In January 2026, the ASEAN Digital Masterplan 2030 (ADM 2030) was launched at the 6th ASEAN Digital Ministers’ Meeting (ADGMIN) and Related Meetings, setting the strategic direction for ASEAN’s digital integration efforts over the next five years. The ADM 2030 spans areas such as the enhancement of digital infrastructure, e-governance, cybersecurity, and the digital economy.
A key outcome for the region is the development of a resilient, secured and trusted digital ecosystem to facilitate the adoption of digital services and trusted cross-border data flows. Consultation with stakeholders in the development of ADM 2030 surfaced cybersecurity as one of the top three barriers to ASEAN’s digital progress. Cybercrimes now account for 30% of all recorded crime in Southeast Asia (SEA). The cyberscam threat in the region is well-documented: the combined annual loss from scam offences across East Asia, South-East Asia, Australia, and New Zealand is estimated at between US$ 88.3 billion and 114.1 billion for 2025, alongside cyberscam centres that have trafficked people from across the globe. Data breach costs incurred by businesses in SEA have reached a record high of US$ 4.12 million according to IBM.
Threats to the region’s digital ecosystem are evolving. The increasingly transnational nature of cybercrimes, and the emergence of new risks such as content abuse, deepfakes and impersonations, online child exploitation, misinformation and disinformation, and harassment necessitate regional coordination.
The ASEAN Cybersecurity Cooperation Strategy 2026-2030 outlines the vision for consolidated ASEAN cybersecurity efforts. Key to realising this vision is the Roadmap on the ASEAN Cooperation on Online Safety, coordinated by Brunei Darussalam.
In view of developing this roadmap, the Authority for Infocommunications Technology Industry (AITI) of Brunei Darussalam organised the ASEAN Cooperation on Online Safety Workshop, where Arifah Sharifuddin contributed TFGI’s perspective on the principles that could potentially underpin a regional framework for online safety and evidence-based interventions for cross-border harms.
Moderators and Panellists
Moderator
- Siti Umi Athirah Haji Ra’emi Maleek, Senior Manager, International, AITI
Panellists
- Mediodecci Lustarini, Secretary of the Directorate General of Digital Space Oversight, Ministry of Communications and Digital Affairs (MCDA), Indonesia
- Clara Koh, Director, Public Policy, Central Southeast Asia and ASEAN, Meta
- Muhammad Nadzmi Abd Aziz, Head of Policy Research and e-Safety Department, Malaysia Communications and Multimedia Commission (MCMC), Malaysia
- Arifah Sharifuddin, Institute Director, Tech for Good Institute
- Lim Li Chyi, Advocate, Yusof Halim & Partners, Brunei Darussalam
Key Takeaways
- Inclusivity, shared responsibility, and resilience are necessary for cultivating online safety
Cross-border digital harms are often difficult to litigate or prosecute, due to the lack of alignment in regulatory and enforcement capacities across multiple jurisdictions. SEA, for example, lacks a regionally aligned definition for scams and fraud, and legal frameworks to address this vary from country to country. Similarly, there is no universal legal treatment of online harms, with recent attempts to expand the definition of what constitutes them. Singapore, for example, enforced the Online Safety (Relief and Accountability Act of 2025 (OSRAA) in June 2026 to cover categories such as doxxing and online stalking; Malaysia’s framework established six months earlier through the Online Safety Act 2025 encompasses child sexual abuse material, financial fraud, and categories associated with harassment, terrorism or violence and indecent content.
Establishing the principles that underpin future digital cooperation agreements is vital in the design of shared regional guidelines for online safety. In the context of SEA’s complex cyberthreat landscape and in recognition of diverse sociocultural norms and regulatory regimes, it is important for such a regionally aligned safety framework to uphold inclusivity, shared responsibility, and resilience.
Preliminary findings from TFGI’s ongoing survey on scams and fraud in the region reveal that demographic features (e.g., age, gender, employment) are less of a predictor of vulnerability to online harms than a person’s exposure to and usage of digital technologies. While such traits should still be considered in the design and implementation of solutions, prioritising inclusivity recognises that anyone can become a victim of an online harm.
TFGI’s research consistently shows the need for a whole-of-society approach where responsibilities are distributed across society. Governments, platforms, financial institutions, telcos, communities, and users all have a role to play in mitigating online risks and challenges. Sharing responsibility leverages expertise across sectors and disciplines to create holistic online safety measures.
Regional efforts should also look toward cultivating longer-term digital resilience. This requires looking beyond short-term monitoring and response. Interventions need to consider victim support and recovery, and remain adaptive to address new and emerging schemes.
- Measure readiness through response, not just awareness
Raising awareness of online harms is often the first step in addressing them, as seen in campaigns against online gender-based violence and online child sexual exploitation and abuse.
But awareness alone is not enough. Preliminary findings from TFGI’s survey on scams and fraud indicate that while there is relatively high confidence in detecting and identifying attempts, less than 20% of respondents from the SEA-6 (Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam) are able to determine safe actions after an attempt and have a clear understanding of where to report. Previous scam victims are also not necessarily more capable than non-victims of identifying a scam or fraud attempt the second time around.
Facilitating digital readiness begins with ensuring digital users know, understand and can routinely execute a safe response to online harms when encountered. Initiatives across the threat incident lifecycle should aim to build response as a muscle.
Countries are working toward this in various ways. SG ScamWISE is an example of a collaborative national education programme that pulls from the expertise of different sectors to develop innovative learning tools and develop a culture of continuous learning across demographic groups. Citizen-driven reporting platforms incentivise citizens to report and build cultural vigilance. Ultimately, investing in individual response mechanisms should go hand in hand with broader platform and societal measures to effectively combat online harms.
- Trust as an enabler for the digital economy
Negative perceptions of digitalisation are developing due to online harms. Survivors often experience physical and mental health issues and stigmatisation. 86% of Southeast Asians are concerned about their data being stolen. Preliminary findings from TFGI’s research show that only 55% of Southeast Asian respondents trust that digital services are safe for them to use, and 42% sometimes avoid digital services due to worry about scams and fraud. A minority have reduced the use of online banking and new digital services or apps due to this concern.
In SEA’s complex digital landscape, the bigger issue isn’t just the harms themselves but that they are eroding trust in digital systems, leading to reduced digital participation. This, in turn, potentially dampens the growth of the digital economy.
Trust in digital technologies is therefore a key enabler of a robust, thriving and sustainable digital economy. Roadmaps for SEA’s digital future should not only consider how to support trade and innovation, but also continue the work of ensuring safe and secure online ecosystems that SEA’s digital users can confidently navigate and interact with.
