Heshantha Fernando

[Numbers.lk @numberslka]

⚖️ Supreme Court Judges’ Retirement Ages Around the World 🌍

1. 🇺🇸 United States - No fixed age; life tenure
2. 🇲🇬 Madagascar - No fixed mandatory age reported
3. 🇬🇧 United Kingdom - 75
4. 🇨🇦 Canada - 75
5. 🇧🇷 Brazil - 75
6. 🇦🇷 Argentina - 75
7. 🇮🇶 Iraq - 72
8. 🇦🇺 Australia - 70
9. 🇯🇵 Japan - 70
10. 🇳🇿 New Zealand - 70
11. 🇳🇱 Netherlands - 70
12. 🇮🇪 Ireland - 70
13. 🇮🇱 Israel - 70
14. 🇬🇭 Ghana - 70
15. 🇰🇪 Kenya - 70
16. 🇱🇷 Liberia - 70
17. 🇳🇬 Nigeria - 70
18. 🇵🇭 Philippines - 70
19. 🇰🇷 South Korea - 70
20. 🇪🇸 Spain - 70
21. 🇷🇺 Russia - Generally 70
22. 🇩🇪 Germany - 68
23. 🇧🇩 Bangladesh - 67
24. 🇲🇺 Mauritius - 67
25. 🇸🇪 Sweden - 67
26. 🇲🇾 Malaysia - 66 1/2
27. 🇮🇳 India - 65
28. 🇵🇰 Pakistan - 65
29. 🇳🇵 Nepal - 65
30. 🇷🇸 Serbia - 65
31. 🇹🇷 Türkiye - 65
32. 🇧🇹 Bhutan - 65 or upon expiry of the term
33. 🇱🇰 Sri Lanka - 65
34. 🇪🇹 Ethiopia - 60

⭕️ Some countries use fixed judicial terms instead of a mandatory retirement age. Rules may also differ for chief justices, constitutional courts, and other top courts.

⭕️ Some judges serve without a fixed retirement age, while others must retire between the ages of 60 and 75. Sri Lanka is at the lower end of the spectrum.

#TopCourt #Judiciary #RetirementAge #Law #GlobalComparison

[Sanjiva Weerawarana @sanjiva]

Proud of Sri Lanka to have resisted US pressure and attended.

@anuradisanayake @Dr_HariniA @MFA_SriLanka

[Numbers.lk @numberslka]

SRI LANKA’S 🇱🇰 JAVELIN SENSATION RUMESH THARANGA WINS GOLD AT GOLDEN SPIKE 🇨🇿 — RISES TO WORLD NO. 2

⭕ 🇱🇰 Rumesh Tharanga won the men’s javelin throw at the 65th Golden Spike athletics meet in Ostrava, Czech Republic, on June 16.

⭕ The 23-year-old secured the gold medal with a best throw of 86.57 metres.

⭕ With the victory, Tharanga became the first Sri Lankan athlete to win an event at the Golden Spike meet.

⭕ His latest performance has also lifted him to No. 2 in the men’s javelin world rankings, with 1,333 points.

⭕ The result followed his record-breaking 92.62m winning throw at the Rome Diamond League on June 4.

A historic achievement for Sri Lankan athletics. 🇱🇰

#SriLanka #JavelinThrow #WorldNo2 #Athletics

[Numbers.lk @numberslka]

PayPal in Sri Lanka 🇱🇰: Decade-Old Deadlock Nears 2026 Breakthrough 👏👏

⭕ Sri Lanka 🇱🇰 is reportedly set to officially launch PayPal services from 15 May 2026.

⭕ This means Sri Lankan 🇱🇰 users and businesses may, for the first time, be able to receive international payments directly into local bank accounts through PayPal, not just send money abroad.

⭕ Sri Lanka 🇱🇰 has pursued PayPal inward payments since at least 2014, but legal, banking and foreign exchange barriers delayed access for over a decade.

⭕ Multiple administrations, including the MR, Yahapalana and Gota administrations, spoke about building a digital economy and making Sri Lanka 🇱🇰 a digital hub, but basic inward payment access remained a major gap.

⭕ CBSL’s archaic and lagging stance was a major part of the delay, as its cautious approach to foreign exchange rules, licensed banking channels, AML safeguards and transaction monitoring remained the main bottleneck.

⭕ CBSL was also uncomfortable with PayPal’s closed-loop global platform, where foreign currency balances, reversals and transfers could operate outside Sri Lanka’s 🇱🇰 local banking system.

⭕ To this day, many freelancers and SMEs still lack a convenient formal way to receive payments for services provided to foreign clients.

⭕ The NPP Government’s Digital Ministry managed to get all parties to agree on some form of implementation, which is highly commendable.

⭕ PayPal is now expected to launch in Sri Lanka 🇱🇰 on 15 May, initially for B2B inward payments to exporters, according to reports.

⭕ This means the first phase will support business-to-business export payments, not full PayPal access for general users, especially freelancers, B2C sellers and digital product creators.

⭕ Sri Lanka 🇱🇰 already has formal export payment channels with heavy regulatory processes, so PayPal’s initial B2B rollout may not immediately transform exporter payments or create a major impact. but it is still an important starting point.

⭕ The real test is whether CBSL, local banks and PayPal expand this limited B2B rollout into wider inward payment access, similar to what users already have in many other countries.

⭕ After more than a decade of delays, the real test is whether CBSL, local banks and PayPal expand this limited B2B rollout into wider access for ordinary Sri Lankan 🇱🇰 users, freelancers, SMEs and digital businesses to receive global payments easily, legally and reliably.

#SriLanka #PayPal

[Numbers.lk @numberslka]

Sri Lanka’s 🇱🇰 GDP Per Capita Tops $5,000: First Time in History!

⭕ Sri Lanka GDP per capita reached $5,003 in 2025, crossing the $5,000 mark for the first time, as per the CBSL Annual Economic Review 2025.

⭕ The figure increased from $4,546 in 2024, surpassing the previous peak of $4,372 recorded in 2018.

⭕ In 2022, Sri Lanka was declared bankrupt during the economic crisis, with GDP per capita falling to $3,464.

⭕ Data shows that four years later, Sri Lanka 🇱🇰 has not only recovered lost ground but also exceeded its pre-crisis peak, showing strong signs of economic recovery.

#SriLanka #Economy

[Dilhan Manawadu @DilhanManawadu]

Platform Engineering Is Eating DevOps. The Agentic Era Made It Inevitable https://t.co/aJpDqMuepy

[Krishna Rajagopal @static_d]

In March 2025, an attacker stole a single bot token. No human owner. No rotation policy. No MFA. One forgotten credential, and 23,000 organisations spent their weekend rotating secrets.
The account had no owner. That is the entire story.

Most organisations run rigorous identity governance for their people. Joiners get onboarded. Leavers get offboarded. Access gets reviewed.

Machine identities work on none of those rules. Service accounts, API keys, OAuth tokens, CI/CD pipeline credentials — created when a project needs them, left running when it ends. They accumulate permissions across system migrations and team changes. Nobody reviews them. Nobody removes them.
The accounts with the least governance are the ones attackers find first.

One question worth putting to your team this week: how many machine identities in your environment have admin-level access, and when were they last reviewed?

If the answer is "we are not sure," that is where the programme starts.

We put together a five-step remediation plan — sequenced by urgency, not complexity — and we are sharing it below.

[Slorgen @ForzenStur]

Harsha de Silva feels like a wasted talent, overshadowed by the nonsensical politics of his own party

Hope he manages to work his way into the government someday!

An interesting discussion:

https://t.co/l1VFejZhxy

[Krishna Rajagopal @static_d]

Most organizations have three to five times more API endpoints than their security inventory shows.

Enterprises spend heavily on web application security while treating APIs as internal infrastructure. APIs expose the same sensitive data with direct database access, but attackers bypass hardened web frontends to exploit them directly.

Development teams create APIs for features, contractors build integrations, acquisitions bring API portfolios, micro services generate hundreds of endpoints. Security teams work from outdated catalogs.

Why APIs are different:
They respond to programmatic requests that scale. A vulnerability affecting one user on a website can compromise millions of records through API abuse. Browser controls don't apply. WAFs miss context. Authentication doesn't guarantee authorization.

OWASP API Security Top 10: Broken object-level authorization is the number one risk. Organizations authenticate users but fail to verify resource-level access. An authenticated customer changes an order ID parameter and views other customers' orders.

Six baseline controls:
1. Discovery - Network traffic analysis and code scans find shadow APIs
2. Authentication and authorization - OAuth 2.0, object-level checks at every call
3. Input validation - Strict schemas, treat all input as hostile
4. Rate limiting - Endpoint-level limits prevent credential stuffing and data scraping
5. Encryption - TLS 1.3, return only necessary data
6. Monitoring - Track authentication failures, enumeration patterns, geographic anomalies

Financial services, healthcare, and e-commerce APIs are under automated attack right now. Detection capability determines impact.

[Krishna Rajagopal @static_d]

Jenny had processed invoices for twelve years. She could spot a fake vendor document from across the room. But that Tuesday morning in March, the email looked perfect—right letterhead, correct account manager, proper billing cycle. She clicked.

What happened next took 121 days.

The hackers moved like house guests with a key, settling in quietly while the family went about daily routines. For four months, they learned the company's heartbeat—who logged in when, which systems connected, where important data lived.

By week six, they knew Sarah from HR checked email every Monday morning first. By month two, they'd mapped every server like studying blueprints. They watched backup schedules run at 2 AM nightly. They learned Dave from IT took his kids to soccer practice Tuesdays at 6 PM.

The attackers became digital anthropologists, studying company culture with scientific patience. They weren't just stealing—they were learning to become invisible residents.

Month four arrived like a countdown reaching zero. In forty-seven coordinated minutes on Thursday afternoon, everything went dark. Security cameras. Backup systems. Email servers. Even the Wi-Fi coffee machine.

The ransom note appeared on every screen: "We've been your neighbors for 121 days. We know when you work, when you sleep, and exactly what you're worth."

The CEO later told investigators the most chilling part wasn't the money demanded—it was realizing strangers had lived in their systems longer than some employees had worked there.

The breadcrumbs were there all along. Unusual login times. Slight data access changes. Small anomalies that looked like business noise—unless someone was watching for ghosts.

121 days. That's how long patient predators need to become family.

Case study and timeline: https://t.co/W98Cz3b8c6

#AKATISekurity #Cybersecurity #RansomwareStories #DigitalForensics #HumanSideOfSecurity

[Numbers.lk @numberslka]

Sri Lanka's 🇱🇰 Brain Drain: New Study

⭕ A on going study by University of Peradeniya study reveals that 50%+ of state university graduates in some disciplines are migrating permanently, never returning to Sri Lanka.

⭕ In the worst-hit departments, the migration rate hits 80-90% while taxpayers foot a Rs. 87 billion annual bill.

⭕ Sri Lanka 🇱🇰 has 142,000 undergraduates currently in state universities, 44,000 new enrollments annually
- 25% Arts
- 20% Management & Commerce
- 13% Engineering
- 10% Medical/Health
- 11% Agriculture etc

⭕ According 2023 Data, Government spent Rs. 87 billion on university education.

⭕ Most who migrate are the best graduates who secure highest performance at university level with Science-based degrees seeing "almost all students leaving" along with Agriculture and Engineering - precisely the skills Sri Lanka needs most

⭕ Study recommends migrants reimburse government USD 10,000-15,000 per graduate, or alternatively send USD 50,000 to family in Sri Lanka to recover portion of public investment - but enforceability remains questionable

⭕ Researchers acknowledge the contradiction: can't force graduates to stay due to unemployment and low wages, parents actively support migration, and private/government sector salaries can't compete with overseas opportunities - classic middle-income country trap

⭕ Study suggests "making entrepreneurs from university education" but this requires startup ecosystem development, access to capital, market opportunities, regulatory reforms, and cultural shift toward risk-taking.

Sri Lanka's free education system has inadvertently become a development aid program for other countries, with billions in taxpayer investment flowing overseas through skilled migration. Until the nation can create economic conditions that make staying as attractive as leaving, this costly export of human capital will continue unabated.

(Source: Prof. Wasantha Athukorala and Laksman Kumara at the University of Peradeniya vis Dailymirror)

[Numbers.lk @numberslka]

Story of SupremeSAT 🛰️ and PM Harini

⭕ May of 2012, SupremeSAT registered with the BOI with a stated investment of Rs 1.828 billion.

⭕ Ownership: Supreme Global Holdings (80%) and Supreme SL Investment (20%). The project was led by R. M. Manivannan, who owns Supreme Global Holdings, along with Jaya Sudhir and Alberto de Simone.

⭕ Manivannan appointed Rohitha Rajapaksa (youngest son of former President Mahinda Rajapaksa) as chief technical director and issued him shares through Dycer International, a company 100% owned by Rohitha.

⭕ Jaya Sudhir Jayaram, a Malaysian national reportedly linked in media and UN reporting to fraud and money laundering, was alleged to have paid $10 million in bribes to Saddam Hussein’s regime in the Iraq Oil-for-Food scandal. He was also reportedly stopped at Sri Lanka’s airport with USD 50,000 in undeclared cash and released without penalty, reportedly due to political influence.

⭕ Supreme SL Investment has almost no public footprint, no visible active operations, and is known mainly for holding shares in SupremeSAT typical of a shell or special-purpose vehicle (SPV).

⭕ Publicly available information shows no clear link from Supreme Global Holdings to credible revenue-generating operations, satellite or otherwise. They have been involved in crypto and other ventures, with little evidence of a conventional operating business or about their clients.

⭕ The same group behind SupremeSAT launched another large real estate project - Horton Square using the same offshore setup, the same principals, and additional political links. Horton Square brought back Manivannan, Jayaram, and de Simone. The BOI rejected the project due to concerns over these directors, but the UDA still approved it.

⭕ The company used an offshore firm Paradise Island Holdings Ltd., based in the UAE and nominee directors, obscuring the ultimate owners. One director was Renuka Shanmuganathan, whose sister-in-law is Nirupama Rajapaksa, a cousin of Mahinda Rajapaksa.

⭕ The land for Horton Square was bought from Purni Edwards, wife of Rienzie Edwards, who was indicted by the U.S. government in 2016 in connection with an alleged $50 million international fraud scheme using shell companies and offshore bank accounts, including transfers to Sri Lanka.

⭕ SupremeSAT-1” wasn’t a separate Sri Lankan spacecraft. It was capacity leased on ChinaSat-12 (which had earlier been ordered as Apstar-7B). The leased capacity was then co-branded/marketed as “SupremeSAT-1."

⭕ In Parliament, Prime Minister Harini stated the revenue as Rs 343.9 billion, but Minister Wasantha Samarasinghe corrected the figure to Rs 343.9 million later. Regardless of the figure, it reflects the company’s revenue, not the revenue for Sri Lanka.

⭕ The government should not blindly accept documents submitted to or from the BOI. PM Harini should have realized, even while reading, that these numbers are questionable. This raises real concerns about the PM's financial literacy.

⭕ BOI companies do not pay income tax in Sri Lanka during their concession periods. This private company used BOI tax-holiday status to extract profits while contributing nothing to the national treasury.

⭕ Having companies like these under the BOI is solely to get income-tax concessions, with little to no oversight, and the government has granted their associates BOI company status while the BOI is not doing due diligence on commitments.

⭕ The pattern: Foreign or politically connected entities register with the BOI, claim massive “investments,” generate tax-free revenue and legal cover to operate under the shadow, transfer profits offshore, and leave Sri Lanka with zero benefit.

⭕ There are genuine companies under the BOI, yes but many others abuse tax concessions, misreport finances, and operate with zero oversight.

At least something good may come of this: the government might audit the BOI, review every agreement and commitment, and clean house...

#SriLanka #BOI

[Krishna Rajagopal @static_d]

What do fine jewelry and critical data have in common?

Both are priceless assets, deserving of uncompromising protection.

AKATI Sekurity. The Guardians of Digital Value.

#ProtectWhatYouValue #DigitalAssets #Cybersecurity #AKATISekurity

[Evil Savior @EvilSavior7]

වන්දනා මාන කරන නායකයෝ ලෝකේ හදන්නේ නෑ!

අපි දිනනවා 500% ෂුවර්..

[Krishna Rajagopal @static_d]

Is your entire cybersecurity stack tied to one brand?
It might look streamlined — until the breach hits.
Read our board-level briefing on how to mitigate hidden vendor risk : https://t.co/qDSdJ3oSzR

[Kavi Senu @KaviSenu]

අනුර නම් දැන් too much... කොහොමද දෙයියනේ මේව අර මිනිස්සු ඉවසන්නේ 😂

[Numbers.lk @numberslka]

⚡ What Went Unnoticed in the Last CEB Tariff Reduction? 🇱🇰

While many focused on the overall tariff cuts, a key change slipped under the radar. With the latest tariff revision (last month), PUCSL reduced the peak-time Domestic TOU tariff from Rs. 72 to Rs. 55, bringing it back to 2015 levels (Rs. 54).

🔹 What is TOU?

Time of Use (TOU) is a special electricity tariff that charges different rates based on the time of day:

✅ Off-Peak (10:30 PM – 5:30 AM): Rs. 13/unit
✅ Day (5:30 AM – 6:30 PM): Rs. 25/unit
❌ Peak (6:30 PM – 10:30 PM): Rs. 55/unit

⭕ Who Benefits? TOU is mainly used by high-consumption households (~>300 units) with 30A, 3-phase connections, often with multiple air conditioners running during peak hours.

⭕ If the peak-time rate was higher, these households might have reduced AC usage, easing stress on the grid. Now, with rates at 2015 levels, there’s no incentive to cut consumption.

⭕ With the prevailing hot weather, Sri Lanka’s peak demand now exceeds 2750MW, forcing CEB to rely more on high-cost thermal power plants to meet peak demand.

⭕ CEB profited in the last 6 months due to heavy rains, prompting PUCSL to pass the relief to consumers through tariff reductions. However, CEB is now losing money, and in the next tariff revision, a 20%+ hike is inevitable.

⭕ Short-term tariff relief is welcome, but poor regulatory decisions—like reducing TOU peak rates —worsen CEB’s losses, leading to higher future tariff hikes that burden regular consumers.

#SriLanka 🇱🇰 #Electricity #TOUTariff

[Heshantha Fernando @Hesh78SL]

If the government walks the talk, Sri Lanka 🇱🇰 could be on the cusp of a new chapter.

[Numbers.lk @numberslka]

🇱🇰 Budget 2025: A Well-Planned Roadmap, But Can Revenue Keep Up?

1. Spending Priorities Hit the Mark

⭕️ The government has allocated funds strategically, focusing on trade, modernization, digitalization, and research – critical drivers for a post-crisis economy.

⭕️ Social sectors like child welfare, autism support, and prison reforms also received attention, addressing often-overlooked gaps. No glaring missteps; the budget ticks almost all policy boxes. ✅

2. Salary Hikes: A Slow Burn to Boost Confidence

⭕️ Public sector salary increases are phased over multiple years, a smart move to manage fiscal pressure. This creates optimism about future earnings without straining the Treasury’s immediate cash flow.

Note: At first glance, state sector salaries appear to have had the greatest increase ever, but the devil is in the details. For some professionals, the reduction in OT & ED rates could mean their take-home pay next April might actually be less than what they earn in March. (Just for optics—this cannot be intentional, but somebody at the treasury screwed up pretty badly.)

3. No Populist Pitfalls

⭕️ The budget steers clear of the JVP-style rhetoric (think unsustainable subsidies or aggressive nationalization). Instead, it leans into pragmatic reforms, signaling a shift toward fiscal discipline and pro-growth policies.

4. Revenue Side: High Hopes, Big Hurdles

⭕️ While spending is well-calibrated, revenue targets look ambitious. The push for digitalization and cashless transactions could improve tax compliance over time, but tangible gains may lag.

⭕️ The revenue plan leans on inefficient refunds (10% WHT, SVAT cancellation) to retain state liquidity. This exploits systemic inefficiencies in refund processes – a quick cash fix but not stimulative for businesses or the economy.

5. Key Agencies Under the Microscope

Key revenue generating agencies (IRD, Customs) face stretch targets meeting these goals will demand exceptional performance – think faster digitization, reduced leakage, and stricter enforcement. A tough ask without systemic reforms.

6. The Bottom Line

⭕️ For a country rebuilding from crisis, this budget is as good as it gets. It checks all the boxes: growth sectors funded, social gaps addressed, and fiscal discipline mostly intact. If the government walks the talk, Sri Lanka 🇱🇰 could be on the cusp of a new chapter.

#SriLanka #Budget2024

[Numbers.lk @numberslka]

Sri Lanka’s Parliament Speaker, [Dr.]* Asoka Sapumal Ranwala, resigns amid controversy over qualifications. 🇱🇰

⭕ Speaker Ranwala failed to provide proof of his Basic Degree and PhD credentials.

⭕ Despite claiming to possess the qualifications, he resigned, citing delays in obtaining the documents. - [ You be the judge of that statement]

⭕ It took a week of immense public scrutiny and an opposition-backed no-confidence motion to compel his resignation.

These things happen. When outsiders enter politics without proper scrutiny, they inevitably face intense public scrutiny. Things come out. The real test for the NPP gov is what they going to do about it?

⭕ The only way for the NPP to truly rise above this situation is to be completely transparent, identify those who misrepresented their qualifications, and force them to resign. The party must undertake a full cleanup. That is how they can send a message: “Yes, we messed up, but we will stand by the principles the public voted for & everyone will be treated the same.”

⭕The NPP did not come to power due to traditional factors such as politics, favoritism, practicality, or well-crafted proposals. Instead, they were elected because the people chose to prioritize character, integrity, and principles above all else.

⭕If the public begins to believe that they have once again been misled by yet another party with a brand-new set of slogans.. concluding that all politicians are alike and that nothing ever truly changes—then faith in those values will erode for generations to come. Such a loss of trust would be the greatest crime any political party could commit against a nation.

[Numbers.lk @numberslka]

World's Largest Cabinet to the Smallest: Sri Lanka 🇱🇰

⭕ Mahinda Rajapaksa's govt (2010-2015) had 107 ministers, with 67 of them in the Cabinet at its peak, creating the world’s largest cabinet.

⭕ Today, AKD's govt announced a 3-person cabinet, likely targeting 15 in the long run.

⭕ These 'one-word' portfolios are a refreshing shift. 👏👏

#SriLanka 🇱🇰 #Governance