Internet penetration rates and average connection speeds continued to increase during the coverage period. According to the Department of Statistics, household internet access increased from 91.7 percent in 2020 to 95.5 percent in 2021.1 DataReportal’s Digital 2022 report indicates an internet penetration rate of 89.6 percent of the population.2 Data reported in March 2022 as a part of the Jalinan Digital Negara (JENDELA) digital development plan indicates that 95.5 percent of populated areas have access to fourth-generation (4G) mobile services.3 The increase in internet penetration rates was largely driven by developments in mobile broadband infrastructure, including optimization of 4G long-term evolution (LTE) networks, and new mobile and data subscriptions offered by providers.4

The government initiated the five-year National Fiberisation and Connectivity Plan (NFCP) in 2019 and the five-year JENDELA project in August 2020 to improve fixed-line broadband services. JENDELA’s 2022 report indicates the initiative has made meaningful progress on expanding internet connectivity, though the effort to expand satellite broadband access in rural and interior locations has lagged.5 As of March 2022, 99.3 percent of third-generation (3G) carries have shut down and migrated customers to 4G services—a core component of the JENDELA plan—with the aim of full transition by the end of 2022.6 Despite these improvements, complaints about mobile network coverage have significantly increased in 2021, particularly during the summer, across all major service providers,7 and continued through early 2022.8

As of August 2020, approximately 20 percent of the country still had very poor internet access. In some places, internet access is disrupted when individuals dig up fiber-optic cables, steal copper wires, or otherwise vandalize internet infrastructure. 9 The government is using satellite technologies to expand internet access to rural and remote areas (see A2). These technologies provide broadband coverage to areas unreachable by 4G and fiber-optic technologies; however, they also offer limited capacity, incur high operational costs, and are unstable in poor weather conditions.10

In May 2022, speed-testing company Ookla reported Malaysia’s median mobile internet download speed at 29.36 megabits per second (Mbps) and its median fixed-line broadband speed at 82.89 Mbps.11 JENDELA reported an average of 40.13 Mbps mobile broadband speed as of March 2022.12 The Malaysian Communications and Multimedia Commission (MCMC) revised its quality standards in 2021 to require service providers to deliver a minimum of 2.5 Mbps for wireless broadband speeds and 25 Mbps for fixed wireless access, for 90 percent13 Between January and June 2022, MCMC issued 40 compliance notices for failure to meet that standard.14

In February 2021, the Malaysian government decided to build and manage a state-operated fifth-generation (5G) technology infrastructure.15 The first 5G network was launched in selected areas of Kuala Lumpur, Putrajaya and Cyberjaya in December 2021, with YTL Communications and Telekom Malaysia offering 5G services.16

The rollout of internet infrastructure, however, is hindered by local authorities and bureaucracy. The lack of standardization of planning permission processes, according to a telecommunications firm, hinders internet infrastructure development.17 According to a JENDELA report released in April 2021, deployment and renewal costs of tower and rooftop structures vary significantly across states and among local authorities within the same state.18

Catastrophic flooding in several states in December 2021 damaged more than 800 telecommunications towers, in some cases interrupting connectivity.19 As of late December, repairs were at 60 percent completion.20

The cost of internet access remained affordable during the coverage period, though internet access is limited in rural areas. The previous PH government contributed to more affordable internet access by enforcing the Mandatory Standard on Access Pricing (MSAP), which caps the wholesale prices service providers can charge.21 The MSAP has been extended to December 2022.22

The government reported in early 2019 that broadband prices had decreased by 25 percent in 2018. Major telecommunications providers Celcom Axiata Bhd, Maxis Bhd, and TIME dotcom Bhd reduced their broadband prices by between 30 and 65 percent.23 According to the Alliance for Affordable Internet, the cost of 1 gigabyte (GB) of broadband data in Malaysia averaged $5.86 in 2020, or 0.65 percent of gross national income (GNI) per capita.24 According to the International Telecommunications Union (ITU), in 2021, 2 GB of mobile broadband data cost $8.48 whereas 5 GB of fixed broadband data cost $20.28.25

Internet use is centered around cities. In 2020, the most recent data available, a government survey showed that 75.6 percent of internet users were in urban areas and 24.4 percent were rural.26 In the third quarter of 2021, the MCMC reported that the fixed-broadband penetration rate was highest in Kuala Lumpur federal territory, at 62.8 percent, and lowest in rural Kelantan state, at 16.8 percent.27

In December 2021, the MCMC announced that digital infrastructure in rural areas would be expedited, with implementation of broadband service by way of satellite technology to be ready by early 2022, and 362 new towers to be built to improve 4G coverage by the end of 2022.28 As of March 2022, broadband expansion under JENDELA reached 798 of the 839 rural and interior locations identified and a new satellite launched in June 2022 also aimed to reduce the connectivity gape.29

Gender disparities in internet access are declining. In 2020, 54.3 percent of internet users were men and 45.7 percent were women. In comparison, in 2018, 59 percent were men and just 41 percent were women. Internet users are also generally younger: 34.1 percent of users are between 20 and 24 years old, representing the largest pool of users among all age groups.30

COVID-19 highlighted the issue of affordability and accessibility of electronic devices to access the internet. Students in rural areas have reported that poor internet access affected their studies. In February 2022, a student in Sarawak trekked for two hours to attend his online university interview due to poor internet speed in his community.31

The Ministry of Communications and Multimedia launched several initiatives to assist students during the COVID-19 pandemic, including a 20 ringgit ($4.74)–per-month prepaid data pass offering 15 GB data of data to eligible students from January to April 2021, free access to e-learning tools via five telecommunications companies, and free Wi-Fi provided by six companies at 130 public housing sites. 32 A new service package was introduced in October 2021 to provide affordable data to students.33

The government launched a 3.5 billion ringgit ($830 million) program in May 2021 to assist users in purchasing smartphones and accessing broadband services, with data plans running for 12 months.34 The government plans to contribute 2 billion ringgits ($474 million) to this program, while 12 telecommunication providers will be contributing an additional 1.5 billion ringgits ($356 million) worth of support, mainly in the form of free data. 35

There were no reported cases of government-imposed restrictions on internet access during this coverage period. The last major reported incident of authorities restricting access occurred in 2012.36 However, a partly state-owned company continues to dominate the network infrastructure.

Telekom Malaysia, the country’s largest telecommunications company, retains a fixed-line monopoly and owns the country’s last-mile connections (see A4).37 As of July 2021, the government retained a 0.38 percent stake in Telekom Malaysia, which was formerly state-owned, while government-linked companies and statutory bodies held the majority of shares in the company.38 The fact that one partly state-owned company controls so much of the internet infrastructure provides a path for the authorities to restrict connectivity in the future.

The nonprofit Malaysia Internet Exchange allows service providers to exchange local traffic more efficiently.39 Malaysia has several connections to the international internet, making the network more resilient.40

Economic obstacles and political barriers posed by patronage networks restrict the diversity of service providers.

According to MCMC data, 351 network-facilities providers owned or operated internet infrastructure in 2021, an increase from 220 providers in 2019.41 Telekom Malaysian is the dominant player in the fixed-line market, having a 90 percent share of the market as of July 2021.42 Fiber-optic home broadband service is provided by Astro IPTV. Other providers of broadband and mobile internet service include Celcom, Digi, TIME Internet, Tune Talk, and Yes, a wireless 4G provider.43

In June 2022, after the coverage period, the MCMC approved the proposed merger of Digi and Celcom, Malaysia’s second- and third-largest mobile service operators, after the companies signed a merger agreement in June 2021. The merger remains pending, awaiting review from other regulatory bodies.44 In response to concerns about reduction of competition—the merged companies would form the largest mobile service provider in the market—Digi and Celcom submitted proposed remedies to the MCMC in June 2022, after the coverage period.45

The government established the Digital Nasional Berhad (DNB)—a company owned by the Ministry of Finance to provide 5G infrastructure throughout the country—in March 2021. The DNB licenses 5G access to service providers and is the sole 5G provider in Malaysia. Industry groups like the Global Mobile Industry Association raised concerns about the poor track record of the DNB’s model, while the nonprofit Institute for Democracy and Economic Affairs criticized the lack of transparency and competition.46 Several telecommunications providers sought to have the government authorize a second 5G service provider in December 2021.47 The Minister of Finance has justified the approach on the grounds that it would ensure an affordable service and accelerate 5G rollout.48 The government later agreed to reduce its stake in the DNB to 30 percent, offering 70 percent equity to telecommunications companies. Six service providers were reportedly exploring a stake as of June 2022.49

The regulatory body that oversees service providers, the MCMC, has appeared to lack transparency in its decision-making processes and exercise of powers, despite its multistakeholder advisory board.

The Ministry of Communications and Multimedia oversees the MCMC. The Communications and Multimedia Act (CMA) 1998 gives the ministry a range of powers, including the authority to license the ownership and operation of network facilities.

The Malaysian Communications and Multimedia Commission Act 1998 directs the ministry to appoint the MCMC chairperson; there are currently seven other commission members from backgrounds including civil service, finance, accounting, and academia.50 The MCMC Act 1998 states the commission should consist of a chairman, three members representing the government, and between two and five members from other sectors. All members are appointed by the communications minister. It is unclear how candidates are selected. The MCMC has taken steps to curtail online speech and has not always addressed internet-related issues in a fair manner (see B1).

In May 2018, activists called on the PH government to review the ambit of the MCMC’s powers and investigate whether it had abused its position under the BN regime.51 The government did not undertake such a review before losing power in February 2020, nor did the succeeding PN government.

There were transparency concerns regarding a 5G tender process. In June 2020, the PN government cancelled an order made the previous month awarding 5G broadband frequency bands to five companies after it emerged that one of the recipients was the little-known firm Altel, which is controlled by the politically connected tycoon Syed Mokhtar al-Bukhary.52 Reports later suggested that the tender process had not been open. The government said it was backtracking on the order “due to technical and legal reasons and the need for a more transparent process.”53

The government’s rollout of 5G infrastructure has also been criticized for limiting competition (see A4) and lacking transparency. The DNB awarded a 10-year contract amounting to 11 billion ringgits ($2.6 billion) to Ericsson to deploy 5G network infrastructure. Prominent journalist Wong Chun Wai raised concerns about the decision to limit 5G deployment to a single vendor,54 and an opposition parliamentarian called for a corruption inquiry following reporting on Ericsson’s questionable business practices in other countries.55 The DNB asserted that Ericcson had been selected based on merit after it offered the lowest tender price out of four bidders and scored well on tender-evaluation criteria.56 In June 2022, after the coverage period, activists affiliated with the ruling government urged the Malaysian Anti-Corruption Commission (MACC) to investigate the DNB over concerns on lack of transparency and procurement issues.57

The government does not systematically block or filter online content, although several websites remained blocked during the coverage period.

The MCMC has not released an official list of blocked sites. According to the Open Observatory of Network Interference (OONI) database, which runs technical tests to verify website blocking, websites blocked during the coverage period spanned religious material, political criticism, and LGBT+ content, as well as pornography.58 An OONI report on LGBT+ website censorship found that international LGBT+ websites were primarily blocked, with Malaysian LGBT+ sites accessible. Between June 2016 and July 2020, Gay Star News, Planet Romeo and Utopia Asia were subject to DNS blocking in more than 50 percent of tests, with Telekom Malaysia being the ISP with most LGBT+ site blocking detected.59 As of May 2022, Planet Romeo, Gay Star News and Utopia Asia remained blocked.60

Since June 2021, the website belonging to the Coalition for Clean and Fair Elections (BERSIH) has been blocked by ISP TIME DotCom Berhad.61

The MCMC revealed that, as of March 2021, a total of 2,195 gambling sites were blocked.62 In April 2021, cryptocurrency platform Remitano was blocked by the MCMC upon request of the Securities Commission for operating a digital asset exchange (DAX) without authorization, violating Section 7 of the Capital Markets and Services Act 2007.63 The Ministry of Communications and Multimedia reported that the MCMC blocked 4,068 pornographic sites between 2018 and September 2021.64

The MCMC periodically instructs websites and social media platforms to remove content.65 Blog owners and Facebook users have been told to remove content that touches on sensitive issues involving race, religion, and the monarchy. The MCMC may choose to exercise this power on its own discretion,66 and officials indicated during the coverage period that they might seek additional authorities to force content removals.67

In July 2022, after the coverage period, Prime Minister Ismail Sabri Yaakob obtained an injunction ordering online outlet Agenda Daily to remove an allegedly defamatory article about him, pending the outcome of a civil suit over the article (see C3).68

In March 2022, Malaysia’s highest court dismissed an appeal from the popular news portal Malaysiakini over a previous ruling that found the outlet in contempt of court.69 In June 2020, the government had initiated legal proceedings against the portal after readers posted five comments criticizing the judiciary on an article that detailed the reopening of the country’s courts after a COVID-19 lockdown.70 The outlet’s administrators reportedly removed the comments two days after being contacted by police. In February 2021, the Federal Court found Malaysiakini guilty of contempt of court (see C3).71 Following the decision, the lead counsel for Malaysiakini opined that the Federal Court had set a precedent that news portals, in order to avoid liability, needed to take active steps to moderate comments before they are published.72

In October 2020, the MCMC warned that legal action could be taken against account holders of parody accounts.73 Following this announcement, in December 2020, Bermana TV, a Twitter account parodying the Bernama news agency, was suspended by Twitter after receiving an MCMC complaint.74

The government has repeatedly investigated the pseudonymous Twitter account Edisi Siasat (also known as Edisi Khas), which is known for publishing claims on corruption and abuse of power allegations involving government officials.75 The account was suspended by Twitter for a terms-of-service violation in February 2022, which the account attributed to posts alleging corruption involving drug charges against the son of a prominent businessman.76

Intermediaries risk liability for some content posted by users, though it is not clear whether this leads them to remove more content than necessary. In 2012, Parliament passed an amendment to the Evidence Act 1950 that holds intermediaries liable for seditious content posted anonymously on their networks or websites.77 This includes hosts of online forums, news outlets, and blogging services, as well as businesses providing Wi-Fi services.78 The amendment holds individuals liable if they “facilitate” the publication of the offending content, and holds the owner of the computer the content was published from liable, whether or not they are the author.79

Authorities have requested that social media companies remove content. From July to December 2021, Facebook removed 136 items pursuant to government requests, including 13 that the MCMC alleged were blasphemous, hate speech, or obscene, according to disclosures from the company.80 Twitter received 189 legal demands to remove content in the same period and complied with 23 percent of them.81 In December 2021, the MCMC requested that Twitter remove posts criticizing the poor handling of Malaysia’s floods by the government on the grounds of national interest, citing Section 233 of the Communications and Multimedia Act 1998.82

Content blocking and removal requests are generally nontransparent and lack judicial oversight or effective avenues for appeal.

Blocks are implemented on the authority of the MCMC, which reports to a government ministry (see A5). No list of affected sites is provided by the MCMC. A person whose content is blocked can request that the MCMC provide a reason for the decision and the MCMC is required to comply within 30 days of receipt.83

Under Section 263(2) of the CMA, the authorities are given the power to request that ISPs disable access to sites that contain illegal content on revenue or national security grounds, under what is commonly known as an “access blocking order.”84 The CMA does not prescribe a process on how to challenge or appeal an access blocking order.

Sections 120 and 121 of the CMA provide a channel to appeal against a direction or decision, but not a determination, of the MCMC, via the Appeal Tribunal and judicial review. The Court of Appeal clarified that judicial review under section 121 of the CMA is not intended to be applied generally; instead, it is only intended to apply to decisions and actions of the MCMC under “Part V–Powers and Procedures of the MCMC.”85

Revisions to the Malaysian Communications and Multimedia Content Code—a voluntary industry code that participants may nevertheless be fined for breaking—which took effect at the end of May 2022 extended the Content Code to cover online service providers. The Content Code revisions also loosened restrictions on nonsexual nudity and imposed prohibitions on advertising targeted at children.86 It remains to be seen whether the Content Code revisions will drive service providers to remove content more frequently.

Self-censorship is common among online journalists and ordinary users, particularly in regard to sensitive issues such as Islam’s official status, race, the monarchy, and the preferential treatment enjoyed by the bumiputera—the term for ethnic Malays and other indigenous people—over Chinese and Indian minorities. Discussing these topics can lead to prosecution, which contributes to self-censorship online.87

Several civil society organizations observed a widening media crackdown under the PN government. Civil society groups have also noted that the February 2021 Malaysiakini decision may have had a deleterious effect on freedom of speech and expression online (see B2 and C3).88

The MCMC has explicitly warned individuals against posting comments online relating to the “3Rs”: royalty, religion and race. Individuals discussing these issues may face questioning or prosecution.89

Self-censorship among journalists is common.90 Malaysian journalists express more discomfort covering certain subjects as compared to the period under the previous government.91 Journalists often face harassment and intimidation in the form of police questionings and threats of defamation suits for reporting against the ruling government and government officials (see C3).

Online content manipulation persists, especially around tense political moments such as elections, although it is not as systematic or widespread as it was while the BN coalition was in power.

Both government and opposition figures have been known to pay online commentators, known as “cybertroopers,” to generate favorable content and denigrate their opponents.92 A report from the Oxford Internet Institute (OII) published in January 2021 concluded that these cybertroopers have manipulated the information landscape, employing consistent strategies and demonstrating “medium capacity capabilities.”93 An OII report published in September 2019 noted evidence that cybertroopers received formal training.94 Cybertroopers were particularly active in the run-up to the May 2018 general elections.95

In September 2020, during the corruption trial of Rosmah Mansor, the wife of former prime minister Najib Razak, her aide disclosed that 100,000 ringgits ($24,000) per month was allocated between 2012 and 2018 to pay 30 to 40 cybertroopers to counter criticisms of Mansor.96

The government has taken several steps to combat what it characterizes as “false news.” In 2017, the Communications and Multimedia Ministry launched SEBENARNYA, a fact-checking portal that encouraged social media users to verify the content of all news reports shared on popular platforms, with the slogan, “not sure, don’t share.”97 Officials claimed the portal was nonpartisan.98 The PN coalition that took power in March 2020 launched a 24-hour news channel in June 2020 to combat purportedly false news,99 prompting the Centre for Independent Journalism to raise concerns that the channel could spread state propaganda.100

In November 2020, the PN government rebranded the Special Affairs Department (JASA) as the Department of Community Communications (J-KOM). Under the BN coalition, JASA had been a department that disseminated information and conducted strategic communication on behalf of the government. Opposition members considered it to be a propaganda tool of the BN coalition.

In December 2020, the House of Representatives (Dewan Rakyat) reduced the allocated budget for J-KOM from 85.5 million ringgits ($20.3 million) to 40 million ringgits ($9.5 million), insisting that the budget be used only to relay important COVID-19-related information.101 Disclosures in December 2021 indicated that J-KOM curtailed its activities that year,102 though government statements about appropriations for J-KOM in the Budget 2022 process were inconsistent and the number of J-KOM staff remains unclear.103

In September 2021, Parliament restricted media coverage of its proceedings to only 16 media agencies without disclosing a reason. Organizations not named in the list include online news sites such as Free Malaysia Today, The Vibes, The Malaysian Insight, Malaysian Gazette, and The Malaysian Reserve.104 Previously, Parliament had restricted media coverage of its proceedings between November and December 2020 to 15 media agencies to prevent the spread of COVID-19 and to comply with health and safety procedures. The list of those permitted agencies did not include any that exclusively operated online news portals,105 and Parliament’s process of choosing the permitted outlets lacked transparency and explanation.106

In March 2021, after a post that criticized the city of Putrajaya’s vaccination plan and that was allegedly authored by a Ministry of Health employee went viral, the ministry issued a gag order prohibiting members of the civil service from commenting on public policy and government decisions on social media without prior approval.107

In an investigation released in August 2021, the news outlet Malaysiakini identified several networks that had spread pro–Chinese government content, including Chinese state media content and disinformation, during the Hong Kong protests against the National Security Law.108 A study by the Singaporean ISEAS Yusof Ishak Institute identified false information narratives prevalent on Malaysian social media that represented Ukraine as the aggressor in the Russian invasion of Ukraine in February 2022.109

Score Change: The score improved from 1 to 2 to reflect the lack of formalized constraints on digital media outlets.

Many online platforms struggle to stay economically viable, and government restrictions occasionally contribute to difficult market conditions. In the past, a number of news sites have faced significant financial penalties due to defamation charges from political leaders (see C3).

Amid a July 2020 investigation of Al-Jazeera over a documentary covering authorities’ mistreatment of migrants during the COVID-19 pandemic, the government announced that the outlet had flouted the Film Act 1981 by not applying for a license to produce the documentary. Communications Minister Saifuddin Abdullah said that all video producers needed a license “regardless of whether they are mainstream media agencies or personal media that broadcast films on social media platforms or traditional channels.”110 Saifuddin later clarified that social media users were free to produce and upload videos without a license, though he did not provide further clarity on whether media organizations needed a license to produce video content.111

Online outlets are not subject to the licensing restrictions that limit print outlets from publishing.112 In 2016, news site Malaysiakini was investigated for receiving foreign funds under Section 124C of the penal code, which prohibits activities detrimental to parliamentary democracy and carries a mandatory jail term up to 15 years for violations.113

Digital media is more diverse than traditional media in Malaysia. More established sites such as Malaysiakini and the Malay Mail Online have been joined by smaller platforms that contribute to the diversity of information.114 Several digital news platforms are among the country’s most popular websites.115 However, online self-censorship around controversial issues such as Islam’s official status, race, and the monarchy limit the diversity of viewpoints available about those topics (see B4).

Expanded internet access has led to the emergence of a vibrant blogosphere. English and Malay are the dominant languages, and many civil society groups, including those representing ethnic minorities, have a dynamic online presence. Websites in Chinese, Tamil, and other minority languages are also increasing in number and influence.

LGBT+ Malaysians face widespread discrimination and harassment, limiting online content. There is also an active podcast catering to LGBT+ listeners, although the hosts remain anonymous for fear of reprisal; several LGBT+ websites are blocked (see B1).116 Anti-LGBT+ statements from government officials may drive self-censorship, as when the Human Rights Commission of Malaysia (SUHAKAM) stated that the fundamental rights under the Federal Constitution are not rights to maintain a lifestyle contrary to societal norms and religion.117

Social media continues to be an important avenue for accessing a wide array of information. Nearly 27.2 million people used WhatsApp, making it the most popular communication app.118 Newer platforms that carry a wide range of information, like TikTok, have also seen a recent increase in use among Malaysians.

There are no specific laws against the use of virtual private networks (VPNs).

Digital tools remain available for users and have helped expose and undercut the government’s control over traditional media. Social media has been a particularly effective tool for mobilization. However, restrictive laws around free expression and the threat of criminal prosecution could limit some online mobilization.

Throughout June and July 2021, Malaysians used the hashtags #Lawan (fight) and #BendaraHitam (black flag) to criticize the government’s handling of the pandemic, including during an online protest in early July and an offline mobilization on July 31.119 Internet users who organized the protests were detained for their online activities. Three protest organizers were investigated for their social media postings several days prior to the protest, under Section 505(b) of Penal Code and Section 233 of CMA,. Another activist was investigated for her tweets under Section 4(1) of Sedition Act 1948 and Section 233 of the CMA, and was questioned for over 10 hours.120 Seven activists involved in planning another #Lawan protest were investigated under the Sedition Act prior to the protest. According to one of the activists, the investigation was carried out based on an online report.121

After journalist Lalitha Kunaratnam published an investigation alleging corruption involving Azam Baki, the chief commissioner of the Malaysian Anti-Corruption Commission (MACC), the hashtag #TangkapAzamBaki (Catch Azam Baki) went viral on social media. Protests organized under the hashtag in January 2022 were organized by civil society organizations and political youth wings.122 Police questioned at least 19 activists over their participation in the protest.123 Investigation papers were sent to the office of deputy public prosecutor for further action.124

The constitution provides citizens with “the right to freedom of speech and expression” under Article 10 but allows for limitations on those rights.125 However, a number of laws also undermine freedom of expression (see C2).

The PH government kept its pledge to abolish the Anti-Fake News Act in December 2019,126 which the previous BN coalition had passed in May 2018, ostensibly to curb the spread of purportedly false news, especially through social media. The sweeping law threatened to seriously restrict free expression online,127 and activists argued that it was meant to silence criticism of the government and was vulnerable to abuse (see C2).128

The minister of home affairs has absolute discretion under Section 7(1) of the Printing Presses and Publications Act 1984 to ban media on the grounds of public order, morality, security, public interest, or national interest.

A number of laws impose criminal and civil penalties for online activities. The government exercises tight control over online, as well as print and broadcast, media through laws like the Official Secrets Act of 1972 and the Sedition Act, which dates back to 1948. Violations can be punished with fines and several years in prison.

Amendments passed in 2015 widened the scope of the Sedition Act, requiring users to remove online content that is considered seditious and obligating the court to issue an order blocking access to unidentifiable seditious content.129 The maximum penalty in general sedition cases is now seven years in prison, up from three years before the amendments. A provision also imposes up to 20 years in prison for seditious activities that result in physical harm or destruction of property.130 In 2015, the Federal Court rejected a constitutional challenge to the Sedition Act.131

The Anti-Fake News Act 2018, which was repealed in December 2019, covered news, information, data, reports, images, or recordings in any form that are wholly or partly false.132 Despite its repeal, the government can still use other laws, including the penal code, to punish purported misinformation (see C3), as culture minister Tan Sri Annuary Musa noted in October 2021.133

The Emergency (Essential Powers) (No. 2) Ordinance 2021 was enacted in March 2021 and revoked in December of that year, after the expiration of the state of emergency related to the COVID-19 pandemic.134 The ordinance, which bore strong resemblance to the repealed Anti-Fake News Act, criminalized spreading purportedly false news relating to COVID-19 or to the Emergency Proclamation.135 People charged under the law faced a fine of up to 100,000 ringgits ($24,000), imprisonment of up to three years, or both; a convicted individual may also have been ordered to apologize to those affected by their activities.136 While the MCMC noted several measures that would prevent the ordinance from being used arbitrarily, activists worried that the law could be inconsistently enforced because of the ambiguity of what constitutes “fake news.”137

Defamation is a criminal offense under Sections 499 to 520 of the penal Penal Ccode. Media outlets benefit from stronger protections under the Defamation Act 1957 if they can prove that the content is accurate and was published without malice;138 bloggers, who lack this protection, are at greater risk for defamation charges. Section 505(b) of the penal code criminalizes statements intended to cause “fear or alarm to the public” or to “commit an offense against the State or public tranquility” with imprisonment up to two years, a fine, or both.

The government has also pursued prosecutions for online content under the CMA. The act’s broadly worded Section 211 bans content deemed “indecent, obscene, false, threatening, or offensive.” Spreading such content on the internet constitutes “improper use of network facilities or network service” under Section 233.

During the coverage period, internet users were arrested and prosecuted for online speech. Content critical of Islam, the monarchy, or the government, or touching on sensitive racial issues can lead to arrest and prosecution. Social media users were also investigated, arrested, and charged for posting unverified news about the COVID-19 pandemic.

Several individuals were arrested and prosecuted for insulting the monarchy, often under Section 233 of the CMA or the Sedition Act 1948.139 In December 2021, blogger Dian Abdullah, also known as Lai Yuet Ming, was sentenced to a fine of 10,000 ringgits ($2,400) for allegedly violating Section 233(1)(a) of the CMA and Section 505(b) of the penal code by criticizing the king as well as former prime minister Muhyiddin Yassin in blog posts.140 Activist Aiman Hakim was investigated under Section 4(1) of the Sedition Act 1948 and Section 233 of CMA and detained for one day in July 2021 over a Twitter post that allegedly insulted the royal institution.141 In June 2021, politician Iswardy Morni was charged under Section 4(1)(a) of the Sedition Act for allegedly insulting the king on Facebook. He pleaded not guilty and was released on bail. The case was ongoing at the end of the coverage period. If convicted, he faces a fine of up to 5,000 ringgits ($1,200), imprisonment of up to three years, or both.142

Journalists, activists, and internet users are also routinely charged and prosecuted for criticizing the government, political parties, and other official bodies. From 2021 to May 2022, graphic designer and activist Fahmi Reza has faced 11 police investigations over his satirical work on social media.143 In January 2022, for instance, Reza was investigated under Section 4(1) of the Sedition Act 1948 and Section 233 of the CMA for uploading a satirical image of the Pahang State coat of arms that highlighted the state’s logging issues.144 In April 2022, he was arrested and remanded for two days under the Sedition Act and the CMA over a satirical graphic depicting an ape in royal attire145 Former parliamentarian Siti Aishah was arrested in June 2022, after the coverage period, after her TikTok video criticizing the removal of subsidies by the government went viral.146

In June and July 2021, several people were detained around the online premiere of a short animated film about police brutality hosted by the Freedom Film Network.147 Hakimie Amrie Hisamudin, a journalist with the online outlet Free Malaysia Today, was summoned by police over his news article on the event.148 Police investigated Anna Har, the cofounder of Freedom Film Network (FFN), and cartoonist Amin Landak under Sections 500 and 505(b) of the Penal Code and Section 233(1)(a) of CMA, and also raided FFN’s office and Amin’s home, seizing electronic devices.149 Four other activists were investigated about the film under the same laws.150

The government also continued to investigate internet users under the penal code and the CMA for online speech deemed insulting to Islam and the pProphet Muhammad. In February 2022, a senior Penang State official was investigated over a Facebook post commenting on how police handled a controversial religion conversion and child custody case.151 In March 2019, a Facebook user was sentenced to 10 years in prison for insulting Islam and the prophet, although in September 2019, the prison term was reduced to six years.152

Individuals continued to be charged with or sued for with defamation during the coverage period. In April 2022, the Pahang State government filed a civil defamation suit against Shariffa Sabrina, the president of an environmental NGO, after she alleged corruption involving state forestry operations. Officials had previously sought a letter of apology and 1 million ringgits ($240,000) in damages.153 The Pahang State government also sought an apology and 1 million ringgits from Wong Tack, a member of Parliament, for alleging that the state government had been involved in illegal logging that caused massive floods.154 In January 2022, Tan Sri Azam Baki, the head of the anticorruption commission, filed a defamation suit against researcher Lalitha Kunaratnam over corruption allegations that she reported about on the news portal Independent News Service.155 Kunaratnam also faces a criminal investigation stemming from police reports filed by Baki.156

Defamation charges also targeted online news outlets. After Malaysiakini published articles on environmental damage linked to Raub Australian Gold Mining, the mining company sued the outlet for defamation. In July 2021, the Federal Court ordered Malaysiakini to pay 200,000 ringgits ($47,000) in costs and damages, in addition to 350,000 ringgits ($83,000) ordered by the Court of Appeal in a 2018 ruling.157 Prime Minister Sabri in February 2022 filed a defamation suit in his personal capacity against the owner of the news site Agenda Daily over an article purportedly depicting Sabri as worrying about becoming the shortest serving prime minister.158 A court filed an injunction ordering the article to be removed pending the lawsuit in July 2022, after the coverage period (see B2).159

Individuals were also arrested for the dissemination of “fake news” related to COVID-19 under the Emergency Ordinance (Essential Powers) (No. 2) 2021, though the extent of enforcement remains unclear. The deputy communications and multimedia minister reported that 12 of 30 investigations between March to December 2021 under the proclamation had resulted in charges, with 2 under investigation as of that month.160 Previously, in October 2021, Communications and Multimedia Minister Annuar Musa reported that 15 of 26 investigations since March 2021 had resulted in charges, with 4 cases ongoing.161

According to human rights organisation Suara Rakyat Malaysia (SUARAM), there were at least 21 cases being investigated under Section 233 of CMA from January to April 2022.162

Anonymous online communication and encryption are not prohibited in Malaysia.

Since 2006, the MCMC has mandated that all service providers register prepaid SIM cards upon purchase.163 The MCMC issued fines of over 20 million ringgits ($4.7 million) for noncompliance with this regulation during the coverage period.164 Legal-name registration is not required for bloggers or customers at cybercafés. It is a criminal offense under Section 507 of the penal code to commit criminal intimidation by anonymous communication.

Users can largely use encryption tools as they please, although a number of laws allow police to access encryption and decryption codes when conducting searches, including the Computer Crimes Act (CCA), the criminal procedure code, and the CMA, among others.165

Privacy protections in Malaysia are poor. It is difficult to ascertain the extent of government surveillance of users’ internet activities.166

Legal provisions allow the police, prosecutors, and the communications minister to intercept online and mobile communications. The laws are generally interpreted to require network operators and service providers to assist law enforcement and intelligence agencies in surveillance efforts, even where clear procedures are lacking. A court order is not required for emergency interception, which applies to cases with national security implications. Under the Security Offenses (Special Measures) Act 2012, a police officer with the rank of superintendent of police or above may intercept communications without the authorization of the public prosecutor in urgent cases.167 While it was in force, the Emergency (Essential Powers) (No. 2) Ordinance 2021 also granted authorities access to digitize data and the power to demand the preservation and disclosure of traffic data.168

In May 2020, Israeli news site CTech reported on documents in an Israeli court case revealing that, in April 2018, officials from the then-ruling BN coalition signed a 6.3 million ringgit ($1.5 million) deal to purchase surveillance technology from Israeli cybersecurity startup Senpai for use by the Malaysian intelligence agency.169 The deal was signed just over a month before the May 2018 election, and the technology was allegedly planned for use surveilling the political opposition ahead of the vote. Former prime minister Najib Razak denied the allegations.170

Citizen Lab reported in December 2020 that the government may be a customer of Circles, a surveillance firm whose products could be used to snoop on the location, texts, and calls of targeted phones.171 In 2013, Citizen Lab reported that FinFisher—described by distributor Gamma International as providing “governmental IT intrusion and remote monitoring solutions”—was detected on servers in Malaysia.172 The software potentially allows the server to steal passwords, tap Skype calls, and record audio and video without the permission of its targets.173 Citizen Lab also identified “a Malaysian election–related document” that it characterized as a “booby-trapped candidate list” containing spyware.174 Because the spyware is only marketed to governments, “it is reasonable to assume that some government actor is responsible,” the group concluded. A separate Citizen Lab report published in 2014 asserted that a Malaysian government agency was a “current or former user” of the Remote Control System spyware marketed by the Milan-based Hacking Team.175 In 2016, the prime minister’s office denied having purchased this spyware but could not confirm whether other government agencies had done so.176

Social media monitoring continues to be a concern, and several government agencies and officials have announced that they are monitoring platforms for content related to race, religion, royalty, and false information, including antivaccine propaganda. 177 In October 2018, Israeli newspaper Haaretz reported that Malaysia had previously purchased sophisticated surveillance technology from Israeli firms that can monitor and analyze social media and other open-source information.178 Previously, the US-based company Snaptrends also reportedly discussed its social media monitoring technology with Malaysian authorities.179

Amid the COVID-19 pandemic, the government has rolled out several smartphone apps that access personal information for contact-tracing purposes. For example, the Gerak Malaysia app tracks location, while MyTrace uses Bluetooth proximity data to assist with contact tracing.180 The MySejahtera app launched by the Ministry of Health, which enables access to personal information for COVID-19 contact-tracing and vaccination purposes, was mandatory to enter businesses until May 2022,181 raising privacy concerns.182 The Health Ministry has assured users that their data is secure and would not be misused,183 though the app was exploited to send unsolicited texts and emails to app users in October 2021 (see C8).

Internet users raised similar concerns about a “conversion therapy” app distributed by the Department for Islamic Development Malaysia since 2016, which requests permissions to access sensitive user data.184 The app was removed from the Google Play store in March 2022.185

The law protects against using individual data for commercial purposes, but there are no provisions specifically addressing online privacy.186 In some cases, service providers are required to aid the government in monitoring user communications.187

The CCA mandates that providers give police access to user information once a warrant is obtained. Providers that fail to comply can face up to three years’ imprisonment and fines of up to 25,000 ringgits ($5,900).188 Section 116 of the criminal code allows the police to access user information, which is defined as “the necessary password, encryption code, decryption code, software or hardware, and any other means,” when conducting a criminal investigation.189 Depending on the offense being investigated, the criminal procedure code does not always require police to obtain a warrant. Section 116c allows the public prosecutor to force service providers to collect and retain specific user communications or data. The prosecutor can also authorize a police officer to install devices to collect such information.

The Malaysian Personal Data Protection Act (PDPA) 2010, which regulates the processing of personal data in commercial transactions, came into effect in 2013. The law makes it illegal for commercial organizations to sell personal information or allow third parties to use it. Those convicted of violating the law can be fined up to 100,000 ringgits ($24,000) or sentenced up to one year in prison. The federal and state governments are exempted from the law, as are entities that process data outside Malaysia.190 The act requires that information about Malaysians be stored locally and limits conditions under which it can be transferred abroad, though the extent to which those rules are enforced is unclear.191

Enforcement against violations of personal data protection regulations appears to be increasing. The Department of Personal Data Protection reported receiving 1,111 complaints in 2020, the most recent available data, of which 816 cases were deemed relevant to the PDPA and acted upon. The department reported taking enforcement actions in one case, issuing a fine of 37,500 ringgits ($8,900), and having 14 cases pending.192

In August 2020, the government contracted with MyEG Services Bhd, an electronic government services provider, to share data collected by employers while monitoring foreign workers’ COVID-19 status.193

Between July and December 2021, Facebook received 96 total requests for information from the government relating to 220 users—the highest number since the company began disclosing that data in 2013. Facebook complied with 79 percent of the requests.194 In the same period, Twitter received three such requests and complied with none of them.195

Intimidation and physical violence against individuals in retaliation for their online activities has been a problem in Malaysia. Journalists, activists, and members of marginalized communities such as LGBT+ people sometimes face online harassment.

Users sometimes face offline retaliation for online posts related to Malaysian government officials. In April 2021, 20 police officers forcibly entered the home of political caricature artist Fahmi Reza and arrested him for alleged sedition (see C3). According to Reza, the police kicked a hole in his door and seized his laptop and smartphone before they arrested him.196 In March 2020, Kow Gah Chie, a journalist for Malaysiakini, was subjected to racist comments and violent threats on Facebook after she published a story on comments by the environment minister that seemingly supported logging in ecologically sensitive areas.197 In June 2022, after the coverage period, police officers raided the home of former senator Siti Aishah in the course of her arrest (C3).198

Users continue to face online retaliation, including doxing and threats, for their online posts. In June 2021, a Facebook user posted pictures of a man who resembled the head of Kedah State government test-driving a car, an activity prohibited under the Movement Control Order in place at the time. After posting the pictures, the user and her family received hate mail and threats, particularly from supporters of the official; their personal details were also released and circulated online.199

LGBT+ users also have been subjected to harassment, homophobic slurs, and hateful content online. A study released in December 2021 found that almost 90 percent of the 220 LGBT+ Malaysians surveyed reported being affected in some way by online harassment.200 In December 2021, a Malaysian actor and TikTok influencer faced online criticism for appearing in a gay romance web series that was used to promote the gay dating app Blued. Following the backlash, the actor denounced the show and said he did not know about the show’s connection to Blued or its LGBT+ themes.201 In response, an official in the prime minister’s office called for the MCMC to investigate digital content relating to LGBT+ people.202 In March 2021, Nur Sajat, a prominent transgender entrepreneur, received death threats after posting a video on Facebook saying she “does not want to be a Muslim anymore.”203 Artists who featured drag queens and LGBT+ dancers in music videos also faced online harassment during the coverage period.204

Technical attacks aimed at suppressing political information online were not reported during the coverage period, though technical attacks have been recorded in the past.

Between January and May 2021, there were a total of 4,615 cybersecurity incidents reported to Cyber Security Malaysia.205 Malaysian citizens are also impacted by data security breaches. For example, in September 2021, a database containing the full names, identity card numbers, addresses, and contact details of four million Malaysians held by the National Registration Department was listed for sale online.206 The leak was attributed to the Inland Revenue Board, which denied responsibility.207

In October 2021, a weakness in the government’s MySejahtera COVID-19 contact tracing app was abused to send users spam emails. The Ministry of Health subsequently assured users that it was fixing the issue.208

The National Cyber Security Agency (NACSA) was formed in February 2017 as the lead cybersecurity organization. The National Cyber Security Policy (NCSP) was formulated in 2016 to address the risks to critical sectors of the economy.209 In October 2020, the PN government allocated 1.8 billion ringgits ($427 million) to develop a 2020–24 cybersecurity strategy.210