Asia's cyber future: control, code and the new legal frontier

Asia Times

29-05-2025

By any measure, Asia is no longer just catching up in cybersecurity—it's redefining what the legal future of the digital world might look like. That future, though, is anything but cohesive.
As nations in the region push ahead with ambitious digital transformations, they're also rewriting the rules of online conduct, each in their own style, driven by distinct political pressures and national objectives.
The urgency is not abstract. In the first three months of 2025, the region accounted for nearly half of global data breaches. Not a typo—43%. And the attacks aren't just increasing in number. They're sharper and more systemic.
Intrusions jumped by over 100% compared to the same period last year. Across capitals from Dhaka to Seoul, lawmakers are racing to catch up—not just with criminals but with each other.
What's emerging is not a unified playbook but a clash of legal imaginations. Some are focusing on digital sovereignty. Others on AI accountability. Few agree on definitions. Fewer still on enforcement.
However, taken together, the shifts underway across Asia offer a revealing glimpse into how different societies are navigating the risks and promises of the digital age.
Bangladesh may have surprised even its critics when it tore up its controversial 2023 cyber law this May and replaced it with something far more rights-oriented. The new ordinance doesn't just add some civil liberty language to old rules. It treats internet access as a civic entitlement—a radical departure for the region.
At the heart of the reform are three major shifts. First, it directly tackles AI-generated abuse, criminalizing the use of deepfakes and synthetic media for harassment and disinformation. It goes beyond regional peers by including politically manipulative content in its net. Second, platforms now have 72 hours to take down flagged content.
Notably, protections for journalists were written in, shielding reportage from takedown demands. Third, district-level cyber tribunals have been empowered to clear a backlog of tens of thousands of cases—an administrative nightmare that had previously gummed up the justice system.
Still, all is not settled. One provision bans online content deemed hateful to religion but offers no clear guidance on what that means in practice. Platform moderators are now caught between local enforcement and vague standards—a legal ambiguity that recalls similar tensions in Pakistan.
In January, Pakistan passed amendments that created a new Digital Rights Protection Authority designed to oversee—and in many ways, control—online speech. The law grants the body broad authority to block content considered harmful to 'national cohesion,' a term that raises eyebrows for its vagueness.
Yet it also breaks new ground. Companies are now required to publish the accuracy rates of their AI moderation tools, a move that has not been attempted anywhere else. And under the new data rules, foreign platforms must localize data for Pakistani users—a mandate that's putting them on a collision course with multinational cloud providers.
But the most debated feature is the financial penalty. Anyone found spreading 'fake news' faces a steep fine—just over $7,000. Since the law passed, a majority of journalists surveyed have reported pulling their punches. The chill is real.
India's approach in 2025 has been a study in contrasts. On paper, the country has strengthened its central cybersecurity apparatus. CERT-In now requires organizations to report breaches within six hours, especially in sectors like finance. It's one of the fastest mandates in the world.
Yet enforcement is uneven. While the Reserve Bank has pushed ahead with sophisticated monitoring requirements for fintechs, the Health Ministry is behind schedule by over a year on medical cybersecurity guidelines.
The result is a patchwork: some sectors are under constant surveillance while others are barely regulated at all. This fragmentation risks creating blind spots where threats can hide in plain sight.
Singapore remains the gold standard for rule-based digital governance. Its recent amendments extend protection to temporary critical infrastructure—like cloud systems used during elections—and demand rigorous annual security audits. Vendors working with state systems must now sign binding cybersecurity clauses. There's even a mandate for AI-powered stress testing of defenses.
That's one end of the spectrum. On the other, countries like Vietnam continue to allow the market to set its own pace. A striking 78% of Vietnamese fintech firms still lack formal breach response protocols. The legal inertia there stands in contrast to regional initiatives trying to foster a more unified cybersecurity front.
ASEAN, to its credit, is experimenting with shared threat intelligence and harmonized reporting formats. The effort has improved regional ransomware tracking, though not without friction. Malaysia's insistence on strict data localization laws, for example, makes real-time threat sharing harder than it should be.
Japan's 2025 data protection amendments have tried to strike a balance. On one hand, they reduce the burden on certified companies by extending breach reporting deadlines. On the other, they push forward on AI and biometric oversight.
New rules require audits for facial recognition systems in public spaces. At the same time, Japan has greenlit the use of personal data for AI model training without prior consent—a controversial, but calculated bet to stay ahead in the generative AI race.
South Korea, meanwhile, is shaping the frontier. Its AI Framework Act, set to roll out later this year, introduces mandatory algorithmic impact assessments for public systems with large user bases. Political content generated by AI must be watermarked.
Financial institutions are now on the clock to adopt quantum-proof encryption before 2027. These are not just technical tweaks; they're policy bets on how the future will unfold.
Then there's China. Its revised Cybersecurity Law doubles down on surveillance and state control. New provisions restrict biometric data collection—no gait analysis or keystroke tracking without official approval.
The definition of 'critical data' has expanded to include electric vehicle systems and smart grids. Fines for repeat violations can now hit 5% of global revenue, and they apply retroactively. Compliance, especially for foreign firms, is becoming a labyrinth.
Beneath all these laws lies a deeper issue: people. Or rather, the shortage of them. Asia faces a cybersecurity talent gap that's now over three million people.
In India, there's one chief security officer for every 12,000 companies. In Indonesia, more than half of new hires don't understand basic encryption. Singapore has started subsidizing AI security certifications, and it's helping, but slowly.
Legal bottlenecks are also slowing down cross-border enforcement. Mutual legal assistance requests between ASEAN nations and China often take more than a year. Standards on cryptocurrency tracing vary wildly. South Korea allows AI-based forensic evidence; Indonesia doesn't even recognize it.
Three themes are beginning to dominate: the regional race to regulate AI, the mismatch in incident response timelines and the outsourcing boom that's turning cybersecurity into a service industry. Roughly 40% of ASEAN firms now rely on offshore security operations teams—many of them in India or Israel.
Where does it all go from here? Much depends on whether countries can align on legal frameworks for AI accountability, quantum-era encryption, and cross-border evidence sharing.
Talks are already underway. Vietnam and Indonesia are preparing new cybersecurity bills for later this year. What they choose to emphasize—or ignore—will shape the next phase.
The legal battles of this digital era won't be fought in courtrooms alone. They'll be written into contracts, baked into software and hashed out between regulators and engineers. And increasingly, Asia is where that future is being drafted—in multiple languages and under wildly different philosophies of control.
Md. Ibrahim Khalilullah is a law student and vice president of the Bangladesh Law Alliance (BLA).