Overview:
A cybersecurity bill headed to President Surangel Whipps Jr.’s desk would create a new Bureau of Cybersecurity with duties that closely mirror those already assigned to a technology office he established by executive order months earlier — raising questions about how the two would work together.
By: L.N. Reklai
KOROR — The Senate gave final approval July 20 to legislation establishing Palau’s first comprehensive cybersecurity system, voting 13-0 to pass Senate Bill No. 12-9, SD1, HD2 on third reading — even as a separate executive order signed months earlier already created a new technology office within the Office of the President with some similar responsibilities.
The bill, introduced by Sen. TJ Imrur Remengesau and co-sponsored by four other senators, now heads to President Surangel Whipps Jr. for his signature.
SB 12-9 amends Title 15 of the Palau National Code by adding a new chapter establishing a “Bureau of Cybersecurity” under the Ministry of Public Infrastructure and Industries, to be led by a newly created Chief Information Security Officer appointed by the president with Senate confirmation. Lawmakers found that while Palau’s growing internet connectivity has expanded access to education, commerce and public services, it has also created new risks that “bad actors” could exploit to harm users and vulnerable groups, including minors.
Among its key provisions, the bill directs the Bureau of Cybersecurity to:
- Set minimum security standards for government agency information technology systems
- Monitor agency networks to detect and respond to security incidents
- Develop a centralized breach reporting process requiring agencies to notify individuals, companies or groups whose data has been compromised
- Create a model incident-response plan coordinated with state and national cybersecurity agencies
- Establish an advisory committee, with members appointed by the Ministry of Finance, the Senate, the House of Delegates and the president, to help shape a national cybersecurity plan
The bill also sets penalties for breaches of data confidentiality and security. Officers, employees or agents who intentionally or recklessly access, disclose or misuse protected data could face administrative discipline, including termination, and civil penalties of up to $10,000 per instance.
The legislation authorizes $150,000 in initial funding for the bureau and requires it to submit annual budget requests to the Olbiil Era Kelulau to sustain the country’s cybersecurity infrastructure and retain technical staff. A floor amendment adopted July 20 also added an unrelated provision amending Section 604 of Title 7, allowing the president to extend a contract for operation of the Republic of Palau Open Ship Registry by up to six additional months under certain conditions.
Overlap with existing executive order
The bureau SB 12-9 would create arrives after Whipps signed Executive Order No. 500 in April, establishing the Office of Applied Technology and Strategy (OATS) directly within the Office of the President. That office is headed by a Chief Technology Officer who serves at the president’s pleasure and has direct access to the president, including attendance at Cabinet meetings.
Under the executive order, the CTO’s duties already include assessing and advising on technology-related risks such as cybersecurity, data governance and system resilience; reviewing technology procurements government-wide; and supporting implementation of the Palau National Cybersecurity Strategy — functions that closely track several duties SB 12-9 would assign to the Bureau of Cybersecurity and its Security Officer.
Both roles are also tasked with advising the president on technology matters and coordinating with other ministries and agencies on security-related issues, though the two offices would sit in different parts of the executive branch: OATS within the Office of the President itself, and the Bureau of Cybersecurity administratively attached to the Ministry of Public Infrastructure and Industries.
The executive order does not reference SB 12-9 or the Bureau of Cybersecurity, and the bill’s text does not mention OATS or the CTO position, leaving open how the two offices’ mandates — one created by executive order, the other by statute — would be reconciled if the bill is signed into law.
