+65 6221 3009

enquiries@practiceforte.sg

Category: Law

  • Risk of Using Generative AI in Legal Practice

    Risk of Using Generative AI in Legal Practice

    In preparing for an article on OTP Law’s website (reproduced on this website) about material adverse change clauses, I made use of a generative AI engine (used on 28 Apr 2023) and asked it for “Cases on material adverse change clauses in Singapore courts.”. This was the answer it gave me:

    In Singapore, material adverse change (MAC) clauses are commonly used in commercial contracts to allow parties to terminate or renegotiate the terms of the contract if certain events occur that materially affect the value or viability of the transaction. However, the application and interpretation of MAC clauses in Singapore can be complex and fact-specific, and there have been a limited number of cases on the issue.

    One notable case is China Machine New Energy Corp v Jaguar Energy Guatemala LLC [2013] SGHC 186, where the Singapore High Court considered a dispute arising from a power purchase agreement between the parties. The agreement contained a MAC clause that allowed the buyer to terminate the agreement if there was a material adverse change in the seller’s financial condition. The court held that the buyer had not established that there was a MAC and that the seller had not breached the agreement. The court also noted that the burden of proof was on the party seeking to rely on the MAC clause, and that the clause should be narrowly construed.

    Another case is BNA v BNB [2015] SGHC 110, where the Singapore High Court considered a dispute arising from a share purchase agreement. The agreement contained a MAC clause that allowed the buyer to terminate the agreement if there was a material adverse effect on the target company’s business, operations, assets or financial condition. The court held that the buyer had not established that there was a MAC and that the seller had not breached the agreement. The court also noted that the MAC clause should be interpreted in the context of the entire agreement and the commercial objectives of the parties.

    Overall, these cases suggest that Singapore courts will approach the interpretation and application of MAC clauses on a case-by-case basis and will require a high standard of proof before allowing a party to rely on such a clause to terminate a contract.

    This sounds great, easy to read and understand. What is there not to like about it? Except that the cases don’t exist! It is not that the case names or the citations don’t exist. They do but are wrong. The citation for China Machine New Energy Corp v Jaguar Energy Guatemala LLC is not [2013] SGHC 186. It’s another citation. And citation [2013] SGHC 186 is of another case. And, to make it worse, either is about material adverse change clauses. This was a similar situation with the second case cited, BNA v BNB [2015] SGHC 110.

    So what is going on here? The short lay-persons answer is that the AI lied. But AIs don’t lie. All they do is trawl the internet for information (ie. the large language model) and then compile the information in a coherent manner that people understand. So how in that compilation process, the AI put together information that may not be related to one another together in a coherent readable form. To a reader, they appear as the truth. Data scientists don’t fully understand what is going on yet but called this phenomenon ‘hallucination’.

    How do we avoid this? By asking the right question.

    This reminds me of the sci-fi series, “The Hitchhiker’s Guide to the Galaxy.” The Ultimate Question was asked of the supercomputer “Deep Thought”: What is the answer to Life, the Universe, and Everything? After many years of computing, the answer was “42”. It was pointed out by Deep Thought that the question was wrong. Thus the non-sensical answer.

    A ‘profession’ has now grown around generative IA to learn how to ask the right questions, ‘prompt engineering’. The combination of prompt engineering, domain knowledge (the human is still needed in the chain), high quality data, and AI models trained on research frameworks will birth a new scientific approach: Iterative Sciences.

    As to using generative AI for legal work, thankfully as the preceding paragraph makes clear, the human is still need to provide the domain knowledge of law. The human with that domain knowledge needs to read what is generated by the AI for accuracy. Using the answer to my query above, of the four paragraphs generated by the AI, only two were useable (of sorts): the first and last paragraphs, ie. the two shortest paragraphs that contain well-written motherhood statements. Not sure how useful they are actually. In fact, my article on material adverse change clauses used nothing generated by the AI. So, I am happy to report that for the moment, we are safe.

  • The Material Adverse Change (or MAC) Clause

    Despite their popularity, it is widely accepted that a material adverse change (MAC), also known as a material adverse effect (MAE) condition, is notoriously difficult to trigger. A situation not contemplated might have occurred or a contemplated situation might have a lesser adverse impact than anticipated and therefore the clause is not triggered.  One party might want wider conditions while, unsurprisingly, the other party would want narrower ones. However, before we delve into the issues, we need to know what is a material adverse change clause.

    What is a Material Adverse Change Clause?

    A material adverse change (or MAC) clause is common in M&A and financing contracts. Its purpose is to give one party the right to modify or terminate the deal or contract if there is an adverse change in the business that is material to the deal or contract. Not every change is adverse to all parties and for sure not every adverse change will have a material impact on the deal from the point of view of every party.

    Therefore it is up to the parties to negotiate and define as clearly as possible what such a material adverse event is and its consequences to the deal. If the MAC event occurs between the signing and closing of the deal, it may result in the termination and unwinding of the deal. If it occurs after the closing but there are still obligations for one party to fulfill (as an example during earn-out periods), it may result in some or all of the obligations being waived. It may also provide for compensation or damages being paid by one party to the other. In financing arrangements, the MAC clause may result in repayment of the loan.

    MAC clauses often come into focus in the aftermath of significant events that affect the economy, either generally or in a specific industry. Events such as 9-11, global financial crises, and the recent Covid-19 pandemic saw a discernible increase in acquirers trying to invoke MAC clauses to terminate a deal.

    What a MAC clause contains will vary from transaction to transaction and jurisdiction to jurisdiction. In some countries, there might be a ‘market practice’ on how such clauses are usually drafted. But parties must bear in mind that notwithstanding market practices, you can negotiate something else that suits the circumstances of a deal.

    MAC Clauses in ‘Private Transactions’

    In private deals (and even in some deals involving listed or regulated entities), a MAC clause may take the form of either a condition precedent or a condition subsequent to completion. It can also be a warranty that there is no MAC as of a specified date. As a warranty, some acquirers will negotiate that the warranty is repeated at completion to avail of its effect to abort a deal. Sellers of course will resist.

    From an acquirer’s perspective, MAC clauses should attempt to set out every issue or event that is material to an acquirer and to set out the reasons why that is so, especially if it is not clear on the face of that issue why it is material to the acquirer. It should also set out an objective threshold, where possible, to determine materiality. In rare situations, materiality may be left to the acquirer to determine at its discretion. MAC clauses often have carve-outs, that is situations when the MAC clause would not apply. Sometimes there is a third layer, exceptions to the carve-out. Such 3-layer MAC clauses are a common structure used in ‘American’ style or drafted agreements. Parties should also consider if the MAC clause can only be invoked when a material adverse change has occurred or that it can be forward-looking and allow the MAC clause to be invoked in anticipation of such a material adverse change.

    A good illustration of the ‘3 layers’ MAC clause is the English case of Travelport Limited v WEX Inc [2020] EWHC 2670 (Comm).  The case concerned the interpretation of a MAC clause in a share purchase agreement wherein WEX Inc (“WEX”) agreed to purchase 100% of two companies, eNett International (Jersey) Limited (“eNett”) and Optal Limited (“Optal”) from Travelport Limited (“Travelport”). WEX attempted to use the MAC clause to abort the deal because of the Covid-19 pandemic.

    The MAC (or MAE in this case) clause stated:

    “Since the date of this Agreement there shall not have been any Material Adverse Effect and no event, change, development, state of facts or effect shall have occurred that would reasonably be expected to have a Material Adverse Effect.”

    “Material Adverse Effect” was defined in the agreement as:

    “any event, change, development, state of facts or effect that, individually or in the aggregate,

    (x) has had and continues to have a material adverse effect on the business, condition (financial or otherwise) or results of operations of [the eNett Group], taken as a whole, or of [the Optal Group], taken as a whole…or

    (y) would prevent or materially delay the consummation of the transactions contemplated by this Agreement”.

    The relevant carve-out is a proviso to the above clause (x) and states:

    “…provided that, solely for purposes of clause (x), no such event, change, development, state of facts or effect resulting, arising from or in connection with any of the following matters shall be deemed, either alone or in combination, to constitute or contribute to, or be taken into account in determining whether there has been or will be, a Material Adverse Effect:

    a) the general conditions and trends in the industries or businesses in which [eNett], [Optal] or any of their respective Subsidiaries operates, including competition in any of the geographic or product areas in which [eNett], [Optal] or any of their respective Subsidiaries operates …

    b) general economic conditions, financial conditions or capital market conditions (including interest rates, exchange rates and credit markets);

    c) conditions resulting from the commencement, occurrence, continuation or intensification of any act of civil unrest, war (whether or not declared), terrorism or sabotage (including cyberattack), armed hostilities, military attacks or declaration of national emergency;

    d) changes (or proposed changes) in Tax, regulatory or political conditions (including as a result of the negotiations or outcome with respect to Brexit) or Law, IFRS EU or IFRS IASB (or, in each case, any authoritative interpretations thereof or the enforcement thereof);

    e) conditions resulting from any natural or manmade disasters, hurricanes, floods, tornados, pandemics, tsunamis, earthquakes, acts of God or other weather-related or natural conditions…“

    And the exception to the carve-out is:

    “provided, further that any event, change, development or effect referred to in clause (a), (b), (c) or (e) may be taken into account in determining whether there has been a Material Adverse Effect to the extent, and solely to the extent, such event, change, development, state of facts or effect has a disproportionate effect on [the eNett Group], taken as a whole, or on [the Optal Group], taken as a whole, as compared to participants in the industries in which [eNett], [Optal] or their respective Subsidiaries operate.”

    The effect of the MAC clause, in the words of the Judge, is that  “[f]or present purposes all of this complicated structure produces this result: that if conditions resulting from the Pandemic cause a disproportionate effect on either of the eNett or Optal Groups, each taken as a whole, as compared to other participants in the industries in which either of eNett or Optal (or their respective subsidiaries) operate, such conditions fall within the Carve-Out Exception.”

    It important to bear in mind that the agreement was dated 24 Jan 2020, just days before WHO declared the Covid-19 outbreak as “a public health emergency of international concern” on 30 Jan 2020 and almost two months before Covid-19 was classified by WHO as a worldwide pandemic on 11 March 2020.

    It was not necessary for the judge to decide if WEX had properly invoked the MAC clause as the judgment was about a trial of preliminary issues. I cannot find anything as to what happened at the full trial or even if the full trial took place. All I can find is that the parties had entered into a deed of settlement and the deal was completed on 15 Dec 2020.

    MAC Clauses in Takeovers of Publicly Listed Companies

    The use of MAC clauses in takeovers of listed entities in some jurisdictions is regulated by the relevant authorities.

    As an example, the Australian Securities & Investments Commission in its Sep 2022 update stated that it expects MAC conditions to have objective and quantifiable standards by which the parties to a transaction can determine whether the material adverse change has occurred. The MAC condition cannot be subjective or semi-subjective.

    Unquantified MAC clauses are common in commercial drafting. Commercial parties and their legal advisors have for decades viewed such clauses as applying an objective test, and the suggestion in Australia that they need to be quantitatively defined as well has surprised the market. It would be a shame if other regulators follow Australia and unquantified MAC conditions can no longer be used as a key risk management device.

    In another example, the City Code of Takeovers and Mergers of UK provides that for a bidder to invoke a MAC clause so as to cause a bid to lapse, the condition must not be subject to the subjective judgment of the directors of the bidder, nor should satisfaction of the condition be in the bidder’s hands. Further, the circumstances that give rise to the right to invoke the condition must be of material significance to the bidder in the context of the offer.

    What Should Go Into a MAC Clause in an M&A Deal?

    First and foremost, the considerations of an acquirer and of the seller are very different in an M&A deal. So let us start with considerations of the acquirer.

    For Acquirer

    If the acquirer is obtaining financing for the deal, make sure that the conditions align with the financing documents. You definitely don’t want to be caught in a situation where your financier can back out but you can’t.

    Other considerations for an acquirer include:

    • Whether to have a general MAC clause (usually strongly resisted by the seller with good reasons) or whether to have the clause cover specified concerns that the acquirer may have. Even if the seller agrees to a general MAC clause, an acquirer will still need to carefully craft what constitutes a MAC since courts generally interpret MAC clauses narrowly. The general MAC clause should also be looked at in the context of the agreement as a whole since the courts will interpret the intentions of the parties by looking at the documents as a whole.
    • If the seller successfully negotiates ‘general markets events’ as being an exception to what constitutes a MAC, the acquirer should consider incorporating wordings that would still trigger the MAC clause if: (i) the target company is affected comparatively worse when compared to other companies in its industry or (ii) the industry in which the target company operates is disproportionately affected when compared to other industries.
    • Look for what other protections that are available to the acquirer. As examples, obtain undertakings from the seller to run the target company ‘in the usual course of business’ in the period leading up to completion or negotiate for the warranties to be repeated at the completion of the transaction.
    • As stated earlier in the article, see if you can include forward-looking triggers of a MAC clause with words like “… events that are reasonably expected to have a material adverse effect on earnings …”.
    • If you need to specify events, other than the usual ones concerning the financial performance of the target company, consider adding one regarding the departure of key personnel or events that would impair the acquirer’s ability to complete the deal (eg no financing).
    • If your MAC clause has both general provisions and specific events, bear in mind that a court will likely interpret the specific events in the MAC clause as exclusive and exhaustive, thus giving little or no effect to the general provisions.

    For Seller

    The starting position is to resist any MAC clause although this will often be viewed by any acquirer as unreasonable and has the potential to scuttle a deal. As a seller, you must have clear and cogent reasons for this stance. However, from a negotiator’s standpoint, it could make subsequent negotiations for limited and clearly defined MAC clauses easier. You can also try negotiating for a sunset to the MAC clause if the closing of the deal is delayed by the acquirer. After all, if the deal had been completed on the scheduled date, any risk of a MAC would have passed to the acquirer.

    Conversely, if the seller is responsible for the delay in completion, the seller should try to minimise the period at which it may be at risk.

    If the seller accepts the inclusion of a MAC clause, try to negotiate for ‘general market events’ exceptions and for ‘matters disclosed to or within the knowledge of the acquirer’ exceptions. Existing events should also be an exception to a MAC clause.

    Also, look for objective criteria to determine what is material. Usually, parties resort to measurable financial parameters. This may mean, for example, that the valuation, the turnover, EBITDA, etc. of the target company declines by a number of percentage points. Bear in mind that often such financial parameters may not be available on a monthly basis or that the changes may be temporary. Acquirers often want a subjective criterion, that is, they make the determination. A possible but more expensive compromise is to have a third party make that determination.

    Interpretation of MAC Clauses by Courts

    MAC clauses in share sale agreements will be interpreted in accordance with general principles of law. A court, when interpreting any clause of any contract will first look to the words in the contract to determine the parties’ intention. If this still gives rise to ambiguity, the court will then look at the surrounding circumstances to determine that intention. Once a court has interpreted the meaning of the provision, it will then make a factual determination on whether a material adverse change, within the meaning of the provision, has occurred.

    The determination of materiality is an objective one and not what one or the other party believes to be material. Materiality must be assessed at the relevant time, usually when one party asserts that a material adverse change has occurred. It is for the party asserting material adverse change to prove it and courts have said that this is a very high threshold. Therefore the claimant is likely to face a difficult uphill task.

    Some additional points to note from another English case, Grupo Hotelero Urvasco v Carey Value Added [2013] EWHC 1039 (Comm):

    • A change is only material if it significantly affects the company’s ability to perform its obligations under the relevant agreement.
    • A change is not material if it is merely temporary.
    • The party invoking the MAC clause cannot do so on the basis of circumstances of which it was aware at the time of the agreement.
    • Where the MAC clause relates to a company’s financial condition, this is to be determined primarily by reference to its financial information, which may include interim financial information and/or management accounts.
    • Financial information does not, therefore, encompass other matters such as the company’s prospects or external economic or market changes.
    • However, an inquiry is not necessarily limited to the company’s financial information if there is compelling evidence to show that a material adverse change has occurred.

    There is also a Singapore High Court decision, Downeredi Works Pte Ltd v Holcim (Singapore) Pte Ltd [2009] 1 SLR(R) 1070, interpreting the term “material” to mean “significant” in the context of a MAC clause.

    Similar Type Clauses

    Similar to MAC clauses are hardship clauses and force majeure clauses.  Hardship clauses and force majeure clauses aim to regulate the contractual relationship in cases of abnormal and unforeseeable circumstances occurring after the entry into force of the agreement. Hardship clauses usually achieve this by providing for renegotiation of the contractual terms and conditions. Force majeure clauses often provide for pre-determined consequences, including termination, if such circumstances arise.

    Although the clauses have some similarities, the main distinction between such clauses and MAC clauses lies in their scope. Hardship clauses are directed at the performance of the contract. As an example in supply contracts, changes in certain circumstances trigger a renegotiation of supply volumes, prices and/or schedules.  The MAC clause on the other hand concerns a one-off transaction like in an acquisition or in financing.  Further, the consequences are also different. The MAC clause usually results in the termination of the arrangement or some part of the arrangement although on a practical level, parties usually enter into negotiations to see if the deal can be saved before triggering the MAC clause.

    Final Points

    It should be clear from the above that drafting MAC clauses that are effective is no simple task. Sellers and acquirers are almost diametrically opposite when it comes to MAC clauses. The end result after much ‘to-and-fro’ negotiation may be confusing and complicated. It is a task that even seasoned lawyers find daunting. Thus getting good and proper representation is important. The skill set required for your professional advisors should include negotiation skills, good drafting skills along with a sound understanding of the commercial drivers for the deal and of course, of the law.

    If you need to know more how OTP Law Corporation can help with your deal, contact us.

  • Term Sheets, Memoranda of Understanding and Letters of Intent – Same Same or Different?

    In the initial stages of a deal, you may be asked to sign a ‘non-binding’ document that sets out the key parameters for the negotiation. That document is called by many different names: a term sheet or a memorandum of understanding (MOU) or a letter of intent (LOI) or numerous other names.

    Some experts claim that the documents described by each of these terms are different. However, to me, a rose by any other name is still a rose. While by convention or practice, the description used for the same type of ‘non-binding’ document is different for different types of transactions, the terms are very often used interchangeably such that the name is not important. A term sheet is often the description used for the non-binding document in M&A or financing deals while MOU or LOI is used to describe the non-binding document in other commercial transactions. But do not be surprised if you find MOUs being used in M&A deals or term sheets being used in distributorship negotiations.

    What is important is to make sure you understand what are the parameters set out in the document, whether it is binding or non-binding, and if binding, which parts are binding. For this article, the term “MOU” will be used to describe such documents generally.

    Purpose of the MOU

    Often, while negotiating deals, it is important to set out the broad areas of agreement or the boundaries of negotiation. However, parties may not want binding agreements, either because some of the terms may require the approval of upper management or have to be cleared by their lawyers. So they draft and sign a non-binding MOU. Its language is often non-legalistic and anticipates that binding definitive agreements will be signed later.

    In general, the MOU will provide:

    (a) A framework for the parties to negotiate a final contract.

    (b) A record of key terms agreed on.

    (c) Details of the fundamental commercial arrangement or commitment reached.

    (d) A mechanism for dealing with pre-contractual issues such as exclusivity, confidentiality, due diligence and/or intellectual property.

    (e) A degree of comfort to the parties that a deal is possible, ie no deal beaker issues, before they incur further expenses.

    The signed MOU can also be used as a basis to seek funding for the deal from third parties subject of course to any binding confidentiality obligations. It will also form the basis for parties’ professionals like their accountants and lawyers to prepare the required accounting and legal documentation.

    Is an MOU binding?

    Many people assume that an MOU is not legally binding. After all, it is only an ‘understanding’ and not a contract. Unfortunately, that is not always the case. In certain circumstances, an MOU or parts of it can be binding. The two key questions to determine if the MOU (or some parts) is or is not binding are:

    (a) Did the parties intend to be bound by all or certain obligations set out in the MOU? A court would first examine the content of the MOU to make this determination. Therefore, to avoid uncertainty, the MOU should have clear statements as to whether the parties intend for the MOU to be or not to be binding, and if binding, which parts are binding.

    (b) Is the MOU sufficiently clear and certain to be legally binding? A court will not ‘fill in the blanks’ in an MOU for the parties. A court also will not interpret obligations that are not clear. As an example, “obligations on the usual terms” or “sold at a fair price” are generally unenforceable unless there is a custom of trade where the phrases “usual terms’ or “fair price” is determinable.

    What to Look Out for in an MOU?

    When negotiating a commercial deal and one party suggests using an MOU, it is important to consider the following:

    (a) Do you really need an MOU? If you only need to deal with confidentiality or to require parties to not negotiate with other parties while negotiating this deal, would a non-disclosure agreement or an exclusive negotiation (or lock-out) agreement suffice? After all, you may not want to commit to positions that you are not ready for in the MOU, which is the next point.

    (b) Will the MOU limit your flexibility to negotiate? Even no-binding MOUs can affect your bargaining power. The counter-party can refer to positions set out in the MOU as ‘moral’ power against you. A hint. If the counter-party for reasons specific to its case needs something to be stated but you are still undecided, it is possible to state in the MOU that “ABC wants DEF to take on the responsibilities of doing XYZ. However DEF will need to consider this request further taking into consideration its own commercial needs.” That way, you can satisfy ABC’s special needs while maintaining your flexibility.

    (c) Is the MOU intended to be legally binding? If so, make sure that the obligations and terms are sufficiently clear to be enforceable. You might want to seek legal help on this.

    (d) If the MOU is not intended to be legally binding, is this clearly stated? To minimise the impact of one party suddenly claiming that the MOU is legally binding, have clear language to say so. Certain terms of art like “Subject to Contract” have been interpreted by courts in many countries, including Singapore, to mean that a final binding contract is anticipated to be prepared.

    (e) Do you want the MOU to be binding? This is different from the earlier points. If the MOU is intended not to be legally binding and is subject to contract, then if no final binding contract is signed, there is no deal on any terms and parties are free to do their own thing. The resources spent for the negotiation is wasted. If that is not what you want, think about a binding MOU or at least making certain parts of the MOU binding. You might also want to think about having some sort of commitment by the parties for the final binding contract to be based on the broad framework set out in the MOU. Otherwise, you may be forced to re-negotiate the deal from scratch (some time termed “de novo”) again.

    (f) For key terms that are yet to be agreed, do you want a mechanism to have these key terms determined? Like the decision whether you want a binding or non-binding MOU, this is another decision that is a two-edged sword. Depending on your commercial circumstances, you may or may not want such a mechanism. Having such a mechanism limits your flexibility to negotiate. Not having such a mechanism can result in no final deal and wasted resources.

    (g) Do you want a ‘no reliance clause’ in the MOU? A ‘no reliance’ clause is a boilerplate (or standard) clause that seeks to prevent claims for statements or conducts made before, during or after negotiations that are not set out in the agreement (or in the present situation, in the MOU). Properly drafted, it can also prevent claims that a non-binding MOU is binding because of such ‘by-the-way’ statements or conduct.

    (h) Do you want certain parts of the MOU to be binding? If you want some of the above points (the determinative mechanism and/or the ‘no reliance’ clause) in your MOU, you will have to consider making certain parts of your MOU binding. Confidentiality provisions, protection of intellectual property provisions and exclusivity (or lock-out) provisions might be some of the other provisions you might want binding.

    (i) Are there any tax or other regulatory implications of signing an MOU? Contract law aside, there could be other issues to be considered before signing even a non-binding MOU. As an example, in Singapore’s Code on Take-overs and Mergers, disclosures of agreements, arrangements or understandings between parties must be disclosed to the public.

    Concluding Words

    While a non-binding MOU is designed as a document for parties themselves to prepare and set out their key commercial arrangements in simple and business-friendly language, there are still some areas that parties should keep in mind to maximise the effectiveness of the MOU (as oppose to doing an MOU because everyone else is signing one) and to avoid some of the pitfalls of an MOU.

    As always, if in doubt, please consult us.

  • Online Safety in Singapore – The Recent Online Safety (Miscellaneous Amendments) Bill

    Online Safety in Singapore – The Recent Online Safety (Miscellaneous Amendments) Bill

    by Lim Seng Siew, director OTP Law Corporation. Accredited Specialist in Data and Digital Economy Law by SAL.

    Singapore, like many countries around the world, is on a trend to regulate online content to enhance the online safety of users. UK has its own Online Safety Bill as does Ireland’s Online Safety and Media Regulation Bill and the EU’s Digital Services Act.

    Singapore’s Online Safety (Miscellaneous Amendments) Bill was passed in Parliament on 9 November 2022 and came into force on 1st February 2023.  The Bill primarily makes appropriate amendments to the Broadcasting Act 1994 with the introduction of a new Part 10A. A minor clarification amendment to the Electronic Transactions Act 2010 was also made.  There is no stand-alone Online Safety Act.  The Bill was tabled after consultations with stakeholders and the public.

    In the second reading of the Bill in Parliament, the Minister of Communications and Information highlighted that most online platforms do not fall within the remit of the then-existing provisions of the Broadcasting Act. As such the Bill was intended to regulate social media platforms because of their high volume of harmful content.

    The new Part 10A in the Broadcasting Act empowers the Infocomm Media Development Authority (IMDA) to regulate online communication services (whether from within Singapore or outside) accessible by Singapore end-users. The measures that IMDA can take are: (a) to issue codes of practice for providers of regulated online communication services; and (b) to issue blocking directions to online communication services providers and to internet access service providers to deal with egregious content.  A new Fourth Schedule to the Broadcasting Act lists the online communication services that are within Part 10A. At present, the Fourth Schedule is limited to “social media service”.

    Codes of Practice

    Along with the press release by the Ministry of Communications and Information on 31 Jan 2023, the IMDA also released its draft Code of Practice for Online Safety for further consultation. The Code is expected to be implemented in the second half of 2023. Online communication services that have significant reach or impact can be designated by IMDA as regulated online communication services (ROCS). ROCS providers will be required to comply with the Code.

    The draft Code has provisions requiring ROCS providers to put in place systems and processes to mitigate the risks to Singapore users (in particular children of different age groups) from exposure to harmful content and to account to its users for such measures. Harmful content is much wider than egregious content that can give rise to blocking directions by IMDA. Harmful content covers sexual or violent content as opposed to sexually violent content (per egregious content). It also includes cyberbullying content and content facilitating vice and organised crime.

    The draft Code has sections on: (a) User Safety;  (b) User Reporting; and  (c) Accountability. Its key provisions are:

    (a) The ROCS provider must implement community guidelines, standards, and content moderation measures to minimise users’ exposure to harmful content.

    (b) Users must have access to tools to help them manage their own safety and exposure to harmful content.

    (c) Users must have easy access to information related to online safety, including Singapore-based safety information.

    (d) The ROCS provider must have technologies and processes in place to pro-actively detect and remove child sexual exploitation and abuse material and terrorism content.

    (e) The ROCS provider must have targeted measures to minimise children’s exposure to inappropriate content, including children appropriate community guidelines, standards, and content moderation measures.

    (f) Children must not be sent targeted content that is detrimental to their physical or mental well-being.

    (g) The children and their parents/guardians must have access to tools to enable them to manage the children’s safety and minimise their exposure to harmful or inappropriate content. The tools must limit, not such what content the child can see, but also limit who else can see the child’s information or interact with the child. Unless access by children is restricted, children must be provided with their own accounts where the default settings are robust and more restrictive appropriate to the age of the children.

    (h) Users must be able to report concerning content or unwanted interactions. The mechanism must be easy to use and transparent.

    (i) Such users’ reports must be assessed and appropriate action taken in a timely and diligent manner, depending on the severity of harm. Action taken can include taking down the content and warning or banning the account that posted the content.

    (j) Where the report is not frivolous or vexatious, the reporting user must be informed of the decision and action taken. If action is taken against the user who posted the content, that user must also be informed of the decision and action taken. These must take place without undue delay. The users have the right to ask for a review of the decision and action taken.

    (k) The ROCS provider must submit to IMDA annual reports on the measures that are put in place to combat harmful and inappropriate content. The report should include: (i) how much and types of harmful or inappropriate content they encountered ; (ii) what steps have been taken to mitigate Singapore users’ exposure to harmful or inappropriate content; and (iii) what action has been taken on user reports. The report will be published on IMDA’s website.

    The draft Code is accompanied by Guidelines that provide non-exhaustive examples of harmful content for all users and inappropriate content for children.

    Failure to comply with the codes of practice without a justifiable reason can result in a financial penalty not exceeding S$1 million or directions to remedy the failure.

    Blocking Directions

    If IMDA finds egregious content on online communication services, directions can be issued to the online communications provider and to internet service providers to disable access to such content by Singapore end-users. Egregious content includes content advocating or instructing self-harm or suicide; physical or sexual violence; terrorism; child sexual exploitation; public health risk in Singapore; or likely to cause racial or religious disharmony in Singapore.

    There are 3 types of directions that IMDA can issue:

    (a) A direction to an online communication service provider to disable access by Singapore end-users to the egregious content. As an example, to block a post on a social media site from being viewed by a Singapore user through a browser or mobile device.

    (b) A direction to an online communication service provider to stop the delivery or communication of egregious content to Singapore end-users. As an example, to block an instant message containing egregious content or a link to egregious content from being sent to Singapore users.

    (c) A direction to an internet access service provider to block access by Singapore end-users to an online communication service if the provider of that online communication service fails to comply with an IMDA direction. This can mean that the entire service is blocked and not just the post or message with the egregious content.

    Failure to comply with a blocking direction to an online communication service provider can result in a fine not exceeding S$1 million and a further fine of not more than S$100,000 per day for a continuing offence.  Failure to comply by an internet access service provider can result in a fine not exceeding S$20,000 per day up to a maximum of S$500,000.

    Conclusion

    How effective the codes will be, only time will tell.

  • Cyber-hygiene and Phishing Part 4: Other Steps to Take to Protect Yourself

    Cyber-hygiene and Phishing Part 4: Other Steps to Take to Protect Yourself

    by Lim Seng Siew, Director OTP Law Corporation

    In the first and second parts, we talked about what is a phishing attack and what to do if you are a victim. In the third part we talked about the simple steps to take to protect yourself against an attack. In this fourth and part of the series about Cyber-hygiene and Phishing, we will talk about other, more complicated, steps that you can take to reduce the chances of being a victim of a hack.

    Steps With Assistance Basket

    The suggestions in this basket are much more technical than just installing an anti-malware (one of the simple steps in the earlier article) onto your computers and may require your IT provider to help.

    Configure Your Email Servers

    Your email servers can be configured to ‘prevent’ your emails from being spoofed. I use ‘prevent’ in parentheses because, as I had said earlier, it is not possible to prevent hacking, just making it more difficult for a hacker.

    What you tell your IT provider is “Please configure my email servers to enable SPF, DKIM and DMARC. I want to prevent our emails from being spoofed and so that our emails are not marked as spam by other email servers.”

    To briefly explain what they mean and do.

    SPF stands for “Standard Policy Framework”. What SPF does is to allow email servers receiving your email to verify that the email comes from your domain and is authentic, and not forged or spoofed.

    DKIM stands for “Domain Keys Identified Mail”. What it does is to add a digital signature to every message sent from your organisation. Receiving email servers will read the signature and verify whether message actually came from you. DKIM also prevents message content from being changed when the message is transported between servers.

    Finally, DMARC stands for “Domain-based Message Authentication, Reporting & Conformance”. DMARC tells the receiving email servers what to do with messages from your organisation when they don’t pass either SPF or DKIM. Failed messages can either (a) continue to be sent to the recipient, (b) quarantined or sent to the spam folder, or (c) rejected, ie not sent to the recipient. Usually as a start, you might want to choose the first option (continue to be sent) until you are certain that only false emails are tagged. Whichever option is chosen, DMARC also sends reports that tell you which messages pass or fail SPF and DKIM. These reports can help you identify possible email attacks and other vulnerabilities with your email servers.

    Like the password checker, CSA has its Internet Hygiene Portal (at https://ihp.csa.gov.sg/home where you can check if your website and email are secure.

    Back-Ups Including Off-Site Back-Ups

    In our everyday life, we have ‘back-ups’ for many things: the spare key to our front door or keeping a properly inflated spare tyre in our car.

    The same should apply to your business data. You cannot assume that the information that you store will always be safe and accessible. Even if you are not a victim of a hack, negligence of a staff or a system corruption (physical storage devices do breakdown sooner or later) can result in lost data. Regular and systematic back-ups will ensure that if the information is lost, it can be restored from the back-ups.

    Experts advise making several back-up copies of valuable files and safekeeping them in different places. This is to plan for the contingency that your first back-up option becomes corrupted.

    Some planning and discussion with your IT provider will be necessary. Questions such as the following need to be asked and answered: Do I need to do daily incremental back-ups? Do I need to do weekly or monthly complete back-ups? Do I need real-time back-ups? Do I do the back-ups on removable devices? On external hard drives? On dedicated back-up devices? On the cloud?

    Another key question is “Where is the data that I want backed-up stored?” If your staff stores the files in multiple devices and locations, must all these devices and locations be backed-up? Or should your staff be educated and trained to store all the files in one place (say a dedicated folder on your file servers) so that only that place needs to be backed-up?

    At least one back-up copy should be kept off-site or in a reliable cloud service. If your on-site files, including your on-site back-ups, fall victim to ransomware or is destroyed by fire, you will have that off-site copy or cloud copy from which to restore and reconstruct your files.  However, bear in mind that restoring from off-site back-ups is not as easy as copying files back into your system after it has been restored or cleaned of any malware. Further, you have to ensure that the off-site or cloud back-up copies are immutable copies of your data, ie that they cannot be encrypted or corrupted by ransomware. So regular testing of your back-up and restoration process should be carried out.

    Encryption

    Encryption is a cybersecurity measure that protects your data even if the data is stolen. A hacker will have to ‘crack’ the decryption key before he can get his hands on the data. With strong encryption, decrypting files can take years of computing power.

    Both data stored or backed-up on your devices or the cloud (termed ‘data at rest’) and data that is moving across the internet or a private network (termed ‘data in transit’) should be encrypted.

    Data in transit is usually encrypted by the application used to transfer that data. As an example, many instant messaging apps encrypt all messages sent and received between their users. Websites that have “https” as part of its web address also encrypt all traffic between its web server and the web browsers of its visitors.

    Similarly, many cloud storage providers encrypt both data in transit (ie data that is moving between the user and the cloud storage) and data at rest (ie data that is stored in the cloud storage).

    It probably would not make sense to encrypt ALL files generated by a business. So, you will need to discuss with your staff and your IT provider to see what types of data would benefit from encryption and what would not. In short, a risk-based assessment will have to be undertaken.

    Files that are copied or backed-up onto removable storage devices should be encrypted, especially if these devices are going to be physically moving around. Thus, if the storage device is lost or stolen, the data remains safely out of the hands of the thief or hacker.

    Do not overlook the data encryption tools that are already incorporated in some of the common operating systems like the Encrypted Files System (EFS) in Microsoft’s Windows and Android Encryption in Google’s Android. By default, no file is encrypted for both systems. EFS can be enabled by users (or through Group Policies) on a per-file, per-directory, or a per-drive basis. Encryption in Google’ s Android is generally either a full-disk encryption (FDE) or a file-based encryption (FBE). Confusing? Yes, it can be. That is why help from your IT provider will be useful.

    A useful point to note. Whether encryption has been used is factor taken into consideration by the PDPC to determine if an organisation has or has not taken reasonable steps to secure the personal data it collects.

    Monitor

    “Don’t know, don’t ask” is definitely not one of the mantras to be adopted where cyber-hygiene is concerned. The fact that you had been hacked or that hacking is on-going but you know nothing about it is not only embarrassing when it is subsequently discovered, but can potentially mean that prima facie, you did not take reasonable steps to secure your data.

    Proactive monitoring can give you early warning signs of an impending attack, whether they are specifically directly at your organisation or as part of a global tidal wave. Servers, routers, applications and systems that are used by your organisation should be configured (again, with the help of your IT provider) to either generate periodic (say weekly) reports or have real-time monitors to spot any suspicious activities. However, do not overreact when you see such reports for the first time. There will be many suspicious activities. Hackers routinely use bots to scan multiple systems, including yours, for vulnerabilities such as vulnerable codes that have not been patched. In today’s day and age, these activities are part of the ‘background noise’. What you should be looking out for are changes to the ‘background noise’ that might indicate either that you are being targeted or that some vulnerability has been detected.

    Steps With Consultation Basket

    This third and final basket of suggestions is one that will require consultation between various stakeholders, including senior management, staff, and the IT provider as they involve longer term planning, top management decision, and operational changes. You don’t have to implement all the suggestions but only adopt what suits you and your practice.

    Consider Implementing Zero Trust Policy

    Zero trust policy is basically a philosophy that states no one, whether inside or outside the network, should be trusted unless their identification has been thoroughly checked. Zero trust assumes that every attempt to access the network or an application is a threat. Traditional security models are based on the ‘moat and castle’ or ‘perimeter defence’ model, that is a moat surrounding the castle and anyone inside the castle is assumed to be a friend. A zero trust model doesn’t make that assumption. It in fact goes a few steps further in that the user or device, even after verification, is granted only the minimum of permissions necessary to perform an authorised task and for only a limited period of time.

    The weakness of the perimeter defence model is that the perimeter has all but disappeared with the proliferation of devices that ‘connect’ to your system. This is the result of employees working from home (WFH) in the wake of the global pandemic. Such devices include desktops, laptops, smartphones, tablets, smart TVs and other internet of things (IoT) devices. As a result, hackers have many more points to breach security controls.

    Implementing Zero Trust Policy is not easy. Some of the considerations include:

    • Verifying the identity of authorised users, often using 2FA. In newer implementations, the authentication is via an authenticator app.
    • After the user is verified, the device from which the user seeks authentication also needs to be verified. This usually requires some sort of device management system.
    • After the user and device used have been verified, then permissible access of the user and device needs to be verified. As an example, if a user logs in using a laptop with VPN, then the user can have access to certain pre-defined segments of your network or to certain pre-defined folders of your server. If the user logs in using an IoT device (which is generally views as having a higher risk), then the user is only allowed to access an even more restrictive segment of the network or server.
    • Some zero trust implementations also verify the types of services that a user or device is permitted to have access to. As an example, a user using an IoT device may only have ‘read only’ access to certain services while a user using a laptop will have full access to the same services.

    As the considerations are varied with numerous factors to be taken into account, you will need to work with your key staff and with an experienced IP provider to implement any zero trust policy. Further, it is likely that as you gain more experience, the policies will have to be modified to suit the working requirements of your organisation.

    Reduce Your Attack Surface

    One of the aims of any cybersecurity plan is to reduce the attack surface. The smaller the attack surface, the easier and cheaper it is to protect. Unnecessary complexity can result in poor management and higher chances of mistakes that allow greater opportunities for hackers to gain unauthorised access to your systems.

    The simpler step is to disable all unnecessary or unused: (a) software or applications; (b) computers or devices; and (c) user and admin accounts. However, this is not as easy as it sounds. Many of us allow staff to use their own laptops, tablets and mobile-phones (the Bring Your Own Devices or BYOD ‘culture’), for them to work from home (or for that matter, anywhere), and to use thumb-drives as a means of transferring or transporting files. Just these three steps have increased the attack surface multi-fold and made things more complicated. It makes scanning for vulnerabilities more difficult but makes implementing the zero trust policy more important.

    This cannot be done over-night because you do not want to disrupt your existing work processes that has been in place for a while. The cost for doing so also needs to be weighed against the savings. As an example, you should consider buying laptops for your entire office. That way, you can set the configurations for the laptops and only allow these laptops to access your office system. Any access from mobile devices (even your staffs’ own devices) can then be restricted to read-only access to limit any potential harm caused by such devices.

    Consider Cloud Services

    I will not be dealing with the decision whether to or not to migrate to the cloud. Rather I am just going to weigh cloud versus on-premise solutions from a cybersecurity standpoint. Hybrid WFH makes cloud services an important alternative to on-premise or hosted solutions although both of them have their own security issues.

    An important point to keep in mind, the cloud is not the solution to any hacking problem. A careless employee who gives out login credentials in reply to a phishing email will compromise the cloud service. So, training and all the previously discussed suggestions are still important.

    Further, the larger and established cloud service providers would have, either as a default or as an option, some of the cybersecurity solutions that I have suggested for a user to choose from. Discuss the options with your IT provider and the cloud service provider you are considering.

    I have listed some factors to be considered when deciding between cloud or on-premise solutions.

    Cloud ServicesOn-Premise Solutions
    Choice of Industrial Std Security Solutions at lower up-front costs and at subscription rates.You must decide on specific solutions, usually, at high up-front installation and implementation costs.
    Maintenance, up-grades, and monitoring are usually part of the cloud service and covered in the subscription.You must engage external provider or do these tasks yourself.
    Physical security of data centers and network usually best of class.You must provide for dedicated secured space and network on premises for hardware.
    Surrender control of data to provider.You have full control over what to implement.
    Larger service providers and their larger clients are usual targets for hackers (cloud hacking). You will be collateral damage, even if not a target.You might not be a target for hackers.  However opportunistic hackers might still spot vulnerability in your systems and launch an attack.
    Subject to downtime of provider.Subject to downtime of your own equipment.

    The Summary

    In summary and to recap all four parts:

    • Have a Written Breach Management Plan – Include C.A.R.E. (Contain, Assess, Report, Evaluate)
    • Prevention is Better Than Cure – Practice Cyber-hygiene
      1. Simple Steps
        1. Have Anti-Malware / Update Software
        2. Practice Password Hygiene:

    Strong password / Different Accounts, Different Passwords / 2FA / Don’t share passwords / Don’t login over unsecured wi-fi / Change passwords regularly / Use password manager

    • Learn to Spot Phishing Messages:

    Mismatched or Misleading Information / Beware of Homograph attacks / Use of Urgent or Threatening Language / Promise of Attractive Rewards / Request for Confidential Information / Unexpected Emails & Suspicious Attachments

    1. Training & Keeping up to Date
    2. Steps With Assistance
      1. Configure Email Servers – SPF /DKIM / DMARC
      2. Back-Ups – Multiple Copies & Off-site Copies
    • Encryption
    1. Monitor Your Systems
    2. Steps With Consultation
      1. Zero Trust Policy
      2. Reduce Attack Surface
    • Consider Cloud Services
    • Key Resources
      1. CSA’s Password Checker (https://www.csa.gov.sg/gosafeonline/Resources/Password-Checker)
      2. CSA’s Internet Hygiene Portal (https://ihp.csa.gov.sg/home)
      3. Talk to us at OTP Law Corporation. Our website site is otp.sg
  • Cyber-hygiene and Phishing Part 3: Simple Steps to Protect Yourself

    Cyber-hygiene and Phishing Part 3: Simple Steps to Protect Yourself

    by Lim Seng Siew, Director OTP Law Corporation

    In the first and second parts, we talked about what is a phishing attack and what to do if you are a victim. In this third part, we will talk about simple steps that you can take to reduce the chances of being a victim of such an attack.

    Cyber-hygiene – Prevention (or Reduction) is Better Than Cure

    It is impossible to prevent a cybersecurity incident from happening. You can only do so if you have infinite resources, infinite time, and infinite talent. And that is an impossibility. Instead, efforts should be focused on, firstly, making it difficult for a hacker to hack into your system, such that the hacker will move onto other targets, and, secondly, if there is a successful hack to reduce the opportunity for harm.

    I have divided the precautions that an organisation can take into 3 baskets:

    1. The first basket contains simple steps that an organisation can take on its own with minimal or no assistance from IT providers (Simple Steps Basket).
    2. The second basket is for those steps that an organisation can take with assistance from IT providers if the organisation does not have the in-house know-how to do so (Steps With Assistance Basket).
    3. And the third basket contains those steps that will require the organisation to work with IT providers as these steps often involve consultation with various stakeholders (Steps With Consultation Basket).

    I will deal with the simple steps in this article and leave the other 2 for a later one.

    It must be borne in mind that cyber-hygiene is not an IT issue, only for the IT staff to implement. It is an ‘all-of-organisation’ issue.  The hacker, using social engineering methods, will not be sending phishing emails to the IT staff of an organisation but to the general staff who are likely to be less aware of cybersecurity issues. Social engineering methods are methods used by hackers to manipulate our emotions such that we stop thinking rationally and start acting on impulse without proper regard to what it is that we are actually doing.

    Simple Steps Basket

    Have Anti-Virus / Anti-Malware

    Anti-virus and anti-malware software are almost similar, and the terms are often used interchangeably. However, there are important differences. Anti-malware generally has a broader coverage then anti-virus with advanced features such as sandboxing and removal of potential malware applications, behaviour monitoring to identify threats based on suspicious behaviour rather than relying on the ‘signatures’ of pre-existing and known threats and is designed to be used in a business environment across the entire organisation. As a result, anti-malware is generally more expensive than a plain vanilla anti-virus software.

    It is also important to have the software installed on all potential attack surfaces. An attack surface is all possible points of attack, whether physical or digital, where an unauthorised user can gain access to a system. The digital attack surface encompasses all the hardware and software that is connected to an organisation’s network. These include applications, codes, ports, servers, and websites. The physical attack surface comprises all endpoint devices that an attacker can gain physical access to, such as desktop computers, hard drives, laptops, mobile phones, tablets, Smart TVs and USB drives. Even passwords written on paper and physical break-ins to premises are potential physical attack surfaces.

    Update Your Software

    All software, even those from well-regarded software companies, have bugs. Some of these bugs can result in serious vulnerabilities to systems where the software is used. Hackers routinely scan for such vulnerabilities and once a vulnerability is found, will attempt to exploit it before the software developer discovers and patches the vulnerability. Updating all your software regularly will reduce the hacker’s opportunity to exploit vulnerabilities in your systems.

    Many modern commercial off-the-shelf software have automatic updates, some even have this enabled by default while others require you to manually enable this feature. The general rule is to enable automatic updates with one key exception, if your system uses customised software. Occasionally customised software relies on third-party software libraries. If these third-party libraries are updated and routines relied on by your customised software are depreciated (ie made obsolete), your customised software may suddenly stop working. Responsible developers of customised software will have their own updates to avoid this situation, but it is always prudent to check with them.

    Practice Password Hygiene

    Passwords enable a user to access important accounts and data, making them an attractive target for hackers. Further, just about everything about passwords is inconvenient, from creating them, remembering them, and using them. On one hand they cannot be too simple otherwise they can be easily cracked. On the other hand, they cannot be too complicated otherwise they will be forgotten. So, some password hygiene tips.

    First, use strong passwords. The recommendation is to have at least 12 characters mixing uppercase and lowercase letters with numbers and symbols. Popular these days is to use a passphrase comprising a few words strung together. As such phrases are easier to remember, users are less likely to write them down. An example is a passphrase like “2minutE1@QquiZ”, ie “Two minute Ten Question Quiz”. The Cyber Security Agency (CSA) of Singapore has a webpage (at https://www.csa.gov.sg/gosafeonline/Resources/Password-Checker where you can check the strength of your password. Use it.

    Second, use different passwords for different accounts. A big No! No! is using the same password for your personal and corporate accounts. While this may make remembering the passwords difficult, there are tricks that can be used to make this easier. As an example, use a passphrase like “2minutE1gma@QquiZ” for your gmail account and “2minutE1yah@QquiZ” for your yahoo account.

    Third, enable and use 2-factor authentication (2FA) wherever possible. Modern 2FAs is as simple as receiving a one-time passcode on your mobile device. Most organisations, including Google and Microsoft, offer 2FA free of charge.

    Fourth, do not share your passwords with anyone and do not write them down. If you need to grant temporary access to anyone, change your password to a ‘throw-away’ password. Once the need for that temporary access is over change the password back to a more lasting one. Remember that some systems do not allow you to recycle old passwords. So, you may have to change your password from “2minutE1@QquiZ” to “3minutE1@QquiZ”.

    Fifth, do not login to online services over an unsecured wi-fi network. If you are unsure about the ‘free’ wi-fi network, make use of the hotspot feature on your mobile-phone. You can then tether your laptop or tablet to your mobile-phone hotspot.

    Sixth, change your passwords regularly. The recommendation is to change them every 90 days. However, many users will find this too troublesome.

    Seventh, consider using a password manager. Having a unique password for every account or service that must be changed every 90 days will mean a lot of passwords to manage. Unless you have perfect memory, you will need something to help you remember these complex passwords. The temptation to writing them on a sticky note attached to the back of the monitor should be resisted. Instead consider using a password manager. These secure applications store all your unique passwords and can generate new strong passwords as needed. Many password managers can sync the information across multiple devices so you will never be without the correct password when they are needed. Another great feature many password managers have is website verification. If you click on a phishing link instead of the real one, the password manager will not auto-fill your password.

    Learn how to Spot Phishing Scams

    Here are some of the signs to look out for to determine if there is a possible phishing scam.

    (a) The message has mismatched or misleading information.

    One of clearest indicators of a phishing scam is when the information in the message is wrong. As a simple example, the message asks you to confirm your payment instructions to Bank A. However, you do not have any account with Bank A or that you had not issued any payment instructions in the past few days. That message is very likely a phishing scam.

    The more sophisticated hackers are more subtle. They will attempt to mislead you into believing that the information you see is genuine. Therefore, you need to examine the information closely.

    If the message asks you to click on a link to a website, check the website address carefully. Better yet, re-type the website address into your web browser from a source that you know is correct. Hackers often create phishing websites with web addresses (or URLs) that are visually similar to the genuine websites. This technique is called a homograph attack or script spoofing. A simple example is when the web address substitutes a “0” (ie zero) for an “O” or a “1” for an “l”.

    More sophisticated methods substitute either Cyrillic or Greek characters for our usual Latin ones. An example of this is the word “bank” compared with “bаnk”, the first using the Cyrillic character for “a” while the latter is the usual “a” of our Latin character. The Cyrillic letters – а, с, е, о, р, х and у  – are those that you should look out for because of their visual similarity to those that we are used to. The latest versions of popular browsers have built-in protection against most homograph attacks.

    Sometimes, the link ‘as shown’ in the body of the message appears to be a legitimate one. However, if you click on the link, you will be brought to another website. If you move (or hover) your mouse over the link before clicking, a small window will pop-up showing you the true destination. If the two links (the ‘as shown’ link and the link shown when you hover the mouse) are different, it is a strong indicator of a phishing message.

    A similar technique is also used for email addresses, they may look similar to, but are in fact different from an organisation’s official email. Hover your mouse over the email to see the true address. Also check the cc or bcc lists to see if there are any unusual addresses. Unusual emails in such lists is a sign of a ‘man-in-the-middle’ attack. A ‘man-in-the-middle’ attack is when the attacker secretly relays and alters the messages between 2 legitimate parties who believe that they are directly communicating with each other when in fact they are referring to the ‘man-in-the-middle’.

    (b) The message uses urgent or threatening language.

    Hackers also use urgent or threatening language in their messages. It’s a social engineering trick. Urgency can mean you act before you think. Hackers often use words like “Urgent action required”, “Your account will be terminated”, “This is your boss. Transfer money to me urgently.” The fact that the message is unexpected helps create that sense of urgency. Take your time. There is in fact very few situations when you need to respond to any message immediately.

    Other tricks used by hackers to create a sense of urgency include saying that they’ve noticed suspicious activity or login attempts, claiming that there is a problem with your account or payment, saying that you need to confirm some personal or financial information, claiming to be from some government authority who requires you to respond immediately, or issuing some ultimatum.

    (c) Promise of attractive rewards

    If it is too good to be true, it probably is. Phishing messages often offer amazing deals or rewards, again to encourage you to act before you can think. A recent technique used is to ask you to complete a survey (which will have questions about your personal and financial information) for a chance to win attractive, but not so ‘amazing’ that it would be suspicious, prizes.

    (d) Request for confidential information

    Nowadays, most organisations do not ask for your confidential information to be sent via unsolicited email or unsolicited calls. If the caller or sender claims to be from your bank and asks for your NRIC number or bank account number, be careful. Inquire further. Most scammers will not be able to respond properly to such inquiries.

    On the other hand, it is possible to be over cautious. Banks, as part of their security protocols, often ask you for certain information to verify your identity. So, if the caller asks for such information, is the caller legitimately from the bank or is the caller a scammer? When in doubt, contact the bank directly using the contact information from a legitimate source. Don’t rely on the contact information in the suspicious email.

    (e) Unexpected emails & suspicious attachments

    Hackers send out millions of emails in the hope that someone responds. Don’t be that one. If you receive an unexpected email and have identified it as a phishing email, do not click on any link or attachment. Instead delete it to prevent any accidental clicking. Also notify your IT provider so that the email address can be added to the organisation’s spam or blocked list.

    Training & Keeping up to Date

    The final suggestion in this basket is training, not just of the IT staff but also the general staff and senior management. Do the training regularly since people need reminding and hackers keep updating their techniques. Learning how to counter these new techniques is important.

    In addition, you should also keep up to date with the latest happenings in the cybersecurity world by checking or subscribing to resources provided by the PDPC, SingCert, and many of the major software or cybersecurity companies. These resources provide information about the latest vulnerabilities or hacks and their solutions or patches.

    You will also need to reassess your processes on a regular basis to deal with the newer techniques used by hackers or newly discovered vulnerabilities that have yet to be patched.

    In the fourth and final part of this series, we will discuss about the other steps that can be taken to reduce the chances of you being a cybersecurity victim.

    If you have a need to seek legal advice on your cybersecurity situation or just require legal assistance in any way, please reach out to us at enquiries@otp.sg or +65 64383922.

  • The Life-Cycle of a Start-Up: From Cradle to Grave (Part 3)

    The Life-Cycle of a Start-Up: From Cradle to Grave (Part 3)

    Article by Lim Seng Siew.

    Businesses do get married. There are a number of terms used to describe the various forms of business ‘marriages’: acquisitions or takeovers, mergers, joint ventures are among the common terms. Dealing with each in turn.

    Acquisitions or Takeovers

    An acquisition or takeover happens when one company (the acquirer) acquires most or all of the shares of another company (the target) to gain control of the target company. Most of the time, the acquirer pays cash for the target’s shares. Sometimes, the acquirer swaps its shares for the shares of the target company, termed ‘shares-for-shares’ swap.

    ‘Shares-for-shares’ swaps that result in the acquirer becoming a subsidiary of the target company are known as ‘reverse takeovers’. This often happens when a privately held company (technically, the target but in actual terms, the acquirer) with strong prospects ‘reverse’ acquires a listed shell company (technically the acquirer but in actual terms, the target) which has no legitimate business operations and limited assets.

    While in theory all the acquirer needs is to acquire 1 share plus 50% of the target company’s issued shares (ie 50% + 1) to gain control of the target, in practice this rarely happens. This is especially so when the target company is privately held, ie not listed on any stock exchange. Why would you, as a seller, give up control of your business to another without realising a substantial immediate financial gain? After all, there is always the possibility of the business failing because the acquirer doesn’t understand your business.

    Most acquisitions of privately held companies are friendly and happen with the mutual agreement of both the acquirer and the shareholders of the target. This does not mean that the negotiations for the deal will therefore be easy. Each party will still negotiate hard to extract the maximum gain from the deal. However the hard bargaining should be tampered by the bigger picture of the mutual benefits that can arise if the deal is successful.

    Some acquisitions can be hostile, commonly termed as ‘hostile takeovers’. The shareholders of the target company do not agree to the takeover. For listed companies, there are rules governing parties’ conduct during a takeover. The rules ensure transparency and fairness for all concerned in the deal. Takeovers of listed companies, especially hostile takeovers, are beyond the scope of this article.

    Mergers

    Closely related to an acquisition is a merger. In a merger, 2 separate business, usually of almost equal characteristics (in terms of size, market share, employees, scale of operations etc), join together to form a new legal entity. The 2 original businesses are usually dissolved after the merger is completed.

    Joint Venture

    A joint venture (or JV) is a business arrangement in which 2 or more parties agree to pool their resources for a specific project. The participants of a JV maintain their own businesses. The JV can be in the form of a separate company (JV Co) in which the participants are its shareholders. It can also be a partnership or a mere contractual arrangement commonly termed ‘consortium’.

    Once the project ends, often the JV Co is liquidated, the partnership is dissolved or the consortium disbanded.

    Other Forms of Business ‘Marriages’

    Sometimes, instead of the acquirer acquiring the shares of the target company, only the assets, contracts and businesses of the target company are acquired, ie ‘asset acquisition deals’. This typically happens when the target company is facing bankruptcy proceedings.

    There is also a management buyout, ‘MBO’ for short, where the company’s executives purchase a controlling stake in the company.

    There is another form of a deal called “Acqui-hire’ where the acquirer is not really interested in the business of the target but in the talent (ie key personnel) in the target company.  It happens fairly often in the start-up world where talent is in short supply. Acqui-hires are also used as a ‘soft landing’ by the start-up’s founders and employees when the start-up fails to raise more money for its needed capital. The irony with ‘acqui-hires’ is that the team from the failed start-up enters the office of the acquirer in an elevated position, with lots of money and guaranteed employment contracts, all thanks to a business that went broke.

    We have talked about what the various terms mean in a business ‘marriage’. In the next part, we will talk about the processes involved in an acquisition.

  • Cyber-hygiene and Phishing Part 2: Planning Ahead for an Attack

    Cyber-hygiene and Phishing Part 2: Planning Ahead for an Attack

    by Lim Seng Siew, Director OTP Law Corporation

    In the first part, we talked about what is a phishing attack. In this second part, we will talk about what to do if you are a victim of a hack.

    Steps to Take When an Incident Occurs – C.A.R.E.

    The PDPC has a very convenient 4-stage data breach management model under the acronym C.A.R.E. which stands for “containing” the breach, “assessing” risks and impact, “reporting” the incident and “evaluating” the response and recovery to prevent future breaches.

    The Data Breach Management Plan

    The 4-stage CARE model should be in your Data Breach Management Plan (sometimes called Incident Response Plan) and you should have a plan, even if you are a one-man operation. When a breach occurs, things are likely to move fast and will be chaotic. Planning ahead will help reduce the confusion and stress. Further, the plan should be in writing. In a chaotic situation you will forget. Therefore, when a suspected breach is detected, just whip out the plan and follow the steps listed. Remember that the plan need not be perfect. The Evaluation stage also involves re-evaluating your always ‘imperfect’ plan and refining it if necessary.

    It’s also not enough to have just a plan. Equally important is to test the plan with ‘dry-runs’. The dry-runs will familiarise your staff with the plan and identify any kinks or shortcomings with the plan. A practical tip is to have the dry-run as one of your office’s team building exercise. With a bit of imagination, it can be fun.

    Contain the Breach

    Act to contain the breach as soon as you are aware of a data breach. In earlier times, this can be to simply turn everything off. In today’s world, this may not be an option especially if some of the technologies used by your business involve cloud services. And even if you can turn the equipment off, at some point in time you will need to turn them back on. So other steps are still necessary.

    To contain the breach, your first step will be to change the passwords, not just of the hacked account but all others as well, especially when these other accounts use the same password.

    Next, do a full system scan with anti-malware apps to detect if any malware has been installed in any of the computers or devices used in your business. You need to know ALL the accounts and ALL the computers and devices used. So, the plan must have an updated list of all these accounts and equipment.

    Alert your banks and credit card companies. If necessary, change or stop your credit cards. You can do this while the scan is ongoing. The contact information of your banks and credit card companies should be in your plan. You should also monitor all your accounts for any suspicious activities.

    Call your IT provider (internal IT staff or an external service provider) for assistance and notify your cybersecurity insurer. These insurers will have the necessary experts on call to assist you with the more complicated containment and assessment situations. Further, they can advise on other precautions to take as their other customers may also be victims of the same hacker.

    Ask your IT provider to preserve the evidence of the hack or compromise such as the phishing email from which the attack started from, the system log files that record how the attack progressed, and/or the malware that was installed on your systems.

    The steps you take in the containment stage is focused on preventing further compromises, determining the extent of the breach, and implementing mitigating measures to minimise the impact of the breach.

    Assess Risks and Impact

    The second stage is to assess if your containment is working or if the hacking is still going on. If the hacking is still on going, then you should continue with the containment efforts until the hacking has stopped.

    Once the containment efforts are successful, then a deeper assessment of the data breach should be undertaken. That deeper assessment covers discovering the root cause of the breach, the effectiveness of the containment actions, and the effectiveness of any technical protection (eg encryption) of the data. Assistance from your IT provider or cybersecurity insurers is usually required to do this.

    In parallel with the technical assessment must be an assessment as to who needs to be informed of the incident. The steps taken to assess if the data breach is a notifiable breach under the DBNR must be documented as the PDPC may take enforcement action against you if they deem that there has been an unreasonable delay in that assessment.

    Report the Incident

    The next stage is to Report the incident. You should have determined during the assessment stage who should be informed.

    You should report the incident to the Police if a crime is suspected, to the PDPC if the breach involves personal data and is of a significant scale or causes significant harm, and to SingCert (Singapore Computer Incident Response Team) if it is a cybersecurity incident, and to the regulator of your business sector, if there is such a regulator. The PDPC also has a voluntary reporting scheme even if the incident is not a mandatorily notifiable one.  An incident or breach need not be a cybersecurity incident. As an illustration, if physical documents are stolen and those documents contain customer’s confidential information and/or personal data, the police and the PDPC should be informed but SingCert need not be informed since it is not a cybersecurity breach.

    The individuals whose data or information are compromised should also be informed. The PDPA requires the affected individuals to be informed as soon as possible, at the same time or soon after notifying PDPC. However, bear in mind that there could be some exceptions. As an example, if adoption information is involved, consider carefully whether certain individuals should be informed as the adoptee may not know that he or she is adopted.

    The PDPC Guide on Managing and Notifying Data Breaches says that you have 30 days to determine if it is a notifiable breach. Any longer will have to be justified to PDPC. However, once it is determined that there is a notifiable breach, you must report to PDPC within 3 days. The PDPC has a webpage (at https://eservice.pdpc.gov.sg/case/db where reports can be made.

    Except for the requirements by the PDPC, there are no hard timelines for when an organisation must notify other parties. However, you should do so as soon as possible. You don’t want to explain to the affected customers why you took 3 months to notify them. Explaining to them about the incident is already difficult enough.

    Evaluate the Response and Recovery

    The final stage is to Evaluate how you responded to the incident. Do that after the chaos has reduced and the reports made. This is so that you can deal with the next incident better.

    Things for you to consider in your post-breach evaluation include:

    1. Determining the cause of the incident. Are there signs that should be monitored to prevent another similar incident? Are there weaknesses that can be strengthened?
    2. Evaluating the effectiveness of the initial containment actions. Are there weaknesses that can be strengthened?
    3. Evaluating the Data Breach Management Plan. Does the plan need to be updated?
    4. Evaluating the effectiveness of external parties like your IT provider or cybersecurity insurer. Were they able to effectively support you during the incident? What feedback can you give them? In a more drastic situation, you might have to consider engaging a fresh set of external parties.
    5. Evaluating employees’ response. Were employees aware of security related issues? Were the key employees (like your internal IT team) given sufficient resources to manage the incident? Is additional or refresher training required?

    Thus far, we have been dealing with what to do after an incident has occurred. In the third part of this series, we will discuss what are the simple steps to take to reduce the chances of being a victim of a hack.

    If you have a need to seek legal advice on your cybersecurity situation or just require legal assistance in any way, please reach out to us at enquiries@otp.sg or +65 64383922.