During its plenary session on December 16, Parliament held the final discussion of a bill on cybersecurity and instructed the Standing Committee on Innovation and e-Policy to prepare it for parliamentary approval.

The bill was formulated to establish a legal basis for cybersecurity activities and regulate relations related to ensuring the integrity, accessibility and confidentiality of information in the cyber environment.

The bill addresses cybersecurity through information systems and information networks used to access, process, use and disseminate digital information, as well as their risk prevention, detection, suppression, response and recovery.

It stipulates that intelligence agencies conduct cybersecurity risk assessments of state-owned legal entities, guarantee special equipment and software, operate digital analysis laboratories, and evaluate projects and programs to be implemented through loans and grants.

The bill also states that almost all intelligence agencies will be solely responsible for cybersecurity, according to lawmaker B.Bat-Erdene.

In accordance with the bill, there will be a national center to deal with and respond to cyberattacks across the country. Parliamentarian N.Uchral said that it would operate under the General Intelligence Agency. Moreover, a public center will be established to combat private and civilian cyberattacks. The public center will operate under the state administrative body and be headed by the prime minister, N.Uchral noted.

During the session, legislator Ch.Khurelbaatar commented, “It is questionable whether it is right to authorize the General Intelligence Agency to be in charge of this sector. Will foreign organizations cooperate with the Mongolian inntelligence agency? International IT companies are responsible for cybersecurity. It is also doubtful whether it is right to concentrate all power on the prime minister. In accordance with the bill, the IT sector will have to obtain permission from the General Intelligence Agency to receive loans and assistance. This bill’s approach is wrong.” 

N.Uchral responded that the National Security Council, government, and General Intelligence Agency suggested that the intelligence service be responsible for information of public and private organizations.

“Considering that the information security of private organizations and citizens should not be under the control of law enforcement agencies, it was decided that the public center should be under the Ministry of Communications, which is expected to be established soon. The national center is designed to provide security for state information. Since the government is responsible for cybersecurity policy, the public center will be established under the prime minister. We believe that in the event of an attack, it would be appropriate to set up a joint team,” he explained.

Parliament approved the draft amendment to the Criminal Code, which was submitted together with the bill on cybersecurity. In particular, Article 26 on crimes against cybercrimes of the law was amended. 

Moreover, in line with the bills, Parliament amended the Criminal Procedure Code of Mongolia. It stipulates that the General Intelligence Agency will investigate cases of infringing, modifying, editing, concealing, adding, copying, or disabling information by attacking systems, networks, state official and special-use networks and organizations with critical information infrastructure that contains information related to state secrets. The bill also provides for intelligence agencies to investigate cases of preparation and sale of special software and hardware for illegal access to these networks.