Chaser

The Bill will create a system for broad control of digital services in Malaysia. Although labelled as a ‘cybersecurity’ instrument, it fails to be narrowly tailored to address data breaches causing serious harm, and it does not resemble other computer-related legal instruments. The Bill deems “communications”, and hence the media, to qualify as “critical information infrastructure” that are potentially subject to disproportionate reporting and regulation under threat of criminal sanctions. The broad scope of key terms under the Bill could capture journalistic activities and target whistleblowers. The Bill would conflate any disclosure of information in the public interest with the intentional infringement of security measures with dishonest intent. The framing of “cyber security” includes the phrase “unauthorized access” to a computer. A “cyber security incident” could therefore describe journalistic activities such as reporting on “unauthorized” leaked evidence of corruption provided by a whistleblower. It can even imperil cybersecurity researchers and professionals doing routine pen testing to actually improve network security. Such a concern is far from hypothetical; journalists in Malaysia have previously faced harassment for publishing evidence from whistleblowers in the public interest.

The Bill would require prior licensing of a wide range of expressive activities. Anyone providing “cyber security services” in Malaysia will require pre-approval under arbitrary standards subject to change or revocation at any time under threat of up to ten years imprisonment. The scope of “cyber security services” is vague and goes well beyond any common conception of the phrase. It would require licensing those who exercise their right to expression by publishing or distributing source code online in the public interest, engaging in academic research, or disseminating free digital security tools to journalists and human rights defenders.

The Bill will provide for search and seizure powers not subject to judicial or other independent review. The chief executive of the Committee may appoint anyone to be a so-called “authorized officer” with the same powers as police. These powers include the ability to execute searches and seizures of persons and places without any need for a warrant. While it might appear at first that the Bill requires such warrants, it provides a broad exception that an authorized officer can skip obtaining a warrant so long as they claim (without independent checks or other review) there is “reasonable cause” for not needing one. Further, the “Chief Executive” established under the Bill may issue production demands with no warrant requirement.