right of free speech, content regulation of the Internet continue to be popular amongst the governments of a large number of countries. In some cases, attempts at content regulation has garnered considerable support from the local citizenry. In Singapore for instance, a very recent gallup poll conducted by Channel News Asia revealed82 that most Singaporeans are satisfied with the level of censorship in Singapore, although many felt that the community should play a bigger role in making censorship decisions. The poll revealed that 85% of the respondents felt that censorship was necessary. The need to protect children and maintain moral standards were given as important and justifiable reasons for the level of censorship in Singapore. 82% of the respondents stated that they were satisfied with the level of censorship in Singapore. Implementation and Enforcement In relation to the implementation and enforcement of Internet content regulations in Singapore, one observer has the following comments to make: “Despite Singapore's technological prowess and the relatively small number of users and content it must regulate, censoring the Internet has proved virtually impossible for the SBA. Singapore has realized that it is unfeasible to censor the Internet in the same manner as other types of media. In recognition that "there is a limit to what domestic legislation can achieve in the face of a global and borderless medium like the Internet," the SBA chief stated, "that it was impossible to fully regulate the Internet."83 Censoring the Internet has proved difficult despite assistance from ISPs within Singapore. The three major ISPs within Singapore, being either partially government-owned or linked to government companies, evince the SBA's considerable influence in the domestic Internet industry.84 These three ISPs utilize proxy servers to regulate all incoming Internet traffic and to implement the SBA's policies. The proxy servers act as filters and block access to sites the government deems objectionable. However, the effectiveness of the SBA content restrictions must be questioned when the SBA has announced it would block access to only one hundred high-impact pornographic sites, and over 28,000 cyberporn Websites existed as of 1998. Moreover, the explosive growth of new cyberporn sites would seemingly circumvent any SBA attempts to block identifiable cyberporn sites.85 The SBA has also directed the three ISPs to provide an optional Family Access Network (FAN) to which parents can subscribe for their children. The FANs essentially empower the parents, who are unfamiliar with other methods of protection, such as filtering software, to manage how their children access the Internet. However, the effectiveness of the FANs must also be questioned when considering the difficulties in censoring the Internet via proxy servers. Moreover, by simply downloading by-pass programs that are readily available on the Internet, other methods of protection such as software filters can be circumvented. The difficulties in regulating the Internet are further compounded by the ambiguities that exist in applying the current laws and the SBA lincensing to the Internet. For example, if an individual posts a libelous message against the PAP, the question remains whether both the ISP and ICP are liable. Due to these ambiguities and the Internet's young and evolving condition, the SBA and other enforcement agencies have implemented a "light-touch approach" in enforcing current laws on the Internet and to the enforcement of its Internet regulatory framework. This means that an offender will be given a chance to rectify the violation before the SBA takes action. However, it is still unclear whether a violation of an existing law will be forgiven upon rectifying the violation. If a violation of an Internet regulation persists, the SBA has discretionary authority on how much to fine the offender and whether to revoke his license. The SBA Website proclaims that "[t]o date, SBA has not taken action against anyone for objectionable content on the Internet, as service and content providers have generally abided by the guidelines."86 Although the SBA may not have acted, Singapore Telecom reportedly shut down the Web page of a seventeen year-old who was disseminating racist jokes about Malays.87 Also, in a high profile case, Singaporean Lai Chee Chuen faced seventyseven charges of possessing obscene films, including material from the Internet. Authorities emphasized that Lai's arrest followed a tip from Interpol, which had been monitoring child pornography rings via the Internet. Regardless, individuals remain concerned about personal privacy especially when lincensing specifically obligates ISPs to cooperate with authorities in any manner necessary. Supposedly, individuals who limit their Internet activities to engaging in private communications and to receiving information, such as downloading pornographic images, are outside of the SBA's purview. However, in 1994, Singapore authorities searched public Internet accounts for graphics files usually associated with pornographic images. Of the 80,000 image files found, only five were considered pornographic by authorities.”88 Some Final Thoughts on Internet Content Regulation At this juncture, it may be apt to note that the peculiar features of the Internet and its propensity to change the dynamics and form of human interaction has generated a degree of unease amongst persons concerned with the applicable laws that govern their transactions and communications in cyberspace. This is hardly a new problem as history abounds with situations where the law struggles to catch up whenever new technology acts as a catalyst for sweeping social and economic change. At the risk of oversimplifying the debate somewhat, there are generally three views that have been canvassed in relation to the laws that should apply to the Internet. Some commentators have argued that cyberspace is a unique and novel environment that cries out for a new set of rules tailored specifically for it.89 For example, it has been argued that the Internet should be governed in a manner suited to its particular history, customs and technological capabilities.90 Adherents of this school of thought vehemently oppose attempts to apply conventional models of regulation to the Internet. Some commentators adopt a ‘middle-path’ and argue that the law of cyberspace should evolve slowly through a careful application of common law principles, with particular attention paid to the aspects of cyberspace that make transactions in cyberspace unique.91 The last category of commentators share the opinion that existing legal principles are adequate in dealing with issues relating to transactions conducted in cyberspace.92 It is therefore important for the Singapore government (or for that matter, the governments of any other country) to review its laws and regulations so that they are consonant with the underlying conceptual approach it wishes to take towards the Internet. Amidst the flurry of legislative initiatives that are taking place at breakneck speed all over the globe, it is important that "knee-jerk" reactions are not adopted. As cyberspace has largely eviscerated the traditional concepts93 that underlie traditional legal dogma, there is an increasing need to constantly review existing laws and regulations to accommodate new technologies and to address the legal issues that arise as a consequence. The Internet Code of Practice is meant to be a fluid document that should evolve to meet the aspirations and needs of Singaporeans. The clamor amongst many younger Singaporeans for a more relaxed stance on censorship, coupled with the more internationalist outlook of younger Singaporeans, could well auger the eventual demise of the Internet Code of Practice. Until that day arrives, it is important that the Internet Code of Practice, along with other laws in Singapore that seek to regulate the dissemination of information, be constantly tinkered with so as to ensure that they remain relevant and reflective of the needs of Singaporeans. PRIVACY Privacy Concerns The advent of the Internet has paved the way for the development of a new era of mass media communication such as electronic mail access, the World Wide Web, virtual communities and instant messaging systems. Correspondences meant to be private are often not conducted in private, which unintentionally allows for unwanted public access. The sophistication of information technology has on the one hand brought tremendous convenience, yet on the other it has facilitated privacy invasions that were not feasible or possible in the past. Apart from commercial organisations, government bodies are also known to take advantage of these technical advancements to intrude into the privacy of its citizenry. Turning to an example that has generated considerable controversy, the U.S. Federal Bureau of Investigations (FBI) has developed a system known as Carnivore that is capable of monitoring all online traffic details, like email and browsing, generated by any targeted user.94 The potential ramifications of such activities are compounded when the information collected concerns particulars relating to children. The specific privacy concerns that apply to children will be discussed in the section on “Protecting Children’s Privacy Online”. In this section and the next section on “E-Asean Initiatives”, we will deal broadly with the privacy concerns that arise in relation to activities conducted on the Internet without making a distinction between activities that are engaged in by children and those that involve adults. Early in the technological timeline of the Internet, online privacy mainly concerned itself with issues related to “information privacy”, i.e. privacy of personal communication and personal data. Usually, this was performed with the use of cookies. However since 1999, many new techniques like online personal data profiling were developed by online companies, which stepped into the realm of privacy pertaining to personal behavioural traits.95 These techniques allowed online companies to amass large amounts of actionable psycho-graphic and behavioural profiles of their online visitors.96 The stunning aspect of these technologies is their ability to automatically update databases almost instantaneously to reflect their consumers’ latest browsing habits and behaviours,97 thereby enhancing the predictive features of their software on the sly. Recent events98 have also indicated the ease in combining sets of databases with different bits of information about a consumer to generate a complete list of his personal information, behavioural habits and personal preferences. Possession of such information - even if anonymous - is extremely valuable. Many online businesses use the size of their member databases as a means to attract business and on occasion as an asset that can be freely sold to interested third parties. Today, it is no longer surprising to receive an email with offers from another site after registering on a certain website. Online privacy concerns are moving away from information privacy to issues of online profiling and other advancements. Consumer profiles are usually treated as assets by online businesses, which can be sold, rented, loaned or transferred to other unaffiliated parties. For example, a revised clause in the privacy policies of online retailer Amazon.com, with more than 23 million registered users, now states: Business Transfers: As we continue to develop our business, we might sell or buy stores assets. In such transactions, customer information generally is one of the transferred business assets. Also, in the unlikely event that Amazon.com Inc., or substantially all of its assets are acquired, customer information will of course be one of the transferred assets.99 Prior to this revision, Amazon firmly declared that all personal information submitted by customers would not be disclosed to third parties. The revised clause not only puts privacy at risk but its ambiguity provides leeway for Amazon.com to offer this collected information for auction in certain circumstances. Amazon had to publicly clarify its new policy to evade questioning by the U.S. Federal Trade Commission (FTC).100 In another case involving the bankruptcy proceedings of Toysmart.com, a U.S. federal judge had to set aside conditions on the proposed sale of the failed online retailer to safeguard the company’s prized database of more than 250,000 consumer profiles.101 These incidents have been used to illustrate the threat that technological sophistication has on privacy. Fortunately, there exist many pro-privacy protection organisations like the World Wide Web Consortium (W3C), Junkbusters.com, Electronic Privacy Information Centre and some governments that are actively updating privacyenhancing technologies, policies and laws to protect privacy. Countries in Asia would do well to monitor these developments and, where necessary, implement appropriate legislation. It should be noted that even parties from countries with lax privacy laws have to be mindful of the requirements imposed by privacy laws of the countries of persons they engage in business with and ensure that they comply with them.102 It is also perhaps timely for the ASEAN member countries to give serious thought to developing a common charter on privacy and, where necessary, implement appropriate privacy legislation. This would serve the dual purposes of providing a sense of comfort to potential investors as well as ensuring that the privacy laws of the ASEAN member countries are in line with international norms in the area. It is useful to note that some countries in Asia are already starting to conduct bilateral discussions for the purposes of streamlining their privacy laws. E-ASEAN Initiatives At this stage, it is also instructive to note that the ASEAN Economic Ministers recently created a high-level public-private sector advisory body to develop a broad-based and comprehensive action plan towards evolving an ASEAN e-community or ASEAN espace. The action plan will cover the necessary physical, legal, logistical, social and economic infrastructure for such an endeavor. Each ASEAN Leader is required to name two members to the Task Force, one being a private sector individual and the other being a public official. In November 1998, the Prime Minister of Singapore, Mr Goh Chok Tong proposed the creation of the ASEAN Information Infrastructure (AII) at the Annual ASEAN Summit in Hanoi. A year later, an AII feasibility study report was endorsed by all ASEAN leaders with the AII expanded to e-ASEAN. On the 25th of November 2000, the heads of the states of ASEAN signed the landmark "e-ASEAN Framework Agreement"103 at the informal summit meeting. The Agreement aims to promote co-operation and to develop, strengthen and enhance the competitiveness of the Information Communication Technology (ICT) sector in ASEAN. The agreement also seeks to reduce the digital divide within individual ASEAN Member States and amongst ASEAN Member States, to facilitate co-operation between the public and private sectors in realizing e-ASEAN. Another stated aim of the agreement is to liberalize trade in ICT products, ICT services and investments that support the e-ASEAN initiative. The Agreement commits ASEAN members to an implementation schedule to achieve digital readiness for the region in order to develop the basis for ASEAN's competitiveness into the future, better the lives of their citizens through the application of information and communication technologies and foster the spirit of the ASEAN community. Following the adoption of the Agreement, each of the ASEAN governments is now moving towards implementing it in its domestic legal and regulatory framework. It is instructive to note that the promotion of personal data protection and consumer privacy falls within the mandate of the e-ASEAN Task Force as spelt out in the Agreement. To drive and facilitate the implementation of the above-mentioned initiatives, two formal groups were formed. They are the e-ASEAN Task Force (EATF) and the eASEAN Working Group (EAWG) comprising government and private sector representatives. The e-ASEAN initiative is envisioned as a holistic electronic action plan based on existing work in ASEAN, especially the AII, Electronic Commerce, Telecommunications, and other relevant sectors such as Trade, Tourism, Science and Technology. The eASEAN aims to tie up all these separate initiatives into a comprehensive plan for greater synergy. It would make great contributions towards revealing the ASEAN Vision 2020, through the development of a strong ICT infrastructure, vibrant electronic services and a dynamic ICT sector. Hopefully, the e-ASEAN initiatives will have the effect of ensuring that the privacy laws of the various ASEAN member states develop in a unified manner and takes due account of developments taking place in other parts of the world. This common front and unified stance would also give the ASEAN grouping further leverage in situations where proposals for reforms are made at an international level. Protecting Children’s Privacy Online With a view to gaining a foothold in the lucrative children market, many advertisers and marketers have started to focus their efforts on the rapidly growing numbers of children online. It has, for example, been observed that: “World Wide Web sites and other interactive online services are being designed to capture the loyalty and spending power of the "lucrative cybertot category." A variety of new interactive advertising and marketing techniques have been developed specifically for this new medium. Many of them threaten to manipulate children and rob them of their privacy. If allowed to develop without any intervention, these practices will become widespread and even more egregious.”104 A study conducted by the American-based Center for Media Education (CME) revealed that children are exposed to two kinds of threats: 1) invasion of children's privacy through solicitation of personal information and tracking of online computer use; and 2) exploitation of vulnerable, young computer users through new unfair and deceptive forms of advertising: “Invasion of children's privacy. Marketers have devised a variety of techniques to collect detailed data and to compile individual profiles on children. For example, children are offered free gifts such as T-shirts or chances to win prizes like portable CD players if they will fill out online surveys about themselves. Tracking technologies make it possible to monitor every interaction between a child and an advertisement. The ultimate goal is to create personalized interactive ads designed to "microtarget" the individual child. Unfair and deceptive advertising. Other online advertising practices have been developed which would violate long-standing safeguards protecting children in other media. But because neither the proprietary online services (e.g., America Online, CompuServe, Prodigy) nor the World Wide Web are subject to such regulations, marketers are able to pursue children with few or no restraints. As a consequence, advertising and content are often seamlessly interwoven in new online "infomercials" for children. Entire electronic advertising "environments" have been built to entice children to spend countless hours playing with such popular product "spokescharacters" as Tony the Tiger, Chester Cheetah, and Snap! Crackle! & Pop! Interactive forms of product placement are being developed to encourage children to click on icons in their favorite games and play areas and immediately be transported to advertising sites.”105 It would appear that some form of regulation is necessary if children’s privacy is to be effectively protected in cyberspace. The following extract provides a useful response to the issue of protecting the privacy of children online: “With the online interactive media still in their early stages of development, there is a unique opportunity to develop safeguards for ensuring that children will be treated fairly by marketers and advertisers. Although there may be hesitancy to take regulatory action regarding this new and evolving medium, adopting a "waitand-see" attitude on the issue of marketing practices targeting children is not sensible. Without safeguards, the new forms of marketing to children online will be governed only by the marketplace. While industry leaders may argue that they can police themselves through selfregulation, past experience demonstrates that effective self-regulation is highly unlikely, and will not develop at all without some government intervention. There is little evidence that industry leaders even recognize the need to set limits on the marketing onslaught aimed at vulnerable youngsters. Instead, the emphasis is on continuing to refine techniques for creating loyal, lifetime consumers. Nor is it reasonable to expect parents to effectively protect their children from these practices. While many parents may try to monitor their children's use of online services, it is not an easy task. Unlike television, which the entire family may watch together, many children use their computers alone. Children also tend to have greater computer skills than their parents, which makes periodic monitoring more difficult. And because of the "halo effect," arising out of the educational uses of computers, many parents implicitly trust computers, preferring that their children go online instead of watching television. They are unaware that children's Web sites can be more intrusive and manipulative than the worst children's television. The new technological screening software services -- e.g., SurfWatch, Cyber Patrol, Net Nanny, SafeSurf, CYBERsitter -- are also not likely to adequately address the problems presented by online advertising and marketing to children. Most of the software programs were developed to protect children from sexual materials, rather than manipulative advertising and intrusive marketing practices. Even if software were created that could effectively screen out such practices, its value would be limited to those parents who could afford it, learn how to use it, and to devote the time needed to install and regularly update it. Given the inability of most parents to monitor their children's activities online, and the unlikely prospect of adequate industry self-regulation, the best hope for children is a regulatory framework which will give them the protection they need. A complete ban on children's advertising in cyberspace is not necessary. … The most effective approach is to establish a new series of regulations to protect children from manipulative, invasive, and deceptive advertising online. … The following principles should guide the development of regulations for online advertising and marketing to children: 1. Personal information (including clickstream data) should not be collected from children, nor should children's personal information be sold. Since most children neither understand the importance of privacy (their family's or their own), nor can resist the blandishments and bribes offered for personal information, the online collection of such information from them should be prohibited. Likewise, technological monitoring of interactions between children and online advertising should not be allowed. Children's personal information, however gathered (from organizations or mailing lists), should not be sold or distributed. 2. Advertising and promotions targeted at children should be clearly labeled and separated from content. The integration of advertising and content should be proscribed in children's content areas. Advertising should not be disguised as content, and children should understand which is which. Product placement should not be allowed. 3. Children's content areas should not be directly linked to advertising sites. Children who go to a content area should be allowed to fully explore and use it without having to constantly resist the skillful efforts of advertisers to lure them away. Discrete underwriting should be allowed, but not hyperlinks designed to catapult children into captivating advertising environments. 4. There should be no direct interaction between children and product spokescharacters. Just as rules are in place to shield children from the influence of such spokescharacters on TV, it is crucial that similar protections be developed for online services. The interactive nature of the new medium gives spokescharacters the potential for even greater influence over children. 5. There should be no online microtargeting of children, and no direct-response marketing. Advertising pitches specifically tailored to each individual child should also be prohibited. Online ads fully utilizing animation, video, sound, 3-D, and interactivity, are likely to become the most persuasive advertising ever. To allow them to be individually crafted to each child based on his or her particular preferences would give online advertising unprecedented power over children. Children should also be protected from direct response marketing online which combines a hard sell with incentives to make immediate impulse purchases. These principles do not prohibit all online advertising directed at kids, but do establish clear boundaries between content and advertising. By placing limits on egregious and exploitative practices, they require that children be treated fairly, truthfully, and appropriately. Working together, policy makers, parents, and industry leaders could ensure that children make the most of the exciting educational and cultural opportunities in cyberspace, while avoiding deceptive advertising, manipulative marketing, and a wholesale loss of privacy.”106 It is perhaps timely for countries in the ASEAN region as well as in other parts of the Asia-Pacific region to consider implementing regulations to ensure that some degree of protection is accorded to children when they surf the Internet so as to ensure minimal invasion of their privacy. As the above extract so aptly illustrates, industry regulation is not likely to be completely effective in this respect. Whilst some countries are starting to focus on issues pertaining to privacy and looking towards self-regulation by industry as a possible option, the specific and unique concerns pertaining to children is often overlooked. In the quest to develop a privacy regime that applies to activities conducted online, the limited utility of a self-regulation model in protecting the interests of children online is also usually not fully appreciated. This has hampered efforts at developing a framework on privacy that effectively protects the interests of children online. It is also apt to note that in the United States, Internet-related legislation that seek to protect children is sometimes struck down on the basis that they infringe upon the constitutional rights of adults. It is unfortunate, however, that in some cases where the judges have been prepared to strike down suggested enforcement measures for Internet regulation on this basis, they fail to suggest alternative, less-restrictive methods for regulation.107 It is suggested that countries that do not follow the American constitutional model should not be hampered by these American developments and that a more robust strategy should be employed in these countries in the quest to protect the interests of children. Privacy Protection in Singapore An Introduction The Singapore legal system does not contain any explicit right to data privacy. Singapore does not have any legislation that specifically governs data protection or privacy. The relevant Ministers have stated in Parliament time and again, that the Government prefers to rely on industry self-regulation. On 25 February 2000, in response to a query from an MP on the possibility of specific legislation to protect the privacy of computer users, the Minister of State for Communications and Information Technology Mr Lim Swee Say said: “… it is not necessary at this point in time to enact separate legislation to protect the privacy of computer users. We have in place legislation, such as the Official Secrets Act, Computer Misuse Act and Banking Act, to protect the confidentiality of data held by the Government, statutory boards and financial institutions. In the private sector, several professions such as the medical and legal fields already have strict codes of conduct in place to ensure proper handling of data. …In view of the fast pace of change of the Internet world, we believe that at this moment, industry self-regulation is still the best way to go.”108 The issue of privacy does not seem to have been a very hot debated issue in Singapore, when the government launched its masterplan on e-commerce and related topics. On the respective websites of the Infocomm Development Authority of Singapore,109 the Controller of Certification Authorities (CCA)110 and the Electronic Commerce Hotbed Singapore111 almost nothing is said about privacy. Notwithstanding the absence of specific data protection legislation, privacy is not entirely unprotected in Singapore. Certain limited aspects of privacy do receive a degree of protection. For instance, there is the common law of confidential information. Furthermore, some statutes, while not specifically dealing with data protection or privacy, do contain specific confidentiality provisions. While there is no single, encompassing legislation governing online privacy specifically, the obligation to respect privacy of information or data is dealt with by one or more of the following means: by agreement, under the law of confidence or under specific legislation such as the Banking Act (which prohibits disclosure of financial in formation without the permission of the customer), the Official Secrets Act, the Statutory Bodies And Government Companies (Protection Of Secrecy) Act and the Statistics Act. Apart from the foregoing, some statutes also grant invasive rights to government entities, in particular the police. A notable example would be section 15 of the Computer Misuse Act, which grants broad powers to the police to search computers and to demand for decryption keys, with a failure to produce such keys being a criminal offence. Electronic Communications In July 1998, three major legislation concerning computer networks came into force in Singapore. They are the Computer Misuse (Amendment) Act, the Electronic Transactions Act and the National Computer Board (Amendment) Act. The amended Computer Misuse Act prohibits the unauthorized interception of computer communications. The amended Computer Misuse Act also provides the Police with additional powers of investigations. Under the amended Act, it is now an offense to refuse to assist the Police in an investigation. Amendments also widened the provisions allowing the Police lawful access to data and encrypted material in their investigations of offenses under the Computer Misuse Act as well as other offenses disclosed in the course of their investigations. Such power of access requires the consent of the Public Prosecutor. Under the Computer Misuse Act, certain acts that have a bearing on privacy and data protection have been criminalised. For instance, section 3 makes it an offence to “knowingly [cause] a computer to perform any function for the purpose of securing access without authority to any program or data held in any computer.” Under section 3(1) of the Computer Misuse Act, any person who knowingly causes a computer to perform any function for the purpose of securing access without authority to any program or data held in any computer shall be guilty of an offence. It is immaterial that the act in question is not directed at any particular program, data or computer.112 On the other hand, the Electronic Transactions Act imposes a general obligation of confidentiality upon persons who receive electronic information pursuant to powers under the Act.113 This obligation is subject to three limited exceptions, namely disclosure for the purposes of the Act, for the prosecution of an offence under any written law, or pursuant to an order of court. The Electronic Transactions Act imposes a duty of confidentiality on records obtained under the act and imposes a maximum $10,000 fine and 12 month jail sentence for disclosing such records without authorization. The Police has broad powers to search any computer to require disclose of documents for an offence related to the act without a warrant. The Electronic Transactions Regulations sets the standards for the integrity and security of the Certification Authorities. The Regulations contain procedures for a system of licensing, standards and control in the services offered by Certification Authorities. Article 28 of the Regulations provides that with some exceptions, that every licensed certification authority and its authorised agent must keep all subscriber-specific information confidential, and that any disclosure of such information by the licensed certification authority or its agent must be authorised by the subscriber. The Electronic Transactions Security Guidelines establish the security criteria for the management, systems and operations of certification authorities. These guidelines are aimed at protecting the integrity, confidentiality and availability of certification services, data and systems. CAs that intend to be licensed by the Controller of Certification Authorities (CCA) are required to comply with the mandatory criteria stated in the security guidelines. The guidelines supplement the provisions in the Electronic Transactions Act and its Regulations. Access and integrity controls must be implemented for the CA systems that store and process the subscribers' information and certificates. Clause 2.7.1 of the Security Guidelines provides that Certification Authorities shall deploy adequate security controls to protect the confidentiality of the subscribers information under its custody to ensure subscriber privacy. Confidential information provided by the subscriber must not be disclosed to a third party without the subscribers' consent, unless the information is required to be disclosed under the law or an order of the court. Under clause 2.7.2 of the Security Guidelines, it is up to the parties to decide a definition on what is confidential, but it is implied that it should include much more than information submitted merely for certification, but also certificate usage and statistical information acquired by the Certification Authorities in the course of their operation. Under clause 2.7.4, information resources shall be monitored to minimize risk of data overflow, corruption and unauthorised addition, modification, deletion, and in clause 3.9.3, digital archives are required to be indexed, stored, preserved and reproduced so as to be accurate, complete, legible and accessible to authorised persons. Electronic Surveillance In 1994, Technet – then the only Internet provider in Singapore serving the academic and technical community – scanned through the email of its members looking for pornographic files. According to Technet, they scanned the files without opening the mails, looking for clues like large file sizes. In September 1996, a man was fined $70,000 for downloading sex films from the Internet. It was the first enforcement of Singapore's Internet regulation. The raid followed a tip-off from Interpol, which was investigating people exchanging pornography online. Following this incident, the Singapore Broadcasting Authority took steps to assure Singaporeans that it does not monitor their email messages, chat groups, what sites people access, or what they download. To allay concerns that SBA uses proxy servers to monitor what users are doing on the Internet, like users' emails and the sites they have accessed, the SBA website contains a statement that SBA does not regulate personal communications, such as Internet Relay Chat (IRC) and email, and that it does not monitor individual access to web pages, but respects and upholds the individual's right to privacy on the Internet.114 In May 1999, there was an incident where an Internet user detected unauthorised port-scanning of her computer. SingNet, a local ISP, had been scanning its more than two hundred thousand subscribers’ computers for Trojan horses and viruses without informing them. This was after two youths had hacked into seventeen accounts on the SingNet network. When the matter came to light and its subscribers protested, SingNet claimed that it had done nothing wrong save that it did not inform its subscribers that it was scanning their accounts. On 6 January 2000, the Infocomm Development Authority of Singapore (the industry regulator for ISPs) issued a set of guidelines for ISPs on scanning of subscribers’ computers.115 The guidelines essentially require ISPs to obtain the explicit consent of their subscribers before undertaking such scanning activities. The Infocomm Development Authority of Singapore (IDA), on behalf of the National IT Committee, also released on 6 January 2000 a set of guidelines to safeguard public interests when Internet Access Service Providers (IASPs) conduct preventive security scanning exercises.116 The need for such guidelines was heightened following an incident in May 1999 when SingNet scanned 200,000 subscribers' computers without informing them. The government had stressed that such computer scanning without permission is wrong, and that more clarity is required in the approach to such scans. The Guidelines for IASPs on Scanning of Subscribers' Computers were developed by the IDA in close consultation with all the players in the Internet access services market. The guidelines are based on international best practices in the areas of consumer privacy and protection. In line with international practices, an industry self-regulation approach has been taken in the formulation and implementation of the guidelines. The guidelines articulate the importance of accountability and transparency when security-conscious IASPs conduct scanning exercises to ensure that their subscribers' computers are safe and are not infected by malicious software or viruses. In particular, consent by IASP subscribers should be explicitly obtained before such exercises can be conducted. Scanning activities must be non-intrusive, and the IASP must inform its subscribers on how their privacy will be protected during such activities. Electronic surveillance also takes place daily on the roads in Singapore. Since 1998, an extensive Electronic Road Pricing system for monitoring road usage has been put in place. The system collects information on a motor vehicle's road usage from smart cards inserted into card readers installed in every car whenever the motor vehicle passes through electronic gantries placed at various locations in Singapore and on which video surveillance cameras are mounted. Video surveillance cameras are also used for monitoring traffic conditions on the major expressways in Singapore. Telecommunications Surveillance The unauthorised interception of telecommunications may amount to a criminal offence. Under section 46 of the Telecommunications Act 1999, any person who fraudulently retains or wilfully detains or makes away with a message or record of a message which ought to have been delivered to some other person or being required by a public telecommunication licensee to deliver up any such message or record thereof neglects or refuses to do so shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 3 years or to both. "message" means any sign, signal, writing, image, sound, intelligence or information of any nature transmitted by telecommunications. In turn, telecommunications is defined as “a transmission, emission or reception of signs, signals, writing, images, sounds or intelligence of any nature by wire, radio, optical or other electro-magnetic systems whether or not such signs, signals, writing, images, sounds or intelligence have been subjected to rearrangement, computation or other processes by any means in the course of their transmission, emission or reception”. Under regulation 12(3) of the Singapore Broadcasting Authority (Broadcasting and Television) Regulations,117 no unauthorised person shall intercept any sign, signal, writing, image, sound or intelligence of any nature transmitted by wire, radio, visual or other electromagnetic system, which is not intended for the general public. It is unclear if the criminal prohibitions would cover transmission logs captured by computer systems, but section 46 of the Telecommunications Act 1999 would appear to prohibit the unauthorised interception of emails. Under section 41, any person who, intending to prevent or obstruct the transmission or delivery of any message, or to intercept or to acquaint himself with the contents of any message, or to commit mischief, damages, removes, tampers with or touches any installation or plant or any part thereof used for telecommunications belonging to a public telecommunication licensee or interferes with the radiocommunication service or system of a public telecommunication licensee shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 3 years or to both. Telephone tapping would therefore be prohibited under section 41. However, the section does not appear to prohibit electronic interception of communications. Under Section 58 of the Telecommunications Act, the Minister may give directions for the stopping, delaying, and censoring of messages and the carrying out of any other purposes which the Minister thinks necessary, when it appears to the Minister to be requisite or expedient to do so on the occurrence of any public emergency, in the public interest or in the interests of public security, national defence, or relations with another government, or for the discharge of an obligation of Singapore under an international agreement which Singapore is party to. Section 42 of the Telecommunications Act makes it an offence for any officer, employee or agent of a public telecommunication licensee, to, inter alia, wilfully acquaint himself with any message or part thereof, i.e. to listen in on telephone calls, unless it was done pursuant to an order of the Minister or a court order. Telecommunications Providers’ Obligations Recently, The Code Of Practice For Competition In The Provision Of Telecommunciation Services (“the Telecommunications Code of Practice”) came into effect. There are some other regulations that also protect privacy in limited aspects. Section 3 of the Code of Practice for Competition in the Provision of Telecommunication Services118 issued by the Info-communications Development Authority of Singapore (“IDA”) imposes a duty upon telecommunications licensees to protect so-called “End User Service Information”. In particular, licensees may not, without authorisation from the End User, use such information to develop or market other goods, nor can licensees provide such information to affiliates or third parties. Industry Self-Regulation Self-regulation is the least intrusive and most efficient means to ensure fair information practices, given the rapidly evolving nature of the Internet and computer technology. In September 1998, the National Internet Advisory Committee (“NIAC”) proposed an industry-based self-regulatory ECommerce Code for the Protection of Personal Information and Communications of Consumers of Internet Commerce. The NIAC was set up by the Ministry of Information and The Arts to advise the Singapore Broadcasting Authority on the regulation of electronic information services and the developments of the Internet. The voluntary Code sets out general privacy obligations of Internet Service Providers and Internet Content Providers that provide commercial services for the management of personal information of consumers and internet commerce users. Providers that adopt the Code can use the Privacy Code Compliance Symbol. The Code would oblige providers to ensure the confidentiality of business records and personal information of users, including details of usage or transactions, would prohibit the disclosure of personal information, and would require providers not to intercept communications unless required by law. The Code would also limit collection and prohibit disclosure of personal information without informing the consumer and giving them an option to stop the transfer, ensure accuracy of records and provide a right to correct or delete data. The Code would be enforced by an industry-run Compliance Authority. Providers that were in compliance could use a "Privacy Code Compliance Symbol." The regulatory authority for the electronic medium in Singapore is the Singapore Broadcasting Authority (SBA). SBA is a statutory board under the Ministry of Information and the Arts (MITA). The NIAC had specifically focused on the protection of E-Commerce consumers against exploitation of their personal data and transactions by commercial service providers over the Internet as a means of nurturing the development of E-Commerce. The NIAC felt that this aspect was important in instilling public confidence and trust in the Internet as a trustworthy and secure tool for E-Commerce. After looking at business data protection models used in other countries such as Australia and the United Kingdom, the NIAC drew up its E-Commerce Consumer Protection Code which lays down guidelines for conducting E-commerce over the Internet. The key objectives of these guidelines are: to establish confidence in and encourage the use of the Internet for electronic commerce; to protect local E-Commerce consumers against improper or wrongful exploitation of their personal data and transactional information by private services providers over the Internet; and to provide adequate safeguards communications or transactions. for the confidentiality of users' The NIAC examined various methods for safeguarding the confidentiality of users' personal and transactional data submitted to providers of commercial services over the Internet. It also considered and discussed users' rights in preventing the improper exploitation of their personal information as well as the legitimate business use of such data by private sector providers. The NIAC made the following key recommendations, which mirror existing data protection principles: A provider must take reasonable steps to ensure the confidentiality of business records and personal particulars of each user including details of usage or transactions carried out by the user. Users should have the means to prevent information about them obtained for a specific business purpose from being used for other unconnected business purposes without their consent (for example the sale of such information to third parties for direct marketing or mailing purposes). As far as possible, providers should make transparent to users their business policies concerning the collection or use of such information; A provider should collect personal particulars relating to a user only where such particulars are relevant and necessary for the provision of the services provided, or for any other legitimate purposes made known to the user at or before the time the information is collected; The provider should use this personal information only for its own marketing, billing or other purposes as necessary to provide its service. If it intends to use it for other purposes then the user should be informed at or before the time the information is collected and given the option of whether to allow the information to be used; There should be basic standards for the use and management of personal information of consumers of Internet E-Commerce. Providers should take reasonable measures to ensure that the information collected in relation to a user is accurate and if necessary kept up to date, amended or deleted as requested by the user. In particular, users should have the means to view any information collected or recorded about themselves from their E-Commerce transactions over the Internet and request for amendments to be made; There should be adequate safeguards for the confidentiality of users' communications or transactions over the Internet. Providers should refrain from intentionally accessing or monitoring their users' communications and transactions over the Internet unless they have the express consent of users or are required to do so by the relevant authorities; and However, the NIAC stressed that a key principle to bear in mind is that these steps taken to ensure confidentiality of personal information should have as small an impact as possible on the economic viability of the providers and the services they make available. The NIAC recommended that the E-Commerce Consumer Protection Code be considered for incorporation into a broader self-regulatory Industry Code of Practice governing both content and E-Commerce issues on the Internet. This Industry Code of Practice could be administered by an independent body set up by the industry itself in line with the NIAC's objective of encouraging greater industry self-regulation. This body could provide a channel for dealing with complaints by users relating to any breaches of the Code. The NIAC further recommended that the industry body administering the Code of Practice should: develop a procedure for recourse by users in the event of any breach of the Industry Code; highlight clearly its role and scope so that public expectations as to what the Code can achieve are realistic and practical; be mindful of the impact on the industry with respect to costs and operative issues in implementing the Code. CaseTrust In keeping with the Singapore Government’s preference for industry self-regulation, the Consumers Association of Singapore (“Case”) had, in conjunction with the Retail Promotion Centre of Singapore and CommerceNet Singapore Ltd., introduced CaseTrust (www.casetrust.com.sg) in 1999. This is an accreditation scheme for both online and offline retailers, whereby accredited stores would have had their business practices audited. Online retailers would also have their information security procedures audited. CASETrust is a joint project of the Consumers Association of Singapore (“CASE”), CommerceNet, and Retail Promotion Centre, it serves as accreditation scheme for web based retailers. CASETrust members expected to respect the privacy rights of their customers by adopting certain criteria out in the CASETrust Code of Practice pertaining to the collection, display and use of personal information. Web based retailers who meet the criteria can display the CASETrust logo on their websites. This scheme is similar to the government-backed scheme, TrustUK, that was launched in the UK in July 2000 to inspire consumer confidence in buying online. The TrustUK logo will be available to online companies who sign up for the TrustUK regulations covering order fulfilment, payment security and data privacy.119 The CaseTrust accreditation scheme incorporates the earlier E-Commerce Code for the Protection of Personal Information and Communications of Consumers of Internet Commerce promulgated by the National Internet Advisory Committee in 1998. The Code was drawn up as part of the Committee’s Report for 1997-1998.120 The IDA has also announced, in March 2000, that it would make TRUSTe an industry “trustmark” seal for Singapore.121 CONCLUSION The legal and procedural barriers to protecting the interests of children on the Internet are vexing. In the course of the discussion in this chapter, we have seen how definitional difficulties as well as different cultural and social mores create difficulties in relation to devising an effective international framework for protecting children online. The problems are further compounded by different approaches that have been adopted in relation to issues involving the exertion of criminal jurisdiction over activities conducted via the medium of the Internet, extradition and the obtaining of evidence. The lack of a consistent and harmonious framework on privacy, content regulation and pornography also act as major obstacles to effecting a workable international strategy to protect the interests of children on the Internet. However, as the discussion also seeks to show, the difficulties are not insurmountable.122 What is ultimately important, at the end of the day, is that there must be a determination on the part of all countries to protect children so that an effective legal regime can then be devised. With a degree of judicial ingenuity in adopting a broad reading of existing offence-creating provisions in existing criminal statutes, timely legislative intervention to fill in the loopholes and a fair degree of concerted global co-operation in the field, much can be done in the ongoing battle to protect children. It is perhaps apt to end the discussion by reproducing a quote that cuts to the chase and helps put the issues in perspective: “The children’s life is far more important than those sorts of relatively minor concerns about civil liberties and entrapment. Those are important questions, but set them against a child’s life, a child’s psychological well-being, and frankly there’s only one possible answer.”123 * LLM, LLB (Hons); Assistant Professor, Nanyang Business School, Nanyang Technological University; Advocate & Solicitor, Supreme Court of Singapore; Solicitor, Supreme Court of England & Wales. This author welcomes any comment or feedback on this article which should be directed to him at asamtani@ntu.edu.sg. 1 Jennifer Stewart, “If This Is The Global Community, We Must Be On The Bad Side Of Town: International Policing of Child Pornography On The Internet”, (1997) Houston Journal of International Law 205 (Volume 20, Number 1) at page 244. 2 Taken from a report, titled “Privacy Online”, made by the American Federal Trade Commission to the American Congress and reproduced in David Flint, “The Internet and Children’s Rights: Suffer the Little Children”, (2000) Computer Law & Security Report 88 (Vol 16, No 2) at page 92. 3 The information superhighway is best thought of as an evolving superset that includes the Internet along with the physical telecommunications networks, cable television, mobile and other cellular networks. The information superhighway is essentially a high-capacity (broadband) electronic highway that is capable of simultaneously supporting a very large number of electronic commerce applications that permit interactivity between users: see Richard Doernberg and Luc Hinnekens, Electronic Commerce and International Taxation (1999) at pp 45-47. 4 For a brief but comprehensive description of the Internet, see Oliver Hance, Business and Law on the Internet (1996) at pp 33-50. 5 This infrastructure brings together several means of telecommunications (from telephone cable to satellite communication), with each party being responsible for setting up its network and bearing the costs of interconnection with other networks. Private individuals and commercial entities often connect to the Internet via an access provider and would bear the costs of the telephone line when connecting to the provider, as well as the costs of the subscription to the provider, who is connected to the network and whose job is to provide others with access to it. 6 The ARPA (Advanced Research Project Agency) was set up at the end of the 1960s by the American Defense Department, with the intention of accomplishing the simple but strategic objective of ensuring the dispatch of orders to fire from the control centre to the ballistic missile bases even after communication networks were partially destroyed by an attack. This mission was quickly extended to include access to and the sharing of all the computing resources of the United States. The new network was called the ARPAnet. 7 Howard Rheingold, The Virtual Community: Homesteading on the Electronic Frontier (1993) at p 67. 8 Electronic commerce is an important part of the growth of the Internet. Electronic commerce is the general term for Internet and non-Internet computer-to-computer processing of a growing variety of transactions, ranging from electronic data interchange (‘EDI’) – the well-established handling of business-to-business purchase orders, invoicing, remittance notices and other routine documents – to electronic payment systems, credit cards and consumer sales of goods and services. Increasingly, however, electronic commerce is used to mean Internet commerce for two reasons. Firstly, the Internet’s size, growth rate and ease of access open up immense market opportunities for large, medium and small firms. Secondly, the economics of the Internet will make it increasingly attractive – under some circumstances – to move electronic commerce onto the Internet from the many company, industry and special-purpose value-added networks that are currently the main vehicles for EDI, Financial EDI and other electronic commerce transactions. 9 Chuck Martin, Net Future: The 7 Cybertrends That Will Drive Your Business, Create New Wealth, and Define Your Future (1999). 10 See T J Tan, “Net Effect – Copyright Conundrum in Cyberspace” (1997) 9 S.Ac.L.J. 229 and L Rose, Netlaw: Your Rights in the Online World (1995) for a useful discussion of some of these issues. 11 Steven Hick and Edward Halpin, “Children’s Rights and the Internet”, (May, 2001) The Annals of the American Academy of Political and Social Science 56. 12 For a fuller report of the incident and an overview of the concerns, see Futile Quest For Kid Porn Traders (Reuters), available at http://www.wired.com/news/politics/0,1283,45965,00.html. 13 The arrests followed a 2-year undercover sting investigation dubbed 'Operation Avalanche' into the largest known commercial child pornography business ever uncovered. 14 Whilst not dealing specifically with the issue of child pornography, two recent reports do provide some assurance that not everything is doom and gloom in the fight against pornography and that some developing countries are actively seeking to address the problems associated with the peddling of pornography. On 19 August 2001, the Singapore police announced that it will invoke Emergency (Public Order and Prevention of Crime) Ordinance 1969 (Ordinance 5) section 3(1) to immediately detain pornography peddlers without trial if they threaten a police officer enforcing the national crackdown of the trade. In Malaysia, gangs behind the illegal pornographic and pirated video compact disc trade have threatened the Domestic Trade and Consumer Affairs Minister Tan Sri Muhyiddin Yassin in an effort to stop the ongoing crackdown. Following from this incident, it was recently announced that new amendments will be introduced to curb the spread of pornography which includes a mandatory jail term for those involved in the production, distribution and sale of pornographic videos: see http://www.nstpi.com.my/Current_News/NST/Friday/Frontpage/20010727074413/Article/. It was also recently announced that heavier fines and longer jail terms are part of the Malaysian government plans against those who possess pornography. In addition, the Malaysian government is also considering amending the Printing Presses and Publication Act to accommodate punishments for those producing pornographic materials and amending the Film Censorship Act 1952 to toughen laws against smut which is said to be contributing to an increasing number of sex-related crimes. According to Deputy Home Minister Datuk Chor Chee Heung, the move was necessary to stop the spread of pornographic material: “Heavy Penalties For Those Found With Porn”, The Sunday Times, August 26, 2001 at page 20. 15 In Singapore, however, it is likely that the applicable offence creating provisions of the Penal Code and sections 3 and 4 of the Children and Young Persons Act (Cap 38) will cover situations involving real child pornography, whether disseminated via the medium of the Internet or otherwise. 16 For a thorough discussion of issues pertaining to enforceability in the Internet environment, please see Chris Reed, Internet Law: Text and Materials (Butterworths, 2000) at pages 252 – 267. 17 Enforceability issues may also arise in situations where no penalties are provided in relevant criminal legislation or where the penalties are so minimal that potential criminals are not dissuaded from committing the offences. A recent development in the US provides a good illustration. A new South Carolina law will require the state's computer technicians to report to law enforcement authorities any child pornography they locate. The American Civil Liberties Union have correctly noted that the law may be unenforceable because there are no penalties against technicians that do not report the incident: see http://www.siliconvalley.com/docs/news/tech/009509.htm. 18 Kelsen, Pure Theory of Law (2nd Edition, University of California Press, 1967). 19 According to Kelsen, at page 35 of Pure Theory of Law, “[a] norm that is not obeyed by anybody anywhere, in other words a norm that is not effective at least to some degree, is not regarded as a valid legal norm”. 20 Chris Reed, Internet Law: Text and Materials (Butterworths, 2000) at pages 252 – 253. 21 Chris Reed, Internet Law: Text and Materials (Butterworths, 2000) at page 253. 22 Chris Reed, Internet Law: Text and Materials (Butterworths, 2000) at pages 266 – 267. 23 Lars Davies, A Model for Internet Regulation? – Constructing a Framework for Regulating Electronic Commerce (London: Society for Computers and Law, 1999) at p 6 (accessible at http://www.scl.org). 24 This analysis was adopted by the English Criminal Court of Appeal in R v Bowden, (Otton LJ, Smith J, Collins J) 10 November 1999 accessible at http://www.cyber-rights.org/documents/rvbowden.htm. This latter approach is generally referred to as the “effects doctrine”. Neal Kumar Katyal, “Criminal Law in Cyberspace”, (2001) 149 University of Pennsylvania Law Review 1003. 27 “Year’s Jail, Fine For Net Sex Offenders”, The Straits Times, June 29, 2001 at page 4. 28 In the United States, there may be difficulties in successfully prosecuting persons who produce, possess or distribute fake child pornography. In a comment published in the National Law Journal on 13 August 2001, “'Virtual Child' Pornography Issue Heads for U.S. Supreme Court: First Amendment lawyers fret over '96 law”, David E Rovella notes that the Child Pornography Prevention Act (CPPA) of 1996 is “constitutionally suspect in the eyes of some First Amendment lawyers, and faces a significant test before the U.S. Supreme Court this fall. One federal judge says the federal law is a paradigm shift in the way Congress views the First Amendment and child pornography. In addition to addressing pornography involving real children -- as in the Texas arrests -- it bars the production, possession or distribution of fake child porn. It outlaws obscene material with adults portraying minors, adults who seem underage and computer-generated images that appear to portray minors. In 1999, in a case brought by an adult entertainment industry group, the 9th U.S. Circuit Court of Appeals reversed a trial court ruling that held the "virtual pornography" section of the law to be constitutional. Free Speech Coalition v. Reno. The government has since appealed that ruling to the U.S. Supreme Court, and was granted certiorari in January. A lawyer for the Free Speech Coalition says the CPPA, and state laws like that used in Ohio in July to convict a man for fictional depictions of child sex abuse in his diary, endanger free speech. ” 29 The discussion in this section is based substantially on the author’s previously published article on the subject: see Samtani Anil, “Re-Visiting the Singapore Internet Code of Practice”, 2001 (2) The Journal of Information, Law and Technology accessible at http://elj.warwick.ac.uk/jilt/01-2/anil.html. 30 Accessible at http://www.kidshield.com/politics/politics_international.htm#Singapore. 31 Internet Service Providers refer to the following two groups: Internet Access Service Providers, who function as the main ‘gateways’ to the Internet, and Internet Service Resellers, who obtain Internet access from the Internet Access Service Providers and resell such access to the public. Internet Service Resellers include schools, public libraries, cybercafes and service providers such as Singapore Network Services Pte Ltd and National Computer Services Pte Ltd. 32 Internet Content Providers are information providers on the World Wide Web. They include web authors, such as Singapore Press Holdings Ltd for the AsiaOne web sit, web publishers such as SilkRoute Ventures Pte Ltd, and web server administrators such as Sembawang Media Pte Ltd. 33 The Internet Class Licence Scheme is a licensing framework which spells out the regulatory requirements for both Internet Service Providers and Internet Content Providers. Details on the Internet Class Licence Scheme may be viewed at http:/www.sba.gov.sg/netreg/govgaz/clnotif.htm. See also, “Internet Regulation to Start on Monday”, The Straits Times, 12 July 1996, at p 1; “SBA Class Licensing Scheme - Scheme Affect 2 Groups: Content, Access Providers”, The Straits Times, 12 July 1996, at p 43. 34 It is worth noting that the old Internet Code of Practice was introduced at a time when other jurisdictions were also grappling with issues relating to pornography: see, for example, the American and German experience discussed in “Germany launches porn probe into American Online”, The Straits Times, 15 July 1996, at p 4 and “Testing Time in Cyberspace”, The Sunday Times, 14 July 1996, at p 3. 35 The National Internet Advisory Committee was appointed by the Minister for Information and the Arts in August 1996 to advise the SBA on the regulation of electronic information services and the development of the industry. The National Internet Advisory Committee comprises members from a wide cross section of society and has three sub-committees that address the following areas: industry development, public education and legal matters. 36 The full text of the report may be viewed at http://www.sba.gov.sg/niacrpt.htm. 37 The discussion of the specific provisions of the new Internet Code of Practice is taken primarily from this author's previous article on the subject: see Samtani Anil, "The Revised Internet Code of Practice”, (1998) 20 Asia Business Law Review 55. 38 The full text of the new Internet Code of Practice can be viewed at http://www.sba.gov.sg/netreg/govgaz/code.htm. 39 Clause 1(1) of the new Internet Code of Practice. 40 Clause 6(3) of the Singapore Broadcasting Authority Act. 41 Clause 1(2) of the new Internet Code of Practice. 42 Clause 1(2) of the new Internet Code of Practice. 43 Clause 70(1) of the Singapore Broadcasting Authority Act. 44 Clause 23 of the Singapore Broadcasting Authority Act. 25 26 45 Clause 4 of the new Internet Code of Practice contains guidelines to determine what material is to be considered as ‘prohibited material’; this is discussed later in this article. 46 Clause 2 of the new Internet Code of Practice. 47 Clause 3 of the new Internet Code of Practice. 48 See discussion below on ‘The National Internet Advisory Committee and its Recommendations’. 49 This reading of Clause 3 would also be consistent with section 9A of the Interpretation Act (Cap 1) which stipulates that in interpreting the “provision of a written law, an interpretation that would promote the purpose or object underlying the written law (whether that purpose or object is expressly stated in the written law or not) shall be preferred to an interpretation that would not promote that purpose or object.” As we shall shortly see, one of the main objects of the new Internet Code of Practice (as identified by the NIAC in its report) is to enable Internet Service Providers and Internet Content Providers to be aware of the extent of their obligations upon reading the Code. Performance of the acts stipulated in Clause 3 should, therefore, be viewed as being exhaustive of the obligations imposed pursuant to the Code, in so far as the scenarios identified in Clause 3 are concerned. 50 See, for instance, the SBA’s assurance in the Industry Guidelines that business or professional closed usergroups which conduct professional discussions on websites will not be regulated. These activities, however, potentially fall within the purview of the Code. 51 Such extrinsic material may be referred (a) to confirm that the meaning of the provision is the ordinary meaning conveyed by the text of the provision or (b) to ascertain the meaning of the provision when (i) the provision is ambiguous or obscure or (ii) the ordinary meaning conveyed by the text of the provision leads to a result that is manifestly absurd or unreasonable. 52 Additionally, a person aggrieved by a conviction in such circumstances may possibly challenge the conviction on the grounds that the exercise of the discretion to prosecute was for an improper purpose. The courts will intervene, however, only if it can be shown that no reasonable authority would have instituted prosecution action in the circumstances: see Sydney Municipal Council v Campbell [1925] AC 338 and R v Hendon Justices, ex p DPP [1994] QB 167. 53 See, “Postings on New SBA Rules Flood the Net”, The Straits Times, 17 July 1996, at p 21. 54 See, however, clause 4(4) of the New Internet Code of Practice which impliedly suggests that prior approval for content posted on the Internet is not required. 55 Clause 3(4) of the new Internet Code of Practice. 56 Clause 3(4) of the new Internet Code of Practice. 57 Clause 72(1) of the Singapore Broadcasting Authority Act. 58 Clause 72(4) of the Singapore Broadcasting Authority Act. 59 Clause 72(2) of the Singapore Broadcasting Authority Act. 60 See above note 17. 61 The 19-member committee include, inter alia, personnel from institutions as varied as the AttorneyGeneral’s Chambers, National Library Board, National Computer Board, National University of Singapore, Ministry of Education, Yayasan Mendaki and the National Trades Union Congress in addition to personnel from companies such as Singapore Cable Vision Pte Ltd, Sembawang Media Pte Ltd and Xerox Singapore Software Centre. 62 Clause 1(1) of the old Internet Code of Practice. 63 Clause 1(2) of the old Internet Code of Practice. 64 See above note 21. 65 See, “Jitters Over New Net Regulations”, The Straits Times, 13 July 1996, at p 29; “Postings on New SBA Rules Flood the Net”, The Straits Times, 17 July 1996, at p 21; see also the letters sent to the Forum page of the Straits Times: “Broad Phrasing of Guidelines Open to Wide Interpretation”, The Straits Times, 13 July 1996, at p 36 and “Regulations Leave Some in Limbo”, The Straits Times, 13 July 1996, at p 36. 66 See, “Some Home Pages Come Under General Laws”, The Straits Times, 19 July 1996, at p 46. 67 Clause 4(1) of the new Internet Code of Practice. 68 See, “Revised Internet Code Makes Taboo Areas Clear”, The Straits Times, 23 October 1997, at p 3; “Porn is SBA’s Target in Net War”, The Straits Times, 23 October 1997, at p 32. 69 SBA’s policy and aims may be viewed at http://www.sba.gov.sg/netreg/infosht.htm. 70 See SBA’s website at http://www.sba.gov.sg/internet.htm. 71 See Clay Shirky, Voices from the Net (1995) at pp 92 – 140 and Oliver Hance, Business and Law on the Internet (1996) at pp 103 – 112. 72 See above note 44. 73 See, “New Net Rules Show S’pore ‘is Ready to Become Info Hub’”, The Straits Times, 25 October 1997, at p 65 which highlights the fact that all three Internet Access Service Providers in Singapore warmly welcomed the changes introduced by the new Internet Code of Practice. In particular the clarity of the new Code and SBA’s consultative approach were noted with favour by the Internet Access Service Providers. 74 This comes hot on the heels of suggestions to link-up the Asean member countries into a single cyber region for the purposes of attracting investors in information and communications technologies: see, “EAsean: 10 States, One Cyber Region”, The Straits Times, 26 November 1999, at p 44; “Project to Wire Up Asean Made a Priority”, The Straits Times, 27 November 1999, at p 45; and “Asean Kick Start Wiring Up of Region”, The Straits Times, 29 November 1999, at p 21. 75 This does not mean, however, that different jurisdictions do not exhibit features that are common to each other. 76 The word “censorship” is derived from the title of the Roman official responsible for enforcing speech codes, namely the censor. 77 See Bradley Steffens, Censorhip (1996) at pp 13-15. 78 In the United States, a free-speech challenge to a federal law designed to protect children from pornography on the Internet is headed for trial in February 2002 after an appeals court panel refused to dismiss the case. A three-judge panel from the 3rd U.S. Circuit Court of Appeals rejected a government motion to dismiss the challenge to the Children's Internet Protection Act of 2000 that cuts off federal funding to schools and libraries that do not install software designed to block access to pornographic material on personal computers. Three dozen plaintiffs, headed by the American Library Association and the American Civil Liberties Union, filed the challenge to the law in March, alleging it violated free-speech rights enshrined in the American Constitution. The plaintiffs argue that installing the pornography-filtering software constrains the ability of adults to access lawful material, including Web sites of interest to homosexuals and women's groups. Government lawyers argued the challenge was without merit, saying the law did not constrain free speech but simply imposed conditions on libraries that accepted federal money: see http://news.cnet.com/news/0-1005-200-6690184.html?tag=lh. 79 This report can be viewed at http://www.hrw.org/hrw/worldreport99/special/internet.html. 80 Examples can be found at http://techlawjournal.com/internet/19990119.htm and http://techlawjournal.com/internet/19990320.htm. 81 Additional information can be found at http://tao.ca/fire/nettime/0165.html. 82 In a gallup poll conducted by Channel News Asia which was reported on air on 7 November 1999: http://www.channelnewsasia.com/archive/1999/11/7/singaporenews12537.htm. 83 Anil Penna, Singapore moves to tame Internet, Agence France-Presse, July 11, 1996 ("SBA recognized that it was impossible to fully regulate the Internet. Singapore is positioning itself as an information hub for the region by promoting itself as a base for the broadcasting industry and does not want to stifle this development."). 84 See Garry Rodan, The Internet and political control in Singapore, 113 Political Science Quarterly, No. 1, 63, 65 (1998). 85 The SBA does not make available a list of the banned sites. And, the SBA has deflected complaints that the proxy servers slow down Internet access and has even argued that their use is beneficial for performance. See SBA and The Internet: Answers to Frequently Asked Questions, (visited Feb. 13, 1999) accessible at http://www.sba.gov.sg/feedback.htm. 86 SBA's Approach to the Internet (accessible at http://www.sba.gov.sg/work/sba/Internet.nsf/ourapproach/1). 87 See Garry Rodan, The Internet and political control in Singapore, 113 Political Science Quarterly, No. 1, 63, 65 (1998). 88 See Garry Rodan, The Internet and political control in Singapore, 113 Political Science Quarterly, No. 1, 63 at 77 (1998). 89 One commentator has described the law, in its struggle to adapt to digital technologies, as “behaving like an almost dead fish flopping on the dock. It is gasping for air because the digital world is a different place”: see Nicholas Negroponte, Being Digital (1995) at p 237. Another commentator, highlighting the “problem of digitized property” and lack of physical boundaries in cyberspace, likens the reliance on traditional legal models to “sailing into the future on a sinking ship . . . developed to convey forms and methods of expression entirely different from the vaporous cargo it is now being asked to carry.” This commentator then goes on to suggest that instead of trying to make the old legal models work through a “grotesque expansion” of existing laws or through the “brute force” application of these laws to the digital world, there is an urgent “need to develop an entirely new set of methods as befits this entirely new set of circumstances”: see John Perry Barlow, “The Economy of Ideas”, Wired 1994 at p 85. See Johnson, D and Post, D, ‘Law and Borders – The Rise of Law in Cyberspace’ (1996) 48 Stanford Law Review 1367. 91 See Lessig, L, ‘The Zones of Cyberspace’ (1996) 48 Stanford Law Review 1403 and Lessig, L, ‘Symposium: Emerging Media Technology and the First Amendment: The Path of Cyberlaw’ (1995) 104 Yale Law Journal 1743. 92 See Easterbrook, ‘Cyberspace and the Law of the Horse’ (1996) University of Chicago Legal Forum 207. 93 Such as territorial-based jurisdictional rules. 94 The Carnivor FOIA Litigation, Electronic Privacy Information Center, February 14 2001: http://www.epic.org/privacy/carnivore 95 D. Mulligan, Public Workshop on Online Profiling, Testimony of the Center for Democracy and Technology Before the Federal Trade Commission, November 30 1999: http://www.cdt.org/testimony/ftc/991130mulligan.shtml 96 Doubleclick has 120 million consumer profiles, http://www.doubleclick.net/us/corporate/presskit/pressreleases.asp?asp_object_1=&press%5Frelease%5Fid=2506, Engage has 88 million consumer profiles, http://www.engage.com/press_room/1001q2.cfm, 24/7 Media collects information from over 4,600 websites, http://www.247media.com/publishers/web_adv.html 97 Doubleclick mentions this in its press release: Doubleclick Delivers On Q1 Expectations, Launches Research Business, And Expands Email Capabilities, http://www.doubleclick.net/us/corporate/presskit/pressreleases.asp?asp_object_1=&press%5Frelease%5Fid=2506 98 C. Macavinta, Privacy fears raised by DoubleClick database plans, January 25 2000, http://news.cnet.com/news/0-1005-200-1531929.html?tag=rltdnws. 99 Amazon.com Privacy Notice, http://www.amazon.com/exec/obidos/tg/browse/-/468496/103-41681405108658. 100 N. Wingfield, Amazon clarifies customer info policy, ZDNet News, September 1 2000: http://www.zdnet.com/adnn/stories/news/0,4586,2622866,00.html. 101 J.Guidera & F. Byrt, Toysmart customer data still in limbo, ZDNet News, August 18 2000. 102 In the European Union, for instance, governments have moved aggressively to regulate the use of personal data. In the United States, on the other hand, the government has largely refrained from such regulation, instead allowing companies and associations to regulate themselves, save for a small number of narrowly drawn regulations targeting specific industries. These divergent responses can best be explained by different cultural mores and the different legal approaches to privacy in general. The EU's aggressive regulation of the use of personal data originating in its fifteen member countries is embodied in its Directive on the Privacy of Personal Data 95/46/EC ("the Directive"), which took effect on 25 October 1998. The Directive embodies the principle that privacy is a fundamental human right. It also serves the purpose of equalizing the level of data privacy protection guaranteed in each EU member country so as to decrease transaction costs for entities that operate across national borders. The Directive provides a high level of protection for the privacy of personal data, and it extends that protection beyond the EU by prohibiting the transfer of data to third countries unless those countries can guarantee a vaguely defined "adequate" level of data protection. See also Julia M Fromholz, "The European Union Data Privacy Directive", (2000) 15 Berkeley Technology Law Journal 461. 103 A copy of this agreement can be accessed at http://www.e-aseantf.org/docs/eframework_agreement.doc. 104 See page 1 of the report “Web of Deception: Threats to Children from Online Marketing” accessible at http://www.cme.org/children/marketing/deception.pdf. 105 See pages 1 and 2 of the report “Web of Deception: Threats to Children from Online Marketing” accessible at http://www.cme.org/children/marketing/deception.pdf. 106 See pages 19 to 21 of the report “Web of Deception: Threats to Children from Online Marketing” accessible at http://www.cme.org/children/marketing/deception.pdf. 107 Reno v American Civil Liberties Union, 117 Supreme Court 2329 (1997). 108 Singapore Parliamentary Reports, vol.71, 25 Feb 2000, columns 1060-1. 109 http://www.ida.gov.sg. 110 http://www.cca.gov.sg. 111 http://www.ec.gov.sg. 112 Section 3(3), Computer Misuse Act. 113 Section 48 of the Electronic Transactions Act (Cap.88, 1999 Rev. Ed.). 114 http://www.sba.gov.sg/sitemap.htm. 90 115 The Guidelines and the accompanying press release are available online at http://www.ida.gov.sg/Website/IDAContent.nsf/dd1521f1e79ecf3bc825682f0045a340/7c22304fecdd8affc8 25685e0035f9eb?OpenDocument. 116 Guidelines for Internet Access Providers on scanning of subscribers’ computers, 6 Jan 2000. 117 S212/99. 118 The Code is available online at http://www.ida.gov.sg/Website/IDAContent.nsf/vSubCat/Policy+&+RegulationCodes+of+Practice?OpenDo cument. 119 http://www.theregister.co.uk/content/1/12014.html. 120 The report is available online at http://www.sba.gov.sg/work/sba/internet.nsf/cd297adfb2b98505482566170057cf04/47525ba84928829a482 566820011867f?OpenDocument. 121 IDA news release, 1 March 2000, “Helping Singaporeans Go Online”: accessible at http://www.ida.gov.sg/Website/IDAContent.nsf/dd1521f1e79ecf3bc825682f0045a340/9c65cc5cc9a05541c 8256895000f0dfd?OpenDocument. 122 We sometimes see that courts instinctively try to do the “right thing” in relation to activities such as child pornography. The Alberta (Canada) Court of Appeal, for instance, recently ruled that an Internet company acted legally when it peeked into a client's e-mail, found child pornography and called the police, and unanimously upheld the 1998 conviction against Dale Thomas Weir for possession of child pornography. The case began in 1996 when Weir complained to his Internet provider, Alberta Suprent, that his email service was not functioning properly. In fixing such problems, the provider searched for emails that include attachments that are too large to fit in the user's mail box. They found an email addressed to Weir's with an attachment that appeared to be child pornography, opened it and contacted police. A fuller report of the decision can be found at http://www.nationalpost.com/home/story.html?f=/stories/20010712/616457.html. 123 The comments were made by John Carr, a spokesman for NCH Action for Children and were featured in a documentary by BBC Scotland Frontline, ‘XXX Files’ (6 October 1998). The quote is also referred to in David Flint, “The Internet and Children’s Rights: Suffer the Little Children”, (2000) Computer Law & Security Report 88 (Vol 16, No 2) at page 88.