Provision of real-time interception assistance

Legislation which specifically provides authority to intercept communications is summarised below.  Where not explicit, these rights can be interpreted widely to require network operators and service providers to assist law enforcement and intelligence agencies in their surveillance and censorship activities.

Criminal Procedure Code (the “CPC”)

Under section 116B, a police officer conducting a search under the CPC is to be given access to computerized data whether stored in a computer or otherwise. For the purpose of this section, “access” includes being provided with the necessary password, encryption code, decryption code, software or hardware and any other means required to enable comprehension of the computerized data.

Section 116C gives the law enforcement and intelligence agencies very wide powers to intercept communications which may be evidence related to an offence.

Under section 116C, the Public Prosecutor (the Attorney General) may authorise a police officer to intercept any message transmitted or received by any communication, which may be evidence related to the commission of an offence. The CPC defines “offence” as any act or omission made punishable by any law for the time being in force, including offences such as money laundering or gambling.  The Public Prosecutor may also require a communications service provider to intercept and retain a specified communication or communications of a specified description received or transmitted, or about to be received or transmitted by that communications service provider, or authorise a police officer to enter any premises and to install on such premises, any device for the interception and retention of a specified communication or communications of a specified description and to remove and retain such device.

Section 116C is silent as to whether a warrant is required, which will ultimately depend on the offence under investigation and the circumstances at hand.  Under sections 62 and 116A, a search without warrant is possible if there is reasonable cause for suspecting that there is evidence of a security offence or organised crime concealed or any stolen property is concealed in any place and there are good grounds to believe that a delayed search is likely to result in their removal.  A “security offence” has the same meaning as under the Security Offences (Special Measures) Act 2012 (set out immediately below).

Security Offences (Special Measures) Act 2012 (the “SOSM”)

Section 6 SOSM allows the Public Prosecutor (the Attorney General) and police officers to intercept all communications likely to contain any information relating to the commission of a security offence.  A “security offence” is an offence stated in chapter VI (offences against the state) or chapter VIA (offences relating to terrorism) of the Penal Code, for example, activity detrimental to parliamentary democracy, sabotage, waging war against the Yang di-Pertuan Agong (the King of Malaysia) and committing terrorist acts.

Section 6(1) states that the Public Prosecutor may authorise any police officer:

  • to intercept, detain and open any postal article in the course of transmission by post;
  • to intercept any message transmitted or received by any communication; or
  • to intercept or listen to any conversation by any communication,

if he considers that it is likely to contain any information relating to the commission of a security offence.

Under section 6(2) SOSM, a police officer not below the rank of Superintendent of Police may do any of the above without authorisation of the Public Prosecutor in urgent and sudden cases where immediate action is required leaving no moment for deliberation. In practice, this may give police the power to intercept communications in a wide range of circumstances, including electronic communications.

Communications and Multimedia Act 1998 (the “CMA”)

There are a wide range of offences provided for under the CMA, including breach of licence terms, and telecommunication specific issues such as improper or fraudulent use of network facilities/services.

Section 252 CMA authorises an authorised officer or a police officer of or above the rank of Superintendent to intercept communications if a public prosecutor believes a communication is likely to contain information relevant to an investigation into an offence under the CMA or its subsidiary legislation.

The CMA defines “authorised officer” as any public officer or officer appointed by the Malaysian Communications and Multimedia Commission (the “MCMC“) and authorised in writing by the Minister with responsibility for communication and multimedia (presently the Minister of Communications and Multimedia (the “Minister“)).  “Intercept” is defined as the aural or other acquisition of the contents of any communications through the use of any electronic, mechanical, or other equipment, device or apparatus.  “Communications” is defined as any communication, whether between persons and persons, things and things, or persons and things, in the form of sound, data, text, visual images, signals or any other form or any combination of those forms.

Furthermore, section 265 CMA gives the Minister the right to require implementation of interception capabilities by a licensee or class of licensees. A “licensee” is a person who either holds an individual licence, or undertakes activities which are subject to a class licence.  There are four categories of licensable activities: Network Facilities Service Provider; Network Service Providers; Applications Service Provider; and Content Applications Service Provider.  A telecommunications service provider must be licensed if it is providing licensable activities, and generally network service providers will be required to be licensed.

Please note that section 265 is silent as to whether the implementation of the interception capability would only be for purposes pursuant to a CMA offence.  As a result, if read widely, it may cover offences outside of the CMA.

Section 38 gives the Minister the power to suspend or cancel an individual licence by declaration in certain circumstances, for example, if the licensee has failed to comply with the CMA or the conditions of its individual licence or the suspension or cancellation is in the public interest.  Section 48 also provides similar cancellation powers to the Minister in respect of a class licensee.

Section 254 gives an authorised officer additional powers for the purposes of the execution of the CMA or its subsidiary legislation for specified purposes, including:

  • to require the production of records, accounts, computerised data and documents kept by a licensee or other person and to inspect, examine and to download from them, make copies of them or take extracts from them; and
  • to make such inquiry as may be necessary to ascertain whether the CMA or its subsidiary legislation have been complied with.

Copyright Act 1987 (the “Copyright Act”)

Offences under the Copyright Act include making for sale or hiring any infringing copy, distributing infringing copies and circumvention of technological protection measures.

Under section 50B Copyright Act, the Public Prosecutor (the Attorney General) may authorise an Assistant Controller or a police officer not below the rank of Inspector Officer to intercept or to listen to any communications for the purpose of any investigation into an offence under the Copyright Act or its subsidiary legislation, if he considers that the communication is likely to contain information relevant to the investigation.

An Assistant Controller comes under the purview of the Intellectual Property Corporation of Malaysia (the “MYIPO“), and is appointed or deemed to be appointed by the Director General of the MYIPO under section 5 Copyright Act.

Section 43H Copyright Act provides a copyright owner whose right has been infringed to notify (in the manner determined by the Minister charged with the responsibility for intellectual property at the relevant time) a service provider to remove or disable access to the electronic copy on the service provider’s network within 48 hours of receipt of notification.

Malaysian Anti-Corruption Commission Act 2009 (the “MACC”)

Under section 43 MACC , if the Public Prosecutor (the Attorney General) or an officer of the Malaysian Anti-Corruption Commission (the “Commission“) of the rank of Commissioner or above, as authorised by the Public Prosecutor, considers that it is likely to contain any information which is relevant for the purpose of an investigation into an offence under the MACC, it may authorise any officer of the Commission to intercept any message transmitted or received by any telecommunication, or to intercept, listen to and record any conversation by any telecommunication, and listen to the recording of the intercepted conversation.

Section 47 also imposes a legal obligation on every person to give information if required by an officer of the Commission or a police officer on any subject which it is such officer’s duty to inquire into under the MACC.

  • Certain interception powers are also authorised to particular Law enforcement and intelligence agencies under the Kidnapping Act 1961, the Strategic Trade Act 2010, the Dangerous Drugs Act 1952, and the Dangerous Drugs (Forfeiture of Property) Act 1988.

Disclosure of Communications Data

As established above, various statutes provide wide powers of access, information gathering, search and seizure to law enforcement and intelligence agencies, which do not specifically distinguish between metadata and other types of data relating to communications, but may entail disclosure of such information.  The following statutes give the relevant authorities wide powers of search and seizure that may include the right to access communications stored on a computer server.

Computer Crimes Act 1997 (the “CCA”)

The CCA generally protects against the misuse of computers, for example, hacking. The CCA also provides wide powers of search, seizure and arrest to a police officer of or above the rank of Inspector. Under section 10, whenever there is reasonable cause to believe that in any premises there is evidence of the commission of an offence under the CCA, an officer may be empowered to enter the premises, by force if necessary, and there to search for, seize and detain any such evidence and he shall be entitled to:

  • have access to any program or data held in any computer, or have access to, inspect or check the operation of, any computer and any associated apparatus or material which he has reasonable cause to suspect is or has been in use in connection with any offence under the CCA;
  • require (i) the person by whom or on whose behalf the police officer has reasonable cause to suspect the computer is or has been so used; or (ii) any person having charge of or otherwise concerned with the operation of, the computer, apparatus or material, to provide him with such reasonable assistance as he may require; and
  • require any information contained in a computer and accessible from the premises to be produced in a form in which it can be taken away and in which it is visible and legible.

Section 10(3) of the CCA also states that any police officer may arrest without a warrant any person whom he reasonably believes to have committed or to be committing an offence against the Act.

Anti-Money Laundering and Anti-Terrorism Financing Act 2001 (the “AMLATFA”)

Section 31 AMLATFA confers wide powers on an investigating officer to conduct a search without a warrant if the officer is satisfied or has reason to suspect that a person has committed an offence under AMLATFA. These powers include searching for any property, record, report or document, and inspecting and taking possession of or making copies of or taking extracts from any record, report or document so seized and detained, and detaining them for such period as he deems necessary.

Section 37 requires any person to deliver any property, document or information which an investigating officer has reason to suspect:

  • has been used in the commission of an offence under AMLATFA: or
  • is able to assist in the investigation of an offence under AMLATFA,

that is in the possession or custody of, or under the control of, that person or is within the power of that person to furnish.

Under section 67(1), similar powers exist where the competent authority or an enforcement agency has reason to believe that a person is committing, has committed or is about to commit an offence under AMLATFA.

The definition of “document” for these purposes is very wide and may be interpreted to include metadata relating to electronic communications.

Anti-Trafficking In Persons Act and Anti-Smuggling of Migrants Act 2007 (the “ATPAASMA”)

Section 32 ATPAASMA stipulates that any enforcement officer conducting a search under ATPAASMA shall be given access to computerized data, whether stored in a computer or otherwise. For this purpose, the enforcement officer shall be provided with the necessary password, encryption code, decryption code, software or hardware or any other means required for his access to enable comprehension of the computerized data.

Communications and Multimedia Act 1998 (the “CMA”)

The CMA gives the Malaysian Communications and Multimedia Commission (the “MCMC“) information gathering powers. Section 73 gives the MCMC the right to direct any person to provide them with information if the MCMC has reason to believe that the person has any information or document relevant to the performance of MCMC’s powers and functions or is capable of giving any evidence which MCMC has reason to believe is relevant to the performance of its powers and functions.

Under section 77, MCMC may take and retain, for as long as necessary, any document provided to it pursuant to its information-gathering powers.

Under section 247, a magistrate may issue a warrant authorising any police officer or authorised officer to enter premises if it appears to the magistrate that there is reasonable cause to believe an offence under the CMA or its subsidiary legislation is being or has been committed on the premises or that those premises contain any evidence or thing which is necessary to an investigation.  The authorised officer may enter the premises at a reasonable time with or without assistance, and if need be by force, and to search for and seize any such evidence or thing.  Section 247(8) states that if a search under section 247 indicates that there is any interference-causing equipment, radio apparatus or radiosensitive equipment, the authorised officer may direct that necessary steps be taken to ensure an interference-free environment.

Section 249 CMA gives the police officer and authorised officer conducting a search under the CMA (whether with or without a warrant) access to computerised data, however stored. “Access” is defined to provide police with a full range of rights in relation to accessing data, including being provided with the necessary password, encryption code, decryption code, software or hardware and any other means required to comprehend computerised data.

Section 253 CMA makes it an offence to obstruct a search when a police officer or authorised officer is executing any duty imposed or conferred by law. If there is a court order or search warrant, the network operators and service providers may be liable for contempt of court if it refuses to assist.

General Consumer Code of Practice for the Communications and Multimedia. Industry (the “GCC“)

The GCC requires a service provider to retain records of a customer’s bill for a minimum period of one year. Material collected and recorded in relation to complaints handling processes is also to be retained by network operators and service providers for one year following the resolution of a complaint.  However, the GCC also states that consumer data or information collected by service providers should not be kept longer than necessary.

The definition of “consumer” under GCC means a person who receives, acquires, uses or subscribes to services relating to communications and multimedia within the meaning of the CMA.

National security and emergency powers

Law enforcement and intelligence agencies have a number of special powers in times of emergency or for other special reasons.  Below, we identify the common legislation invoked in such circumstances.  Please note that there may be instances where emergency legislation is passed which is specific to a particular state within Malaysia.  This is beyond the scope of this report.

Communications and Multimedia Act 1998 (the “CMA”)

Under the CMA, a licensee shall, upon written request by the Malaysian Communications and Multimedia Commission (the “MCMC“) or any other authority, assist MCMC or other authority as far as reasonably necessary in preventing the commission or attempted commission of an offence or otherwise in enforcing the laws, including the protection of the public revenue and preservation of national security.

Under section 266, on the occurrence of any public emergency or in the interest of public safety, the Yang di-Pertuan Agong (the King of Malaysia) or the authorised Minister may:

  • suspend the licence of any licensee, take temporary control of any network facilities, network service, applications service and/or content applications service owned or provided by a licensee in any manner as he deems fit;
  • withdraw either totally or partially the use of any network facilities, network service, applications service and/or content applications service from any licensee, person or the general public;
  • order that any communication or class of communications to or from any licensee, person or the general public relating to any specified subject shall not be communicated or shall be intercepted or detained, or that any such communication or its records shall be disclosed to an authorised officer mentioned in the order; or
  • order the taking of possession of any customer equipment.

Under section 266(c), on the occurrence of any public emergency or in the interest of public safety, the Yang di-Pertuan Agong or the authorised Minister may order that any communication or class of communications to or from any licensee, person or the general public relating to any specified subject shall not be communicated or shall be intercepted or detained, or that any such communication or its records shall be disclosed to an authorised officer mentioned in the order.

Emergency (Essential Powers) Act 1979 (the “EEPA”)

Section 2 EEPA gives the Yang di-Pertuan Agong the power to make any regulations whatsoever (the “Essential Regulations“) which he considers desirable or expedient for securing public safety, the defence of Malaysia, the maintenance public order and of supplies and services essential to the life of the community.

The Essential Regulations may, among other things, authorise the taking possession, control, forfeiture or disposition, on behalf of the Government of Malaysia, of any property or undertaking; or the acquisition, on behalf of the Government of Malaysia, of any property other than land; or authorise the entering and search of any premises; or provide for any other matter in respect of which it is in the opinion of the Yang di-Pertuan Agong desirable in the public interest that regulations should be made (sections 2(g), (h) and (o)).

Official Secrets Act 1972 (the “OSA”)

Under section 6 OSA, any court may issue a search warrant to search for and seize a document, even though an offence under the OSA is not alleged, if it is satisfied that there is reasonable cause to believe a document contains matter or information prejudicial to the safety or interests of Malaysia and is directly or indirectly useful to a foreign power or to an enemy.  “Document” is interpreted to include any other data embodied so as to be capable of being reproduced.

Section 12 OSA gives the Minister the power to require the production of certain messages sent to or from any place outside of Malaysia from any person who owns or controls any telecommunications device used for sending or receiving such messages (including the originals and transcripts of such messages and all other papers relating to the message).  The request must be made by means of a warrant, and the messages should be provided to the Minister or any person named in the warrant.

There is also a duty under section 11 OSA to provide information when required to do so by the police, by any member of the armed forces or by an authorised public officer.

Section 3(b) and (c) OSA stipulates that if, for any purpose prejudicial to the safety or interest of Malaysia, any person either makes any document or obtains, collects, records, publishes or communicates to another person any information which might be directly or indirectly useful to a foreign country, then they will be guilty of an offence punishable by life imprisonment. For the purpose of this section, “document” includes, in addition to a document in writing and part of a document:

  • any map, plan, model, graph or drawing;
  • any photograph;
  • any disc, tape, sound track or other device in which sound or other data (not being visual images) are embodied so as to be capable (with or without the aid of some other equipment) of being reproduced therefrom; and
  • any film, negative, tape or other device in which one or more visual images are embodied so as to be capable (as aforesaid) of being reproduced therefrom.

Under section 27 OSA, in the course of any court proceedings related to an offence under the OSA, an application may be made for a court order by the prosecution to exclude the public from any part of a hearing.  The grounds required are that the publication of any evidence or statements made in the course of the proceedings would be prejudicial to the safety of Malaysia.

Censorship Related Powers

Communications and Multimedia Act 1998 (the “CMA”)

In general, the Minister and the Malaysian Communications and Multimedia Commission (the “MCMC“) are granted very wide powers to make determinations or declarations, the effect of which is that they may take control of or shut down network operators and service providers. Usually, the determinations or directives are issued pursuant to the CMA, which grants the Minister and the MCMC the power to issue determinations or directives on certain issues.

The CMA also contains several provisions regulating content and voluntary industry codes such as the Malaysian Communications and Multimedia Content Code (the “Code“) (please see section 5.2 below) and General Consumer Code of Practice for the Communications and Multimedia Industry. Compliance with these voluntary industry codes by service providers is good practice but is not mandatory other than for licensed service providers and any person directed by the MCMC to comply. Failure to comply with such direction is an offence.

Section 211 of the CMA states that no content applications service provider shall provide content which is indecent, obscene, false, menacing, or offensive in character with intent to annoy, abuse, threaten or harass any person. Section 6 of the CMA defines content as any sound, text, still picture, moving picture, audio-visual or tactile representation, which can be manipulated, stored, retrieved or communicated electronically.

Under section 233, (a) a person who by means of any network facilities or network service or applications service knowingly makes, creates or solicits and initiates the transmission of obscene, indecent, false, menacing or offensive content with intent to annoy, abuse, threaten or harass any person; or (b) a person who knowingly by means of any network facilities or network service or applications service provides any obscene communication for commercial purposes or permits a network service or applications service under the person’s control to be used for an activity described in (a), commits an offence.

Section 195 provides that the MCMC may use any of its powers under the CMA in the resolution of complaints received from consumers in relation to matters of customer service and consumer protection, including but not limited to, the failure of a licensee under the CMA to comply with a consumer code.

Malaysian Communications and Multimedia Content Code (the “Code“)

The Code provides guidelines and procedures for good practice in relation to the dissemination of online content to the public by service providers in the communications and the multimedia industry.   The Code also regulates Internet Content Hosting Providers (“ICH“) and Internet Access Service Providers.

Companies who provide access to any electronic content (such as sounds, texts or pictures), but who do not control such content or have any knowledge of what it comprises, are deemed “innocent carriers”. As such, they are not responsible for such content for the purposes of the Code.

The Code expressly states that ICHs are not required to do certain things, such as to block access by their users/subscribers to any material unless directed to do so by the Complaints Bureau, or monitor the activities of users and subscribers. (The Complaints Bureau is an arm of the Communications and Multimedia Consumer Forum, set up by the Malaysian Communications and Multimedia Commission to protect the rights of consumers in this sector.  It deals with all complaints that relate to the Code.)

Anti-Money Laundering and Anti-Terrorism Financing Act 2001 (the “AMLATFA”)

Section 6(3) stipulates that no person shall publish in writing or broadcast any information, including a report of any civil or criminal proceedings but excluding information published for statistical purposes by a competent authority or the Government, so as to reveal or suggest:

  • that a disclosure was made under section 5; or
  • the identity of any person as the person making the disclosure.

Section 5 relates to protection of informers and information relating to an offence under AMLATFA.

Sedition Act 1948

Section 10 states that the court may make an order prohibiting the issuing or circulation of a seditious publication which would be likely to lead to unlawful violence, or appears to have the object of promoting hostility between different classes or races of the community.  The order will be given on the application of the Public Prosecutor (the Attorney General) and will require every person having any copy of the prohibited publication in his possession, power, or control to deliver every such copy into the custody of the police.

Bearing this in mind, some legal provisions may extend responsibility to network operators and service providers in relation to such laws even if the content is not actually provided or created by the network operators and service providers.  These include abetting an offence punishable with imprisonment under section 116 of the Penal Code.  In addition, under section 114A Evidence Act 1950, it is possible that the network operators and service providers may be presumed to be the publisher of the content contained on its customers’ sites, unless the contrary is proved.

Other relevant legislation

In relation to enforcement measures, the Malaysian Communications and Multimedia Commission (the “MCMC“) is authorised to block or remove scam websites or websites with illegal content and they largely work with the police and other enforcement agencies to implement this, for example, through use of the Penal Code and sedition laws.  The Penal Code, for example, provides for offences in relation to complaints about violent “hate” sites, including section 505 which makes it an offence to make, publish or circulate any statement, rumour or report:

  • with intent to cause, or which is likely to cause, fear or alarm to the public, or to any section of the public whereby any person may be induced to commit an offence against the State or against the public tranquillity; or
  • with intent to incite or which is likely to incite any class or community of persons to commit any offence against any other class or community of persons.

The penalty for an offence under this section is up to two years’ imprisonment, a fine, or both.

The Penal Code also contains offences in relation to printing content containing slander or libel, and offences in relation to hosted sites which contain illegal content or encourage illegal acts.

Oversight of the use of these powers

Communications and Multimedia Act 1998 (the “CMA”)

Under the CMA, section 18 states that the Appeal Tribunal established under section 17 may review any matter on appeal, from a decision or direction of the Malaysian Communications and Multimedia Commission (the “MCMC“), but not from a determination by the MCMC. Any decision by the Appeal Tribunal is final and binding on the parties to the appeal and is not subject to further appeal.

Section 120 provides that an aggrieved person or person whose interest is adversely affected by a decision or direction (but not a determination) of MCMC may appeal to the Appeal Tribunal for a review of the merits and the process of certain decisions or directions of the MCMC, unless the matter is not subject to an appeal to the Appeal Tribunal.

Section 121 provides for judicial review where a person is affected by a decision or other action of the Minister or Commission and all other remedies provided under the CMA have been exhausted.

Security Offences (Special Measures) (Interception of Communications) Regulations 2012 under the SOSM (the “2012 Regulations”)

Regulation 3 requires that a police officer who has acted under section 6(3) SOSM (interception without authorisation by the Public Prosecutor in urgent cases where immediate action is necessary) must submit a written report to the Public Prosecutor (the Attorney General) containing specified information detailed in the Second Schedule of the 2012 Regulations.  The information required includes details of the officer making the interception, details relating to the individual whose communication was intercepted, the facts surrounding the investigation and the grounds for using interception.

Anti-Money Laundering and Anti-Terrorism Financing Act 2001 (the “AMLATFA”)

Section 31(4) requires the investigating officer, in the course of his investigation or search, to prepare and sign a list of all property, documents or information detained and state in the list the location in which or the person on whom, the property, document or information is found.

General power for Judicial Review (“JR“)

Judicial review of the decision-making process of an authority exercising a power of a public nature by a court is available even if the executive/administrative decision is not open to any appeal or is expressed by the law to be ‘final and conclusive’. Courts are not necessarily prevented from reviewing such acts or decisions.

The powers of the High Court in relation to JR are enshrined under the Specific Relief Act 1950 and the Courts of Judicature Act 1964.  Grounds for JR include procedural impropriety, illegality, and irrationality in the decision-making process.

Publication of law and aggregate data relating to lawful intercept and communications data requests

Restrictions on network operators and service providers

Under federal Malaysian law, there are no specific restrictions on publishing aggregate data relating to, for example, the volume of interceptions made in a single year.  However, where not already set out in this report, the following laws could be employed to restrict such publication, in certain circumstances.

Communications and Multimedia Act 1998 (the “CMA”)

The CMA provides confidentiality obligations in relation to evidence which is considered to be confidential by the Malaysian Communications and Multimedia Commission (the “MCMC“) in the course of an investigation or trial (sections 24B, 61 and 63 CMA).  Such confidentiality obligations are open to judicial review under section 121.

In addition, under section 80 CMA, the MCMC is itself bound by certain obligations in respect of the publication of information, and it may also issue a direction, requiring network operators or service providers to comply with similar obligations. Section 80(3) CMA states that the MCMC must not publish any information disclosed to it if the publication would:

  • disclose a matter of a confidential character;
  • be likely to prejudice the fair trial of a person; or
  • involve the unreasonable disclosure of personal information about any individual (including a deceased person).

However, the MCMC may publish an abstract relating to such information provided that the particulars in the abstract are not be arranged in any way which would compromise or prejudice the person providing such information.

Aggregate data published by government agencies.

Anti-Money Laundering and Anti-Terrorism Financing Act 2001 (the “AMLATFA”)

Section 6(3) AMLATFA (described in section 4.3 above) prevents the disclosure of certain information in legal proceedings, however, it exempts information published for statistical purposes by a competent authority or the government.

Generally, however, government agencies do not publish aggregate data in relation to the federal powers of interception, disclosure of data or censorship, as described in this report.
Law stated as at 15 January 2015.

This information was originally published in the Legal Overview to the Telenor Group report on Authority Requests for Access to Electronic Communication in May of 2015.

Social

Follow us on Twitter @IndustryDialog