Sri Lanka is facing an onslaught of online criminal activity, especially a range of scams which prey on an unaware and vulnerable segment of a nation which has only recently jumped onboard the digital bandwagon. Due to a lack of awareness, poor policy-making and lethargy on the part of the enforcement arms of the State, more vulnerable people keep becoming victims of such organised crime operations. However, some of the local law enforcement agencies, who do have legitimate woes about capacity and capability gaps when it comes to dealing with crimes in the digital domain, have begun to call for the empowerment of ill-advised legislation to ‘enable’ them to act regarding cyber-crime, especially online scams.

Recently, the Department of Police has suggested the establishment of the proposed Online Safety Commission (OSC) under the Online Safety Act, No. 9 of 2024 (OSA), arguing that the commission could contribute to reducing online scams. However, civil society in Sri Lanka, especially academics, legal experts, many in the Information Technology field, and those in the media field view that the OSA is fundamentally flawed and is not a suitable legal tool to effectively address online scams. One technology expert who spoke to The Daily Morning on the topic drew a parallel between the proposed Online Safety Commission and George Orwell’s ‘Ministry of Truth’ in his book ‘1984’. Many have been calling for the OSA to be repealed and to be replaced with a better, less ‘vulnerable to be abused’ legislation. However, such calls had fallen off deaf ears during the former administration.

“In George Orwell’s dystopian novel ‘1984’, the Government of the fictional totalitarian State of Oceania has a dubious-named Ministry of Truth, whose real purpose is propaganda and revisionist history. In the just-released Online Safety Bill, the Sri Lankan Government proposes setting up an innocuously-named Online Safety Commission, which will have powers to decide what is true and false for all 22 million Sri Lankans. It would be akin to our own Truth Commission, whose members are appointed by the President,” the expert opined. The law’s list of 14 offences includes lofty aims like protecting children from (online) abuse, outlawing cheating through online scams, and prohibiting revenge pornography. There is broad agreement on the need for better law enforcement to create a safer internet experience, but Sri Lanka already has laws to tackle most of these concerns. “Adding them to this new law seems like a ploy to divert attention from its main purpose: Criminalising what citizens express or share on the web (including but not limited to social media platforms) in the name of countering falsehoods. Indeed, the word ‘false’ is found 23 times in the draft law,” he said, adding that the risk of selective application of the law to suppress legitimate political criticism and dissent: “The law, deciding whether a given piece of information is true or false will be left to five presidentially-appointed persons forming the Online Safety Commission (and in some cases, it will be up to magistrates). But assigning the monopoly over truth to a State entity can seriously undermine freedom of expression, which is guaranteed as a fundamental right in the Constitution [Article 14 (1)(a)]. It is important to note that the Asia Internet Coalition (AIC), commenting that the OSB when it was a Bill, termed it in its current form, ‘unworkable’.”

So, then why do the law enforcement agencies keep on empowering themselves with the provisions of such an Act. Sri Lanka has a history of laws being abused to suppress dissent and criticism. Could it be that the Police are trying to find a ‘comfortable’ piece of legislation, where their actual ‘police work’ can be minimised, while using the Legislature as a tool to ‘append and remand’ suspects for prolonged periods, by meeting a vague and woefully inadequate threshold of evidence? If one were to go by the history of the island's use and abuse of laws over the last three decades, such action by authorities would not seem too far-fetched. Let us hope that such concerns are misplaced.

The tragedy is that, Sri Lanka already has better legal frameworks available, through legal instruments such as the Budapest Convention and the Counter Ransomware Initiative which is led by the United States. Both offer opportunities for technical support and capacity building. It is indeed a shame, that even though Sri Lanka became a signatory to the 2001 Budapest Cybercrime Convention and ratified in May 2015, our nation still has not got our act together, even almost after a decade, the convention entered our legal system.

Irrespective of effective legal mechanisms to combat issues like online scams, the reality is that Sri Lanka needs greater investment in sustained public awareness campaigns to combat online threats effectively. Awareness is key to reducing risk and vulnerabilities. It also acts as a trip-wire for the law enforcement and regulatory bodies to react quickly to new scams. Furthermore, awareness building is low cost, effective and builds resilience. The new Government should  start with such, and strongly consider repealing the OSA.