+65 6221 3009

enquiries@practiceforte.sg

Author: publisher

  • Self-Determination and the Mediator’s Role in a Culture of Harmony

    Self-Determination and the Mediator’s Role in a Culture of Harmony

    This article was published by The Academy of Experts in The Expert & Dispute Resolver [Volume 28, Number 2 (2023)]. Republished with permission.

    English is not the author’s native language and we appreciate the time and effort taken to write the article. It has been published as submitted to reflect the author’s intentions.

    by Keiko Tanaka

    “What do you think?”

    “I understand you disagree with me, so what is your opinion?”

    When I did my first homestay in England as a teenager, I was so perplexed by this kind of question that I was unable to answer. Until then, I had had very little experience of being asked for my opinion by my superiors, such as teachers and people older than me – let alone having my views taken seriously by them. It wasn’t until I studied mediation in London and started to discuss these things with other mediators that I realised the practice of expressing one’s personal opinions was not built into Japanese culture.

    Through my conversations with foreign mediators, I began to notice that Japanese people are not good at self-determination. As I have already explained, when I was young I was rarely asked for my opinion and I would probably not have been able to express an opinion if it differed from that of my superiors. I grew up in a culture that placed the highest priority on harmony, both at home and at school. If you were not aligned with others you were expected to gauge the situation and adjust your opinions in order not to stand out. In Japanese, there is an expression “wound up ona long thing” which translates roughly to “if you can’t beat ‘em, join ‘em”. From a young age, children are expected to read the atmosphere and blend in.

    So how do groups make decisions? In the business world there is a culture of “nemawashi”, or “behind-the-scenes negotiations”. As mentioned above, expressing a divergent Opinion in public is seen as bad-manners, even shameful. Japanese people fear that expressing their personal opinion may cause someone (worst of all their boss) to lose face, or it may destroy the mood in the room.

    As a result, before holding a meeting the person in charge will usually speak individually with each participant and any other stakeholders, to coordinate views as a whole before the meeting begins. So when it comes to the actual meeting, there are unlikely to be any dissenting opinions, and it will feel as if everyone is in perfect agreement.

    What about in schools, homes and other settings? The balance of power is a major factor. Powerful, assertive people usually have the upper hand. If you are lower status you are not expected to express a personal opinion. Your role is to gauge the attitudes of your superiors – parents, teachers, more senior students etc.

    Traditionally anyone in Japan who is unable to adapt to this consensus-building culture is branded as someone who cannot read the air, and is treated as an outsider or weirdo. These days, outside of business, the pressure to read the air and align with others is becoming a problem in school and social life.

    In the business world there is growing dissatisfaction with the traditional consensus-building culture. Japan is undergoing big changes such as the diversification of the workforce, erosion of the tradition of lifetime employment (i.e. working in the same company from graduation to retirement), and the emergence of new styles of working among young people. To deal with these developments, facilitators are being brought in to manage meetings, and supervisors and leaders are being taught how to give coaching. In this era of internationalisation and diversification, Japan’s traditional “nemawashi” culture is starting to change. We are beginning to think about how to incorporate diverse opinions to reach mutual agreement. And at the same time the practice of “nemawashi” is being introduced abroad.

    1 Characteristics of the Japanese language

    Status is built into the Japanese language. As a lower status person, you are expected to choose words that convey to higher status people that you see yourself as lower status than them, and express your respect for them. Another important characteristic of the Japanese language is that you do not explicitly negate someone else’s opinion.

    In my last article I wrote that in Japanese the verb comes at the end of the sentence, so when you finally hear it, the sentence may turn out to mean completely the opposite to what you were expecting. Because of this we need to read the intentions of the speaker during the earlier part of the sentence (subject, complement, adjectives, nouns) and gather non-verbal information from their facial expressions and voice. This is required not only by the mediators but also by the parties. On top of this, it is also sometimes necessary to choose different verbs in order to show respect.

    Answering tag questions

    Consider the question:

    “ You did not say XYZ, did you?”

    This kind of “tag question” is an example of why it is so difficult for Japanese people to learn English, and for English speakers to learn Japanese.

    If you were to answer a tag question like this, in English you would either answer: “Yes, I did say XYZ” or “No, I did not say XYZ”. In Japanese, your answer would be either “Yes, I did not say XYZ” or “No, I did say XYZ”. In other words Yes and No are used in entirely the opposite way in Japanese.

    I suspect this stems from a culture of not wanting to negate the speaker right at the beginning of your sentence. If your sentence contains a negative expression, you want to start the sentence with something positive that sends out the message “you are right”, before moving on to the negative expression.

    If you were to start the sentence with “No” it would sound doubly negative.

    If a mediator uses this kind of tag question, and a Japanese party answers only with Yes or No, without including the rest of the sentence, precisely the opposite meaning will be conveyed, which could lead to major misunderstanding.

    Respectful and humble words

    Respectful words are used in everyday speech to express respect for the other person through the choice of verb. This is a way to lower yourself and show that you consider the other person as superior. It is part of social etiquette to choose the verb based on the situation.

    Students at the outset of their education and employees at the outset of their career will receive training in how to choose their words, for instance when answering phone calls or meeting people for the first time. This skill is required in order to express yourself without causing others to lose face.

    The same goes for mediators, who need to choose the right honorific and humble terms to convey trust and respect between the parties involved. This is a major difference between English and Japanese mediation. When a mediator, acting as an interpreter, translates what one party is saying in English into Japanese they will have to choose their verbs with great care, to avoid giving the wrong nuance and causing offence.

    Singular and plural in spoken Japanese

    In my previous article, I wrote that in Japanese we do not address the person we are speaking to as “you”. Another interesting difference is that in English “you” is extremely neutral – it can be used for singular or plural and for any gender and relationship. In Japanese, it is very difficult to express “you” in the second person plural, and it is impolite to begin a spoken sentence with the word “you”. As a result certain sentences, when translated from English into Japanese become rather distant, third-person expressions. Once you also factor in honorifics and suffixes it creates even more distance and hierarchy in the relationship with the other person.

    Let’s look at some sentences that begin with “you” to see how they differ in English and Japanese.

    Suppose as a mediator you want to reflect back what one party (Ms. A) has just said. In English it might sound like this:

    Ms. A, you are saying that you are worried about your relationship with (NB no possessive case ) husband, and at the same time, you both need to think about (NB no possessive case ) children’s best interests.

    As a mediator if you translate this into Japanese you wouldn’t address the party as “you”. It may give the impression that you look down on them, which could make them feel uncomfortable and undermine the relationship of trust that you want to achieve as a mediator.

    If I were to translate such a sentence into Japanese I would say the Japanese equivalent of:

    What Ms. A is saying is that Ms. A is worried about her relationship with (NB no possessive case ) husband, and at the same time, Ms. A thinks it is necessary (NB no subject!) to think about the childrens best interests.

    As I mentioned earlier, it is not only second-person expressions that are difficult to translate, but also third-person. This is because in Japanese the subject of the verb is not stated, but has to be guessed from the context.

    What about the plural form? Consider the case where a mediator wants to talk about both parties’ issues at the same time.

    In English they might say, for example:

    “Mr. A and Ms. B, both of you are talking about family finance, custody, and visitation.”

    When I try to translate this into Japanese, I would say the Japanese equivalent of:

    “Both Mr. A’ and Ms. B’s statements are about family finance, custody, and visitation.”

    Or

    “Both Mr. A and Ms.B are talking about family finance, custody, and visitation. ”

    In other words the second person plural “you” becomes third person. Thus, in the Japanese language the verb is changed in order to express respect for the other person. And when you want to repeat the story of the person in front of you, you use the third person instead of the second person in order not to sound rude.

    So when we mediate in Japanese, the subject ends up as third person – either singular or plural. If an English mediator listened to a direct Japanese interpretation, it would feel as if the nuance of speaking to one person as opposed to two people is lost. To the ear of a native English speaker, it can sound cold and impersonal, like a news broadcast.

    Meanwhile if you directly translate the words of an English mediator into Japanese, it will begin with the word “you”, and the wording will be direct, which will feel jarring to a Japanese person, and may make it difficult for them to respond or express an alternative opinion.

    If the interpreter and the mediator are different people, and if they are unaware of the difference nuances involved, it could have a negative impact on the outcome of mediation. If the mediator is also acting as interpreter, they will need a great deal more ingenuity than a normal interpreter, and the pressure on them will be far greater than on a regular mediator.

    3 The concept of family, social context and self-determination

    (1) The individual in relation to the family

    As mentioned above, the Japanese language does not make a clear distinction between oneself and others. This system of deliberately making the subject vague has been part of our culture for nearly 2000 years, and is a way of preserving harmony.

    Recently, while walking around town, I noticed some tombstones. In Japan the name engraved on tombstones is the family name. For example, on my family tombstone it says “Tanaka Family”. Several members of the family will be buried in the same grave. The oldest son of the family inherits the tomb. In fact, there is a category of family court mediation called “ritual succession”. The issue of who takes over responsibility for graves is so important that it is a separate category of mediation. For traditional weddings and other important occasions, the invitations and sign posting at the venue will state the names of the two families, such as “Tanaka Family and Yamamoto Family,” instead of the names of the individuals.

    My experience of overseas mediation training and international couple mediation has made me think about the role of the individual in the context of Japanese culture. I feel that in Japanese culture we have been educated to prioritise others, to be in harmony with our surroundings, and to avoid putting ourselves in the forefront.

     Of course, times have changed and we are now less constrained by traditional thinking than before. School education has also begun to incorporate new communication styles and to teach debating skills including how to express one’s opinions. Nevertheless in some parts of society, especially in the countryside, the traditional culture is still very much alive, and it will take time for it to change. With the current mix of old and new cultures, the traditional balance of power has been disrupted and often it is frankly very difficult to decide how to act.

    (2) The process of expressing one’s opinion and self-determination

    Mediation, with its emphasis on self-determination, is a Copernican concept for us Japanese. Having a mediator who supports you to listen carefully to your own story and to the other person’s story and then draw your own conclusions – this is an unusual experience for us. I believe it will be a major force in driving Japanese culture forward.

    We are not used to self-determination and expressing our own opinions. For this reason it may take longer for Japanese people to express their opinions and make their own decisions, compared to people from other cultures. I think that the Japanese language reinforces the culture of maintaining harmony by not making the subject matter explicit.

    I have realised through my practice that it is necessary to be very mindful of such cultural differences when mediating cases involving international relations. In this sense, case intake and case management are very important. This time is a chance for the mediator to prepare the parties for the joint meeting where they will be invited to express their views in front of others and make their own decisions.

    4 Summary

    Perhaps we Japanese, with our thorough training in preserving harmony, are good at reading each other’s feelings and the general atmosphere. However we are not good at verbalising and expressing, including the linguistic context. Japanese mediators must do their best to support their clients within the cultural context. And I hope you, after reading this article, will remember to bear this in mind when you mediate Japanese parties.

    25 years have passed since I started studying mediation in England. Every day, as a Japanese person, I learn more about foreign mediation, with the support of foreign mediator friends. I am always asking myself how I can help foreign mediators adapt to Japanese culture.

    The longer I work as a mediator, the more I feel that there is no conflict resolution method more suited to Japanese culture than mediation. This is because in mediation both parties influence the outcome, and the process invites you to think about and respect the other person. In this sense mediation is entirely in line with the Japanese concept of harmony.

  • Mediation in the Context of Japanese Ideology and Language

    Mediation in the Context of Japanese Ideology and Language

    This article was first published by The Academy of Experts in The Expert & Dispute Resolver [Volume 28, Number 1 (2023)]. Reproduced with permission.

    English is not the author’s native language and we appreciate the time and effort taken to write the article. It has been published as submitted to reflect the author’s intentions.

    by PracticeForte advisory affiliate Keiko Tanaka

    When you think of Japanese culture, what comes to mind? Samurai? Tea ceremony? Stone gardens? The visible culture of Japan may be easy to imagine, but what about its ideological and linguistic culture? In this article I would like to consider Japanese culture from this less common perspective.

    1 Harmony

    Mediation as an institution was first introduced to Japan shortly before the judicial reform of 2000. As Japan reconsidered its judicial system, mediation began to receive attention for the first time.

    Japan already had a system of discussion and consultation which dates back to 1232 and the enactment of the Goseibai Shikimoku law. This law established a system whereby disputes could be discussed in consultation with the authorities of the time. However it was not until 1875 that conciliation was institutionalised in the judiciary – when the samurai era had come to an end and the influence of Western culture began to be felt in Japan.

    In Japan there is a saying: ‘ Harmony is to be valued “ It was written by Prince Shotoku (574-627 AD) in the first article of the Constitution of Japan (AC 604). It is taken to mean: ‘Above all, do not fight, for harmony is the most important thing’. Through his constitution, Prince Shotoku set the cultural norms for Japanese nobility and bureaucracy, and established the Buddhist idea of ‘wa’ (harmony) as the basis of Japanese politics.

    This ‘wa’ is of great significance to the Japanese. Many people have a tendency to avoid conflict. The culture of avoiding conflict can lead to avoiding discussion altogether. There is an expression ‘kuki wo yomu’ (reading the air). Japanese people are expected to sense the other person’s feelings and try to understand them without relying on words. This idea that Japanese people all understand one another is also related to the fact that Japan is an island nation, and was closed off from the rest of the world from 1639 to 1854 due to ‘sakoku’, the national isolation policy.

    Because of this emphasis on harmony, and the belief that we can understand one another without words, conflict is rarely expressed openly. We tend to bottle things up inside. Because people do not express their opinions openly, it is easy to assume that people around you think the same way as you. Moreover, it is considered shameful to speak to outsiders, including mediators, about one’s relationship problems, whether with family members or at work. And it is highly embarrassing, and bad for one’s appearance, to tell outsiders anything that might shame one’s relatives.

    The culture | have described – of not expressing opinions openly, not sharing one’s feelings or circumstances with others, and reading other people’s minds and body language – is still alive today. It remains the prevailing way of thinking, especially outside the capital.

    2 Self-determination

    The culture I have described above presents some challenges for applying the principle of self-determination in mediation. The tendency of not expressing one’s thoughts openly and reading the atmosphere of people around one is not just seen in mediations and major life decisions – it is also seen in daily life. For instance when going out for a meal with work colleagues, there is an unspoken rule that you can only say what you want to eat once the boss has chosen and it’s generally safest to order the same thing as the boss. Knowing this, some old-fashioned bosses won’t even bother to ask people what they want to eat, but place an order on everyone’s behalf. Nowadays this is changing, especially in the cities. But where hierarchical relationships remain strong, it is often still the case.

    So what does self-determination mean in the context of Japanese mediation? | believe parties in Japan can acquire self-determination, but gradually, over the long process of mediation. At the outset of a mediation the parties have only just decided they want to have a conversation, and they’ve only just become aware of mediation and figured out how to access it. At this stage their ability to demonstrate self-determination is likely to be low. But little by little, as the process unfolds, it can change. Over the course of a long struggle they can learn to think for themselves and come to their own conclusions.

    As a foreign mediator, when dealing with Japanese clients (excluding lawyers), if you keep in mind these cultural characteristics and allow more time than usual for the mediation, you will hopefully have a more successful and satisfying experience.

    3 Language

    (1) Forms of address

    There are three systems of notation for writing in Japanese: hiragana (which conveys Japanese language and content), kanji (Chinese characters), and katakana (used mainly for words from foreign countries). So if for example we see a word written in katakana, we know that it is either a foreign word or a modern word.

    Spoken language is even more complex. In Japan we have ‘keigo’, a different way of speaking to people who are superior in status. You can speak in such a way as to raise the status of the other person or put yourself down, depending on the context. For example, although you would use the same word to address your mother or mother-in-law, the form of verb you use will differ. Given their superior status, parents (whether in-laws or not) are rarely referred to by their name, but rather by the word that describes their position in the family. Moreover family designations vary depending on who is speaking. Younger siblings address their older siblings not by name, but as ‘elder brother’ or ‘elder sister’. For example my younger sister calls me ‘elder sister’, and not Keiko, whilst I and other members of the family call her by her name because she is the youngest in the family. For this reason, if a foreign mediator addresses their client by their first name it might be taken badly.

    Another cultural consideration is the use of the word ‘you’. In Japan you should only address someone as ‘you’ if you have higher status, if you are an older person speaking to a close relation, or if your job gives you authority, for instance a government official. Otherwise, it may appear rude.

    Given all these considerations, in Japan it is necessary to take time to confirm at the outset of a relationship how you are going to address one another. This is particularly true in the case of mediations.

    (2) Word order

    If you want to translate the English expression “I can’t get along with him anymore” into Japanese, the word order will be “I him get along with can’t”. In other words, the order is subject, object, verb and auxiliary verb. Through my experience in international mediation cases, I feel that we Japanese have a habit of registering the subject and object as soon as they are spoken, then looking at the speaker’s facial expression and behaviour and guessing the verb and auxiliary verb. Sometimes, of course, we guess wrongly. When you finally hear the last word it can come as a pleasant surprise, or as a disappointment, especially if the sentence is long.

    As a foreign mediator working with a simultaneous interpreter, you should be aware that when you get to the end of a sentence the meaning may be completely the opposite of what you were expecting.

    The same applies with questions. For example, the English question “What did you feel at that time?” would in Japanese be “You at that time felt what?” or “You at that time what felt?”. The question and verb come at the end. The client, who is listening to the Japanese translation, does not know what the mediator wants to ask until the end of the question, so there is a gap during which his or her imagination can roam wild. If it is a long sentence, this gap is even longer. Hearing the first few words of the interpretation, the client starts thinking about how to answer the question, but when the interpreter reaches the end, the client may discover that the question was not at all what they were expecting. They need to reorganise their thoughts completely. This can be very disorienting for the client.

    The same can be said of summaries, which mediators use to play back the client’s story. The longer the mediator talks, the longer the client has to imagine things in his or her head before the verb finally arrives. For these reasons, when communicating through a Japanese interpreter it is worth trying to keep your sentences as short as possible.

    4 Non-verbal communication

    In Japan we place a lot of importance on non-verbal aspects of communication. The nature of our language and history have led Japanese people to pay close attention to the facial expressions and gestures of people around us when we communicate. As a mediator, in order to build good understanding and ensure a satisfying mediation, you will also need to pay attention to these non-verbal aspects, consider how they relate to self-determination, and figure out how best to support the parties in the light of them.

    Conclusion

    In this article I have considered mediation in the context of Japanese culture, based on my personal experience as opposed to objective data.

    Editor’s Note

    You may not be a Mediator or be particularly interested in Japanese culture, however, this article has a much wider value. In addition to the fascinating hidden culture, it has valuable insights for Mediators and Experts (and lawyers) into the importance of language both verbal and unspoken as well as pre-conditioned and not visible attitudes.

  • Risk of Using Generative AI in Legal Practice

    Risk of Using Generative AI in Legal Practice

    by Lim Seng Siew, director OTP Law Corporation. Accredited Specialist in Data and Digital Economy Law by SAL.

    In preparing for an article on OTP Law’s website (reproduced on this website) about material adverse change clauses, I made use of a generative AI engine (used on 28 Apr 2023) and asked it for “Cases on material adverse change clauses in Singapore courts.”. This was the answer it gave me:

    Answer:

    In Singapore, material adverse change (MAC) clauses are commonly used in commercial contracts to allow parties to terminate or renegotiate the terms of the contract if certain events occur that materially affect the value or viability of the transaction. However, the application and interpretation of MAC clauses in Singapore can be complex and fact-specific, and there have been a limited number of cases on the issue.

    One notable case is China Machine New Energy Corp v Jaguar Energy Guatemala LLC [2013] SGHC 186, where the Singapore High Court considered a dispute arising from a power purchase agreement between the parties. The agreement contained a MAC clause that allowed the buyer to terminate the agreement if there was a material adverse change in the seller’s financial condition. The court held that the buyer had not established that there was a MAC and that the seller had not breached the agreement. The court also noted that the burden of proof was on the party seeking to rely on the MAC clause, and that the clause should be narrowly construed.

    Another case is BNA v BNB [2015] SGHC 110, where the Singapore High Court considered a dispute arising from a share purchase agreement. The agreement contained a MAC clause that allowed the buyer to terminate the agreement if there was a material adverse effect on the target company’s business, operations, assets or financial condition. The court held that the buyer had not established that there was a MAC and that the seller had not breached the agreement. The court also noted that the MAC clause should be interpreted in the context of the entire agreement and the commercial objectives of the parties.

    Overall, these cases suggest that Singapore courts will approach the interpretation and application of MAC clauses on a case-by-case basis and will require a high standard of proof before allowing a party to rely on such a clause to terminate a contract.

    This sound great, easy to read and understand. What is there not to like about it? Except that the cases don’t exist! It is not that the case names or the citations don’t exist. They do but are wrong. The citation for China Machine New Energy Corp v Jaguar Energy Guatemala LLC is not [2013] SGHC 186. It’s another citation. And citation [2013] SGHC 186 is of another case. And, to make it worse, either is about material adverse change clauses. This was a similar situation with the second case cited, BNA v BNB [2015] SGHC 110.

    So what is going on here? The short lay-persons answer is that the AI lied. But AIs don’t lie. All they do is trawl the internet for information (ie. the large language model) and then compile the information in a coherent manner that people understand. So how in that compilation process, the AI put together information that may not be related to one another together in a coherent readable form. To a reader, they appear as the truth. Data scientists don’t fully understand what is going on yet but called this phenomenon ‘hallucination’.

    How do we avoid this? By asking the right question.

    This reminds me of the sci-fi series, “The Hitchhiker’s Guide to the Galaxy.” The Ultimate Question was asked of the supercomputer “Deep Thought”: What is the answer to Life, the Universe, and Everything? After many years of computing, the answer was “42”. It was pointed out by Deep Thought that the question was wrong. Thus the non-sensical answer.

    A ‘profession’ has now grown around generative IA to learn how to ask the right questions, ‘prompt engineering’. The combination of prompt engineering, domain knowledge (the human is still needed in the chain), high quality data, and AI models trained on research frameworks will birth a new scientific approach: Iterative Sciences.

    As to using generative AI for legal work, thankfully as the preceding paragraph makes clear, the human is still need to provide the domain knowledge of law. The human with that domain knowledge needs to read what is generated by the AI for accuracy. Using the answer to my query above, of the four paragraphs generated by the AI, only two were useable (of sorts): the first and last paragraphs, ie. the two shortest paragraphs that contain well-written motherhood statements. Not sure how useful they are actually. In fact, my article on material adverse change clauses used nothing generated by the AI. So, I am happy to report that for the moment, we are safe.

  • The Material Adverse Change (or MAC) Clause

    Despite their popularity, it is widely accepted that a material adverse change (MAC), also known as a material adverse effect (MAE) condition, is notoriously difficult to trigger. A situation not contemplated might have occurred or a contemplated situation might have a lesser adverse impact than anticipated and therefore the clause is not triggered.  One party might want wider conditions while, unsurprisingly, the other party would want narrower ones. However, before we delve into the issues, we need to know what is a material adverse change clause.

    What is a Material Adverse Change Clause?

    A material adverse change (or MAC) clause is common in M&A and financing contracts. Its purpose is to give one party the right to modify or terminate the deal or contract if there is an adverse change in the business that is material to the deal or contract. Not every change is adverse to all parties and for sure not every adverse change will have a material impact on the deal from the point of view of every party.

    Therefore it is up to the parties to negotiate and define as clearly as possible what such a material adverse event is and its consequences to the deal. If the MAC event occurs between the signing and closing of the deal, it may result in the termination and unwinding of the deal. If it occurs after the closing but there are still obligations for one party to fulfill (as an example during earn-out periods), it may result in some or all of the obligations being waived. It may also provide for compensation or damages being paid by one party to the other. In financing arrangements, the MAC clause may result in repayment of the loan.

    MAC clauses often come into focus in the aftermath of significant events that affect the economy, either generally or in a specific industry. Events such as 9-11, global financial crises, and the recent Covid-19 pandemic saw a discernible increase in acquirers trying to invoke MAC clauses to terminate a deal.

    What a MAC clause contains will vary from transaction to transaction and jurisdiction to jurisdiction. In some countries, there might be a ‘market practice’ on how such clauses are usually drafted. But parties must bear in mind that notwithstanding market practices, you can negotiate something else that suits the circumstances of a deal.

    MAC Clauses in ‘Private Transactions’

    In private deals (and even in some deals involving listed or regulated entities), a MAC clause may take the form of either a condition precedent or a condition subsequent to completion. It can also be a warranty that there is no MAC as of a specified date. As a warranty, some acquirers will negotiate that the warranty is repeated at completion to avail of its effect to abort a deal. Sellers of course will resist.

    From an acquirer’s perspective, MAC clauses should attempt to set out every issue or event that is material to an acquirer and to set out the reasons why that is so, especially if it is not clear on the face of that issue why it is material to the acquirer. It should also set out an objective threshold, where possible, to determine materiality. In rare situations, materiality may be left to the acquirer to determine at its discretion. MAC clauses often have carve-outs, that is situations when the MAC clause would not apply. Sometimes there is a third layer, exceptions to the carve-out. Such 3-layer MAC clauses are a common structure used in ‘American’ style or drafted agreements. Parties should also consider if the MAC clause can only be invoked when a material adverse change has occurred or that it can be forward-looking and allow the MAC clause to be invoked in anticipation of such a material adverse change.

    A good illustration of the ‘3 layers’ MAC clause is the English case of Travelport Limited v WEX Inc [2020] EWHC 2670 (Comm).  The case concerned the interpretation of a MAC clause in a share purchase agreement wherein WEX Inc (“WEX”) agreed to purchase 100% of two companies, eNett International (Jersey) Limited (“eNett”) and Optal Limited (“Optal”) from Travelport Limited (“Travelport”). WEX attempted to use the MAC clause to abort the deal because of the Covid-19 pandemic.

    The MAC (or MAE in this case) clause stated:

    “Since the date of this Agreement there shall not have been any Material Adverse Effect and no event, change, development, state of facts or effect shall have occurred that would reasonably be expected to have a Material Adverse Effect.”

    “Material Adverse Effect” was defined in the agreement as:

    “any event, change, development, state of facts or effect that, individually or in the aggregate,

    (x) has had and continues to have a material adverse effect on the business, condition (financial or otherwise) or results of operations of [the eNett Group], taken as a whole, or of [the Optal Group], taken as a whole…or

    (y) would prevent or materially delay the consummation of the transactions contemplated by this Agreement”.

    The relevant carve-out is a proviso to the above clause (x) and states:

    “…provided that, solely for purposes of clause (x), no such event, change, development, state of facts or effect resulting, arising from or in connection with any of the following matters shall be deemed, either alone or in combination, to constitute or contribute to, or be taken into account in determining whether there has been or will be, a Material Adverse Effect:

    a) the general conditions and trends in the industries or businesses in which [eNett], [Optal] or any of their respective Subsidiaries operates, including competition in any of the geographic or product areas in which [eNett], [Optal] or any of their respective Subsidiaries operates …

    b) general economic conditions, financial conditions or capital market conditions (including interest rates, exchange rates and credit markets);

    c) conditions resulting from the commencement, occurrence, continuation or intensification of any act of civil unrest, war (whether or not declared), terrorism or sabotage (including cyberattack), armed hostilities, military attacks or declaration of national emergency;

    d) changes (or proposed changes) in Tax, regulatory or political conditions (including as a result of the negotiations or outcome with respect to Brexit) or Law, IFRS EU or IFRS IASB (or, in each case, any authoritative interpretations thereof or the enforcement thereof);

    e) conditions resulting from any natural or manmade disasters, hurricanes, floods, tornados, pandemics, tsunamis, earthquakes, acts of God or other weather-related or natural conditions…“

    And the exception to the carve-out is:

    “provided, further that any event, change, development or effect referred to in clause (a), (b), (c) or (e) may be taken into account in determining whether there has been a Material Adverse Effect to the extent, and solely to the extent, such event, change, development, state of facts or effect has a disproportionate effect on [the eNett Group], taken as a whole, or on [the Optal Group], taken as a whole, as compared to participants in the industries in which [eNett], [Optal] or their respective Subsidiaries operate.”

    The effect of the MAC clause, in the words of the Judge, is that  “[f]or present purposes all of this complicated structure produces this result: that if conditions resulting from the Pandemic cause a disproportionate effect on either of the eNett or Optal Groups, each taken as a whole, as compared to other participants in the industries in which either of eNett or Optal (or their respective subsidiaries) operate, such conditions fall within the Carve-Out Exception.”

    It important to bear in mind that the agreement was dated 24 Jan 2020, just days before WHO declared the Covid-19 outbreak as “a public health emergency of international concern” on 30 Jan 2020 and almost two months before Covid-19 was classified by WHO as a worldwide pandemic on 11 March 2020.

    It was not necessary for the judge to decide if WEX had properly invoked the MAC clause as the judgment was about a trial of preliminary issues. I cannot find anything as to what happened at the full trial or even if the full trial took place. All I can find is that the parties had entered into a deed of settlement and the deal was completed on 15 Dec 2020.

    MAC Clauses in Takeovers of Publicly Listed Companies

    The use of MAC clauses in takeovers of listed entities in some jurisdictions is regulated by the relevant authorities.

    As an example, the Australian Securities & Investments Commission in its Sep 2022 update stated that it expects MAC conditions to have objective and quantifiable standards by which the parties to a transaction can determine whether the material adverse change has occurred. The MAC condition cannot be subjective or semi-subjective.

    Unquantified MAC clauses are common in commercial drafting. Commercial parties and their legal advisors have for decades viewed such clauses as applying an objective test, and the suggestion in Australia that they need to be quantitatively defined as well has surprised the market. It would be a shame if other regulators follow Australia and unquantified MAC conditions can no longer be used as a key risk management device.

    In another example, the City Code of Takeovers and Mergers of UK provides that for a bidder to invoke a MAC clause so as to cause a bid to lapse, the condition must not be subject to the subjective judgment of the directors of the bidder, nor should satisfaction of the condition be in the bidder’s hands. Further, the circumstances that give rise to the right to invoke the condition must be of material significance to the bidder in the context of the offer.

    What Should Go Into a MAC Clause in an M&A Deal?

    First and foremost, the considerations of an acquirer and of the seller are very different in an M&A deal. So let us start with considerations of the acquirer.

    For Acquirer

    If the acquirer is obtaining financing for the deal, make sure that the conditions align with the financing documents. You definitely don’t want to be caught in a situation where your financier can back out but you can’t.

    Other considerations for an acquirer include:

    • Whether to have a general MAC clause (usually strongly resisted by the seller with good reasons) or whether to have the clause cover specified concerns that the acquirer may have. Even if the seller agrees to a general MAC clause, an acquirer will still need to carefully craft what constitutes a MAC since courts generally interpret MAC clauses narrowly. The general MAC clause should also be looked at in the context of the agreement as a whole since the courts will interpret the intentions of the parties by looking at the documents as a whole.
    • If the seller successfully negotiates ‘general markets events’ as being an exception to what constitutes a MAC, the acquirer should consider incorporating wordings that would still trigger the MAC clause if: (i) the target company is affected comparatively worse when compared to other companies in its industry or (ii) the industry in which the target company operates is disproportionately affected when compared to other industries.
    • Look for what other protections that are available to the acquirer. As examples, obtain undertakings from the seller to run the target company ‘in the usual course of business’ in the period leading up to completion or negotiate for the warranties to be repeated at the completion of the transaction.
    • As stated earlier in the article, see if you can include forward-looking triggers of a MAC clause with words like “… events that are reasonably expected to have a material adverse effect on earnings …”.
    • If you need to specify events, other than the usual ones concerning the financial performance of the target company, consider adding one regarding the departure of key personnel or events that would impair the acquirer’s ability to complete the deal (eg no financing).
    • If your MAC clause has both general provisions and specific events, bear in mind that a court will likely interpret the specific events in the MAC clause as exclusive and exhaustive, thus giving little or no effect to the general provisions.

    For Seller

    The starting position is to resist any MAC clause although this will often be viewed by any acquirer as unreasonable and has the potential to scuttle a deal. As a seller, you must have clear and cogent reasons for this stance. However, from a negotiator’s standpoint, it could make subsequent negotiations for limited and clearly defined MAC clauses easier. You can also try negotiating for a sunset to the MAC clause if the closing of the deal is delayed by the acquirer. After all, if the deal had been completed on the scheduled date, any risk of a MAC would have passed to the acquirer.

    Conversely, if the seller is responsible for the delay in completion, the seller should try to minimise the period at which it may be at risk.

    If the seller accepts the inclusion of a MAC clause, try to negotiate for ‘general market events’ exceptions and for ‘matters disclosed to or within the knowledge of the acquirer’ exceptions. Existing events should also be an exception to a MAC clause.

    Also, look for objective criteria to determine what is material. Usually, parties resort to measurable financial parameters. This may mean, for example, that the valuation, the turnover, EBITDA, etc. of the target company declines by a number of percentage points. Bear in mind that often such financial parameters may not be available on a monthly basis or that the changes may be temporary. Acquirers often want a subjective criterion, that is, they make the determination. A possible but more expensive compromise is to have a third party make that determination.

    Interpretation of MAC Clauses by Courts

    MAC clauses in share sale agreements will be interpreted in accordance with general principles of law. A court, when interpreting any clause of any contract will first look to the words in the contract to determine the parties’ intention. If this still gives rise to ambiguity, the court will then look at the surrounding circumstances to determine that intention. Once a court has interpreted the meaning of the provision, it will then make a factual determination on whether a material adverse change, within the meaning of the provision, has occurred.

    The determination of materiality is an objective one and not what one or the other party believes to be material. Materiality must be assessed at the relevant time, usually when one party asserts that a material adverse change has occurred. It is for the party asserting material adverse change to prove it and courts have said that this is a very high threshold. Therefore the claimant is likely to face a difficult uphill task.

    Some additional points to note from another English case, Grupo Hotelero Urvasco v Carey Value Added [2013] EWHC 1039 (Comm):

    • A change is only material if it significantly affects the company’s ability to perform its obligations under the relevant agreement.
    • A change is not material if it is merely temporary.
    • The party invoking the MAC clause cannot do so on the basis of circumstances of which it was aware at the time of the agreement.
    • Where the MAC clause relates to a company’s financial condition, this is to be determined primarily by reference to its financial information, which may include interim financial information and/or management accounts.
    • Financial information does not, therefore, encompass other matters such as the company’s prospects or external economic or market changes.
    • However, an inquiry is not necessarily limited to the company’s financial information if there is compelling evidence to show that a material adverse change has occurred.

    There is also a Singapore High Court decision, Downeredi Works Pte Ltd v Holcim (Singapore) Pte Ltd [2009] 1 SLR(R) 1070, interpreting the term “material” to mean “significant” in the context of a MAC clause.

    Similar Type Clauses

    Similar to MAC clauses are hardship clauses and force majeure clauses.  Hardship clauses and force majeure clauses aim to regulate the contractual relationship in cases of abnormal and unforeseeable circumstances occurring after the entry into force of the agreement. Hardship clauses usually achieve this by providing for renegotiation of the contractual terms and conditions. Force majeure clauses often provide for pre-determined consequences, including termination, if such circumstances arise.

    Although the clauses have some similarities, the main distinction between such clauses and MAC clauses lies in their scope. Hardship clauses are directed at the performance of the contract. As an example in supply contracts, changes in certain circumstances trigger a renegotiation of supply volumes, prices and/or schedules.  The MAC clause on the other hand concerns a one-off transaction like in an acquisition or in financing.  Further, the consequences are also different. The MAC clause usually results in the termination of the arrangement or some part of the arrangement although on a practical level, parties usually enter into negotiations to see if the deal can be saved before triggering the MAC clause.

    Final Points

    It should be clear from the above that drafting MAC clauses that are effective is no simple task. Sellers and acquirers are almost diametrically opposite when it comes to MAC clauses. The end result after much ‘to-and-fro’ negotiation may be confusing and complicated. It is a task that even seasoned lawyers find daunting. Thus getting good and proper representation is important. The skill set required for your professional advisors should include negotiation skills, good drafting skills along with a sound understanding of the commercial drivers for the deal and of course, of the law.

    If you need to know more how OTP Law Corporation can help with your deal, contact us.

  • Term Sheets, Memoranda of Understanding and Letters of Intent – Same Same or Different?

    In the initial stages of a deal, you may be asked to sign a ‘non-binding’ document that sets out the key parameters for the negotiation. That document is called by many different names: a term sheet or a memorandum of understanding (MOU) or a letter of intent (LOI) or numerous other names.

    Some experts claim that the documents described by each of these terms are different. However, to me, a rose by any other name is still a rose. While by convention or practice, the description used for the same type of ‘non-binding’ document is different for different types of transactions, the terms are very often used interchangeably such that the name is not important. A term sheet is often the description used for the non-binding document in M&A or financing deals while MOU or LOI is used to describe the non-binding document in other commercial transactions. But do not be surprised if you find MOUs being used in M&A deals or term sheets being used in distributorship negotiations.

    What is important is to make sure you understand what are the parameters set out in the document, whether it is binding or non-binding, and if binding, which parts are binding. For this article, the term “MOU” will be used to describe such documents generally.

    Purpose of the MOU

    Often, while negotiating deals, it is important to set out the broad areas of agreement or the boundaries of negotiation. However, parties may not want binding agreements, either because some of the terms may require the approval of upper management or have to be cleared by their lawyers. So they draft and sign a non-binding MOU. Its language is often non-legalistic and anticipates that binding definitive agreements will be signed later.

    In general, the MOU will provide:

    (a) A framework for the parties to negotiate a final contract.

    (b) A record of key terms agreed on.

    (c) Details of the fundamental commercial arrangement or commitment reached.

    (d) A mechanism for dealing with pre-contractual issues such as exclusivity, confidentiality, due diligence and/or intellectual property.

    (e) A degree of comfort to the parties that a deal is possible, ie no deal beaker issues, before they incur further expenses.

    The signed MOU can also be used as a basis to seek funding for the deal from third parties subject of course to any binding confidentiality obligations. It will also form the basis for parties’ professionals like their accountants and lawyers to prepare the required accounting and legal documentation.

    Is an MOU binding?

    Many people assume that an MOU is not legally binding. After all, it is only an ‘understanding’ and not a contract. Unfortunately, that is not always the case. In certain circumstances, an MOU or parts of it can be binding. The two key questions to determine if the MOU (or some parts) is or is not binding are:

    (a) Did the parties intend to be bound by all or certain obligations set out in the MOU? A court would first examine the content of the MOU to make this determination. Therefore, to avoid uncertainty, the MOU should have clear statements as to whether the parties intend for the MOU to be or not to be binding, and if binding, which parts are binding.

    (b) Is the MOU sufficiently clear and certain to be legally binding? A court will not ‘fill in the blanks’ in an MOU for the parties. A court also will not interpret obligations that are not clear. As an example, “obligations on the usual terms” or “sold at a fair price” are generally unenforceable unless there is a custom of trade where the phrases “usual terms’ or “fair price” is determinable.

    What to Look Out for in an MOU?

    When negotiating a commercial deal and one party suggests using an MOU, it is important to consider the following:

    (a) Do you really need an MOU? If you only need to deal with confidentiality or to require parties to not negotiate with other parties while negotiating this deal, would a non-disclosure agreement or an exclusive negotiation (or lock-out) agreement suffice? After all, you may not want to commit to positions that you are not ready for in the MOU, which is the next point.

    (b) Will the MOU limit your flexibility to negotiate? Even no-binding MOUs can affect your bargaining power. The counter-party can refer to positions set out in the MOU as ‘moral’ power against you. A hint. If the counter-party for reasons specific to its case needs something to be stated but you are still undecided, it is possible to state in the MOU that “ABC wants DEF to take on the responsibilities of doing XYZ. However DEF will need to consider this request further taking into consideration its own commercial needs.” That way, you can satisfy ABC’s special needs while maintaining your flexibility.

    (c) Is the MOU intended to be legally binding? If so, make sure that the obligations and terms are sufficiently clear to be enforceable. You might want to seek legal help on this.

    (d) If the MOU is not intended to be legally binding, is this clearly stated? To minimise the impact of one party suddenly claiming that the MOU is legally binding, have clear language to say so. Certain terms of art like “Subject to Contract” have been interpreted by courts in many countries, including Singapore, to mean that a final binding contract is anticipated to be prepared.

    (e) Do you want the MOU to be binding? This is different from the earlier points. If the MOU is intended not to be legally binding and is subject to contract, then if no final binding contract is signed, there is no deal on any terms and parties are free to do their own thing. The resources spent for the negotiation is wasted. If that is not what you want, think about a binding MOU or at least making certain parts of the MOU binding. You might also want to think about having some sort of commitment by the parties for the final binding contract to be based on the broad framework set out in the MOU. Otherwise, you may be forced to re-negotiate the deal from scratch (some time termed “de novo”) again.

    (f) For key terms that are yet to be agreed, do you want a mechanism to have these key terms determined? Like the decision whether you want a binding or non-binding MOU, this is another decision that is a two-edged sword. Depending on your commercial circumstances, you may or may not want such a mechanism. Having such a mechanism limits your flexibility to negotiate. Not having such a mechanism can result in no final deal and wasted resources.

    (g) Do you want a ‘no reliance clause’ in the MOU? A ‘no reliance’ clause is a boilerplate (or standard) clause that seeks to prevent claims for statements or conducts made before, during or after negotiations that are not set out in the agreement (or in the present situation, in the MOU). Properly drafted, it can also prevent claims that a non-binding MOU is binding because of such ‘by-the-way’ statements or conduct.

    (h) Do you want certain parts of the MOU to be binding? If you want some of the above points (the determinative mechanism and/or the ‘no reliance’ clause) in your MOU, you will have to consider making certain parts of your MOU binding. Confidentiality provisions, protection of intellectual property provisions and exclusivity (or lock-out) provisions might be some of the other provisions you might want binding.

    (i) Are there any tax or other regulatory implications of signing an MOU? Contract law aside, there could be other issues to be considered before signing even a non-binding MOU. As an example, in Singapore’s Code on Take-overs and Mergers, disclosures of agreements, arrangements or understandings between parties must be disclosed to the public.

    Concluding Words

    While a non-binding MOU is designed as a document for parties themselves to prepare and set out their key commercial arrangements in simple and business-friendly language, there are still some areas that parties should keep in mind to maximise the effectiveness of the MOU (as oppose to doing an MOU because everyone else is signing one) and to avoid some of the pitfalls of an MOU.

    As always, if in doubt, please consult us.

  • Online Safety in Singapore – The Recent Online Safety (Miscellaneous Amendments) Bill

    Online Safety in Singapore – The Recent Online Safety (Miscellaneous Amendments) Bill

    by Lim Seng Siew, director OTP Law Corporation. Accredited Specialist in Data and Digital Economy Law by SAL.

    Singapore, like many countries around the world, is on a trend to regulate online content to enhance the online safety of users. UK has its own Online Safety Bill as does Ireland’s Online Safety and Media Regulation Bill and the EU’s Digital Services Act.

    Singapore’s Online Safety (Miscellaneous Amendments) Bill was passed in Parliament on 9 November 2022 and came into force on 1st February 2023.  The Bill primarily makes appropriate amendments to the Broadcasting Act 1994 with the introduction of a new Part 10A. A minor clarification amendment to the Electronic Transactions Act 2010 was also made.  There is no stand-alone Online Safety Act.  The Bill was tabled after consultations with stakeholders and the public.

    In the second reading of the Bill in Parliament, the Minister of Communications and Information highlighted that most online platforms do not fall within the remit of the then-existing provisions of the Broadcasting Act. As such the Bill was intended to regulate social media platforms because of their high volume of harmful content.

    The new Part 10A in the Broadcasting Act empowers the Infocomm Media Development Authority (IMDA) to regulate online communication services (whether from within Singapore or outside) accessible by Singapore end-users. The measures that IMDA can take are: (a) to issue codes of practice for providers of regulated online communication services; and (b) to issue blocking directions to online communication services providers and to internet access service providers to deal with egregious content.  A new Fourth Schedule to the Broadcasting Act lists the online communication services that are within Part 10A. At present, the Fourth Schedule is limited to “social media service”.

    Codes of Practice

    Along with the press release by the Ministry of Communications and Information on 31 Jan 2023, the IMDA also released its draft Code of Practice for Online Safety for further consultation. The Code is expected to be implemented in the second half of 2023. Online communication services that have significant reach or impact can be designated by IMDA as regulated online communication services (ROCS). ROCS providers will be required to comply with the Code.

    The draft Code has provisions requiring ROCS providers to put in place systems and processes to mitigate the risks to Singapore users (in particular children of different age groups) from exposure to harmful content and to account to its users for such measures. Harmful content is much wider than egregious content that can give rise to blocking directions by IMDA. Harmful content covers sexual or violent content as opposed to sexually violent content (per egregious content). It also includes cyberbullying content and content facilitating vice and organised crime.

    The draft Code has sections on: (a) User Safety;  (b) User Reporting; and  (c) Accountability. Its key provisions are:

    (a) The ROCS provider must implement community guidelines, standards, and content moderation measures to minimise users’ exposure to harmful content.

    (b) Users must have access to tools to help them manage their own safety and exposure to harmful content.

    (c) Users must have easy access to information related to online safety, including Singapore-based safety information.

    (d) The ROCS provider must have technologies and processes in place to pro-actively detect and remove child sexual exploitation and abuse material and terrorism content.

    (e) The ROCS provider must have targeted measures to minimise children’s exposure to inappropriate content, including children appropriate community guidelines, standards, and content moderation measures.

    (f) Children must not be sent targeted content that is detrimental to their physical or mental well-being.

    (g) The children and their parents/guardians must have access to tools to enable them to manage the children’s safety and minimise their exposure to harmful or inappropriate content. The tools must limit, not such what content the child can see, but also limit who else can see the child’s information or interact with the child. Unless access by children is restricted, children must be provided with their own accounts where the default settings are robust and more restrictive appropriate to the age of the children.

    (h) Users must be able to report concerning content or unwanted interactions. The mechanism must be easy to use and transparent.

    (i) Such users’ reports must be assessed and appropriate action taken in a timely and diligent manner, depending on the severity of harm. Action taken can include taking down the content and warning or banning the account that posted the content.

    (j) Where the report is not frivolous or vexatious, the reporting user must be informed of the decision and action taken. If action is taken against the user who posted the content, that user must also be informed of the decision and action taken. These must take place without undue delay. The users have the right to ask for a review of the decision and action taken.

    (k) The ROCS provider must submit to IMDA annual reports on the measures that are put in place to combat harmful and inappropriate content. The report should include: (i) how much and types of harmful or inappropriate content they encountered ; (ii) what steps have been taken to mitigate Singapore users’ exposure to harmful or inappropriate content; and (iii) what action has been taken on user reports. The report will be published on IMDA’s website.

    The draft Code is accompanied by Guidelines that provide non-exhaustive examples of harmful content for all users and inappropriate content for children.

    Failure to comply with the codes of practice without a justifiable reason can result in a financial penalty not exceeding S$1 million or directions to remedy the failure.

    Blocking Directions

    If IMDA finds egregious content on online communication services, directions can be issued to the online communications provider and to internet service providers to disable access to such content by Singapore end-users. Egregious content includes content advocating or instructing self-harm or suicide; physical or sexual violence; terrorism; child sexual exploitation; public health risk in Singapore; or likely to cause racial or religious disharmony in Singapore.

    There are 3 types of directions that IMDA can issue:

    (a) A direction to an online communication service provider to disable access by Singapore end-users to the egregious content. As an example, to block a post on a social media site from being viewed by a Singapore user through a browser or mobile device.

    (b) A direction to an online communication service provider to stop the delivery or communication of egregious content to Singapore end-users. As an example, to block an instant message containing egregious content or a link to egregious content from being sent to Singapore users.

    (c) A direction to an internet access service provider to block access by Singapore end-users to an online communication service if the provider of that online communication service fails to comply with an IMDA direction. This can mean that the entire service is blocked and not just the post or message with the egregious content.

    Failure to comply with a blocking direction to an online communication service provider can result in a fine not exceeding S$1 million and a further fine of not more than S$100,000 per day for a continuing offence.  Failure to comply by an internet access service provider can result in a fine not exceeding S$20,000 per day up to a maximum of S$500,000.

    Conclusion

    How effective the codes will be, only time will tell.

  • Foundation Mediation Training Nov 2023

    Foundation Mediation Training Nov 2023

    PracticeForte is pleased to present Foundation Mediation Training held on 1 – 6 November 2023 at PracticeForte Resolution Space.

    This training is open to individuals from all jurisdictions and professions who are interested in becoming mediators, especially overseas professionals interested in being accredited in Singapore.

    Click here for details of the training and to register Now:

  • Cyber-hygiene and Phishing Part 4: Other Steps to Take to Protect Yourself

    Cyber-hygiene and Phishing Part 4: Other Steps to Take to Protect Yourself

    by Lim Seng Siew, Director OTP Law Corporation

    In the first and second parts, we talked about what is a phishing attack and what to do if you are a victim. In the third part we talked about the simple steps to take to protect yourself against an attack. In this fourth and part of the series about Cyber-hygiene and Phishing, we will talk about other, more complicated, steps that you can take to reduce the chances of being a victim of a hack.

    Steps With Assistance Basket

    The suggestions in this basket are much more technical than just installing an anti-malware (one of the simple steps in the earlier article) onto your computers and may require your IT provider to help.

    Configure Your Email Servers

    Your email servers can be configured to ‘prevent’ your emails from being spoofed. I use ‘prevent’ in parentheses because, as I had said earlier, it is not possible to prevent hacking, just making it more difficult for a hacker.

    What you tell your IT provider is “Please configure my email servers to enable SPF, DKIM and DMARC. I want to prevent our emails from being spoofed and so that our emails are not marked as spam by other email servers.”

    To briefly explain what they mean and do.

    SPF stands for “Standard Policy Framework”. What SPF does is to allow email servers receiving your email to verify that the email comes from your domain and is authentic, and not forged or spoofed.

    DKIM stands for “Domain Keys Identified Mail”. What it does is to add a digital signature to every message sent from your organisation. Receiving email servers will read the signature and verify whether message actually came from you. DKIM also prevents message content from being changed when the message is transported between servers.

    Finally, DMARC stands for “Domain-based Message Authentication, Reporting & Conformance”. DMARC tells the receiving email servers what to do with messages from your organisation when they don’t pass either SPF or DKIM. Failed messages can either (a) continue to be sent to the recipient, (b) quarantined or sent to the spam folder, or (c) rejected, ie not sent to the recipient. Usually as a start, you might want to choose the first option (continue to be sent) until you are certain that only false emails are tagged. Whichever option is chosen, DMARC also sends reports that tell you which messages pass or fail SPF and DKIM. These reports can help you identify possible email attacks and other vulnerabilities with your email servers.

    Like the password checker, CSA has its Internet Hygiene Portal (at https://ihp.csa.gov.sg/home where you can check if your website and email are secure.

    Back-Ups Including Off-Site Back-Ups

    In our everyday life, we have ‘back-ups’ for many things: the spare key to our front door or keeping a properly inflated spare tyre in our car.

    The same should apply to your business data. You cannot assume that the information that you store will always be safe and accessible. Even if you are not a victim of a hack, negligence of a staff or a system corruption (physical storage devices do breakdown sooner or later) can result in lost data. Regular and systematic back-ups will ensure that if the information is lost, it can be restored from the back-ups.

    Experts advise making several back-up copies of valuable files and safekeeping them in different places. This is to plan for the contingency that your first back-up option becomes corrupted.

    Some planning and discussion with your IT provider will be necessary. Questions such as the following need to be asked and answered: Do I need to do daily incremental back-ups? Do I need to do weekly or monthly complete back-ups? Do I need real-time back-ups? Do I do the back-ups on removable devices? On external hard drives? On dedicated back-up devices? On the cloud?

    Another key question is “Where is the data that I want backed-up stored?” If your staff stores the files in multiple devices and locations, must all these devices and locations be backed-up? Or should your staff be educated and trained to store all the files in one place (say a dedicated folder on your file servers) so that only that place needs to be backed-up?

    At least one back-up copy should be kept off-site or in a reliable cloud service. If your on-site files, including your on-site back-ups, fall victim to ransomware or is destroyed by fire, you will have that off-site copy or cloud copy from which to restore and reconstruct your files.  However, bear in mind that restoring from off-site back-ups is not as easy as copying files back into your system after it has been restored or cleaned of any malware. Further, you have to ensure that the off-site or cloud back-up copies are immutable copies of your data, ie that they cannot be encrypted or corrupted by ransomware. So regular testing of your back-up and restoration process should be carried out.

    Encryption

    Encryption is a cybersecurity measure that protects your data even if the data is stolen. A hacker will have to ‘crack’ the decryption key before he can get his hands on the data. With strong encryption, decrypting files can take years of computing power.

    Both data stored or backed-up on your devices or the cloud (termed ‘data at rest’) and data that is moving across the internet or a private network (termed ‘data in transit’) should be encrypted.

    Data in transit is usually encrypted by the application used to transfer that data. As an example, many instant messaging apps encrypt all messages sent and received between their users. Websites that have “https” as part of its web address also encrypt all traffic between its web server and the web browsers of its visitors.

    Similarly, many cloud storage providers encrypt both data in transit (ie data that is moving between the user and the cloud storage) and data at rest (ie data that is stored in the cloud storage).

    It probably would not make sense to encrypt ALL files generated by a business. So, you will need to discuss with your staff and your IT provider to see what types of data would benefit from encryption and what would not. In short, a risk-based assessment will have to be undertaken.

    Files that are copied or backed-up onto removable storage devices should be encrypted, especially if these devices are going to be physically moving around. Thus, if the storage device is lost or stolen, the data remains safely out of the hands of the thief or hacker.

    Do not overlook the data encryption tools that are already incorporated in some of the common operating systems like the Encrypted Files System (EFS) in Microsoft’s Windows and Android Encryption in Google’s Android. By default, no file is encrypted for both systems. EFS can be enabled by users (or through Group Policies) on a per-file, per-directory, or a per-drive basis. Encryption in Google’ s Android is generally either a full-disk encryption (FDE) or a file-based encryption (FBE). Confusing? Yes, it can be. That is why help from your IT provider will be useful.

    A useful point to note. Whether encryption has been used is factor taken into consideration by the PDPC to determine if an organisation has or has not taken reasonable steps to secure the personal data it collects.

    Monitor

    “Don’t know, don’t ask” is definitely not one of the mantras to be adopted where cyber-hygiene is concerned. The fact that you had been hacked or that hacking is on-going but you know nothing about it is not only embarrassing when it is subsequently discovered, but can potentially mean that prima facie, you did not take reasonable steps to secure your data.

    Proactive monitoring can give you early warning signs of an impending attack, whether they are specifically directly at your organisation or as part of a global tidal wave. Servers, routers, applications and systems that are used by your organisation should be configured (again, with the help of your IT provider) to either generate periodic (say weekly) reports or have real-time monitors to spot any suspicious activities. However, do not overreact when you see such reports for the first time. There will be many suspicious activities. Hackers routinely use bots to scan multiple systems, including yours, for vulnerabilities such as vulnerable codes that have not been patched. In today’s day and age, these activities are part of the ‘background noise’. What you should be looking out for are changes to the ‘background noise’ that might indicate either that you are being targeted or that some vulnerability has been detected.

    Steps With Consultation Basket

    This third and final basket of suggestions is one that will require consultation between various stakeholders, including senior management, staff, and the IT provider as they involve longer term planning, top management decision, and operational changes. You don’t have to implement all the suggestions but only adopt what suits you and your practice.

    Consider Implementing Zero Trust Policy

    Zero trust policy is basically a philosophy that states no one, whether inside or outside the network, should be trusted unless their identification has been thoroughly checked. Zero trust assumes that every attempt to access the network or an application is a threat. Traditional security models are based on the ‘moat and castle’ or ‘perimeter defence’ model, that is a moat surrounding the castle and anyone inside the castle is assumed to be a friend. A zero trust model doesn’t make that assumption. It in fact goes a few steps further in that the user or device, even after verification, is granted only the minimum of permissions necessary to perform an authorised task and for only a limited period of time.

    The weakness of the perimeter defence model is that the perimeter has all but disappeared with the proliferation of devices that ‘connect’ to your system. This is the result of employees working from home (WFH) in the wake of the global pandemic. Such devices include desktops, laptops, smartphones, tablets, smart TVs and other internet of things (IoT) devices. As a result, hackers have many more points to breach security controls.

    Implementing Zero Trust Policy is not easy. Some of the considerations include:

    • Verifying the identity of authorised users, often using 2FA. In newer implementations, the authentication is via an authenticator app.
    • After the user is verified, the device from which the user seeks authentication also needs to be verified. This usually requires some sort of device management system.
    • After the user and device used have been verified, then permissible access of the user and device needs to be verified. As an example, if a user logs in using a laptop with VPN, then the user can have access to certain pre-defined segments of your network or to certain pre-defined folders of your server. If the user logs in using an IoT device (which is generally views as having a higher risk), then the user is only allowed to access an even more restrictive segment of the network or server.
    • Some zero trust implementations also verify the types of services that a user or device is permitted to have access to. As an example, a user using an IoT device may only have ‘read only’ access to certain services while a user using a laptop will have full access to the same services.

    As the considerations are varied with numerous factors to be taken into account, you will need to work with your key staff and with an experienced IP provider to implement any zero trust policy. Further, it is likely that as you gain more experience, the policies will have to be modified to suit the working requirements of your organisation.

    Reduce Your Attack Surface

    One of the aims of any cybersecurity plan is to reduce the attack surface. The smaller the attack surface, the easier and cheaper it is to protect. Unnecessary complexity can result in poor management and higher chances of mistakes that allow greater opportunities for hackers to gain unauthorised access to your systems.

    The simpler step is to disable all unnecessary or unused: (a) software or applications; (b) computers or devices; and (c) user and admin accounts. However, this is not as easy as it sounds. Many of us allow staff to use their own laptops, tablets and mobile-phones (the Bring Your Own Devices or BYOD ‘culture’), for them to work from home (or for that matter, anywhere), and to use thumb-drives as a means of transferring or transporting files. Just these three steps have increased the attack surface multi-fold and made things more complicated. It makes scanning for vulnerabilities more difficult but makes implementing the zero trust policy more important.

    This cannot be done over-night because you do not want to disrupt your existing work processes that has been in place for a while. The cost for doing so also needs to be weighed against the savings. As an example, you should consider buying laptops for your entire office. That way, you can set the configurations for the laptops and only allow these laptops to access your office system. Any access from mobile devices (even your staffs’ own devices) can then be restricted to read-only access to limit any potential harm caused by such devices.

    Consider Cloud Services

    I will not be dealing with the decision whether to or not to migrate to the cloud. Rather I am just going to weigh cloud versus on-premise solutions from a cybersecurity standpoint. Hybrid WFH makes cloud services an important alternative to on-premise or hosted solutions although both of them have their own security issues.

    An important point to keep in mind, the cloud is not the solution to any hacking problem. A careless employee who gives out login credentials in reply to a phishing email will compromise the cloud service. So, training and all the previously discussed suggestions are still important.

    Further, the larger and established cloud service providers would have, either as a default or as an option, some of the cybersecurity solutions that I have suggested for a user to choose from. Discuss the options with your IT provider and the cloud service provider you are considering.

    I have listed some factors to be considered when deciding between cloud or on-premise solutions.

    Cloud ServicesOn-Premise Solutions
    Choice of Industrial Std Security Solutions at lower up-front costs and at subscription rates.You must decide on specific solutions, usually, at high up-front installation and implementation costs.
    Maintenance, up-grades, and monitoring are usually part of the cloud service and covered in the subscription.You must engage external provider or do these tasks yourself.
    Physical security of data centers and network usually best of class.You must provide for dedicated secured space and network on premises for hardware.
    Surrender control of data to provider.You have full control over what to implement.
    Larger service providers and their larger clients are usual targets for hackers (cloud hacking). You will be collateral damage, even if not a target.You might not be a target for hackers.  However opportunistic hackers might still spot vulnerability in your systems and launch an attack.
    Subject to downtime of provider.Subject to downtime of your own equipment.

    The Summary

    In summary and to recap all four parts:

    • Have a Written Breach Management Plan – Include C.A.R.E. (Contain, Assess, Report, Evaluate)
    • Prevention is Better Than Cure – Practice Cyber-hygiene
      1. Simple Steps
        1. Have Anti-Malware / Update Software
        2. Practice Password Hygiene:

    Strong password / Different Accounts, Different Passwords / 2FA / Don’t share passwords / Don’t login over unsecured wi-fi / Change passwords regularly / Use password manager

    • Learn to Spot Phishing Messages:

    Mismatched or Misleading Information / Beware of Homograph attacks / Use of Urgent or Threatening Language / Promise of Attractive Rewards / Request for Confidential Information / Unexpected Emails & Suspicious Attachments

    1. Training & Keeping up to Date
    2. Steps With Assistance
      1. Configure Email Servers – SPF /DKIM / DMARC
      2. Back-Ups – Multiple Copies & Off-site Copies
    • Encryption
    1. Monitor Your Systems
    2. Steps With Consultation
      1. Zero Trust Policy
      2. Reduce Attack Surface
    • Consider Cloud Services
    • Key Resources
      1. CSA’s Password Checker (https://www.csa.gov.sg/gosafeonline/Resources/Password-Checker)
      2. CSA’s Internet Hygiene Portal (https://ihp.csa.gov.sg/home)
      3. Talk to us at OTP Law Corporation. Our website site is otp.sg