Internet penetration rates and average connection speeds continued to grow during the coverage period. Over 90 percent of Malaysians now have access to the internet.

The latest available government statistics showed that household access to internet and mobile phone service was 90 percent and 98 percent, respectively. The same data also showed that the percentage of households using the internet increased to 84 percent in 2019, while the percentage of households using mobile phones remained at 98 percent.1

The Economist Intelligence Unit’s Inclusive Internet Index 2020 ranked Malaysia 38 out of 100 countries in terms of availability, as determined by the quality and breadth of available infrastructure.2 The change in government in February 2020 is not expected to slow down the government’s promotion of expanded internet access.

The increase in internet penetration rates was largely driven by developments in mobile broadband infrastructure, including better access to and improved quality of 3G and 4G LTE networks, as well as new mobile and data subscriptions offered by providers.3

In July 2020 the speed-testing company Ookla measured Malaysia’s mobile internet download speed at 24.44 Mbps and fixed broadband at 86.82 Mbps, for worldwide rankings of 85 and 41, respectively.4

The cost of internet access remained low during the coverage period. The PH government elected in May 2018 contributed to more affordable internet access by enforcing the Mandatory Standard on Access Pricing (MSAP), which caps the wholesale prices service providers can charge.5 Legislation instituting the MSAP was initially passed in December 2017 and went into effect in January 2018, but it was not enforced until the PH government took power.6

The government reported in early 2019 that broadband prices had decreased by 25 percent in 2018. Major telecommunications providers Celcom Axiata Bhd, Maxis Bhd, and TIME dotCom Bhd reduced their broadband prices by between 30 and 65 percent.7 In July 2019, Telekom Malaysia lowered the cost of an entry-level broadband package with speeds of up to 8 Mbps to 89 ringgits ($21.28) a month, or 69 ringgits ($16.50) a month for existing users.8

Internet use is centered around cities. A government survey showed that in 2018, 70 percent of internet users were in urban areas, with 30 percent from rural areas, reflecting the ongoing urbanization of Malaysia.9 Slight age and gender disparities have also persisted. In 2018, 59 percent of internet users were men and just 41 percent were women. The average age of an internet user was 36.2, up from 33 in 2016. According to statistics, 30 percent of internet users in 2018 were between 20 and 29 years old, while 25.9 percent were between 30 and 39.10

There were no reported cases of government-imposed restrictions on internet access during this coverage period. The last major reported incident of authorities restricting access occurred in 2012.11 However, a partly state-owned company continues to dominate the network infrastructure.

Telekom Malaysia, the largest telecommunications company, retains a monopoly over the fixed-line network and owns the country’s last-mile connections (see A4).12 As of July 2020, the government retained a 27 percent stake in Telekom Malaysia, which was formerly state owned.13 The fact that one partly state-owned company controls so much of the internet infrastructure provides a path for authorities to restrict connectivity in the future.

The nonprofit Malaysia Internet Exchange allows service providers to exchange local traffic more efficiently.14 Malaysia has several connections to the international internet, making the network more resilient.15

Economic obstacles and political barriers posed by patronage networks restrict the diversity of service providers.

According to the most recent data available, the government issued 220 licenses to network facilities providers that own or operate the internet infrastructure in 2019, up from 218 in 2017.16 Telekom Malaysia controls the fixed-line network.17 Other prospective service providers must lease infrastructure from Telekom Malaysia on its terms, resulting in higher prices and potentially contributing to a less diverse market.18

The largest mobile service provider, Maxis Communications, was founded by Ananda Krishnan, who also owns Malaysia’s largest satellite broadcaster and enjoys close ties to former Prime Minister Mahathir Mohamad, who assumed office after the May 2018 elections but was forced out in February 2020.19 Newer mobile service providers like YTL Communications and U Mobile are ostensibly unaffiliated with the government, but observers believe they benefit from political connections.

Fiber-optic home broadband service is provided by Astro IPTV. Other providers of broadband and mobile internet service include Celcom, Digi, TIME Internet, Tune Talk, and Yes, a wireless 4G provider.20

The regulatory body that oversees service providers, the Malaysian Communications and Multimedia Commission (MCMC), has frequently failed to operate in a fair manner, despite its multi-stakeholder advisory board.

The Ministry of Communications and Multimedia oversees the MCMC. The 1998 Communications and Multimedia Act (CMA) gives the ministry a range of powers, including the authority to license the ownership and operation of network facilities.

The CMA directs the ministry to appoint the MCMC chairperson and three government commissioners, plus additional commissioners representing nongovernmental entities.21 There are six commissioners from the private sector. The process for appointing members of the MCMC advisory board is more transparent and participatory, involving consultations with diverse stakeholders, and civil society members are included on the board. Nevertheless, the MCMC has taken steps to curtail online speech and has not always addressed internet-related issues in a fair manner (see B1).

In May 2018, activists called on the PH government to review the ambit of the MCMC’s powers and investigate whether it abused its position under the BN regime.22 The government did not undertake such a review prior to losing power in February 2020, nor did the new PN government do so by the end of the coverage period.

There were transparency concerns regarding a 5G tender process just after the coverage period. In June 2020, the PN government cancelled an order made in May awarding 5G broadband frequency bands to five companies after it emerged that one of the recipients was the little-known firm Altel, which is controlled by the politically connected tycoon Syed Mokhtar al-Bukhary.23 Reports suggested that the tender process was not open. The government said it was backtracking on the order “due to technical and legal reasons and the need for a more transparent process.”24 Under the original order, the 700MHz bands for the 5G network were awarded to Telekom Malaysia, Celcom Asiata Bhd, Digi Telecommunications Sdn Bhd, Maxis Broadband Sdn Bhd and Altel Communications Sdn Bhd.25

The government does not systematically block or filter political, social, or cultural content, although several websites remained blocked during the coverage period. A few sites that address LGBT+ issues were among those blocked, as were websites featuring pornography, piracy, and scams. There are concerns that website blocks will increase, especially after the reform-minded PH government was replaced in February 2020 by a ruling coalition that included components of the Malaysian Islamic Party (PAS) and other members of the BN coalition, which had previously blocked government criticism.

Some websites hosting LGBT+ content remained unavailable by the end of the coverage period.26 In August 2018, the gay dating site Planet Romeo, the LGBT+ news site Gay Star News, and the travel guide Utopia were all reportedly unavailable in the country.

In May 2018, the PH government unblocked three international websites: the UK-based investigative site Sarawak Report, the blogging platform Medium, and the Hong Kong-based commentary site Asia Sentinel. The sites had been blocked due to their reporting on corruption and criticism of former prime minister Najib Razak. In 2015, the MCMC ordered service providers to block access to the Sarawak Report after it published articles on the multibillion-dollar misallocation of resources from the 1Malaysia Development Berhad (1MDB) state investment fund.27 Medium was blocked in 2016, after it refused to take down Sarawak Report articles.28 Asia Sentinel was also blocked in 2016 for “violating national laws” after it published an article that was critical of Najib.29 Each of these sites remained accessible throughout the coverage period.

Blocks on a number of local websites were also lifted after the PH government took power in 2018.30 Access was restored to the news sites Malaysia Chronicle and the Malaysian Insider (now known as Malaysian Insight),31 which were blocked in 2015 and 2016, respectively, after publishing articles about the 1MDB scandal that criticized the government.32 The PH government also unblocked a handful of prominent blogs that were critical of the previous government, such as Din Turtle and Outsyed The Box, a blog that had reposted content from the Sarawak Report.33

Blocking and filtering of online content has previously increased around elections. On the day of the May 2018 general elections, the Malaysiakini news site briefly became inaccessible, but access was restored after several hours.34

The MCMC reported blocking 2,684 sites for pornography and 1,347 for scams between January and October 2018.35 In February 2019, the government also reported blocking 246 websites for piracy.36 In February 2020, the government announced that it would block IP addresses of servers that were found to be hosting pirated copyright content.37

The MCMC periodically instructs websites and social media platforms to remove content.38 Blog owners and Facebook users have been told to remove content that touches on sensitive issues involving race, religion, and the monarchy.

Authorities have requested that social media companies remove content. Between July and December 2019, there were 163 requests from Malaysian authorities to Facebook. Of these, Facebook restricted access in Malaysia to 78 items alleged to violate blasphemy laws, 12 items alleged to constitute illegal hate speech, and one alleged to violate the ban on spreading false information.39 The platform also restricted access to 70 items after receiving reports from the Ministry of Health regarding the impermissible promotion of regulated goods. In the same time period, Twitter received 25 demands to remove content from the government across 46 accounts, and complied with 40 percent of orders.40

Intermediaries risk liability for some content posted by users, though it is not clear whether this leads them to remove more content than necessary. In 2012, Parliament passed an amendment to the 1950 Evidence Act that holds intermediaries liable for seditious content posted anonymously on their networks or websites.41 This includes hosts of online forums, news outlets, and blogging services, as well as businesses providing Wi-Fi services.42 The amendment holds individuals liable if they “facilitate” the publication of the offending content, and holds the owner of the computer the content was published from liable, whether or not they are the author.43

In June 2020, just after the coverage period, the government initiated legal proceedings against popular news portal Malaysiakini after readers posted five comments allegedly criticizing the judiciary on an article discussing the reopening of the country’s courts after a COVID-19 lockdown.44 The outlet’s administrators reportedly removed the comments two days after being contacted by police. In July, a court set a trial date for the case against the outlet and editor Steven Gan (see C3).45

Blocking and removal requests are generally nontransparent and lack judicial oversight or effective avenues for appeal. A provision of the CMA states that none of its wording “shall be construed as permitting the censorship of the internet,” although this is often not the case in practice. The Multimedia Super Corridor, a government information technology (IT) development project, includes a 10-point Bill of Guarantees to member businesses that promises freedom from censorship.46

Blocks are implemented on the authority of the MCMC, which reports to the government (see A5). No list of affected sites is available. Site owners can appeal a block directly to the MCMC, though there is no guarantee that they will receive a reply.

Self-censorship is common among online journalists and ordinary users, particularly in regard to sensitive issues such as Islam’s official status, race, the monarchy, and the preferential treatment enjoyed by the bumiputera—the term for ethnic Malays and other indigenous people—over the Chinese and Indian minorities. Discussing these topics can lead to prosecution, which contributes to self-censorship online.47 Journalists sometimes intentionally leave sensitive material out of their articles.48

Content manipulation persists, especially around tense political moments such as elections, although it is not as systematic or widespread as it was during the period of BN coalition dominance that lasted until 2018.

Both government and opposition figures have been known to pay online commentators, known as “cybertroopers,” to generate favorable content and denigrate their opponents.49 Such partisan manipulation increased on social media in the run-up to the May 2018 general elections.50 Cybertroopers continued to post content during the coverage period, but at a much slower pace.

A report from the Oxford Internet Institute released in September 2019 found that teams of cybertroopers with full-time staff members are employed to manipulate the information landscape.51 According to the report, there is evidence that such teams received formal training. They work to disseminate the preferred messaging of their clients, attack the opposition, and suppress critical content. There is also evidence that automated accounts on Facebook, WhatsApp, Twitter, and YouTube are utilized.

The government has taken several steps to combat what it characterizes as “false news.” In 2017, the Communications and Multimedia Ministry launched SEBENARNYA, a fact-checking portal that encouraged social media users to verify the content of all news reports shared on popular platforms with the slogan, “not sure, don’t share.”52 Officials claimed the portal was nonpartisan,53 and it continued to be updated as of July 2020. The PN coalition that took power in March 2020 launched a 24-hour news channel in June to combat fake news,54 prompting Malaysia’s Centre for Independent Journalism to raise concerns that the channel could propagate state propaganda.55

Previously some online journalists have been subject to informal, inconsistent bans from select government press conferences, reflecting the government’s efforts to control coverage.56

Many online platforms struggle to stay economically viable, and government restrictions contribute to difficult market conditions. In the past, a number of news sites have faced significant financial penalties due to defamation charges from political leaders (see C3). In 2016, the Malaysian Insider ceased operations shortly after it was blocked by authorities, though it cited financial reasons for its closure.57 The outlet reopened under the name Malaysian Insight in 2017.

News sites have withstood regulatory attempts to restrict them in the past, although some efforts have centered around outlets’ offline presence. In 2013, a judge ordered the Home Ministry to grant Malaysiakini the right to reapply for a print license.58 The ministry had repeatedly refused to grant the license and challenged a 2012 appeals court ruling that characterized Malaysiakini’s right to publish a newspaper as fundamental.59 Despite the 2013 court ruling, the ministry again denied Malaysiakini a license in 2014 because it “often causes controversy,” and the publication has therefore never produced a print newspaper.60

Amid the July 2020 investigation of Al Jazeera for airing a documentary on authorities’ mistreatment of migrants during the COVID-19 pandemic (see C3), the government announced that the outlet flouted the 1981 Film Act by not applying for a license to produce the documentary, saying that all video producers needed a license "regardless of whether they are mainstream media agencies or personal media that broadcast films on social media platforms or traditional channels." 61 Communications Minister Saifuddin Abdullah clarified that social media users were free to produce and upload videos without the need to apply for a license or worry that they would be charged,62 although he did not make clear whether media organizations would need a license. The government has also said that it would be amending the Film Act to ensure it aligns with digital technologies.63

Digital media is more diverse than traditional media in Malaysia. More established sites such as Malaysiakini and the Malay Mail Online have been joined by smaller platforms that contribute to the diversity of information.64 Several digital news platforms are among the country’s most popular websites.65 However, online self-censorship around controversial issues such as Islam’s official status, race, and the monarchy limit the diversity of viewpoints available about those topics (see B4).

Expanded internet access has led to the emergence of a vibrant blogosphere. English and Malay are the dominant languages, and many civil society groups, including those representing ethnic minorities, have a dynamic online presence. Websites in Chinese, Tamil, and other minority languages are also increasing in number and influence. There is also a vibrant podcast catering to the LGBT+ community, although the hosts remain anonymous out of fear of reprisal; several LGBT+ websites are blocked (see B1).66

Social media continues to be an important avenue for accessing a wide array of information. In 2018, an estimated 24.6 million people used social media platforms in Malaysia, and 97.3 percent of those users were on Facebook. Also in 2018, 27.8 million people used communication platforms like WeChat, Telegram, Skype, and Facebook Messenger. Nearly 27.2 million people used WhatsApp, making it the most popular communication app.67 Newer platforms such as TikTok that carry a wide range of information have also seen a recent increase in use among Malaysians.

Digital tools remain available for users and have helped expose and undercut the government’s control over traditional media. Social media has been a particularly effective tool for mobilization. However, restrictive laws around free expression and the threat of criminal prosecution could limit some online mobilization.

In February and March 2020, civil society and members of the public used social media to rally opposition to the ouster of the PH government that had won the general election in 2018. Criticism of the takeover of power by the PN coalition were circulated online and via mobile apps.68 Amid peaceful protests, Amnesty International reported that several human rights defenders and activists were taken in for questioning. In one case in March, Nadwa Fikri, a lawyer and protest organizer, was questioned by policy and obliged to grant officers access to her Twitter account.69

Previously, in the run-up to the polls in May 2018, citizens took to social media to offer financial aid as well as transportation assistance for voters who needed to return to their home villages to cast ballots.70 Hashtags such as #CarPoolGE14 and #ReturnHomeToVote trended in the weeks before the elections.71 Following the elections, social media remained a popular tool for digital activism.72

Malaysia’s constitution provides citizens with “the right to freedom of speech and expression” but allows for limitations on those rights. A number of laws also undermine freedom of expression. While some progovernment court decisions have disappointed rights advocates,73 other rulings suggest more judicial independence.

The PH government kept its pledge to abolish the Anti-Fake News Act,74 which the previous BN coalition passed in May 2018, ostensibly to curb the spread of fake news, especially through social media.75 In pushing for the law, authorities had argued that Malaysians most frequently get fake or unverified news via WhatsApp, followed by Facebook, blogs, and other sources.76 The sweeping law threatened to seriously restrict free expression online,77 and activists argued that it was meant to silence criticism of the government and was vulnerable to abuse (see C2).78

Parliament’s lower house repealed the law in August 2018, but the upper house, still controlled by the BN coalition, rejected the repeal in September, calling for the law to be revised rather than repealed outright.79 In March 2019, the government reiterated its intention to repeal and said that it would not charge anyone under the legislation in the meantime.80 In October 2019, the lower house again voted to repeal the law; the Senate was legally barred from blocking the bill a second time, and it was finally repealed in December 2019 .81

A number of laws impose criminal and civil penalties for online activities. The government exercises tight control over online, as well as print and broadcast media, through laws like the Official Secrets Act and the Sedition Act, which dates to 1948. Violations can be punished with fines and several years in prison.

Amendments passed in 2015 widened the scope of the Sedition Act, allowing the government to block electronic content that is considered seditious.82 The maximum penalty in general sedition cases is now seven years in prison, up from three years before the amendments. A provision also imposes up to 20 years in prison for seditious activities that result in physical harm or destruction of property.83 In 2015, the Malaysian Federal Court rejected a constitutional challenge to the Sedition Act.84

The Anti-Fake News Act of 2018, which was repealed in December 2019, covered news, information, data, reports, images, or recordings in any form that are wholly or partly false. It was apparently an offense to possess, produce, offer, or share fake news content.85 The law was applicable to non-Malaysians and to Malaysians residing outside the country, and offenders could have been fined up to 500,000 ringgits ($120,000), imprisoned for up to six years, or both. Those financially supporting the offenders could also have been held liable. Any failure to eradicate the production of fake news could have led to fines of up to 100,000 ringgits ($24,000). The courts could have ordered the destruction of publications containing fake news. Despite its repeal, the government can still use other laws, including the Penal Code, to punish fake news (see C3).

Defamation is a criminal offense under Sections 499 to 520 of the Penal Code. Media outlets benefit from stronger protections under the Defamation Act of 1957 if they can prove that the content is accurate and was published without malice;86 bloggers, who lack this protection, are at greater risk for defamation charges. Section 505(b) of the penal code criminalizes statements intended to cause “fear or alarm to the public” or “commit an offense against the State or public tranquility.”

The government has also pursued prosecutions for online content under the 1998 CMA. The act’s broadly worded Section 211 bans content deemed “indecent, obscene, false, threatening, or offensive.” Spreading such content on the internet constitutes “improper use of network facilities or network service” under Section 233. Amendments to the CMA and the related Communications and Multimedia Commission Act (CMCA) of 1998 were expected to be presented in late 2016,87 including measures to curb the use of social media to inflame “religious and racial sensitivities” or support the “recruitment of terrorists.”88 Critics said these amendments were intended to restrict criticism of the government.89 In September 2018, the PH government asserted that it would amend the CMA to alter some of the more draconian provisions that are most vulnerable to abuse. The changes had not yet been proposed at the end of the coverage period.90

During the coverage period, internet users were arrested and prosecuted for online speech. Content critical of Islam, the monarchy, the government, or touching on sensitive racial issues can lead to arrest and prosecution. A number of social media users were also investigated, arrested, and charged for posting unverified news about the COVID-19 outbreak.

In early 2020, the public prosecutor warned that it would initiate criminal cases against people spreading alleged false information on the internet on any issue relating to the coronavirus.91 As of the end of February 2020, the police had detained at least 12 people for posting fake news, while 36 cases of fake news were being investigated by the MCMC and police.92 In March, the Ministry of Communications and Multimedia announced it was investigating 42 cases of fake news that could “cause public confusion;” it is unclear whether charges were filed.93

Journalist Wan Noor Hayati Wan Alias was charged under Section 505(b) of the penal code following three January 2020 Facebook posts in in which she criticized the government’s decision to allow a cruise ship from China to dock in Malaysia. For each post, she faces a maximum two years' imprisonment, a fine, or both, for a total of up to six years in prison.94 Aliuudin Amit, another user, was fined 5,000 ringgits ($1,200), in lieu of 10 months in jail after pleading guilty to circulating a false statement about a prisoner dying from COVID-19 through WhatsApp.95

Several individuals were also arrested and prosecuted for insulting the Malay rulers, often under Section 233 of the 1998 CMA.96 In July 2020, after the coverage period, a man was jailed for nine months, in lieu of being unable to pay a fine, after being found guilty of insulting the king on Facebook.97 That same month, another man was sentenced to 10 months in prison, after already serving two, for allegedly insulting the king on Instagram.98 In March, a man was fined 8,000 ringgits ($1,900) after being found guilty of insulting the king on Facebook.99 In May, popular former radio personality Patrick Teoh was arrested for allegedly insulting Johor Crown Prince Tunku Ismail Sultan Ibrahim on Facebook.100 He was charged in June and faces a maximum fine of 50,000 ringgits ($12,000) or a maximum one-year jail term or both.101 The case was expected to be heard in September 2020.102

Journalists, activists, and internet users are also routinely charged and prosecuted for criticizing the government, political parties, and other official bodies, especially since the March 2020 change of government. In June 2020, just after the coverage period, the government initiated legal proceedings against popular online news portal Malaysiakini and its editor Steven Gan based on readers’ comments on a news story about the judiciary (see B2).103 In July, a federal court heard a contempt of court case; as of the beginning of September 2020, a judgment had yet to be announced. Gan faces prison time, a hefty fine, or both.104 The government has faced significant criticism from both domestic and international civil society over the prosecution.105 Also in June, the new government initiated an investigation against activist and lawyer Siti Kasim over a Facebook post in which she criticized the PAS party and mentioned banning Islamic schools.106

In July 2020, after the coverage period, the police investigated international broadcaster Al Jazeera and several of its journalists for sedition, defamation, and violations of the CMA (see B6 and C7). The legal harassment came after the outlet broadcast, both on TV and online, a 25-minute documentary on the government’s mistreatment and arrests of migrant workers during the COVID-19 lockdown, including allegations of discrimination and racism.107 The immigration department also lodged a report against the broadcaster;108 the case is ongoing as of September 2020. Relatedly, on July 24 authorities arrested and revoked the work permit of Bangladeshi migrant worker Mohamad Rayhan Kabir after he criticized the government in the documentary. He was detained without charge for over 10 days, and was deported in August.109

The government also continued to investigate internet users under the Penal Code and the CMA for online speech deemed insulting to Islam and the prophet Muhammad. In March 2019, a Facebook user was sentenced to 10 years in prison for insulting Islam and the prophet, although in September 2019 the prison term was reduced to six years.110 In February 2020, a man was charged for stepping on the Quran while streaming live on Facebook; there were no publicly available updates to the case as of the end of the coverage period.111 Also in February, Facebook user Koh Teen Ern was charged for posting comments allegedly insulting to Islam on his account.112 In June 2020, he plead guilty and was fined 6,000 ringgits ($1,435) in lieu of three months in prison.113

Anonymous communication online and encryption are largely not restricted in Malaysia, although there are some registration requirements for mobile phone users. Since 2007, mobile phone owners, including customers using prepaid services, have been required to register as part of an effort to reduce the spread of rumors.114 However, the rule has reportedly been weakly enforced. Real-name registration is not required for bloggers or customers at cybercafés.

Users can largely use encryption tools as they please, although a number of laws allow police to access encryption and decryption codes when conducting searches.115

Privacy protections in Malaysia are poor, and it is difficult to ascertain the extent of government surveillance of users’ internet activities.116

Legal provisions allow the police, prosecutors, and even the communications and multimedia minister to intercept online and mobile communications. While judicial oversight is sometimes required, in practice the courts usually grant requests for interception warrants. The laws are generally interpreted to require network operators and service providers to assist law enforcement and intelligence agencies in surveillance efforts, even where clear procedures are lacking. A court order is not required for emergency interception, which applies to cases with national security implications. Under the Security Offenses (Special Measures) Act of 2012, a police officer at the rank of superintendent of police or above may intercept communications without the authorization of the public prosecutor in urgent cases.117

In May 2020, the Israeli news site CTech reported on documents in an Israeli court case revealing that in April 2018 Malaysian officials from the then ruling BN coalition signed a 6.3 million ringgit ($1.5 million) deal to purchase surveillance technology from Israeli cybersecurity startup Senpai for use by Malaysia’s intelligence agency.118 The deal was signed just over a month before the May 2018 election, and the technology was allegedly planned for use surveilling the political opposition ahead of the vote. Former prime minister Najib Razak denied the allegations.119

In 2013, the University of Toronto-based research group Citizen Lab reported detecting software known as FinFisher—described by its distributor Gamma International as “governmental IT intrusion and remote monitoring solutions”—on 36 servers worldwide, including in Malaysia.120 The software potentially allows the server to steal passwords, tap Skype calls, or record audio and video without permission from other computers.121 Citizen Lab also identified “a Malaysian election-related document” that it characterized as a “booby-trapped candidate list” containing surveillance software.122 Because the spyware is only marketed to governments, “it is reasonable to assume that some government actor is responsible,” the group concluded. A separate Citizen Lab report published in 2014 asserted that a Malaysian government agency was a “current or former user” of the Remote Control System spyware marketed by the Milan-based company Hacking Team.123 In 2016, the Prime Minister's Office denied having purchased this spyware but could not confirm whether other government agencies had done so.124

Social media monitoring continues to be a concern. In March 2019, Minister of Religious Affairs Mujahid Yusof Rawa announced that a special unit had been formed to monitor platforms to find content that insults Islam.125 Similarly, in October 2018, the Israeli newspaper Haaretz reported that Malaysia had previously purchased sophisticated surveillance technology from Israeli firms that can monitor and analyze social media and other open-source information.126 Previously, the US-based company Snaptrends also reportedly discussed its social media monitoring technology with Malaysian authorities.127

Amid the COVID-19 pandemic, the government has rolled out several smartphone apps that access personal information for contact-tracing purposes. For example, the Gerak Malaysia app tracks location, while MyTrace uses Bluetooth proximity data to assist with contact tracing.128

The law protects against using individual data for commercial purposes, but there are no provisions specifically addressing online privacy.129 In some cases, service providers are required to aid the government in monitoring user communications.130 For example, the Computer Crimes Act of 1997 mandates that providers give police access to user information once a warrant is obtained. Providers that fail to comply can face up to three years in prison and fines of up to 25,000 ringgits ($6,000).131 Section 116 of the Criminal Procedure Code obligates service providers to turn over user information, which is defined as “the necessary password, encryption code, decryption code, software or hardware, and any other means.”132 Depending on the offense being investigated, the Criminal Procedure Code does not always require police to obtain a warrant. Section 116c of the code allows the public prosecutor to force service providers to collect and retain specific user communications or data. The prosecutor can also authorize a police officer to install devices to collect such information.

The Malaysian Personal Data Protection Act of 2010, which regulates the processing of personal data in commercial transactions, came into effect in 2013. The law makes it illegal for commercial organizations to sell personal information or allow third parties to use it. Those convicted of violating the law can be fined up to 100,000 ringgits ($24,000) or sentenced to one year in prison. The federal and state governments are exempted from the law, as are entities that process data outside Malaysia.133 The act requires that information about Malaysians be stored locally and limits conditions under which it can be transferred abroad, though the extent to which those rules are enforced is unclear.134

In August 2020, the government contracted with MyEG Services Bhd, an electronic government services provider, to share data collected by employers in the course of monitoring foreign workers’ COVID-19 status.135

Score Change: The score improved from 3 to 4 because there were no reported cases of physical violence against internet users in retribution for their online activities.

Intimidation and physical violence against individuals in retaliation for their online activities is not a major problem, although journalists, activists, and members of marginalized communities such as LGBT+ people are at times subjected to online harassment.

In March 2020, Kow Gah Chie, a journalist for online outlet Malaysiakini, was subjected to racist comments and physically violent threats on Facebook after she published a story reporting comments by the Environment Minister seemingly supporting logging in ecologically sensitive areas.136

LGBT+ users also have been subjected to harassment, homophobic slurs, and hateful content online.137 For example, activist Numan Afifi experienced significant online harassment after speaking at the UN Human Rights Council about LGBT+ rights in Malaysia in April 2019.138

In July and August 2020, shortly after the coverage period, Al Jazeera reported that its journalists and staff involved in creating a documentary critical of the government’s treatment of migrant workers were subjected to online abuse, including death threats and doxing (see B6 and C3).139 A Bangladeshi worker who was interviewed for the documentary was also abused online with hate speech and threats, and his personal details were published on social media prior to his arrest and deportation (see C3).140

Users sometimes face offline retaliation for their online activities. One Facebook user was suspended from their job after their social media posts allegedly insulting the king were reported to the police.141

In March 2019, supporters and leaders of the United Malays National Organization (UMNO) party reportedly harassed and assaulted two interns from Malaysiakini who were reporting on an event featuring former prime minister Najib in Kuala Lumpur.142 An UMNO member was charged with using criminal force during the incident. The suspect’s trial was ongoing at the end of the reporting period, and he faces up to three months in jail and a fine of up to 1,000 ringgits ($240) if convicted.143

Technical attacks aimed at suppressing political information online were not reported during the coverage period.

In previous coverage periods, several technical attacks targeted politicians and political websites on election day in May 2018. Politicians from both the then incumbent BN government and the opposition PH coalition claimed that their phones were hacked, causing them to receive a wave of unsolicited calls from overseas.144 Political parties also claimed that their websites were attacked and became inaccessible.

In previous years, independent online news outlets and opposition-affiliated websites have faced distributed denial-of-service (DDoS) attacks. DDoS attacks force sites to crash by overloading the host server with requests for content. Some observers believe such attacks were either sponsored or condoned by Malaysian security agencies.