A Map Without Clear Milestones

Cybercriminals have already cost Bruneians millions. But what happens when the next target is not your bank account, but the nation’s essential services? Brunei has cybersecurity laws, institutions and strategies. Are they keeping pace with evolving threats? In matters of national security and sovereignty, can we afford to discover weaknesses too late?

 

Brunei’s cyber threats are evolving. Its national strategy carries conflicting timetables, while the public has yet to receive a clear accounting of key readiness commitments.

By Malai Hassan Othman

KopiTalk with MHO | Part Two of Two: The Road Knows Where You Live

 

Cybercriminals have already taken millions of dollars from Bruneians. The money has gone through online scams, impersonation and other forms of digital deception, often beyond any hope of recovery.

 

In June 2025, the then Minister of Transport and Infocommunications, Yang Berhormat Pengiran Dato Seri Setia Shamhary bin Pengiran Dato Paduka Haji Mustapha, disclosed that online scams had cost victims BND12.2 million over three years.

 

The losses have continued. Between 10 March and 7 May this year, the Royal Brunei Police Force investigated 193 fraud cases involving BND1.85 million during Operation FRONTIER+ III, a Singapore-led crackdown on transnational scam networks.

 

Fourteen people were arrested locally. The cases ranged from impersonation of government officials to e-commerce fraud, social media impersonation and loan scams.

 

The two sets of figures cover different periods and should not be added together. Behind both are families whose savings and whose trust in digital services have been shaken.

 

The authorities have not stood still. Police investigations, awareness campaigns, telecommunications safeguards and cross-border operations all show sustained effort.

 

Yet the losses pose an awkward question. Are our defences stopping criminals, or are we simply getting better at counting the damage after the money has gone?

 

Scams are the threat Bruneians can see. The harder test is whether the country is prepared for the threats it cannot see.

 

The first part of this essay began with Malaysia’s decision to bar its civil servants from using Waze. The concern there was not theft but observation: the quiet record of where officials go, how often and when.

 

A phone or connected car can build that record without any system being hacked. Brunei has not publicly set out a distinct framework for managing the security implications of such commercial location data.

 

Observation is not the only risk. Brunei’s own National Cyber Security Strategy warns that state-sponsored actors are targeting critical information infrastructure, the systems behind energy, water, banking, healthcare and government.

 

The strategy cites a regional example. In 2022, a group known as Dark Pink, documented by the security firm Group-IB, attacked government and military bodies in Southeast Asia, including a Malaysian military body.

 

In a compact country, a serious disruption to one essential service could quickly reach others. That is a reason for preparation, not a claim that any system here has been compromised.

 

The warning has come from the very top. In his titah on the 35th National Day in 2019, His Majesty Sultan Haji Hassanal Bolkiah Mu’izzaddin Waddaulah ibni Al-Marhum Sultan Haji Omar ’Ali Saifuddien Sa’adul Khairi Waddien, Sultan and Yang Di-Pertuan of Brunei Darussalam, stressed that cyber security must be given special attention.

 

His Majesty cautioned that the negative effects of the cyber world could seep into the nation, society and the family.

 

Much has followed. Cyber Security Brunei was established in 2020. The Cybersecurity Act provides protections for designated critical systems, while the Personal Data Protection Order 2025 regulates personal data handled by organisations within its scope.

 

In September, Cyber Security Brunei released Version 2.0 of its Code of Practice for critical information infrastructure, adding clauses on artificial intelligence security and secure-by-design principles.

 

At the CySec 2026 conference that month, the Minister of Transport and Infocommunications, Yang Berhormat Dato Seri Setia Mohd Riza bin Dato Paduka Haji Mohd Yunos, gave the keynote address.

 

“Resilience must therefore be incorporated from the outset,” he said, covering how systems are designed, bought, developed, deployed and run. It was the right message, and a demanding one.

 

The difficulty lies with the document meant to guide all this. The national strategy, published in August 2023, carries the dates 2023–2027 on its cover.

 

Inside, its executive summary sets its objectives “within the 2022-2026 period”. Its implementation chapter is plainer still: the strategy “shall then be implemented for 5 years from 2022 to 2026”.

 

Cyber Security Brunei identifies 2023–2027 as the official period. The earlier dates in the published text do not establish a 2026 expiry, but they leave an avoidable ambiguity about the implementation timetable.

 

The world around the strategy has also moved. It was aligned with the Digital Economy Masterplan 2025, which has since been succeeded by Digital Brunei 2030.

 

The minister who signed its foreword now leads another ministry. His successor told a digital conference in August that Brunei must shift from planning to execution.

 

The threats have shifted too. The strategy’s threat chapter gives substantial attention to scams, ransomware, phishing and hijacked social media accounts.

 

Artificial intelligence is not addressed in it, though the updated Code of Practice has since begun to fill that gap. Nor does it set out a distinct approach to connected vehicles or commercial location data.

 

The strategy describes itself as a live document, to be revised at regular intervals. Its broad risk-management principles remain relevant even as technologies and threats change.

 

A new digital plan, an updated Code of Practice and the conflicting dates in the published strategy make this an appropriate moment to clarify milestones and review emerging risks.

 

The strategy also made promises that can be measured. It committed to a National Cyber Security Maturity Assessment, and to mechanisms providing “ongoing visibility” of progress towards its objectives.

 

No published findings could be located. Has the assessment been completed? What gaps did it identify, and which have since been closed?

 

Some findings must stay confidential. No country publishes a map of its own weak points, and none should.

 

But a progress report need not reveal vulnerabilities. It can state which assessments were carried out, which capabilities were strengthened and which priorities remain open.

 

A refreshed strategy could clarify its timetable, align implementation milestones with Digital Brunei 2030 and explain how progress will be measured.

 

An annual public update could identify completed assessments, strengthened capabilities and priorities still outstanding without disclosing sensitive technical details.

 

The strategy could also address connected vehicles and commercial location data more directly, building on recent measures covering artificial intelligence and secure-by-design principles.

 

And the response to scams could be measured not only by arrests, but also by attempted fraudulent transfers stopped before victims lose their money.

The scammers have already shown what happens when individuals are exposed. Their victims discovered the limits of their defences by losing their savings.

 

A nation should not discover its limits the same way. A strategy is a map for the road ahead. It serves the nation only when its milestones are clear, and when someone can show how far along the road we have come.