MyCERT 3rd Quarter 2011 Summary Report - CyberSAFE Malaysia

12transactions, electronically through the useof digital signatures. This Act is an enablinglaw that allows for the development of,amongst others, e-commerce by providingan avenue for secure on-line transactionsthrough the use of digital signatures. TheAct provides a framework for the licensingand regulation of Certification Authorities,and the recognition of digital signatures.The Controller of the Certification Authoritywho has the authority to monitor andlicense recognized Certification Authoritieswas appointed on 1st of October 1998.iii.Communications and Multimedia‘Art. 249 of the Communications andMultimedia Act requires people, during asearch, to give access to computerised datawhether stored in a computer or otherwise,which includes providing the necessarypassword, encryption code, decryptioncode, software or hardware required toenable comprehension of computeriseddata. Refusal to cooperate is punishablewith at most RM100,000 and/or two years’imprisonment (art. 242). This Act containsa provision (art. 256(2)) allowing people torefuse answering questions if they therebywould incriminate themselves; by contrast,the privilege against self-incrimination canbe deemed not to hold for complying with adecryption order.’An authorized officer making an investigationunder this Act may verbally examine aperson who supposed to be acquaintedwith the facts and circumstances of thecase. The person shall be legally bound toanswer all questions relating to the caseput to him by the authorized officer, but theperson may refuse to answer any questionswhere the answer to which would have atendency to expose him to a criminal chargeor penalty or forfeiture. A person making astatement under this section shall be legallybound to state the truth, whether or not thestatement is made wholly or partly in answerto questions.ConclusionCryptography itself is a harmless system.It was built to defend the security systemsof individuals or a nation. The nature ofcryptography is defensive and not offensive.It depends on the user to use it wisely.Cryptography tools are not easily importedor exported because there may be issues thatwill arise at the end of the day if people wereto use cryptography for negative purposes.Restrictions are not same in all countries andthere are no standard restrictions. It dependson what is the government’s view on theimpact of applying cryptography in theircountry. From my personal point of view,cryptography restrictions are not necessarybecause cryptography is not a harmful tool.Cryptography does protect communicationsand does not serve to take advantage onothers. It is the people factor that still playsa role in determining the dangers associatedwith cryptography. ■References1. Whitfield Diffie and Susan Landau(2005). The Export of Cryptography inthe 20th Century and 21st. Palo Alto: SunMicrosystems.2. Wassenar Arrangement onExport Controls for Conventional andDual-Use Goods and Technologies.http://www.wassenaar.org/index.html3. Cryptography Export Laws.http://www.freeswan.org/freeswan_trees/freeswan-1.5/doc/exportlaws.html4. Export or Import Restrictions.http://www.citrix.com/lang/English/lp/lp_1319021.asp5. John Markoff. International GroupReaches Agreement on Data-ScramblingSoftware. The New York Tomes.e-Security | Cyber Security Malaysia | Vol: 28-(Q3/2011)© CyberSecurity Malaysia 2011 - All Rights Reserved