Expanding Freedom and Democracy
Freedom on the Net 2023

Malaysia

Partly Free
61
100
A Obstacles to Access 19 25
B Limits on Content 22 35
C Violations of User Rights 20 40
Last Year's Score & Status
59 100 Partly Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the research methodology and report acknowledgements.

header1 Overview

Internet freedom improved in Malaysia during the coverage period. Access to high-speed internet service improved, while internet users suffered fewer prison terms and pretrial detention periods over online speech. However, criminal prosecutions and investigations for social media posts and other forms of online expression continue to threaten individuals. Though there are few formalized restraints on online media outlets, the government blocks websites and orders content removed over political or religious sensitivities. Users, particularly LGBT+ people, continue to face online and offline harassment for their online posts.

The Barisan Nasional (BN) political coalition ruled Malaysia from independence in 1957 until 2018, maintaining power by manipulating electoral districts, appealing to ethnic nationalism, and suppressing criticism through restrictive speech laws and politicized prosecutions of opposition leaders. The BN lost to an opposition alliance in the 2018 general elections, and political affairs have since been characterized by a more complex pattern of competition and cooperation among multiple coalitions, creating opportunities for reform and modest improvements to civil liberties. The BN and Pakatan Harapan (PH) formed a multiparty coalition government in November 2022, after voters installed a hung parliament for the first time in the country’s history. PH chairman Anwar Ibrahim became prime minister that month, promising numerous reforms.

header2 Key Developments, June 1, 2022 - May 31, 2023

  • The government announced plans in May 2023 to transfer the current state-operated fifth-generation (5G) mobile infrastructure to a private service provider once penetration reaches 80 percent (see A1 and A4).
  • In November 2022, mobile service providers Celcom and Digi completed a merger to become the market’s largest competitor (see A4).
  • The Malaysian Communications and Multimedia Commission (MCMC) established a special task force in December 2022 to tackle the issues of purportedly false news and “sensitive or provocative” content related to the “3Rs”—race, religion, and royalty (see B2).
  • An online film that drew controversy for its portrayal of Islam was removed from the streaming service Viu after the company was contacted by the MCMC. Nine people involved in the film’s production were investigated for religious provocation and faced physical intimidation, online harassment, and death threats (see B2, C3, and C7).
  • In August 2022, Meta reported that a network of inauthentic accounts linked to the Royal Malaysia Police (PDRM) was attempting to manipulate online discourse by posing as independent media while posting memes that disparaged the opposition and government critics. The PDRM denied involvement (see B5).
  • During the November 2022 electoral period, viral TikTok videos using threatening language and violent imagery while discussing the May 13, 1969, race riots were labelled as paid partnerships, leading to allegations that political parties had paid to coordinate the spread of anti–Chinese Malaysian and anti–Democratic Action Party (DAP) sentiments (see B5 and B7).

A Obstacles to Access

A1 1.00-6.00 pts0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 6.006 6.006

Score Change: The score improved from 5 to 6 because mobile speeds increased during the coverage period, according to some measurement sources.

Internet penetration rates and average connection speeds continued to increase during the coverage period, driven by developments in mobile infrastructure.

According to the Department of Statistics, 97.4 percent of individuals in Malaysia were internet users in 2022, and household internet access increased from 94.9 percent in 2021 to 96 percent in 2022.1 DataReportal’s Digital 2023 report indicates an internet penetration rate of 96.8 percent.2 Data reported in October 2022 as a part of the Jalinan Digital Negara (JENDELA) national digital infrastructure development plan indicates that 96.9 percent of populated areas have access to 4G mobile services.3

The government initiated the five-year National Fiberisation and Connectivity Plan (NFCP) in 2019 and the five-year JENDELA project in August 2020 to improve fixed-line broadband services. JENDELA’s 2022 report noted meaningful progress on expanding internet connectivity, though the effort to expand satellite broadband access in rural and interior locations has lagged.4 The sunset of the 3G network was completed in the second quarter of 2022,5 allowing spectrum to be reallocated to 4G networks and contributing to improved service quality.6

The government is using satellite technologies to expand internet access to rural and remote areas (see A2). These technologies provide broadband coverage to areas unreachable by 4G and fiber-optic technologies; however, they also offer limited capacity, incur high operational costs, and are unstable in poor weather conditions.7

In May 2023, speed-testing company Ookla reported Malaysia’s median mobile internet download speed at 49.26 megabits per second (Mbps) and its median fixed-line broadband speed at 94.69 Mbps.8 Ookla reported upload speeds for the same month as 13.59 Mbps and 51.52 Mbps for mobile and fixed-line broadband, respectively. The MCMC reported an average mobile broadband speed of 116.03 Mbps at the end of 2022,9 a significant increase from 40.13 Mbps figure reported that March.10

The MCMC revised its quality standards in 2021 to require service providers to deliver a minimum of 2.5 Mbps for wireless broadband speeds and 25 Mbps for fixed wireless access for 90 percent of the time.11 Between January and June 2022, the MCMC issued 40 compliance notices for failure to meet that standard.12

In February 2021, the Malaysian government decided to build and manage state-operated 5G technology infrastructure.13 The first 5G network was launched in selected areas of Kuala Lumpur, Putrajaya, and Cyberjaya in December 2021, with YTL Communications and Telekom Malaysia offering 5G services.14 In May 2023, the government announced that it would shift to a dual-network model for 5G services once penetration reached 80 percent. Under the dual-network model, the first 5G network would be transferred from the Digital Nasional Berhad (DNB)—a company owned by the Ministry of Finance to provide 5G infrastructure nationwide—to another service provider (see A4), while a second network would begin to be built by another provider as early as January 2024.15 As of May 2023, 5G coverage had reached 57.8 percent of the populated area, and 80 percent penetration was expected to be achieved by the end of the year.16

The rollout of internet infrastructure is hindered by local authorities and bureaucracy. The lack of a standardized planning permission process, according to a telecommunications firm, hinders internet infrastructure development.17 According to a JENDELA report released in April 2021, deployment and renewal costs of tower and rooftop structures vary significantly across states and among local authorities within the same state.18

Flooding in Johor State damaged 160 telecommunications towers in February 2023. More than half of the towers were reported repaired as of mid-March 2023.19 In January 2023, the Ministry of Communications and Digital (MCD) reported that it had upgraded 350 towers affected by floods since 2014 to improve resilience against future flooding, 127 of which were in Kelantan State.20

A2 1.00-3.00 pts0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 3.003 3.003

The cost of internet access remained affordable during the coverage period, though internet access is limited in rural areas.

The previous PH government contributed to more affordable internet access by enforcing the Mandatory Standard on Access Pricing (MSAP), which caps the wholesale prices service providers can charge.1 The MSAP was extended to December 2022.2 A new MSAP came into force in March 2023 and will expire at the end of 2025. The new MSAP further reduces the price of wholesale high-speed (100 Mbps) broadband services from 515 ringgits ($115.15) to 254.26 ringgits ($56.85).3

Malaysia was the highest-scoring country on the Alliance for Affordable Internet’s Affordability Drivers Index in 2021.4 The average cost of 1 gigabyte (GB) of mobile broadband data in Malaysia in 2021 was 0.89 percent of gross national income (GNI) per capita.5 According to the International Telecommunication Union (ITU), the cost of 2 GB of mobile broadband data decreased from $8.48 in 2021 to $2.30 in 2022, though the price of 5 GB of fixed-line broadband data increased from $20.28 in 2021 to $21.68 in 2022.6

Internet use is more prevalent in cities. According to a 2022 MCMC survey, 98.1 percent of households in urban areas had access to the internet, compared to 89.1 percent in rural areas.7 This gap was wider for fixed-line broadband services: 53.3 percent of urban households had access compared to only 23.7 percent of rural households in 2022. In the fourth quarter of 2022, the MCMC reported that the fixed-line broadband penetration rate was highest in Selangor State, at 60.3 percent, and lowest in rural Kelantan State, at 22.5 percent.8

In December 2021, the MCMC announced planned improvements to digital infrastructure in rural areas, with implementation of satellite-based broadband service to be ready by early 2022—JENDELA reported that satellite-based service deployment was sluggish later that year—and 362 new towers to improve 4G coverage by the end of 2022.9 As of March 2022, broadband expansion under JENDELA reached 798 of the 839 rural and interior locations identified, and a new satellite launched in June 2022 was expected to further reduce the connectivity gap.10 Some 102 of the planned 1,661 additional sites to extend mobile 4G coverage in rural and remote areas had been completed by the end of 2022, with one operational, according to a JENDELA report.11

Gender disparities in internet access are declining. In 2022, 98.8 percent of men used the internet, compared to 95.9 percent of women.12

COVID-19 highlighted how equipment affordability and accessibility stood as barriers to connectivity. Students in rural areas additionally reported that poor internet access affected their studies. In February 2022, for example, a student in Sarawak State trekked for two hours to attend his online university interview due to poor internet speed in his community.13

Several initiatives were introduced by the current administration to reduce the digital divide. The Unity Package mobile internet plan, introduced in February 2023, is offered to youth, people with low incomes, senior citizens, and persons with disabilities, and includes six months of 30 GB of data at speeds of 3 Mbps for 30 ringgits ($6.71).14 In the first month of the plan’s launch, over 31,000 people purchased it, according to MCD minister Fahmi Fadzil.15 In March 2023, a Unity Package home internet package was rolled out for residents of public housing and the People’s Housing Project, which provides a two-year contract for unlimited data at speeds of 100 Mbps for 69 ringgits. According to MCD minister Fadzil, 13,000 households benefited from the plan in the first six weeks it was offered.16

The MCMC introduced a new service package in October 2021 to provide affordable data to students.17 Registration for the package continued through April 2023.18

The government launched a 3.5 billion ringgit ($830 million) program in May 2021 to assist users in purchasing smartphones and accessing broadband services, with data plans running for 12 months.19 The government planned to contribute 2 billion ringgits ($474 million) to this program, while 12 telecommunication providers were expected to contribute an additional 1.5 billion ringgits ($356 million) worth of support, mainly in the form of free data. 20 The Jaringan Prihatin program continued through the end of September 2022.21

A3 1.00-6.00 pts0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 5.005 6.006

There were no reported cases of government-imposed access restrictions during this coverage period. The last major reported incident occurred in 2012.1 However, a partly state-owned company continues to dominate network infrastructure.

Telekom Malaysia, the country’s largest telecommunications company, retains a fixed-line broadband monopoly and owns the country’s last-mile connections (see A4).2 As of February 2023, the government retained a 20.1 percent stake in Telekom Malaysia, which was formerly state-owned, while government-linked companies and statutory bodies held the majority of shares in the company.3 4

The nonprofit Malaysia Internet Exchange allows service providers to exchange local traffic more efficiently.5 Malaysia has several connections to the international internet, making the network more resilient.6

A4 1.00-6.00 pts0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 4.004 6.006

Economic obstacles and political barriers posed by patronage networks restrict the diversity of service providers.

According to MCMC data, 351 network-facilities providers owned or operated internet infrastructure in 2021, an increase from 220 providers in 2019.1 Telekom Malaysia is the dominant fixed-line broadband provider, having a 90 percent share as of July 2021.2 Fiber-optic home broadband service is provided by Astro IPTV. Other providers of fixed-line broadband and mobile internet service include CelcomDigi, TIME Internet, Tune Talk, and Yes, a wireless 4G provider.3

In June 2022, the MCMC approved the proposed merger of Digi and Celcom, Malaysia’s second- and third-largest mobile service operators, after the companies signed a merger agreement in June 2021.4 In response to concerns about reduction of competition, Digi and Celcom submitted proposed remedies to the MCMC in June 2022.5 The merger was completed in November 2022, creating CelcomDigi, Malaysia’s largest service provider by number of subscribers.6 Parent companies Axiata and Telenor retain equal stakes of 33.1 percent in the new company.7

In 2021, Maxis held the largest share of the telecommunications market as the largest mobile provider, followed by Digi and Celcom. Telekom Malaysia remained the dominant fixed-line broadband provider, trailed by TIME.8

The government established the DNB in March 2021 to be the sole 5G provider in Malaysia. Service providers purchased access licenses to use the network infrastructure to provide 5G service starting in 2022. Industry groups like the Global Mobile Industry Association raised concerns about the poor track record of the DNB’s model, while the nonprofit Institute for Democracy and Economic Affairs criticized the lack of transparency and competition.9 The government later agreed to reduce its stake in the DNB to 30 percent, offering 70 percent equity to telecommunications companies.10 The government has since announced a plan to introduce a dual-network model once the DNB achieved 80 percent population coverage with the 5G network (see A1). After that, the DNB would be transferred to a private entity, and a second 5G network would be developed by another service provider beginning in 2024.11 In July 2023, after the end of the coverage period, CelcomDigi, Maxis, Telekom Malaysia, U-Mobile, and YTL Communications had agreed to acquire stakes in the DNB from the government.12 It remains unclear how the formation of the second entity will be executed and what parties are likely to be involved.

A5 1.00-4.00 pts0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 1.001 4.004

The MCMC, a regulator that oversees service providers, apparently lacks transparency in its decision-making processes and exercise of powers, despite its multistakeholder advisory board.

The MCD oversees the MCMC. The Communications and Multimedia Act (CMA) 1998 gives the ministry a range of powers, including the authority to license the ownership and operation of network facilities.

The MCMC Act 1998 directs the ministry to appoint the MCMC chairperson; there are currently seven other commission members from backgrounds including civil service, finance, accounting, and academia.1 The act states the commission should consist of a chairperson, three members representing the government, and between two and five members from other sectors. All members are appointed by the MCD minister. It is unclear how candidates are selected.

Fadhlullah Suhaimi stepped down as MCMC chairman after the end of his two-year contract in June 2022.2 Tan Sri Mohamad Salim was appointed as interim chairman until his resignation in December 2022, after the change of government. Datuk Muhammad Azmi subsequently became interim chairman until the MCD again named Mohamad Salim to the post beginning March 1, 2023, for two years;3 Mohamad Salim was previously a commissioner from 2010 to 2014.4

The MCMC has taken steps to curtail online speech and has not always addressed internet-related issues in a fair manner (see B1). In May 2018, activists called on the PH government to review the ambit of the MCMC’s powers and investigate whether it had abused its position under the BN regime.5 The government did not undertake such a review before losing power in February 2020, nor did the succeeding PN government.

The government’s rollout of 5G infrastructure has been criticized for limiting competition (see A4) and lacking transparency. In July 2021, the DNB awarded a 10-year contract amounting to 11 billion ringgits ($2.6 billion) to Ericsson to deploy 5G network infrastructure.6 Prominent journalist Wong Chun Wai raised concerns about the decision to limit 5G deployment to a single vendor,7 and an opposition parliamentarian called for a corruption inquiry following reporting on Ericsson’s questionable business practices in other countries.8 The DNB asserted that Ericsson had been selected based on merit after it offered the lowest tender price out of four bidders and scored well on tender-evaluation criteria.9 In June 2022, activists affiliated with the government of the day urged the Malaysian Anti-Corruption Commission (MACC) to investigate the DNB over transparency and procurement concerns.10 Prime Minister Anwar Ibrahim in December 2022 ordered a review of the 5G rollout tender process.11 In 2021, ZTE won another tender to provide indoor 5G connectivity from the DNB, though neither the DNB nor the government has spoken much about the ZTE contract to the public.12 13

B Limits on Content

B1 1.00-6.00 pts0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content, particularly material that is protected by international human rights standards? 4.004 6.006

The government does not systematically block or filter online content, although several websites remained blocked during the coverage period.

The MCMC has not released an official list of blocked sites. According to the Open Observatory of Network Interference, which runs technical tests to verify website blocking, websites blocked during the coverage period spanned religious material, political criticism, LGBT+ content, and pornography.1 As of May 2023, the official website of the International Lesbian, Gay, Bisexual, Trans and Intersex Association (ILGA); Planet Romeo; Gay Star News; and Utopia Asia remained blocked.2

Since June 2021, the website belonging to the Coalition for Clean and Fair Elections (BERSIH) has been blocked by TIME.3 The implementation of blocking is suspected to be related to BERSIH’s simulated recall election campaign named Pecat atau kekal? (Sack or keep?), which was launched in June 2021.4

Between 2020 and the end of 2022, the MCMC blocked a total of 6,381 gambling websites.5 In April 2021, cryptocurrency platform Remitano was blocked by the MCMC upon request of the Securities Commission for operating a digital asset exchange without authorization, violating Section 7 of the Capital Markets and Services Act 2007.6 The MCMC blocked 4,068 pornographic websites between 2018 and September 2021.7 As of August 2022, the MCMC also blocked 400 websites containing child sexual abuse material. 8

In February 2023, the MCMC issued a directive to service providers requiring them to block the ability to send or receive URLs through text messages, as part of an effort to curb online scams, beginning May 2, 2023.9

There are no specific restrictions on the use of virtual private networks (VPNs).

B2 1.00-4.00 pts0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content, particularly material that is protected by international human rights standards? 2.002 4.004

The MCMC periodically instructs websites and social media platforms to remove content.1 Blog owners and Facebook users have been told to remove content that touches on what are locally known as the 3Rs. The MCMC may choose to exercise this power at its own discretion,2 and officials have indicated that they might seek additional authorities to force content removals.3

From January 2019 to January 2023, the MCMC reported receiving a total of 2,804 complaints, which included 1,625 complaints of obscene content, 564 complaints of false information, and 541 of inappropriate content.4 In December 2022, the government established a special task force to tackle the issues of purportedly false news and the 3Rs. Through April 2023, the MCMC announced that the task force had detected 195 “sensitive or provocative” posts and removed 80 percent of them with the cooperation of social network operators.5

In March 2023, the independent film Mentega Terbang was removed from the online streaming service Viu for its portrayal of Islam, after the company was contacted by the MCMC. Both the MCMC and the Film Censorship Board stated that they did not have jurisdiction to censor the film, as movies and television dramas fall outside the MCMC’s scope and the board’s scope does not include movies released exclusively online.6 The film’s production team was also investigated for religious provocation (see C3) and received harassment and death threats on social media (see C7).7

Authorities have requested that social media companies remove content. From January to June 2022, Facebook removed 66 items pursuant to government requests, 45 of them reported by the MCMC. Nineteen items contained misinformation that violated Section 505(b) of penal code, while 12 items reportedly contained bullying, harassment, and antigovernment content that contravened Section 233(1)(a) of the CMA. An additional 10 requests were for content containing fraud, and another 4 items violated sections 298A and 504 of the penal code for blasphemy and hate speech based on religion.8

From July to December 2022, the government, mostly through MCMC, made 36 requests for Google to remove a total of 116 items, of which 87 items were hosted on YouTube, 17 on Blogger, and 11 on other services. The authorities cited reasons including copyright and trademark violations, bullying and harassment, religious offenses, and defamation.9 Google removed 13 of the items in response to legal takedown requests.

During the same period, TikTok received 55 requests to remove 321 pieces of content from its platform. It removed 185 pieces of content due to violations of community guidelines and 80 due to violations of local law. The company also reported receiving 13 requests to remove accounts, and complied with 5 of them.10 In March 2023, the government revealed that from 2020 to January 2023, the MCMC had made a total of 346 takedown or removal requests to TikTok; 93.9 percent of flagged items were removed.

The government has repeatedly investigated the pseudonymous Twitter account Edisi Siasat (also known as Edisi Khas), which is known for publishing claims regarding corruption and abuse of power.11 The account was suspended by Twitter for a terms-of-service violation in February 2022, which the account attributed to posts alleging corruption involving drug charges against the son of a prominent businessman.12 The Twitter account remains blocked, but Edisi Siasat maintains an active social media presence on Facebook and Telegram.

In July 2022, then premier Ismail Sabri Yaakob obtained an injunction ordering online outlet Agenda Daily to remove an allegedly defamatory article about him, pending the outcome of a civil suit over the article (see C3).13

In March 2022, Malaysia’s highest court dismissed an appeal from the popular news portal Malaysiakini over a previous ruling that found the outlet in contempt of court.14 In June 2020, the government had initiated legal proceedings against Malaysiakini after readers posted five comments criticizing the judiciary on an article that detailed the reopening of the country’s courts after a COVID-19 lockdown.15 The outlet’s administrators reportedly removed the comments two days after being contacted by police. In February 2021, the Federal Court found Malaysiakini guilty of contempt of court (see C3).16 Following the decision, the lead counsel for Malaysiakini opined that the Federal Court had set a precedent that news portals, in order to avoid liability, needed to take active steps to moderate comments before they are published.17

In October 2020, the MCMC warned that legal action could be taken against account holders of parody accounts.18 Following this announcement, in December 2020, Bermana TV, a Twitter account parodying the Bernama news agency, was suspended by Twitter after receiving an MCMC complaint.19 It has since been revived in August 2022 under a different account handle.20

Intermediaries risk liability for some content posted by users, though it is not clear whether this leads them to remove more content than necessary. In 2012, Parliament passed an amendment to the Evidence Act 1950 that holds intermediaries liable for seditious content posted anonymously on their networks or websites.21 This includes hosts of online forums, news outlets, and blogging services, as well as businesses providing Wi-Fi services.22 The amendment holds individuals liable if they “facilitate” the publication of the offending content, and holds the owner of the computer the content was published from liable, whether or not they are the author.23

B3 1.00-4.00 pts0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 2.002 4.004

Content blocking and removal requests are generally nontransparent and lack judicial oversight or effective avenues for appeal.

Blocks are implemented on the authority of the MCMC, which reports to the MCD (see A5). No list of affected sites is provided by the MCMC. A person whose content is blocked can request that the MCMC provide a reason for the decision and the MCMC is required to comply within 30 days of receipt.1

Under Section 263(2) of the CMA, the authorities are given the power to request that internet service providers disable access to sites that contain illegal content on revenue or national security grounds, under what is commonly known as an “access blocking order.”2 The CMA does not prescribe a process on how to challenge or appeal an access blocking order.

Sections 120 and 121 of the CMA provide a channel to appeal against a direction or decision, but not a determination, of the MCMC, via the Appeal Tribunal and judicial review. The Court of Appeal clarified that judicial review under Section 121 of the CMA is not intended to be applied generally; instead, it is only intended to apply to decisions and actions of the MCMC under “Part V–Powers and Procedures of the MCMC.”3

Revisions to the Malaysian Communications and Multimedia Content Code—a voluntary industry code that participants may nevertheless be fined for breaking—which took effect at the end of May 2022 extended it to cover online service providers. The revised code also loosened restrictions on nonsexual nudity and imposed prohibitions on advertising targeted at children.4 It remains to be seen whether the revisions will drive service providers to remove content more frequently.

B4 1.00-4.00 pts0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 2.002 4.004

Self-censorship is common among online journalists and ordinary users, particularly in regard to sensitive issues such as Islam’s official status, race, the monarchy, and the preferential treatment enjoyed by the bumiputera—the term for ethnic Malays and other Indigenous people—over Chinese and Indian minorities. Discussing these topics can lead to prosecution, which contributes to self-censorship online.1

Several civil society organizations observed a widening media crackdown under the PN government. Civil society groups have also noted that the February 2021 Malaysiakini decision may have had a deleterious effect on freedom of speech and expression online (see B2 and C3).2

The MCMC has explicitly warned individuals against posting comments online relating to the 3Rs. Individuals discussing these issues may face questioning or prosecution.3

Self-censorship among journalists is common.4 Malaysian journalists express more discomfort covering certain subjects as compared to the period under the previous government.5 Journalists often face harassment and intimidation in the form of police questionings and threats of defamation suits for reporting against the ruling government and government officials (see C3).

B5 1.00-4.00 pts0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 2.002 4.004

Online content manipulation persists, especially around tense political moments such as elections, although it is not as systematic or widespread as it was while the BN coalition was in power.

The government has taken several steps to combat what it characterizes as “false news.” In 2017, it launched SEBENARNYA, a fact-checking portal that encouraged social media users to verify the content of all news reports shared on popular platforms with the slogan, “not sure, don’t share.”1 Officials claimed the portal was nonpartisan.2 The PN coalition that took power in March 2020 launched a 24-hour news channel in June 2020 to combat purportedly false news,3 prompting the Centre for Independent Journalism (CIJ) to raise concerns that the channel could spread state propaganda.4

Both government and opposition figures have been known to pay online commentators, known as “cybertroopers,” to generate favorable content and denigrate their opponents.5 A report from the Oxford Internet Institute (OII) published in January 2021 concluded that these cybertroopers have manipulated the information landscape, employing consistent strategies and demonstrating “medium capacity capabilities.”6 An OII report published in September 2019 noted evidence that cybertroopers received formal training.7 Cybertroopers were particularly active in the run-up to the May 2018 general elections.8 In May 2023, an aide to the prime minister openly called for progovernment cybertroopers to keep people informed on government’s policies, and instructed press secretaries to work with cybertroopers affiliated with the United Malays National Organisation (UMNO) in preparation for the August 2023 state elections.9

In September 2020, during the corruption trial of Rosmah Mansor, the wife of former prime minister Najib Razak, her aide disclosed that 100,000 ringgits ($24,000) per month was allocated between 2012 and 2018 to pay 30 to 40 cybertroopers to counter criticisms of Mansor.10

Meta’s Quarterly Adversarial Threat Report published in August 2022 revealed a network of inauthentic accounts and pages posing as independent media and attempting to manipulate public discourse across Facebook and Instagram, as well as other social media platforms, including TikTok and Twitter. The accounts posted memes in Malay that supported police and the ruling government coalition of the day, and that disparaged the opposition and government critics.11 Meta’s research identified links to the PDRM, which denied involvement.12

In November 2020, the PN government rebranded the Special Affairs Department (JASA) as the Department of Community Communications (J-KOM). Under the BN coalition, JASA had been a department that disseminated information and conducted strategic communication on behalf of the government. Opposition members considered it to be a propaganda tool of the BN coalition. In December 2020, the House of Representatives (Dewan Rakyat) reduced the allocated budget for J-KOM from 85.5 million ringgits ($20.3 million) to 40 million ringgits ($9.5 million), insisting that the budget be used only to relay important COVID-19-related information.13 Disclosures in December 2021 indicated that J-KOM curtailed its activities that year,14 though government statements about appropriations for J-KOM in the Budget 2022 process were inconsistent and the number of J-KOM staff remains unclear.15

After the November 2022 elections, suspected paid commentators drove a rise in anti–Chinese Malaysian and anti-DAP sentiments online (see B7), including several viral videos that used threatening language and discussed the May 13, 1969, riots and were labelled as paid partnerships on TikTok, leading to allegations that PN engaged professional agencies to coordinate their spread.16

In September 2021, Parliament restricted media coverage of its proceedings to only 16 media agencies without disclosing a reason. Organizations not named in the list included news sites such as Free Malaysia Today, the Vibes, the Malaysian Insight, Malaysian Gazette, and the Malaysian Reserve.17 Previously, Parliament had restricted media coverage of its proceedings between November and December 2020 to 15 media agencies to prevent the spread of COVID-19 and to comply with health and safety procedures. The list of those permitted agencies did not include any that exclusively operated online news portals,18 and Parliament’s process of choosing the permitted outlets lacked transparency and explanation.19

In March 2021, after a post that criticized the city of Putrajaya’s vaccination plan—and allegedly authored by a Ministry of Health employee—went viral, the ministry issued a gag order prohibiting members of the civil service from commenting on public policy and government decisions on social media without prior approval.20

In an investigation released in August 2021, Malaysiakini identified several networks that had spread pro–Chinese government content, including Chinese state-media content and disinformation, during the Hong Kong protests against the National Security Law.21 A study by the Singaporean ISEAS Yusof Ishak Institute identified false narratives prevalent on Malaysian social media that represented Ukraine as the aggressor in the Russian invasion of Ukraine in February 2022.22

In September 2022, the group chief editor of News Straits Times, Ahmad Lokman Mansor, was suddenly removed from his position, due to alleged political interference from dissatisfied UMNO members who own shares in the outlet’s parent company. It is alleged that they objected to positions taken in his editorials, which expressed support for the judiciary and the attorney general in light of the sentencing of former prime minister Najib Razak on corruption charges. UMNO and Media Prima, the parent company of News Straits Times, denied the claims.23

B6 1.00-3.00 pts0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 2.002 3.003

Many online platforms struggle to stay economically viable, and government restrictions occasionally contribute to difficult market conditions. In the past, news sites have faced significant financial penalties due to defamation charges from political leaders (see C3).

Amid a July 2020 investigation of Al Jazeera over a documentary covering authorities’ mistreatment of migrants during the COVID-19 pandemic, the government announced that the outlet had flouted the Film Act 1981 by not applying for a license to produce the documentary. Communications Minister Saifuddin Abdullah said that all video producers needed a license “regardless of whether they are mainstream media agencies or personal media that broadcast films on social media platforms or traditional channels.”1 Saifuddin later clarified that social media users were free to produce and upload videos without a license, though he did not provide further clarity on whether media organizations needed a license to produce video content.2

Online outlets are not subject to the licensing restrictions that limit print outlets from publishing.3 In 2016, Malaysiakini was investigated for receiving foreign funds under Section 124C of the penal code, which prohibits activities detrimental to parliamentary democracy and carries a mandatory prison term of up to 15 years.4

B7 1.00-4.00 pts0-4 pts
Does the online information landscape lack diversity and reliability? 3.003 4.004

Digital media is more diverse than traditional media in Malaysia. More established sites such as Malaysiakini and the Malay Mail Online have been joined by smaller platforms that contribute to the diversity of information.1 Several digital news platforms are among the country’s most popular websites.2 However, online self-censorship around controversial issues such as Islam’s official status, race, and the monarchy limit the diversity of viewpoints available about those topics (see B4).

Expanded internet access has led to the emergence of a vibrant blogosphere. English and Malay are the dominant languages, and many civil society groups, including those representing ethnic minorities, have a dynamic online presence. Websites in Chinese, Tamil, and other minority languages are also increasing in number and influence.

Social media continues to be an important avenue for accessing a wide array of information. WhatsApp was the most used social media platform in 2022, followed by Facebook, Instagram, Telegram, Facebook Messenger, TikTok, Twitter, WeChat, Pinterest, and LinkedIn.3

LGBT+ Malaysians face widespread discrimination and harassment, limiting online content. There is an active podcast catering to LGBT+ listeners, although its hosts remain anonymous for fear of reprisal; several LGBT+ websites are blocked (see B1).4 Anti-LGBT+ statements from government officials may drive self-censorship, as when the Human Rights Commission of Malaysia stated that rights afforded by the constitution are not rights to maintain a lifestyle contrary to societal norms and religion.5 In January 2023, Prime Minister Anwar Ibrahim further stated that his government would not recognize the LGBT+ community.6

A surge of misinformation, false and misleading content during period accompanied the general elections in November 2022, exacerbating racial tensions. The CIJ’s Social Media Monitoring Initiative found that race-based narratives surged during the electoral period, and identified Parti Islam Se-Malaysia president Abdul Hadi Awang as a key amplifier of “divisive, racist, intolerant and hate-based narratives” to influence Muslim voters. The initiative reviewed 52,012 social media posts from October 20 to November 15, and found that over 32,000 contained race-based narratives. Narratives about religion were the next most common at more than 13,000. More than 5,000 posts also targeted women, the LGBT+ community, and refugees.7 Of the posts about race and religion, CIJ found that more than 7,000 included racist and religious slurs, 26 used dehumanizing language, and 4 called for outright attacks against non-Muslims.

In a campaign video that went viral on TikTok, former prime minister Muhyiddin Yassin accused the PH of sponsoring Jewish and Christian groups that were allegedly plotting to Christianize the country.8 Muhyiddin’s remarks were condemned by the Council of Churches of Malaysia as false statements that could heighten religious tensions.

During the politically instable period after the November 2022 elections, during which no coalition commanded a lower-house majority, local groups warned that anti–Chinese Malaysian and anti-DAP sentiments were increasing, driven by suspected coordinated paid commentators on social media (see B5).9 Many of the posts discussed the racial riots of May 13, 1969, to evoke fear and division, and TikTok videos threatened a return to such violence, showing images of weapons and calling for Malays to beware of the DAP and PH. Several of these viral videos were labelled as paid partnerships on TikTok (see B5).10 Many of the sensitive videos were not taken down by TikTok, despite reports by media and a statement from the PDRM, reportedly because the threats made In the did not have a clear target.11

B8 1.00-6.00 pts0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 5.005 6.006

Digital tools remain available for users and have helped expose and undercut the government’s control over traditional media. Social media has been a particularly effective tool for mobilization. However, restrictive laws around free expression and the threat of criminal prosecution could limit some online mobilization.

Women’s March Malaysia (#WMMY23) was held on March 12, 2023, and was organized through online mobilization efforts on its official website, Twitter, and Instagram accounts. Several organizers, speakers, and participants were summoned for questioning in the middle of the night for investigation under Section 9 of the Peaceful Assembly Act 2012 and Section 14 of the Minor Offences Act 1995.1

A group of government contract doctors known as Mogok Doktor Kontrak called for a three-day strike in April 2023 to protest the long-standing contract system and low wages. Shortly after announcing that the first day of the strike had been successful, the group’s Instagram account was apparently deactivated on the second day for unknown reasons.2

Former premier Mahathir Mohamad led a Malay proclamation initiative which called for political unity among Malays and gathered over 20,000 signatures from March to May 2023.3 After the end of the coverage period, in June 2023, he was summoned for investigation regarding whether he violated Section 124B of the penal code by “committing an activity detrimental to parliamentary democracy by any means, directly or indirectly.”4

Throughout June and July 2021, Malaysians used the hashtags #Lawan (fight) and #BendaraHitam (black flag) to criticize the government’s handling of the coronavirus pandemic, including during an online protest and an offline mobilization held that month.5 Internet users who organized the protests were detained for their online activities. Three protest organizers were investigated for their posts several days prior to the protest under Section 505(b) of penal code and Section 233 of CMA. Another activist was investigated for her Twitter posts under Section 4(1) of Sedition Act 1948 and Section 233 of the CMA and was questioned for over 10 hours.6 Seven activists involved in planning another #Lawan protest were investigated under the Sedition Act prior to the protest. According to one of the activists, the investigation was carried out based on an online report.7

After journalist Lalitha Kunaratnam published an investigation alleging corruption involving Azam Baki, the chief commissioner of the MACC, the hashtag #TangkapAzamBaki (Catch Azam Baki) went viral on social media. Protests organized under the hashtag in January 2022 were organized by civil society groups and political youth wings.8 Police questioned at least 19 activists over their participation in the protest.9 Investigation papers were sent to the office of deputy public prosecutor for further action.10

C Violations of User Rights

C1 1.00-6.00 pts0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 2.002 6.006

The constitution provides citizens with “the right to freedom of speech and expression” under Article 10 but allows for limitations on those rights.1 However, a number of laws also undermine freedom of expression (see C2).

The PH government kept its pledge to abolish the Anti-Fake News Act in December 2019,2 which the previous BN coalition had passed in May 2018, ostensibly to curb the spread of purportedly false news, especially through social media. The sweeping law threatened to seriously restrict free expression online,3 and activists argued that it was meant to silence criticism of the government and was vulnerable to abuse (see C2).4

The minister of home affairs has absolute discretion under Section 7(1) of the Printing Presses and Publications Act 1984 to ban media on the grounds of public order, morality, security, public interest, or national interest.

C2 1.00-4.00 pts0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities, particularly those that are protected under international human rights standards? 1.001 4.004

A number of laws impose criminal and civil penalties for online activities. The government exercises tight control over online, as well as print and broadcast, media through laws like the Official Secrets Act 1972 and the Sedition Act. Violations can be punished with fines and several years in prison.

Amendments passed in 2015 widened the scope of the Sedition Act, requiring users to remove online content that is considered seditious and obligating the court to issue an order blocking access to unidentifiable seditious content.1 The maximum penalty in general sedition cases is now seven years in prison, up from three years before the amendments. A provision also imposes up to 20 years in prison for seditious activities that result in physical harm or destruction of property.2 In 2015, the Federal Court rejected a constitutional challenge to the Sedition Act.3

The Anti-Fake News Act 2018, which was repealed in December 2019, covered news, information, data, reports, images, or recordings in any form that are wholly or partly false.4 Despite its repeal, the government can still use other laws, including the penal code, to punish purported misinformation (see C3), as the culture minister noted in October 2021.5

The Emergency (Essential Powers) (No. 2) Ordinance 2021 was enacted in March 2021 and revoked that December, after the expiration of the COVID-19-related state of emergency.6 The ordinance, which bore strong resemblance to the repealed Anti-Fake News Act, criminalized spreading purportedly false news relating to COVID-19 or to the Emergency Proclamation.7 People charged under the law faced a fine of up to 100,000 ringgits ($24,000), imprisonment of up to three years, or both; a convicted individual may also have been ordered to apologize to those affected by their activities.8 While the MCMC noted several measures that would prevent the ordinance from being used arbitrarily, activists worried that the law could be inconsistently enforced because of the ambiguity of what constitutes “fake news.”9

Defamation is a criminal offense under sections 499 to 520 of the penal code. Media outlets benefit from stronger protections under the Defamation Act 1957 if they can prove that the content is accurate and was published without malice;10 bloggers, who lack this protection, are at greater risk for defamation charges. Section 505(b) of the penal code criminalizes statements intended to cause “fear or alarm to the public” or to “commit an offense against the State or public tranquility” with imprisonment up to two years, a fine, or both.

The government has also pursued prosecutions for online content under the CMA. The act’s broadly worded Section 211 bans content deemed “indecent, obscene, false, threatening, or offensive.” Spreading such content on the internet constitutes “improper use of network facilities or network service” under Section 233.

In March 2023, the government announced its intention to amend the CMA 1998 and the MCMC Act 1998 to tackle sensitive social media commentary regarding the 3Rs.11 The MCMC was reviewing the draft bill in March 2023, and the deputy MCD minister said the bill could be tabled at the next parliamentary session.12 At the end of the coverage period, no bill had been brought before Parliament. Also in March 2023, the government also announced that it was considering increasing the penalties for violating Section 233 of the CMA, as well as studying amendments that would give more power to the MCMC to remove social media accounts that violate the CMA. Currently, the MCMC does not have the power to act on these accounts and relies on cooperation from social media platforms.13

The government intends to table a bill on the Malaysian Media Council by March 2024. The bill seeks to regulate the local media industry through establishing a media council, creating a code of conduct for the industry, and setting up dispute resolution mechanisms for public complaints against the media.14

C3 1.00-6.00 pts0-6 pts
Are individuals penalized for online activities, particularly those that are protected under international human rights standards? 3.003 6.006

Score Change: The score improved from 2 to 3 due to a decrease in the number of individuals given prison terms or held in pretrial detention during the coverage period.

During the coverage period, internet users were arrested and prosecuted for online speech, though fewer people were held in pretrial detention or were imprisoned during this coverage period. Content critical of Islam, the monarchy, or the government, or touching on sensitive racial issues can lead to arrest and prosecution.

According to human rights organisation Suara Rakyat Malaysia (SUARAM), 75 individuals were arrested under Section 233 of the CMA in 2022, with most cases involving sensitive remarks online about religion and the monarchy. 1 The government stated in March 2023 that the MCMC opened 23 investigations into content posted on TikTok under Section 233 of the CMA. Two cases ended with warnings while the other 21 cases remained under investigation.2

Several individuals were arrested and prosecuted for insulting the monarchy, often under Section 233 of the CMA or the Sedition Act.3 Blogger Aspan Alias was fined 4,500 ringgits ($1,000) in July 2022 for insulting the king on Facebook, an offense that falls under Section 233 of the CMA.4 In December 2022, a plantation worker was fined 6,500 ringgits ($1,450), or six months in prison if he defaults, after pleading guilty to insulting the king using his Facebook account.5 In April 2023, a laborer was sentenced to six months’ imprisonment in April 2023 after pleading guilty to charges of insulting the king and inciting racial issues on social media.6

Journalists, activists, and internet users are also routinely charged and prosecuted for criticizing the government, political parties, and other official bodies. From 2021 to May 2022, graphic designer and activist Fahmi Reza has faced 11 police investigations over his satirical work on social media.7 In January 2022, Reza was investigated under Section 4(1) of the Sedition Act and Section 233 of the CMA for uploading a satirical image of the Pahang State coat of arms that highlighted the state’s logging issues.8 In April 2022, he was arrested and remanded for two days under the Sedition Act and the CMA over a satirical graphic depicting an ape in royal attire.9 In August 2022, he obtained a discharge-not-amounting-to-acquittal (DNAA) concerning his satirical post allegedly to be insulting former health minister Adham Baba.10 Similarly, in October 2022, he received another DNAA for satirical artwork he posted on Facebook that associated the PAS with beer cans.11

Former parliamentarian Siti Aishah was arrested in June 2022, after her TikTok video criticizing the removal of subsidies by the government went viral.12 Two students were arrested and investigated under Section 14 of Minor Offences Act 1995 and Section 233 of the CMA over a viral video expressing their dissatisfaction with exam questions.13

A TikTok user was investigated by police in May 2023 under Section 233 of the CMA and for defamation under Section 500 of the penal code after posting a video in which he alleged that police refused to take a complaint regarding illegal moneylenders. The man took down the video shortly after, claiming he had misunderstood the advice from police.14

The government also continued to investigate internet users under the penal code and the CMA for online speech deemed insulting to Islam and the prophet Muhammad. In July 2022, a man was convicted and fined 50,000 ringgits ($11,180) or six months’ imprisonment in case of default; he had violated Section 233 of the CMA by allegedly insulting Islam in a YouTube video.15

Footage of a controversial standup comedy performance in June 2022 went viral on social media for insulting Islam, after a Muslim woman was recorded taking off her headscarf and her traditional clothes to show a more revealing outfit after claiming to have memorised 15 chapters of the Quran. A freelance writer believed to be the woman’s partner was charged for uploading “insulting content” under Section 233 of the CMA after posting the recording to his social media accounts.16 He initially pleaded not guilty, but later changed his plea and was fined a total of 16,000 ringgits ($3,580).17

Separately, in July 2022, Rizal van Geyzel, the cofounder of the Crackhouse Comedy Club where the controversial comedy performance took place, was charged on three counts under Section 233 of the CMA for footage of his own stand-up routine uploaded on social media that allegedly discussed sensitive racial issues and were deemed offensive.18 He was fined 8,000 ringgits ($1,790) in July 2023, after the end of the coverage period.19

In March 2023, police opened an investigation into alleged religious provocation over an independent film released online in 2021, Mentega Terbang, after eight police reports were filed over its portrayal of Islam. The investigation came two days after the MCMC stated that the film had been removed from the Viu streaming platform (see B2).20 Nine individuals, including the producers, directors, and six actors involved in the film, were called in for questioning.21 Several members of the production team and their families also faced online harassment and death threats following the film’s release (see C7).

Individuals continued to be charged with or sued for with defamation during the coverage period. In April 2022, the Pahang state government filed a civil defamation suit against Shariffa Sabrina, the president of an environmental group, after she alleged corruption involving state forestry operations. Officials had previously sought a letter of apology and one million ringgits ($223,400) in damages.22 The case is now ongoing at the High Court, with the trial set for September 2024.23 The Pahang state government also sought an apology and one million ringgits from lawmaker Wong Tack for alleging that the state government had been involved in illegal logging that caused massive floods.24 The state government has since filed a defamation suit against him.25

In January 2022, MACC chief Tan Sri Azam Baki filed a defamation suit against researcher Lalitha Kunaratnam over corruption allegations that she reported on the Independent News Service.26 The case will go to trial in July 2024.27 Kunaratnam also faces a criminal investigation after Baki filed police reports against her for defamation.28

The sultanah of Terengganu State, Nur Zahirah, filed a defamation lawsuit against Clare Rewcastle Brown, the editor of the Sarawak Report, over her book, The Sarawak Report: The Inside Story of the 1MDB Exposé. The Sarawak Report is an online news site focused on corruption and environmental issues. The High Court dismissed the suit, stating that although Rewcastle Brown made a factual error, her statements in the book were not defamatory.29 Zahirah appealed the decision to the Court of Appeal, which was scheduled to hear the case in September 2023, after the coverage period.30 If convicted under Section 500 of the penal code, Rewcastle Brown could receive up to two years’ imprisonment, a fine, or both.31

SAVE Rivers, an indigenous environmental activist group, was sued for defamation by Samling Plywood, a timber company, over allegedly defamatory statements published on SAVE Rivers’ website that claimed the company was involved in illegal logging and was rushing to attain a sustainable forestry certification.32 The lawsuit was labelled a strategic lawsuit against public participation (SLAPP) by 160 civil society groups who signed a letter urging Samling to drop the charges.33 Samling dropped the lawsuit after the end of the coverage period, in September 2023.34

Defamation charges are also brought against online news outlets. Then premier Sabri in February 2022 filed a defamation suit in his personal capacity against the owner of the news site Agenda Daily over an article purportedly depicting Sabri as worrying about becoming the shortest-serving prime minister.35 A court awarded an injunction ordering the article to be removed in July 2022 pending the lawsuit, currently scheduled for court in March 2024.36

In March 2022, former finance minister Lim Guan Eng sued both Malaysian Chinese Association vice president Tan Teik Cheng and the Star newspaper, which publishes in print and online, for defamation over allegations that Lim had politicized funding for schools during his tenure.37 The High Court dismissed the suit in June 2023, ruling that the statements in the article were not defamatory.38

The former editor in chief of print and digital newspaper the Edge, Ahmad Azam Mohd Aris, was charged in September 2022 with two counts of criminal defamation over reporting on penny-stock manipulation. He was later acquitted on one count but received a DNAA for the second.39

C4 1.00-4.00 pts0-4 pts
Does the government place restrictions on anonymous communication or encryption? 3.003 4.004

Anonymous online communication and encryption are not prohibited in Malaysia.

Since 2006, the MCMC has mandated that all service providers register prepaid SIM cards upon purchase.1 The MCMC issued fines of over 20 million ringgits ($4.5 million) for noncompliance with this regulation during the coverage period.2 Legal-name registration is not required for bloggers or customers at cybercafés. It is a criminal offense under Section 507 of the penal code to commit criminal intimidation by anonymous communication.

Users can largely use encryption tools as they please, although a number of laws allow police to access encryption and decryption codes when conducting searches, including the Computer Crimes Act (CCA), the criminal procedure code, and the CMA.3

C5 1.00-6.00 pts0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 2.002 6.006

Privacy protections in Malaysia are poor. It is difficult to ascertain the extent of government surveillance of users’ internet activities.1

Legal provisions allow the police, prosecutors, and the communications minister to intercept online and mobile communications. The laws are generally interpreted to require network operators and service providers to assist law enforcement and intelligence agencies in surveillance efforts, even where clear procedures are lacking. A court order is not required for emergency interception, which applies to cases with national security implications. Under the Security Offenses (Special Measures) Act 2012, a police officer with the rank of superintendent of police or above may intercept communications without the authorization of the public prosecutor in urgent cases.2 While it was in force, the Emergency (Essential Powers) (No. 2) Ordinance 2021 also granted authorities access to digitize data and the power to demand the preservation and disclosure of traffic data.3

In May 2020, Israeli news site CTech reported on documents in an Israeli court case revealing that, in April 2018, officials from the then-ruling BN coalition signed a 6.3 million ringgit ($1.5 million) deal to purchase surveillance technology from Israeli cybersecurity startup Senpai for use by the Malaysian intelligence agency.4 The deal was signed just over a month before the May 2018 election, and the technology was allegedly planned for use surveilling the political opposition ahead of the vote. Former prime minister Najib Razak denied the allegations.5

Citizen Lab reported in December 2020 that the government may be a customer of Circles, a surveillance firm whose products could be used to snoop on the location, texts, and calls of targeted phones.6 In 2013, Citizen Lab reported that FinFisher—described by distributor Gamma International as providing “governmental IT intrusion and remote monitoring solutions”—was detected on servers in Malaysia.7 The software potentially allows the server to steal passwords, tap Skype calls, and record audio and video without the permission of its targets.8 Citizen Lab also identified “a Malaysian election–related document” that it characterized as a “booby-trapped candidate list” containing spyware.9 Because the spyware is only marketed to governments, “it is reasonable to assume that some government actor is responsible,” the group concluded. A separate Citizen Lab report published in 2014 asserted that a Malaysian government agency was a “current or former user” of the Remote Control System spyware marketed by the Milan-based Hacking Team.10 In 2016, the prime minister’s office denied having purchased this spyware but could not confirm whether other government agencies had done so.11

Social media monitoring continues to be a concern, and several government agencies and officials have announced that they are monitoring platforms for content related to race, religion, royalty, and false information, including antivaccine propaganda. 12 In October 2018, Israeli newspaper Haaretz reported that Malaysia had previously purchased sophisticated surveillance technology from Israeli firms that can monitor and analyze social media and other open-source information.13 Previously, the US-based company Snaptrends also reportedly discussed its social media monitoring technology with Malaysian authorities.14

Amid the COVID-19 pandemic, the government rolled out several smartphone apps that access personal information for contact-tracing purposes. For example, the Gerak Malaysia app tracks location, while MyTrace uses Bluetooth proximity data to assist with contact tracing.15 The MySejahtera app launched by the Ministry of Health, which enables access to personal information for COVID-19 contact-tracing and vaccination purposes, was mandatory to enter businesses until May 2022,16 raising privacy concerns.17 The Health Ministry assured users that their data is secure and would not be misused,18 though the app was exploited to send unsolicited texts and emails to app users in October 2021 (see C8).

Internet users raised similar concerns about a “conversion therapy” app distributed by the Department for Islamic Development Malaysia since 2016, which requests permissions to access sensitive user data.19 The app was removed from the Google Play store in March 2022.20

In March 2023, Google’s Threat Analysis Group found that users in Malaysia were targeted by spyware through a link shortener sent over short-message service (SMS) that redirected users to pages hosting Android and iOS exploits before redirecting to a news site.21 Google did not share the source of the spyware, the numbers or identities of the victims, or actors who were involved.22

C6 1.00-6.00 pts0-6 pts
Does monitoring and collection of user data by service providers and other technology companies infringe on users’ right to privacy? 4.004 6.006

The law protects against using individual data for commercial purposes, but there are no provisions specifically addressing online privacy.1 In some cases, service providers are required to aid the government in monitoring user communications.2

The CCA mandates that providers give police access to user information once a warrant is obtained. Providers that fail to comply can face up to three years’ imprisonment and fines of up to 25,000 ringgits ($5,600).3 Section 116 of the criminal code allows the police to access user information, which is defined as “the necessary password, encryption code, decryption code, software or hardware, and any other means,” when conducting a criminal investigation.4 Depending on the offense being investigated, the criminal procedure code does not always require police to obtain a warrant. Section 116c allows the public prosecutor to force service providers to collect and retain specific user communications or data. The prosecutor can also authorize a police officer to install devices to collect such information.

The Malaysian Personal Data Protection Act (PDPA) 2010, which regulates the processing of personal data in commercial transactions, came into effect in 2013. The law makes it illegal for commercial organizations to sell personal information or allow third parties to use it. Those convicted of violating the law can be fined up to 100,000 ringgits ($22,360) or sentenced up to one year in prison. The federal and state governments are exempted from the law, as are entities that process data outside Malaysia.5 The act requires that information about Malaysians be stored locally and limits conditions under which it can be transferred abroad, though the extent to which those rules are enforced is unclear.6

The MCD announced its intention to amend the PDPA by end of 2023 to increase the penalties for companies found to be misusing customer data and to include a requirement for companies to notify the DPDA when a data breach occurs.7

In 2021, the Department of Personal Data Protection reported receiving 580 complaints, of which it deemed 326 relevant. The department served 30 notices to data users for failing to renew their registration and fined one data user in the transportation sector 37,500 ringgits ($8,390) for violating the security principle under section 9 of the PDPA.8

Between July and December 2022, Facebook received 59 requests for information from the government relating to 208 users. Facebook complied with 86 percent of the requests.9

The Inland Revenue Board of Malaysia attempted to request personal data of customers under the loyalty program offered by Genting Malaysia Berhad, in order to widen its tax base, reduce tax evasion and increase tax collections. After Genting Malaysia filed for judicial review, the High Court ruled in December 2021 that blanket demands for personal data without the consent of the customer are not allowed under the PDPA.10

C7 1.00-5.00 pts0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? 3.003 5.005

Intimidation and physical violence against individuals in retaliation for their online activities has been a problem in Malaysia. Journalists, activists, and members of marginalized communities such as LGBT+ people sometimes face online harassment.

The politically sensitive period surrounding the November 2022 elections saw an increase of online hate speech, particularly directed at Chinese Malaysians and PH supporters, some of which made violent threats of a repeat of the May 13, 1969, race riots (see B7).1 The CIJ’s Social Media Monitoring Initiative reported increased targeting of LGBT+, migrant, and refugee communities during the period.2

Users sometimes face offline retaliation for online posts related to government officials. In June 2022, police officers raided the home of former senator Siti Aishah Shaik Ismail in the course of her arrest (see C3).3 In April 2021, 20 police officers forcibly entered the home of political caricature artist Fahmi Reza and arrested him for alleged sedition (see C3). According to Reza, the police kicked a hole in his door and seized his laptop and smartphone before they arrested him.4

Users continue to face online retaliation, including doxing and threats, for their online posts. In June 2021, a Facebook user posted pictures of a man who resembled the head of Kedah state government test-driving a car, an activity prohibited under the Movement Control Order in place at the time. After posting the pictures, the user and her family received hate mail and threats, particularly from supporters of the official; their personal details were also released and circulated online.5

LGBT+ users also have been subjected to harassment, homophobic slurs, and hateful content online. A study released in December 2021 found that almost 90 percent of LGBT+ Malaysians surveyed reported being affected in some way by online harassment.6 In December 2021, a Malaysian actor and TikTok influencer faced online criticism for appearing in a gay romance web series that was used to promote the gay dating app Blued.7 In March 2021, Nur Sajat, a prominent transgender entrepreneur, received death threats after posting a video on Facebook saying she “does not want to be a Muslim anymore.”8 Artists who featured drag performers and LGBT+ dancers in music videos have also faced online harassment.9

Members of the production team for the film Mentega Terbang, which was released online via the streaming service Viu before it was taken down in March 2023 (see B2), and their families were harassed online and received death threats in addition to being investigated for religious provocation (see C3). Some were also targeted with offline violence meant to intimidate them: The screenwriter’s and director’s cars were splashed with acid and paint.10

C8 1.00-3.00 pts0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 2.002 3.003

Technical attacks aimed at suppressing political information online were not reported during the coverage period, though such attacks have been recorded in the past.

In 2022, Cyber Security Malaysia reported a total of 4,741 cases of cybersecurity threats including ransomware attacks, cyberespionage, data leaks, and scams.1

Malaysian citizens are also impacted by data security breaches. For example, in September 2021, a database containing the full names, identity card numbers, addresses, and contact details of four million Malaysians held by the National Registration Department was listed for sale online.2 The leak was attributed to the Inland Revenue Board of Malaysia, which denied responsibility.3

In October 2021, a weakness in the government’s MySejahtera COVID-19 contact tracing app was abused to send users spam emails. The Ministry of Health subsequently assured users that it was fixing the issue.4 In February 2023, the deputy minister of health denied that the reported 1.12 million cyberattacks on the government app had resulted in a data leak, claiming that the download of three million vaccination records was a security measure. Police investigations into the attacks were still ongoing as of February 2023.5

In September 2022, a group of hackers threatened to sell the personal data of civil servants online, claiming that they had found a loophole to gain access to the ePaySlip system. The government did not disclose the amount of damages incurred in the incident.6

The official e-services website of the Penang state government was hacked in January 2023, compromising the personal data of 600,000 people, which was posted on a data breach forum.7 The government stated that all data contained in the leak was outdated, and most of those affected were civil servants.

In November 2022, the Electoral Commission announced that it was investigating claims that the personal data of 800,000 people had been leaked from its website and posted online for sale. The commission claimed that an old allegation had resurfaced but also said it was working with the National Cyber Security Agency (NACSA) to investigate.8

The NACSA was formed in February 2017 as the country’s lead cybersecurity organization. The National Cyber Security Policy was formulated in 2016 to address the risks to critical sectors of the economy.9 In October 2020, the PN government allocated 1.8 billion ringgits ($427 million) to develop a 2020–24 cybersecurity strategy.10 In April 2023, the government announced plans to establish a Cybersecurity Commission to counter online scams and other threats.11

On Malaysia

See all data, scores & information on this country or territory.

See More

Country Facts

  • Global Freedom Score

    53 100 partly free

  • Internet Freedom Score

    61 100 partly free

  • Freedom in the World Status

    Partly Free

  • Networks Restricted

    No

  • Websites Blocked

    Yes

  • Pro-government Commentators

    Yes

  • Users Arrested

    Yes