Internet penetration rates and average connection speeds continued to increase during the coverage period. According to the Department of Statistics, household internet access increased from 90.1 percent in 2019 to 91.7 percent in 2020; during the same time period, mobile phone penetration increased from 98.2 percent to 98.6 percent.1 The Economist Intelligence Unit’s Inclusive Internet Index 2021 ranked Malaysia 46th out of 120 countries in terms of availability, which measures the quality and breadth of a country’s available infrastructure.2 The increase in internet penetration rates was largely driven by developments in mobile broadband infrastructure, including optimization of and 4G long term evolution (LTE) networks and new mobile and data subscriptions offered by providers.3

In 2019, the PH government initiated the five-year National Fiberisation and Connectivity Plan (NFCP), which is meant to improve fixed-line broadband coverage. In 2020, the PN government launched Jalinan Digital Negara (JENDELA), a five-year plan with targets to increase 4G coverage, increase mobile broadband speed, and increase nationwide access to gigabit-speed fixed-line broadband service.

Despite these improvements, complaints about mobile network coverage have significantly increased in 2021.4

As of August 2020, approximately 20 percent of the country still has very poor internet access. In some places, internet access is disrupted when individuals dig up fiber-optic cables, steal copper wires, or otherwise vandalize internet infrastructure.5 As a result of the public outcry over poor internet access in Sabah (see A2), the Malaysian Communications and Multimedia Commission (MCMC) announced it will build a telecommunications tower in Pitas, Sabah; the tower is scheduled to be completed by second quarter of 2021.6 The government is utilizing satellite technologies to expand internet access to rural and remote areas. These technologies provide broadband coverage to areas unreachable by 4G and fiber-optic technologies; however, they also offer limited capacity, incur high operational costs, and are unstable in poor weather conditions.7

In May 2021, speed-testing company Ookla measured Malaysia’s mobile internet download speed at 54.54 Mbps and fixed-line broadband at 105.14 Mbps. Malaysia ranks 86th worldwide for mobile internet download speeds and 45th for fixed broadband speeds.8

In February 2021, the Malaysian government decided to build and manage a state-operated 5G infrastructure.9 The government intends for consumers to be able to connect to 5G networks by the end of the year.10

The rollout of internet infrastructure, however, is hindered by local authorities and bureaucracy. The lack of standardization of planning permission processes, according to a telecommunications firm, hinders internet infrastructure development.11 According to a JENDELA report released in April 2021, deployment and renewal costs of tower and rooftop structures vary significantly across states and among local authorities within the same state. The highest total cost of deployment and renewal of a tower for 6 years is in Johor State at 116,750 ringgits ($28,100) and the lowest is in WP Labuan at 12,065 ringgits ($2,970). The highest total cost of deployment and renewal of a rooftop structure for 6 years is in Melaka state at 39,500 ringgits ($9,700) and the lowest is in WP Labuan at 9,000 ringgits ($2,200).12

The cost of internet access remained affordable during the coverage period. The PH government, elected in May 2018, contributed to more affordable internet access by enforcing the Mandatory Standard on Access Pricing (MSAP), which caps the wholesale prices service providers can charge.13 Legislation instituting the MSAP was initially passed in December 2017 and went into effect in January 2018, but it was not enforced until the PH government took power.14 The MSAP has been extended to December 2022.15

The government reported in early 2019 that broadband prices had decreased by 25 percent in 2018. Major telecommunications providers Celcom Axiata Bhd, Maxis Bhd, and TIME dotCom Bhd reduced their broadband prices by between 30 and 65 percent.16 In July 2019, Telekom Malaysia lowered the cost of an entry-level broadband package with speeds of up to 8 Mbps to 89 ringgits ($21.28) a month, or 69 ringgits ($16.50) a month for existing users.17 In October 2020, Digi offered entry-level fiber-optic broadband packages with 50 Mbps speeds costing 90 ringgits ($22) per month.18 According to the Alliance for Affordable Internet, the cost of 1 GB of broadband data in Malaysia averaged $5.86 in 2020, or 0.65 percent of gross national income (GNI) per capita.19

Internet use is centered around cities. In 2020, a government survey showed that 75.6 percent of internet users were in urban areas and 24.4 percent were rural.20 In 2018, 70 percent of internet users were urban, with 30 percent rural. The change in the urban-rural split reflects the country’s ongoing urbanization.21

Gender disparities have declined during the coverage period. In 2020, 54.3 percent of internet users were men and 45.7 percent were female. In comparison, in 2018, 59 percent were men and just 41 percent were women. Internet users are also generally younger: 34.1 percent of users are between 20 and24 years of age, representing the largest pool of users among all age groups. Some 30 percent of internet users in 2018 were between 20 and 29 years old, while 25.9 percent were between 30 and 39.22

COVID-19 highlighted the issue of affordability and accessibility of electronic devices to access the internet. Students in rural areas have reported that poor internet access impacted their studies. To get better internet access to take online exams, one university student in Sabah was forced to climb a tree and another student in Kelantan erected a tent atop a 20 meter-high hill. 23 According to a survey by the Education Ministry in 2020, 36.9 percent of 900,000 student respondents do not have access to electronic devices for e-learning; 5.7 percent own tablets, 9 percent own laptops, and 46 percent own smartphones. 24

The Ministry of Communications and Multimedia has launched several initiatives to assist students during the COVID-19 pandemic, including a 20 ringgit-per-month prepaid data pass offering 15 GB data of data to eligible students from January to April 2021, free access to e-learning tools via five telecommunications companies, and free Wi-Fi provided by six companies at 130 public housing sites. 25

In January 2021, the government announced tax relief of up to 2,500 ringgits ($620) for purchases of mobile phones, computers, and tablets until the end of 2021.26 In addition, the government launched a 3.5 billion ringgit ($853.4 million) program in May 2021 to assist users in purchasing smartphones and accessing broadband services. The government plans to contribute 2 billion ringgits ($487.7 million) to this program, while 12 telecommunication providers will be contributing an additional 1.5 billion ($365.8 million) ringgits worth of support, mainly in the form of free data. 27

Score Change: The score improved from 4 to 5 because there were no reported cases of government-imposed restrictions on internet access during the coverage period and the government does not retain full control over internet infrastructure, limiting the ease with which it can cut off connections.

There were no reported cases of government-imposed restrictions on internet access during this coverage period. The last major reported incident of authorities restricting access occurred in 2012.28 However, a partly state-owned company continues to dominate the network infrastructure.

Telekom Malaysia, the country’s largest telecommunications company, retains a fixed-line monopoly and owns the country’s last-mile connections (see A4).29 As of July 2021, the government retained a 0.38 percent stake in Telekom Malaysia, which was formerly state-owned, while government-linked companies and statutory bodies held the majority of shares in the company.30 The fact that one partly state-owned company controls so much of the internet infrastructure provides a path for the authorities to restrict connectivity in the future.

The nonprofit Malaysia Internet Exchange allows service providers to exchange local traffic more efficiently.31 Malaysia has several connections to the international internet, making the network more resilient.32

Economic obstacles and political barriers posed by patronage networks restrict the diversity of service providers.

According to MCMC data, 351 network-facilities providers own or operate the internet infrastructure in 2021, an increase from 220 providers in 2019.33 Telekom Malaysian is the dominant player in the fixed-line market, having a 90 percent share of the market as of July 2021.34

The founder of the largest mobile service provider, Maxis Communications, is believed to enjoy close ties to former prime minister Mahathir Mohamad, who assumed office after the May 2018 elections but was forced out in February 2020.35

Fiber-optic home broadband service is provided by Astro IPTV. Other providers of broadband and mobile internet service include Celcom, Digi, TIME Internet, Tune Talk, and Yes, a wireless 4G provider.36

The regulatory body that oversees service providers, the MCMC, has frequently failed to operate in a fair manner, despite its multi-stakeholder advisory board.

The Ministry of Communications and Multimedia oversees the MCMC. The Communications and Multimedia Act (CMA) 1998 gives the ministry a range of powers, including the authority to license the ownership and operation of network facilities.

The Malaysian Communications and Multimedia Commission Act 1998 directs the ministry to appoint the MCMC chairperson; there are currently seven other commission members from backgrounds including civil service, finance, accounting, and academia.37 The MCMC Act 1998 states the commission should consist of a chairman, three members representing the government, and between two and five members from other sectors. All members are appointed by the communications minister. It is unclear how candidates are selected. The MCMC has taken steps to curtail online speech and has not always addressed internet-related issues in a fair manner (see B1).

In May 2018, activists called on the PH government to review the ambit of the MCMC’s powers and investigate whether it abused its position under the BN regime.38 The government did not undertake such a review before losing power in February 2020, nor did the succeeding PN government by the end of the coverage period.

There were transparency concerns regarding a 5G tender process. In June 2020, the PN government cancelled an order made the previous month awarding 5G broadband frequency bands to five companies after it emerged that one of the recipients was the little-known firm Altel, which is controlled by the politically connected tycoon Syed Mokhtar al-Bukhary.39 Reports later suggested that the tender process was not open. The government said it was backtracking on the order “due to technical and legal reasons and the need for a more transparent process.”40 Under the original order, 700 MHz bands for the 5G network were awarded to Telekom Malaysia, Celcom Asiata Bhd, Digi Telecommunications Sdn Bhd, Maxis Broadband Sdn Bhd, and Altel Communications Sdn Bhd.41

The government does not systematically block or filter online content, although several websites remained blocked during the coverage period.

The MCMC has not released an official list of blocked sites. According to Open Observatory of Network Interference (OONI) database that runs technical tests to verify website blocking, 18 sites were blocked in Malaysia as of April 2021.42

A few sites that address LGBT+ issues were among those blocked, as were websites featuring pornography, piracy, and scams. Based on OONI Explorer, sites like lgbtglobalfaith.org, LGBT+ news site NewNowNext, gay dating site Planet Romeo, Hot Gay List, and Queer Net showed signs of potential network interference in June 2021.43 In August 2018, Planet Romeo, LGBT+ news site Gay Star News, and travel guide Utopia were reportedly unavailable in the country. 44

The MCMC revealed that, as of March 2021, a total of 2,195 gambling sites were blocked.45 In April 2021, cryptocurrency platform Remitano was blocked by the MCMC upon request by the Securities Commission for operating a Digital Asset Exchange (DAX) without authorization, violating Section 7 of the Capital Markets and Services Act 2007.46 In January 2021, the New Straits Times reported that the MCMC blocked 2,921 pornographic websites between September 2018 and late 2020.47 In February 2020, the government announced that it would block the internet protocol (IP) addresses of servers hosting pirated content.48 In February 2019, the government reported blocking 246 websites for piracy reasons.49

The MCMC periodically instructs websites and social media platforms to remove content.50 Blog owners and Facebook users have been told to remove content that touches on sensitive issues involving race, religion, and the monarchy.

In June 2020, the government initiated legal proceedings against popular news portal Malaysiakini, after readers posted five comments criticizing the judiciary on an article that itself detailed the reopening of the country’s courts after a COVID-19 lockdown.51 The outlet’s administrators reportedly removed the comments two days after being contacted by police. The Federal Court ruled that Malaysiakini was in contempt of court in February 2021 (see C3).52 Following the decision, the lead counsel for Malaysiakini opined that the Federal Court set a precedent that news portals, in order to avoid liability, needed to take active steps to moderate comments before they are published.53

In October 2020, the MCMC warned that legal action could be taken against account holders of parody accounts.54 Following this announcement, in December 2020, Bermana TV, a Twitter account parodying the Bernama news agency, was suspended by Twitter after receiving a MCMC complaint.55

Intermediaries risk liability for some content posted by users, though it is not clear whether this leads them to remove more content than necessary. In 2012, Parliament passed an amendment to the Evidence Act 1950 that holds intermediaries liable for seditious content posted anonymously on their networks or websites.56 This includes hosts of online forums, news outlets, and blogging services, as well as businesses providing Wi-Fi services.57 The amendment holds individuals liable if they “facilitate” the publication of the offending content, and holds the owner of the computer the content was published from liable, whether or not they are the author.58

Authorities have requested that social media companies remove content. Between January and June 2020, Facebook restricted access to 190 items that the MCMC classified as COVID-19 misinformation, 11 items considered to be illegal hate speech, and 175 items which the Ministry of Health alleged violated local laws related to sale and promotion of regulated goods.59 Between July and December 2020, the MCMC requested Facebook restrict access to 10 items reported by MCMC; 5 items were related to COVID-19 misinformation, 3 items were purported hate speech, and 2 items violated the CMA. Between January and June 2020, Twitter received 41 demands to remove or withhold content and complied with 43.9 percent of these requests.60

Content blocking and removal requests are generally nontransparent and lack judicial oversight or effective avenues for appeal.

Blocks are implemented on the authority of the MCMC, which reports to a government ministry (see A5). No list of affected sites is provided by MCMC. A person whose content is blocked could request the MCMC to provide a reason for the decision and the MCMC is required to provide this information within 30 days of receipt.61

Under Section 263(2) of the CMA, the authorities are given the power to request that internet service providers disable access to sites which contain illegal content on revenue or national security grounds, under what is commonly known as an “access blocking order.”62 The CMA does not prescribe a process on how to challenge or appeal an access blocking order.

Sections 120 and 121 of the CMA provide a channel to appeal against a direction or decision, but not a determination of the MCMC, via the Appeal Tribunal and judicial review. The Court of Appeal clarified that judicial review under section 121 of the CMA is not intended to be applied generally; instead, it is only intended to apply to decisions and actions of the MCMC under Part V–Powers and Procedures of the MCMC.63

Self-censorship is common among online journalists and ordinary users, particularly in regard to sensitive issues such as Islam’s official status, race, the monarchy, and the preferential treatment enjoyed by the bumiputera—the term for ethnic Malays and other indigenous people—over Chinese and Indian minorities. Discussing these topics can lead to prosecution, which contributes to self-censorship online.64

Several civil society organizations observed a widening media crackdown under the PN government. Malaysian journalists express discomfort covering certain subjects as compared to the period under the previous government.65 Civil society groups have also noted that the February 2021 Malaysiakini decision may have a deleterious effect on freedom of speech and expression online (see B2 and C3).66

The MCMC has explicitly warned individuals against posting comments online relating to the “3Rs:” royalty, religion and race. Individuals discussing these issues may face questioning or prosecution.67

Content manipulation persists, especially around tense political moments such as elections, although it is not as systematic or widespread as it was while the previous administration, the BN coalition, was in power.

Both government and opposition figures have been known to pay online commentators, known as “cybertroopers,” to generate favorable content and denigrate their opponents.68 A report from the Oxford Internet Institute (OII) published in January 2021 concluded that these cybertroopers have manipulated the information landscape, employing consistent strategies and demonstrating “medium capacity capabilities.”69 A OII report published in September 2019 noted evidence that cybertroopers received formal training.70 Cybertroopers were particularly active in the run-up to the May 2018 general elections.71

In September 2020, during the corruption trial of Rosmah Mansor, the wife of former premier Najib Razak, her aide disclosed that 100,000 ringgits ($24,000) per month was allocated between 2012 and 2018 to pay 30 to 40 cybertroopers to counter slander against Mansor.72

The government has taken several steps to combat what it characterizes as “false news.” In 2017, the Communications and Multimedia Ministry launched SEBENARNYA, a fact-checking portal that encouraged social media users to verify the content of all news reports shared on popular platforms with the slogan, “not sure, don’t share.”73 Officials claimed the portal was nonpartisan,74 and it continued to be updated as of July 2020. The PN coalition that took power in March 2020 launched a 24-hour news channel in June 2020 to combat purportedly false news,75 prompting the Centre for Independent Journalism to raise concerns that the channel could spread state propaganda.76

In November 2020, the PN government rebranded the Special Affairs Department (JASA) as the Department of Community Communications (J-KOM). While the BN coalition was in power, JASA was a department that disseminated information and conducted strategic communication on behalf of the government. Opposition members considered JASA to be a propaganda tool of the BN coalition. In December 2020, the House of Representatives (Dewan Rakyat) reduced the allocated budget for J-KOM from 85.5 million ringgits ($20.9 million) to 40 million ringgits ($9.8 million), insisting that the budget be used only to relay important COVID-19-related information.77

During the COVID-19 pandemic, officials restricted online media from covering parliamentary proceedings. In October 2020, Parliament restricted media coverage of its proceedings between November and December 2020 to 15 media agencies to prevent the spread of COVID-19 and comply with health and safety procedures. The list of permitted agencies did not include any of the media agencies that exclusively operated online news portals.78 Parliament’s process to choose the 15 permitted agencies lacked transparency and explanation.79

In May 2020, coverage of Parliament was restricted to two media groups: Radio Television Malaysia (RTM), which is government-owned, and the Malaysian National News Agency, which was incorporated under the Bernama Act of 1867.80 Similar restrictions were also applied in May 2020 during the Malacca and Perak State Assembly meetings and Senior Minister Ismail Sabri’s daily COVID-19 press conferences.81

In March 2021, after a post—allegedly authored by a Ministry of Health employee—criticizing the city of Putrajaya’s vaccination plan went viral, the ministry issued a gag order prohibiting members of the civil service from commenting on public policy and government decisions on social media without prior approval.82

Many online platforms struggle to stay economically viable, and government restrictions contribute to difficult market conditions. In the past, a number of news sites have faced significant financial penalties due to defamation charges from political leaders (see C3).

Amid the July 2020 investigation of Al-Jazeera over its documentary covering authorities’ mistreatment of migrants during the COVID-19 pandemic (see C3), the government announced that the outlet flouted the Film Act 1981 by not applying for a license to produce the documentary, because all video producers needed a license “regardless of whether they are mainstream media agencies or personal media that broadcast films on social media platforms or traditional channels.” 83 Communications Minister Saifuddin Abdullah later clarified that social media users were free to produce and upload videos without a license, though he did not provide further clarity if media organizations needed a license to produce video content.84

Digital media is more diverse than traditional media in Malaysia. More established sites such as Malaysiakini and the Malay Mail Online have been joined by smaller platforms that contribute to the diversity of information.85 Several digital news platforms are among the country’s most popular websites.86 However, online self-censorship around controversial issues such as Islam’s official status, race, and the monarchy limit the diversity of viewpoints available about those topics (see B4).

Expanded internet access has led to the emergence of a vibrant blogosphere. English and Malay are the dominant languages, and many civil society groups, including those representing ethnic minorities, have a dynamic online presence. Websites in Chinese, Tamil, and other minority languages are also increasing in number and influence. There is also a vibrant podcast catering to the LGBT+ community, although the hosts remain anonymous for fear of reprisal; several LGBT+ websites are blocked (see B1).87

Social media continues to be an important avenue for accessing a wide array of information. Nearly 27.2 million people used WhatsApp, making it the most popular communication app.88 Newer platforms that carry a wide range of information, like TikTok, have also seen a recent increase in use among Malaysians.

There are no specific laws against the use of virtual private networks (VPNs).

Digital tools remain available for users and have helped expose and undercut the government’s control over traditional media. Social media has been a particularly effective tool for mobilization. However, restrictive laws around free expression and the threat of criminal prosecution could limit some online mobilization.

In March 2021, the hashtag #ManaUndiKami (Where Is Our Vote) was used to protest the government’s delay in implementing a 2019 bill that lowered the minimum voting age from 21 to 18.89 Individuals protested against this delay because it implied that 18-year-olds would be barred from voting in the next election; they used the hashtag to call for offline protests.90

In May 2020, the hashtag #MigranJugaManusia (Migrants are Also Human) spread on Twitter as Malaysians protested the detainment of undocumented people targeted in immigration raids in April 2020.91 The hashtag continued to be used at the end of the coverage period to express dissatisfaction over an anti-Rohingya poster released by the Immigration Department in June 2021, 92 raids on undocumented people,93 and general mistreatment against migrants.

In February and March 2020, civil society and members of the public used social media to criticize the PN coalition succeeding the PH government that won the general election in 2018.94

The constitution provides citizens with “the right to freedom of speech and expression” under Article 10 but allows for limitations on those rights.95 However, a number of laws also undermine freedom of expression (see C2).

The PH government kept its pledge and abolished the Anti-Fake News Act in December 2019,96 which the previous BN coalition passed in May 2018 ostensibly to curb the spread of purportedly false news, especially through social media. The sweeping law threatened to seriously restrict free expression online,97 and activists argued that it was meant to silence criticism of the government and was vulnerable to abuse (see C2).98

The minister of home affairs has absolute discretion under Section 7(1) of the Printing Presses and Publications Act 1984 to ban media on the grounds of public order, morality, security, public interest, or national interest.

A number of laws impose criminal and civil penalties for online activities. The government exercises tight control over online, as well as print and broadcast media, through laws like the Official Secrets Act of 1972 and the Sedition Act, which dates back to 1948. Violations can be punished with fines and several years in prison.

Amendments passed in 2015 widened the scope of the Sedition Act, requiring users to remove online content that is considered seditious and obligating the court to issue an order blocking access to unidentifiable seditious content.99 The maximum penalty in general sedition cases is now seven years in prison, up from three years before the amendments. A provision also imposes up to 20 years in prison for seditious activities that result in physical harm or destruction of property.100 In 2015, the Federal Court rejected a constitutional challenge to the Sedition Act.101

The Anti-Fake News Act 2018, which was repealed in December 2019, covered news, information, data, reports, images, or recordings in any form that are wholly or partly false.102 Despite its repeal, the government can still use other laws, including the penal code, to punish fake news (see C3).

The Emergency (Essential Powers) (No. 2) Ordinance 2021 was gazetted in January 2021 and implemented in March 2021. The ordinance, which bears strong resemblance to the repealed Anti-Fake News Act, criminalizes spreading purportedly false news relating to COVID-19 or the Emergency Proclamation.103 Any person who is found guilty will face a fine of up to 100,000 ringgits ($24,700), imprisonment of up to three years, or both; a convicted individual may also be ordered to apologize to those affected by their activities.104 While the MCMC has noted several measures that would prevent the ordinance from being used arbitrarily, activists worry that this law could be inconsistently enforced because of the ambiguity of what constitutes “fake news.”105

Defamation is a criminal offense under Sections 499 to 520 of the penal code. Media outlets benefit from stronger protections under the Defamation Act 1957 if they can prove that the content is accurate and was published without malice;106 bloggers, who lack this protection, are at greater risk for defamation charges. Section 505(b) of the penal code criminalizes statements intended to cause “fear or alarm to the public” or “commit an offense against the State or public tranquility” with imprisonment up to two years, a fine, or both.

The government has also pursued prosecutions for online content under the CMA. The act’s broadly worded Section 211 bans content deemed “indecent, obscene, false, threatening, or offensive.” Spreading such content on the internet constitutes “improper use of network facilities or network service” under Section 233.

During the coverage period, internet users were arrested and prosecuted for online speech. Content critical of Islam, the monarchy, the government, or touching on sensitive racial issues can lead to arrest and prosecution. A number of social media users were also investigated, arrested, and charged for posting unverified news about the COVID-19 outbreak.

Several individuals were also arrested and prosecuted for insulting the monarchy, often under Section 233 of the CMA or the Sedition Act 1948.107 In July 2020, a man was jailed for nine months after being found guilty of insulting the king on Facebook.108 That same month, another man was sentenced to 10 months in prison, after already serving 2, for allegedly insulting the king on Instagram.109 Blogger Dian Abdullah, also known as Lai Yuet Ming, was charged under Section 233(1)(a) of the CMA and Section 505(b) of the penal code for allegedly criticizing the king and premier in blog posts.110 Her criminal proceedings were ongoing at the end of the coverage period.111 In June 2021, after the coverage period, politician Iswardy Morni was charged under Section 4(1)(a) of Sedition Act for allegedly insulting the king on Facebook. He pleaded not guilty and was released on bail. The case was ongoing at the end of the coverage period. If convicted, he faces a fine up to 5,000 ringgits ($1,200), imprisonment not exceeding 3 years, or both.112 In May 2020, radio personality Patrick Teoh was arrested for allegedly insulting the Johor crown prince, Tunku Ismail Sultan Ibrahim, on Facebook.113 He was charged in June 2020 and faces a maximum fine of 50,000 ringgits ($12,300), a maximum one-year jail term, or both.114

Journalists, activists, and internet users are also routinely charged and prosecuted for criticizing the government, political parties, and other official bodies. In March 2021, graphic designer and activist Fahmi Reza was investigated under Section 233 of CMA and Section 500 of penal code in relation to satirical artworks aimed at the health minister, which were posted in Twitter in October 2020 and February 2021.115 In April 2021, the activist was arrested for allegedly insulting the queen by uploading a satirical playlist on Spotify. He was arrested under Section 4(1) of the Sedition Act and Section 233 of the CMA and released the day after his arrest.116

In June 2020, the government initiated legal proceedings against popular online news portal Malaysiakini and editor in chief Steven Gan, based on readers’ comments on a news story about the judiciary (see B2).117 In February 2021, the Federal Court found Malaysiakini guilty of contempt.118 However, Gan was found not guilty. Though the Attorney General’s Chamber sought a 200,000 ringgit ($46,000) fine, the court imposed a hefty fine of 500,000 ringgits ($115,000) on the outlet.119 Malaysiakini was able to crowdfund the fine in short order.120 Two police reports were subsequently lodged against Gan and parliamentarian Charles Santiago regarding their remarks on the Federal Court decision.121 Santiago commented on the vindicative nature of the fine imposed by the court, independence of the judiciary, and media freedom.122 Gan allegedly commented on the impact of the decision, the fine’s size, and his general disappointment.123

In July 2020, the police investigated Al-Jazeera and several of its journalists for sedition, defamation, and violations of the CMA after the outlet broadcasted, both on television and online, a 25 minute documentary on the government’s mistreatment and arrests of migrant workers during the COVID-19 lockdown, which included allegations of discrimination and racism.124 The Immigration Department also lodged a report against Al-Jazeera.125 No charges were filed against the network or its personnel; however, five employees’ applications for work-visa renewals were denied and they have since left Malaysia.126 That same month, authorities arrested and revoked the work permit of Bangladeshi Mohamad Rayhan Kabir; he had criticized the government in the documentary. He was detained without charge for over 10 days and, finally, deported in August 2020.127

The government also continued to investigate internet users under the penal code and the CMA for online speech deemed insulting to Islam and the prophet Muhammad. In June 2020, a furniture worker pled guilty to that charge, receiving a 6,000 ringgit ($1,400) fine instead of imprisonment.128 In March 2019, a Facebook user was sentenced to 10 years in prison for insulting Islam and the prophet, although in September 2019 the prison term was reduced to six years.129

Individuals continued to be charged with defamation during the coverage period. In March 2021, UMNO president Zahid Hamidi initiated a defamation lawsuit in the High Court against the Malaysiakini editor in chief and a Malaysiakini reporter for after it reported on criminal proceedings facing Zahid, which involve accusations of bribery, money laundering, and criminal breach of trust.130

Individuals are also arrested for the dissemination of “fake news” related to COVID-19 under the Emergency Ordinance (Essential Powers) (No. 2) 2021. A teacher was charged with posting “fake news” on Facebook in June 2021. His April 2021 Facebook post claimed that a policeman died after receiving the second dose of a vaccine.131 In June 2021, a social media user known as @CharimanGLC was arrested for his tweets which alleged that the 70 million ringgits ($17 million) spent on developing a COVID-19 vaccination system had been misused.132 As of June 2021, 10 individuals had been arrested for posts sharing “fake news” related to COVID-19 or the emergency declaration; 7 were released on bail and the remaining 3 were not yet charged at the end of the coverage period.133 Journalist Wan Noor Hayati Wan Alias was charged under Section 505(b) of the penal code following three January 2020 Facebook posts criticizing government’s decision to allow a cruise ship from China to dock in Malaysia. Wan Noor Hayati faces up to two years' imprisonment, a fine, or both.134

Anonymous online communication and encryption are not strictly prohibited in Malaysia.

Since 2006, the MCMC mandated that all service providers register prepaid SIM cards upon purchase.135 However, the rule has reportedly been weakly enforced; 1,377,862 prepaid SIM cards were registered without proper verification.136 Legal-name registration is not required for bloggers or customers at cybercafés. It is a criminal offense under Section 507 of the penal code to commit criminal intimidation by anonymous communication.

Users can largely use encryption tools as they please, although a number of laws allow police to access encryption and decryption codes when conducting searches, such as Section 10(1)(c) of the Computer Crimes Act (CCA) 1997, Section 116B of the criminal procedure code, Section 79 of the Digital Signature Act 1997, Section 249 of the CMA, Section 32 of the Anti-Trafficking in Persons and Anti-Smuggling of Migrants Act 2007, and Section 32 of the Strategic Trade Act 2010.137

Privacy protections in Malaysia are poor. It is difficult to ascertain the extent of government surveillance of users’ internet activities.138

Legal provisions allow the police, prosecutors, and the communications minister to intercept online and mobile communications. The laws are generally interpreted to require network operators and service providers to assist law enforcement and intelligence agencies in surveillance efforts, even where clear procedures are lacking. A court order is not required for emergency interception, which applies to cases with national security implications. Under the Security Offenses (Special Measures) Act 2012, a police officer with the rank of superintendent of police or above may intercept communications without the authorization of the public prosecutor in urgent cases.139 The Emergency (Essential Powers) (No. 2) Ordinance 2021 also grants authorities access to digitized data and the power to demand the preservation and disclosure of traffic data.140

In May 2020, Israeli news site CTech reported on documents in an Israeli court case revealing that, in April 2018, officials from the then ruling BN coalition signed a 6.3 million ringgit ($1.5 million) deal to purchase surveillance technology from Israeli cybersecurity startup Senpai for use by the Malaysian intelligence agency.141 The deal was signed just over a month before the May 2018 election, and the technology was allegedly planned for use surveilling the political opposition ahead of the vote. Former prime minister Najib Razak denied the allegations.142

Citizen Lab reported in December 2020 that the government may be a customer of Circles, a surveillance firm whose products could be used to snoop on the location, texts, and calls of targeted phones.143 In 2013, Citizen Lab reported FinFisher—described by distributor Gamma International as providing “governmental IT intrusion and remote monitoring solutions”—was detected on 36 servers worldwide, including in Malaysia.144 The software potentially allows the server to steal passwords, tap Skype calls, and record audio and video without the permission of its targets.145 Citizen Lab also identified “a Malaysian election-related document” that it characterized as a “booby-trapped candidate list” containing spyware.146 Because the spyware is only marketed to governments, “it is reasonable to assume that some government actor is responsible,” the group concluded. A separate Citizen Lab report published in 2014 asserted that a Malaysian government agency was a “current or former user” of the Remote Control System spyware marketed by the Milan-based Hacking Team.147 In 2016, the prime minister’s office denied having purchased this spyware but could not confirm whether other government agencies had done so.148

Social media monitoring continues to be a concern, and several government agencies and officials have announced they are monitoring platforms for content related to race, religion, royalty, and false information, including antivaccine propaganda. 149 Similarly, in October 2018, Israeli newspaper Haaretz reported that Malaysia had previously purchased sophisticated surveillance technology from Israeli firms that can monitor and analyze social media and other open-source information.150 Previously, the US-based company Snaptrends also reportedly discussed its social media monitoring technology with Malaysian authorities.151

Amid the COVID-19 pandemic, the government has rolled out several smartphone apps that access personal information for contact-tracing purposes. For example, the Gerak Malaysia app tracks location, while MyTrace uses Bluetooth proximity data to assist with contact tracing.152 The mandatory use of MySejahtera app raised privacy concerns.153 However, the Health Ministry has assured that the data is secured and would not be misused.154

In May 2021, the phone of parliamentarian Syed Saddiq Syed Abdul Rahman was confiscated by police after he was summoned for questioning.155 The police called Saddiq for questioning after he posted a video online demanding justice for A. Ganapathy, a journalist who died following his arrest.156

The law protects against using individual data for commercial purposes, but there are no provisions specifically addressing online privacy.157 In some cases, service providers are required to aid the government in monitoring user communications.158

The CCA mandates that providers give police access to user information once a warrant is obtained. Providers that fail to comply can face up to three years’ imprisonment and fines of up to 25,000 ringgits ($6,100).159 Section 116 of the criminal code allows the police to access user information, which is defined as “the necessary password, encryption code, decryption code, software or hardware, and any other means,” when conducting a criminal investigation.160 Depending on the offense being investigated, the criminal procedure code does not always require police to obtain a warrant. Section 116c allows the public prosecutor to force service providers to collect and retain specific user communications or data. The prosecutor can also authorize a police officer to install devices to collect such information.

The Malaysian Personal Data Protection Act 2010, which regulates the processing of personal data in commercial transactions, came into effect in 2013. The law makes it illegal for commercial organizations to sell personal information or allow third parties to use it. Those convicted of violating the law can be fined up to 100,000 ringgits ($24,500) or sentenced to one year in prison. The federal and state governments are exempted from the law, as are entities that process data outside Malaysia.161 The act requires that information about Malaysians be stored locally and limits conditions under which it can be transferred abroad, though the extent to which those rules are enforced is unclear.162

In August 2020, the government contracted with MyEG Services Bhd, an electronic government services provider, to share data collected by employers while monitoring foreign workers’ COVID-19 status.163

Between January and June 2020, Twitter received 5 requests to provide information about an account, and between July and December 2020, Twitter received 8 requests. Twitter complied with none of these requests.164

Score Change: The score declined from 4 to 3 because individuals, particularly members of the LGBT+ community, faced online intimidation and harassment in retaliation for their online activity. In one case, caricature artist Fahmi Reza was subjected to intimidation and harassment by the police.

Intimidation and physical violence against individuals in retaliation for their online activities has been a problem in Malaysia. Journalists, activists, and members of marginalized communities such as LGBT+ people sometimes face online harassment.

Users sometimes face offline retaliation for online posts related to Malaysian government officials. In April 2021, 20 police officers forcibly entered political caricature artist Fahmi Reza’s home and arrested him for alleged sedition (see C3). Reza claims that the police kicked a hole in his door and seized his laptop and smartphone before they arrested him.165 In March 2020, Kow Gah Chie, a journalist for Malaysiakini, was subjected to racist comments and physically violent threats on Facebook after she published a story on comments by the environment minister which seemingly supported logging in ecologically sensitive areas.166

Users continue to face online retaliation, including doxing and threats, for their online posts. In July 2020, Al-Jazeera reported that journalists and staff involved in creating a documentary critical of the government’s treatment of migrant workers were subjected to online abuse, including death threats and doxing (see B6 and C3).167 A Bangladeshi migrant worker who was interviewed for the documentary also faced online hate speech and threats, and his personal details were published on social media prior to his arrest and deportation (see C3).168 In June 2021, after the coverage period, a Facebook user posted pictures of a man who resembled the head of Kedah state government test driving a car, which is prohibited under the Movement Control Order. After posting the pictures, the user and her family received hate mail and threats, particularly from the supporters of Menteri Besar; their personal details were also released and circulated online.169

LGBT+ users also have been subjected to harassment, homophobic slurs, and hateful content online.170 In March 2021, Nur Sajat, a prominent transgender entrepreneur, received death threats after posting a video on Facebook saying she “does not want to be a Muslim anymore.”171 Activist Numan Afifi experienced significant online harassment after speaking at the UN Human Rights Council about LGBT+ rights in Malaysia in April 2019.172

Technical attacks aimed at suppressing political information online were not reported during the coverage period, though technical attacks have been recorded in the past.

Several technical attacks targeted politicians and political websites on election day in May 2018. Politicians from both the BN and PH claimed that their phones were hacked, causing them to receive a wave of unsolicited calls from overseas.173 Political parties also claimed that their websites were attacked and became inaccessible.

In recent years, civil society organizations have faced distributed denial-of-service (DDoS) attacks. DDoS attacks force sites to crash by overloading the host server with requests for content. In September 2019, Bersih, an electoral reform group, was targeted by a DDoS after posting a statement online regarding the ongoing pro-democracy protests in Hong Kong.174

In December 2020, the Malaysian Armed Forces (MAF) faced a cyberattack, with hackers attempting to steal government data.175 The Chief of Armed Forces announced that the MAF’s Cyber Defense Operation Center prevented hackers from accessing information within the network, though certain segments outside of the network were hacked. After the attack, users accessing the portal were allegedly shown indecent pictures.176

The National Cyber Security Agency (NACSA) was formed in February 2017 as the lead cybersecurity agency. The National Cyber Security Policy (NCSP) was formulated in 2016 to address the risks to critical sectors of the economy.177 In October 2020, the PN government allocated 1.8 billion ringgits ($432.7 million) to develop a 2020–24 cybersecurity strategy.178

Between January and May 2021, there were a total of 4,615 cybersecurity incidents reported to Cyber Security Malaysia.179 The Malaysia Computer Emergency Response Team counted 798,160 botnet drone viruses by unique IP address and 383,289 malware infections by unique IP address between January to May 2021.180

There are numerous incidents of data security breaches. In April 2021, the personal data of 11 million Malaysian Facebook users was reportedly leaked online.181 In February 2021, e-payment provider E-Pay Malaysia’s data was reportedly leaked and listed on a hacker forum for sale.182 In the same month, the Department of Personal Data Protection received a report that the data of 10 million citizens was leaked from an electoral list.183