Cybercrimes Bill, while needed, grants overreaching powers and lacks checks and balances

The Cybercrimes Bill 2026 was passed by the House of Representatives and the Senate in July 2026, without a single amendment, to repeal and replace the Computer Crimes Act 1997 (clause 61 of the bill).

The bill aims to address digital harms that have emerged in the nearly 30 years since the CCA was passed and introduces overdue protections against AI-generated deepfakes and synthetic deception (clause 23), the non-consensual dissemination of intimate images (clause 24), online scams, identity theft and computer-related fraud (clauses 17 and 22), and attacks on national critical information infrastructure such as power grids, water systems and emergency services (clause 25).

These are legitimate and overdue responses to real and growing digital harms.

As a signatory to the UN Convention against Cybercrime, Malaysia is required under Articles 6 and 24 to ensure that all cyber enforcement powers incorporate strict human rights safeguards, specifically independent judicial oversight, the principle of proportionality, and rights to an effective remedy.

Malaysia has been invited to accede to the Council of Europe’s Convention on Cybercrime (the Budapest Convention), of which Article 15 requires that such powers be subject to judicial or other independent supervision, defined grounds justifying their use and limits on their scope and duration, and that they incorporate the principle of proportionality.

Extreme executive overreach

The bill appears to confer extraordinarily wide investigative and enforcement powers on the executive with no express judicial oversight: officers may access computer systems and compel the production of passwords, encryption or decryption codes (clause 36), intercept communications in real time with the public prosecutor’s authorisation (clauses 40 and 41), and exercise these powers well beyond the cybercrimes the bill is meant to address (clause 48, see also clauses 36-41), without express provisions for independent review, defined limits or any right of appeal.

A person’s devices could be searched and communications intercepted without ever appearing before a judge – a fundamental failure of the checks and balances any democracy under the rule of law would impose on executive power.

These powers extend to any public officer or Malaysian Communications and Multimedia Commission officer designated by the minister (clauses 26 and 27), who may search premises and seize devices, with the possibility to do so without a warrant or court involvement (clause 29), and issue secrecy bound preservation and disclosure notices that leave the recipient unable to disclose their existence (clauses 38 and 39), as long as the officer is “satisfied” that the data is “reasonably required”.

Journalists’ sources and whistleblowers appear to be left just as exposed.

Investigative powers of this breadth, exercised on an officer’s own satisfaction without a warrant or any other statutory safeguard, pose serious risks to personal liberty and privacy, potentially infringing Article 5(1) of the Federal Constitution.

Such powers also create a real risk of random unbridled enforcement efforts and fishing expeditions being taken or attempted, which would be disproportionate and inconsistent with the guarantee of equal protection for all persons under Article 8(1) of the Federal Constitution.

The clauses providing for this are therefore subject to challenge as being unconstitutional, and the purported actions of the authorities under those provisions would likewise be subject to challenge.

The Committee on Combating Cybercrimes overseeing enforcement is also stacked with government agencies and has no independent representation (clause 4).

Furthermore, the vague offences on manipulated content risk criminalising legitimate journalism, artistic expression, satire and political discourse (clause 23), backed by severe penalties regardless of actual harm (clauses 17, 25 and 59(b)).

This ambiguity risks infringing on the constitutional guarantee of freedom of speech and expression under Article 10(1)(a) of the Federal Constitution.

As there are no express safeguards, which Parliament should have built into the bill itself, a person wrongly searched, intercepted or gagged by a secrecy notice would have to litigate his or her way to a remedy that the bill ought to have guaranteed from the outset.

Malaysia deserves cybercrime legislation that is effective, proportionate and consistent with the rule of law, due process and the fundamental liberties guaranteed under the Federal Constitution.

This bill falls far short of expectations. The bill does a disservice to the rule of law and is likely to attract legal challenges. – Bar

Anand Raj is the president of the Malaysian Bar.

Support our work by making a donation. Tap to download the QR code below and scan this QR code from Gallery by using TnG e-wallet or most banking apps: