Legislative Measures And Challenges In Combating Cybercrime - A Critical Analysis Of Sri Lanka’s Legal Framework
Author: LawSphereX
Category: Criminal Law
Published:
Updated:
LEGISLATIVE MEASURES AND CHALLENGES IN
COMBATING CYBERCRIME: A CRITICAL ANALYSIS OF
SRI LANKA’S LEGAL FRAMEWORK
Kalyani Jayasekera, General Sir John Kotelawala Defence University
ABSTRACT
With the rapid integration of computers and networks into everyday life, cyberspace has become a crucial platform for both communication and commerce. However, the rise of technology has also led to a surge in cybercrimes, posing significant challenges to individuals, businesses, and governments worldwide. In Sri Lanka, the increase in criminal activities in cyberspace has prompted the need for a robust legal framework to combat cyber threats effectively. This research critically analyzes the legislative measures implemented by the Sri Lankan government to address cybercrime. The study examines key legal instruments such as the Computer Crimes Act No. 24 of 2007, Electronic Transactions Act No. 19 of 2006, and Penal Code amendments, alongside international obligations and standards. Through a detailed evaluation of these legislative tools, the research highlights both the strengths and shortcomings of Sri Lanka’s approach to combating cybercrime. Additionally, it identifies gaps in enforcement, challenges posed by rapidly evolving technology, and offers recommendations for enhancing the legal framework to ensure better protection of individuals and institutions in cyberspace. This study contributes to the broader understanding of cybercrime regulation in Sri Lanka and provides a foundation for future legal reforms in response to emerging cyber threats. Keywords: cybercrime, law, computer
Introduction Cybercrimes in Sri Lanka have been on the rise, driven by increasing internet penetration and the development use of digital technologies. The parliament of Sri Lanka has enacted laws specially the Computer Crimes Act No. 24 of 2007 to address offenses like unauthorized access, hacking, data breaches, and online fraud. Despite this, law enforcement agencies faces challenges in keeping up with the rapidly evolving nature of cyber threats, including cyberstalking, ransomware, and identity theft. Additionally, gaps in technical expertise and cross-border cooperation complicate efforts to prosecute cybercriminals effectively. To combat these threats, Sri Lanka is also taking actions on strengthening its cybersecurity infrastructure and improving public awareness. Identification of cybercrime Cybercrime involves to criminal activities that are conducted via the internet or through the use of computer systems and networks1. This broad definition includes a wide range of offenses, including unauthorized access to computer systems (hacking), identity theft, financial fraud, cyberstalking, the distribution of malicious software, and the illegal downloading or sharing of copyrighted material. Cybercrime can target individuals, organizations, or governments and often tries the exploitation of technological vulnerabilities for financial gain, harassment, or other malicious intents2. As technology evolves, so too does the landscape of cybercrime, necessitating ongoing adaptations in legal standards and law enforcement strategies to effectively combat these threats. In Sri Lanka, while there isn't a single unified definition of "cybercrime" across various acts, the Computer Crimes Act No. 24 of 2007 provides a foundational understanding through its provisions3. Key aspects of cybercrime identified in this Act include Unauthorized Access, which criminalizes accessing any computer or computer system without permission, including hacking into networks. Data Interference is another crucial component, addressing the unauthorized alteration, deletion, or deterioration of data stored within computer systems4. Additionally, the Act encompasses Computer-related Fraud, which involves actions that result in obtaining financial or personal benefits through deception or manipulation of a computer
1 Clough J, Principles of Cybercrime (2nd edn, Cambridge University Press 2015).
2 Brenner SW, Cybercrime: Criminal Threats from Cyberspace (ABC-CLIO 2010).
3 Part I of the statute discusses computer crimes.
4 Weerakkody D, Cybercrime Law in Sri Lanka: A Detailed Analysis (Stamford Lake 2019).
system. Furthermore, the Penal Code (Amendment Act No. 16 of 2006) addresses Cyberstalking and Harassment, framing these as offenses committed through electronic means5. Although these provisions do not constitute a singular legal definition of cybercrime, they collectively illustrate the types of offenses encompassed within the term in Sri Lanka. Legislations Addressing Cybercrime in Sri Lanka Sri Lanka has developed a comprehensive legal and policy framework to combat cybercrime, protect data, and enhance digital security. The Data Protection Bill and the Cybersecurity Bill aim to safeguard personal information and bolster the country's defenses against cyber threats. The National Information and Cybersecurity Strategy (2019-2023) further outlines the government's strategic goals for enhancing cybersecurity infrastructure, increasing resilience, and promoting public awareness. The Mutual Assistance in Criminal Matters (Amendment) Act, No. 24 of 2018 facilitates international cooperation in handling cybercrimes that cross borders. Additionally, the Electronic Transactions Act, No. 19 of 2006 legitimizes digital transactions and communications, while the Computer Crimes Act, No. 24 of 2007directly addresses offenses such as hacking and data breaches. To tackle financial fraud, the Payment Devices Frauds Act, No. 30 of 2006 focuses on crimes involving payment methods. The Criminal Procedure Act (1979), along with various amendments to the Penal Code (in 2018, 2006, and 1995), provides the procedural and legal mechanisms for prosecuting cybercrimes. Lastly, the Intellectual Property Act emphasizes the protection of digital content from piracy and unauthorized use, ensuring that creative works in the digital economy are safeguarded. The Computer Crimes Act No. 24 of 2007 is Sri Lanka's primary legislation aimed at combating cybercrimes and regulating computer-related offenses. It defines key cyber offenses such as unauthorized access to computer systems, data alteration or destruction, and the illegal interception of communications. The Act criminalizes activities like hacking, computer fraud, and the distribution of malicious software. Additionally, it establishes clear procedures for law enforcement to investigate and prosecute cybercrimes, including provisions for search and seizure of computers, preserving evidence, and obtaining warrants to access electronic data. These provisions seek to ensure that the legal framework is robust enough to address the complexity of digital crimes.
5 Fernando N, The Legal Framework for Cybercrime in Sri Lanka (Lake House 2017).
The Act also recognizes the importance of international cooperation in dealing with cybercrimes, especially since many cyber offenses transcend national borders. By aligning with international best practices, Sri Lanka has positioned itself to collaborate with global law enforcement agencies in addressing cross-border cyber threats6. However, challenges remain in implementing the Act effectively due to the rapid evolution of technology and the sophistication of modern cybercriminals.7 To address these issues, continuous updates to the law, coupled with capacity building for law enforcement and judicial officers, are critical to strengthening the country's cyber defense. The Electronic Transactions Act No. 19 of 2006 was enacted to provide a legal framework for electronic commerce and digital communications in Sri Lanka. It facilitates the use of electronic records, electronic signatures, and digital contracts, ensuring that they have the same legal validity as their paper-based counterparts. The Act applies to various types of transactions, including government services, commercial agreements, and consumer contracts, allowing for the secure and efficient exchange of information in electronic form. It aligns with international standards, such as the UNCITRAL Model Law on Electronic Commerce, ensuring that Sri Lanka can participate in global e-commerce and digital trade. A key provision of the Act is its emphasis on security and authenticity in electronic
communications. The use of electronic signatures, for instance, is recognized, provided that they meet certain reliability standards8. The Act also addresses issues related to the retention of electronic records and the legal admissibility of electronic evidence in court proceedings. By promoting trust and confidence in electronic transactions, the Act aims to foster the growth of digital trade and communication in Sri Lanka, encouraging businesses and consumers to engage in the digital economy9. However, like many technology-related laws, it requires periodic updates to stay relevant in the rapidly changing digital landscape. 6 Perera K, ‘Cybercrime Regulation and Challenges in Sri Lanka: A Review of the Computer Crimes Act No. 24 of 2007 ’(2019) 15(1) Colombo Law Review 45. 7 Fernando S, ‘The Efficacy of Sri Lanka's Computer Crimes Act No. 24 of 2007 in Combating Cybercrime ’ (2016) 28(2) Sri Lanka Journal of Law 112. 8 B.A.R.R Ariyaratna, Contracting in Cyber Space: A Comparative Analysis of Electronic Transaction Law in Sri Lanka, Proceedings in law, 9th International Research Conference-KDU, Sri Lanka 2016, page 39
9 Kanchana Kariyawasam, The Growth and Development of E-Commerce: An Analysis of the Electronic
Signature Law of Sri Lanka, https://www.researchgate.net/publication/29468385_The_Growth_and_Development_of_E- Commerce_An_Analysis_of_the_Electronic_Signature_Law_of_Sri_Lanka' accused on 12.09.2024
The Payment Devices Frauds Act No. 30 of 2006 was introduced to combat fraud related to payment devices such as credit cards, debit cards, and other electronic payment methods in Sri Lanka. The Act criminalizes the unauthorized use, possession, or manufacture of counterfeit payment devices, as well as activities like card skimming and identity theft. It imposes strict penalties, including imprisonment and fines, for individuals or entities involved in fraudulent activities related to payment devices. This law aims to protect both consumers and financial institutions from losses due to card fraud, which has become a growing concern with the rise of digital payments. In addition to criminalizing various forms of payment device fraud, the Act also establishes procedures for law enforcement to investigate and prosecute these offenses effectively. It allows for the confiscation of equipment used in fraudulent schemes and provides for the cooperation of financial institutions in tracking and identifying offenders.10 The law is crucial in securing Sri Lanka’s banking and financial system, particularly as the country moves towards more cashless transactions. Despite its significant provisions, continuous updates and stronger cybersecurity measures are needed to address evolving techniques used by fraudsters in an increasingly digital economy.11 The Telecommunications Act No. 27 of 1996 serves as the primary regulatory framework for telecommunications in Sri Lanka, governing the operation, licensing, and management of telecommunications services and infrastructure. The Act established the Telecommunications Regulatory Commission of Sri Lanka (TRCSL), which is responsible for ensuring the provision of efficient and reliable telecommunications services in the country. The law covers a wide range of areas, including spectrum management, the licensing of telecommunications operators, and the establishment of standards for equipment and services. It also promotes competition within the telecommunications sector, aiming to foster innovation and improve service quality for consumers. Importantly, the Act includes provisions that address the misuse of telecommunications systems, including illegal interceptions of communication, tampering with telecommunication
10 Perera D, ‘An Overview of the Payment Devices Frauds Act No. 30 of 2006: Legal Challenges and
Implementation in Sri Lanka ’(2015) 7(1) Sri Lanka Journal of Banking and Finance Law 85. 11 Silva T, ‘The Legal Response to Credit Card Fraud in Sri Lanka: Analysis of the Payment Devices Frauds Act No. 30 of 2006 ’(2017) 12(3) Journal of Commercial Law 110.
networks, and the unauthorized use of telecommunications equipment12. As digital communication becomes more prevalent, these provisions have become increasingly relevant in combating cybercrimes like hacking, phishing, and unauthorized surveillance. The Act enables law enforcement agencies to collaborate with telecommunications providers to investigate and prevent such offenses13. However, as technology advances, the Act requires updates to adequately address modern issues such as internet-based communications, cybersecurity, and data privacy, ensuring that the legal framework keeps pace with global telecommunications developments. The Penal Code (Amendment Act No. 16 of 2006) was enacted to address emerging criminal activities involving computer systems in Sri Lanka. This amendment expanded the scope of the Penal Code to include offenses such as cyberstalking, cyber harassment, and defamation committed via digital platforms. Before the amendment, traditional laws on harassment and defamation did not fully cover cyber-related activities. With the growing use of the internet and social media, these new forms of crimes required specialized legal responses, and the amendment aimed to provide legal remedies for victims of online abuse and harassment. It imposes criminal penalties, including fines and imprisonment, for those convicted of using digital platforms to stalk, harass, or defame others. The inclusion of cyberstalking and defamation under the Penal Code is critical in ensuring that victims of online abuse have legal recourse.14 The amendment reflects the need to adapt traditional criminal laws to the realities of the digital age, where harm can occur through nonphysical means such as social media posts, emails, or other online communications. However, enforcing these provisions effectively can be challenging, as cyber offenses often involve anonymity or cross-border elements.15 As a result, further developments in digital forensics and cross-jurisdictional cooperation are needed to fully address cybercrimes under this amended law, along with ongoing public awareness campaigns to prevent such offenses. 12 De Alwis R, ‘Regulating Telecommunications in Sri Lanka: An Analysis of the Telecommunications Act No.
27 of 1996 ’(2008) 14(2) Sri Lanka Journal of Public and International Law 53.
13 Wijesinghe P, ‘Telecommunications Regulation in Sri Lanka: Challenges under the Telecommunications Act No. 27 of 1996 ’(2010) 9(1) South Asian Journal of Law and Policy 78. 14 Fernando A, ‘Addressing Cybercrime: The Impact of Penal Code (Amendment Act No. 16 of 2006) in Sri Lanka ’(2009) 5(3) Sri Lanka Law Journal 145.
15 Gunaratne K, ‘The Evolution of Cybercrime Legislation in Sri Lanka: A Focus on the Penal Code
(Amendment Act No. 16 of 2006) ’(2011) 11(1) Sri Lanka Journal of Criminal Law 95.
The Intellectual Property Act No. 36 of 2003 is a comprehensive law governing intellectual property (IP) rights in Sri Lanka, encompassing areas such as copyrights, patents, trademarks, and industrial designs. This Act provides legal protection for creators, inventors, and businesses by granting them exclusive rights to their innovations, works of authorship, and distinctive symbols or designs. It ensures that authors, musicians, software developers, and other creators can control and profit from their creations while also preventing unauthorized use or reproduction by third parties. The Act is essential for promoting innovation and creativity by safeguarding the interests of individuals and businesses in Sri Lanka’s growing digital and knowledge-based economy. In the digital age, this law also plays a critical role in addressing issues like digital piracy, unauthorized distribution of copyrighted content online, and the illegal use of patented technology. The Act includes provisions for enforcement measures, such as injunctions and penalties, for IP infringements, including online violations like downloading or distributing pirated movies, software, or music.16 By aligning with international IP treaties, such as the Berne Convention and the TRIPS Agreement, the Intellectual Property Act facilitates Sri Lanka's participation in global trade and innovation networks.17 However, the evolving nature of technology, including the rise of digital content platforms, necessitates ongoing updates to the Act to address new challenges in protecting intellectual property in cyberspace. The Cyber Security Act (Draft Bill) is a proposed piece of legislation in Sri Lanka aimed at strengthening the country’s cybersecurity infrastructure to combat the increasing threats posed by cyberattacks, data breaches, and other digital crimes. The bill seeks to establish a national cybersecurity framework and define the roles and responsibilities of various government agencies, including the creation of a dedicated cybersecurity authority. This authority would be responsible for safeguarding critical national information infrastructure, coordinating cyber incident responses, and ensuring that public and private entities adhere to cybersecurity standards. The bill is part of Sri Lanka’s broader effort to secure its digital economy, which is growing rapidly with increased internet penetration and the adoption of e-governance services. 16 Silva J, ‘Intellectual Property in the Digital Age: Implications of the Intellectual Property Act No. 36 of 2003 on Cybercrime in Sri Lanka ’(2010) 12(2) Sri Lanka Journal of Intellectual Property Law 75. 17 Perera D, ‘Cyber Piracy and Copyright Protection: An Analysis of the Intellectual Property Act No. 36 of
2003 in Combating Digital Infringement ’(2013) 8(1) Journal of Information Technology and Law 45.
In addition to setting up a regulatory framework, the draft Cyber Security Act includes provisions to enhance public awareness of cybersecurity, protect personal data, and foster international cooperation in dealing with cross-border cyber threats18. The law would introduce penalties for cybercrimes such as hacking, ransomware, phishing, and the illegal interception of communications19. Furthermore, it would mandate that organizations handling sensitive information implement robust cybersecurity measures and report cyber incidents to the authorities. By addressing the growing complexities of digital threats, the Cyber Security Act aims to safeguard Sri Lanka's digital infrastructure and maintain trust in its online services, positioning the country to better deal with the constantly evolving landscape of cyber risks. Conclusion In conclusion, Sri Lanka's comprehensive legal framework for addressing cybercrime reflects the country's commitment to enhancing digital security and protecting its citizens in an increasingly interconnected world. Through key legislations such as the Computer Crimes Act, Electronic Transactions Act, and the proposed Cyber Security Act, the government aims to combat a range of cyber offenses while promoting trust in electronic communications and transactions. However, as technology continues to evolve and cyber threats become more sophisticated, ongoing updates to these laws and robust capacity building for law enforcement are essential. By fostering a proactive approach to cybersecurity, Sri Lanka can not only safeguard its digital infrastructure but also encourage the growth of its digital economy, ensuring a secure and resilient online environment for all stakeholders. 18 Maureen Iqbal, 'The Role of the Cyber Security Act in Safeguarding National Security: A Critical Analysis' (2020) 15 Sri Lanka Journal of Cyber Law 32. 19 Nuwan Jayasinghe, 'Implications of the Cyber Security Act Draft Bill on Sri Lanka's Digital Economy' (2021)
7 Journal of Information Security and Legal Studies 45.
Bibliography Books Brenner SW, Cybercrime: Criminal Threats from Cyberspace (ABC-CLIO 2010). Clough J, Principles of Cybercrime (2nd edn, Cambridge University Press 2015). Fernando N, The Legal Framework for Cybercrime in Sri Lanka (Lake House 2017). Weerakkody D, Cybercrime Law in Sri Lanka: A Detailed Analysis (Stamford Lake 2019). Journal Articles De Alwis R, ‘Regulating Telecommunications in Sri Lanka: An Analysis of the Telecommunications Act No. 27 of 1996 ’(2008) 14(2) Sri Lanka Journal of Public and International Law 53. Fernando A, ‘Addressing Cybercrime: The Impact of Penal Code (Amendment Act No. 16 of
2006) in Sri Lanka ’(2009) 5(3) Sri Lanka Law Journal 145.
Fernando S, ‘The Efficacy of Sri Lanka's Computer Crimes Act No. 24 of 2007 in Combating Cybercrime ’(2016) 28(2) Sri Lanka Journal of Law 112. Gunaratne K, ‘The Evolution of Cybercrime Legislation in Sri Lanka: A Focus on the Penal Code (Amendment Act No. 16 of 2006) ’(2011) 11(1) Sri Lanka Journal of Criminal Law 95. Iqbal M, ‘The Role of the Cyber Security Act in Safeguarding National Security: A Critical Analysis ’(2020) 15 Sri Lanka Journal of Cyber Law 32. Jayasinghe N, ‘Implications of the Cyber Security Act Draft Bill on Sri Lanka's Digital Economy ’(2021) 7 Journal of Information Security and Legal Studies 45. Perera D, ‘An Overview of the Payment Devices Frauds Act No. 30 of 2006: Legal Challenges and Implementation in Sri Lanka ’(2015) 7(1) Sri Lanka Journal of Banking and Finance Law 85. Perera D, ‘Cyber Piracy and Copyright Protection: An Analysis of the Intellectual Property
Act No. 36 of 2003 in Combating Digital Infringement ’(2013) 8(1) Journal of Information Technology and Law 45. Perera K, ‘Cybercrime Regulation and Challenges in Sri Lanka: A Review of the Computer Crimes Act No. 24 of 2007 ’(2019) 15(1) Colombo Law Review 45. Silva J, ‘Intellectual Property in the Digital Age: Implications of the Intellectual Property Act No. 36 of 2003 on Cybercrime in Sri Lanka ’(2010) 12(2) Sri Lanka Journal of Intellectual Property Law 75. Silva T, ‘The Legal Response to Credit Card Fraud in Sri Lanka: Analysis of the Payment Devices Frauds Act No. 30 of 2006 ’(2017) 12(3) Journal of Commercial Law 110. Wijesinghe P, ‘Telecommunications Regulation in Sri Lanka: Challenges under the Telecommunications Act No. 27 of 1996 ’(2010) 9(1) South Asian Journal of Law and Policy 78.