Professional Documents
Culture Documents
Combating The Threats of Cybercrimes in Malaysia - 2013
Combating The Threats of Cybercrimes in Malaysia - 2013
www.compseconline.com/publications/prodclaw.htm
abstract
Keywords: Cybercrimes are increasing in Malaysia. According to a report the crimes jumped by 88 per
Malaysia cybercrime cent in 2011 with 15,218 cases compared with 8090 in 2010. This report has caused a lot of
Cyberlaw concern from the Government and the public. At a glance, these crimes are like ‘diseases’
Cybercrime control measures spreading throughout the country and causing damage to people, the economy and the
Traditional law country. Although various efforts have been taken and some are still ongoing, total
prevention of cybercrime is very difficult. Combating the threat is very challenging since
Malaysia is still lacking in many of the tools required including manpower and technology.
But the efforts will continue. This paper discusses some of the efforts taken by the
Government and other organisations to deal with these problems followed by an analysis
on the application of cyberlaws and how these measures work together with the traditional
law in tackling cybercrime cases.
ª 2012 Duryana binti Mohamed. Published by Elsevier Ltd. All rights reserved.
0267-3649/$ e see front matter ª 2012 Duryana binti Mohamed. Published by Elsevier Ltd. All rights reserved.
http://dx.doi.org/10.1016/j.clsr.2012.11.005
c o m p u t e r l a w & s e c u r i t y r e v i e w 2 9 ( 2 0 1 3 ) 6 6 e7 6 67
fund transfers (Carter, 1995; Grabosky, 2005). The online was an 88 per cent increase compared with 2010 when only
transfer of money usually involves international syndicates 8095 incidents were reported (Kye Lee, 2012). The cybercrime
which target internet users to deposit money for payment of cases reported to the RMP include Short Message System
something which does not exist (Ahzan, 2010). (SMS)/calling, ATM, parcel, Internet Banking/phone banking/
Another type of cybercrime is known as ‘New Crimes, New FTT, phishing, e-commerce and abuse of network facilities
Tools’ because the crimes involve a situation where the under the Communications and Multimedia Act (CMA) 1998.
suspect uses the computer system to alter or modify certain According to the statistics of the Royal Malaysian Police the
data in that system. These crimes are committed against the highest reported case in 2010 was crimes related to misuse of
computer system. They include sabotage, vandalism and ATM and the highest loss amounting to RM20,786,906.62 was
electronic wiretapping or gaining illegal access by imperson- caused by syndicate activities on banking transactions. As of
ating an authorised user or exceeding a person’s authority July 2012, love scams and fraudulent online purchases ranked
(Bologna & Shaw, 2000). Other than these, spreading computer highest among the 403 cases of cybercrimes reported within
viruses, cyberwar, cyber terrorism, denial of service (DOS) i.e. the first three months of the year. These incurred losses of
by preventing others from making use of their system, RM16 million. According to Bukit Aman Cybercrime and
internet pornography or cyber pornography, invasion of Multimedia Criminal Investigation officer ASP Mohd Syafiq
privacy such as access to personal information, software Jinuin Abdullah, the frequency of cybercrime cases had
piracy such as an unauthorised replication of computer soft- increased steadily, where about 6586 reports of such cases
ware, reprogramming, hacking, phishing or identity theft, were lodged last year with RM34 million incurred in losses
cyber squatting, cyber stalking, mass web defacement and compared with 6238 cases involving RM18 million in 2010
faring are all categorised as cybercrimes. In summary, these (Bernama, 2012b).
cybercrimes are evolving and will continue to evolve with new Although there was a statement (Moores, 2004) that
technology and versatile criminal minds. cybercrimes do not cause any physical violence and have low
On the other hand, traditional crimes are crimes personal risk when compared with other crimes, cybercrime
committed without using the computer or electronic medium. has the potential to cause financial damage and monetary loss
These crimes are committed by an individual or a group of that could threaten Malaysian businesses and the economy
individuals either by way of abetment, conspiracy, giving false (Utusan Malaysia, 2004). This fact is supported in a statement
evidence, theft, fraud, assault and murder. These offences are issued by Tommy Seah, Honorary Group Chairperson of
mentioned in the Penal Code of Malaysia and certain statutory International Cybercrime and Forensic Examiner (ICFE) Group
provisions. Street crimes are also part of the conventional of Companies in April 2010. According to him, financial and
crimes and they include snatch theft and robbery. According cybercrimes were among the most prevalent economic crimes
to a report these offences made up 17% of the overall crime committed in Malaysia. The economic crimes constitute
index in 2008 (Karim, 2009). fraud, corruption and bribery, identity theft, money laun-
dering, cybercrime, accounting and financial fraud. On the
1.1.1. Cybercrime incidents and losses enforcement issue, he also said that ‘it was important to
In Malaysia, the incidence of cybercrime started to attract ensure greater enforcement by the authorities and organisa-
public attention when hackers attacked the websites of the tions in order for Malaysia to remain attractive to foreign
Malaysian Parliament and University Technology Mara in investors’ (Bernama, 2010a).
2002. The hackers wiped out all information on the Parliament Early examples of loss can be seen back in 2003 when the
website and replaced the homepage with words in a foreign United Kingdom suffered £60 million losses from cyber-
language. This attack is considered dangerous because it related crimes and a police survey indicated that 83 per cent
affected the government body and one of the public univer- of Britain’s largest companies had been victims of cybercrime
sities in Malaysia. Then, in 2004, many local websites were costing them more than £195 million in business downtime,
affected by web defacement activities which resulted in the lost productivity and perceived damage to their brand or share
emergence of cyber graffiti (New Straits Times, 2004; Sani, price (BBC News, 2005). In October 2012, the Ponemon Institute
2005). The impact of web defacement activities on sites conducted a study on Cost of Cybercrime in UK. The result has
which handle electronic transactions is said to be much shown that cybercrime costs UK organisations an average of
greater than on information-based websites. Then, cyber £2.1m a year each. The study also revealed that the cost of
attacks continued to grow and from the statistics in 2008, attacks on UK organisations range between £400,000 and
fraud recorded the highest number of cases (907) as compared £7.7m. It is submitted that this situation is quite alarming and
to denial of service attacks (12). Until May 2009, system needs proper security measures to handle it. The study also
intrusion recorded the highest number of cases (624) and found that the most costly UK cybercrimes are those caused
denial of service attacks increased to 14 cases. However, fraud by malicious insiders, denial of service attacks and malicious
and forgery cases had reduced to 331 cases. The lowest re- code. The 2012 study also revealed the average annual cost of
ported case in 2009 was for indecent content (6) (Mycert, 2008). cybercrime incurred by US organisations. It is the highest of
In 2009, CyberSecurity Malaysia (the national cybersecurity the countries studied i.e. at $8.9m or £5.5m, which represents
specialist centre under the purview of the Ministry of Science, a 6% increase over the average for 2011, and a 38% increase
Technology and Innovation (MOSTI)) had received 3564 cases over 2010 (Ashford, 2012). In August 2008, eleven people in
reported to the centre; an increase of 68%, compared with the Boston, US were charged in connection with data breaches or
same period in 2008 (The Star, 2010a). In 2011, a total of 15,218 credit card fraud at nine major retailers. According to the
incidents were reported via the Cyber999 Help Centre, which authorities the crimes were the largest Federal hacking and
68 c o m p u t e r l a w & s e c u r i t y r e v i e w 2 9 ( 2 0 1 3 ) 6 6 e7 6
identity theft case ever which involved the theft and sale of Cyber999 Help Centre. This agency has also drafted the
more than 41 million credit and debit card numbers. While in NCSP in 2006 and given emphasis by the Science, Technology
Malaysia, more than RM116 million in damages had been and Innovation Ministry in 2012 due to the increasing volume
incurred in the last two years due to online crime (Cheng, of cybercrime and the dangers of such crime to the security of
2012). the country (Kye Lee, 2012).
In short, the above threats can cripple computer networks CyberSecurity Malaysia has taken various measures to
and systems. Therefore, in order to prevent huge losses to ensure that Malaysia is protected from cyber attacks. Among
business and damage to the integrity of any corporation, these are collaborating with international experts and orga-
efforts must be made to curb these activities (Yunos and Nasir, nisations in information security, which includes conducting
2003). The companies, for example, must protect their integ- OIC-CERT Drills organised by The Organisation of the Islamic
rity by setting up policy-based content security which deals Cooperation e Computer Emergency Response Team
with matters on productivity, online threats, compliance and (Bernama, 2012d). OIC-CERT provides “a platform for member
legal liability (Durbin, 2004; Hamin, 2003). There must also be countries to explore and to develop collaborative initiatives
effective mechanisms to prevent and detect cybercrime and possible partnerships in matters pertaining to cyberse-
activities on all networks in order to avoid attacks like denial curity that shall strengthen their self reliance in cyberspace”.
of service attacks (DOS). This is because without effective Other measures include co-founding the Asia-Pacific
protection, such crimes could threaten the security of the Computer Emergency Response Team (APCERT), becoming
country and threaten the development of ICT in Malaysia. a member of the Forum of Incidents Response and Security
Teams (First) and a member of the Anti-Phishing Working
Group (APWG). In July 2009, CyberSecurity Malaysia signed
2. The efforts to combat cybercrime a MoU with the Malaysian Airlines System (MAS), Asia e-
University, Centre for Advanced Software Engineering of
Although it was reported that the cybersecurity level in Universiti Teknologi Malaysia, Management Science Univer-
Malaysia was better than those in developed countries, sity and Mimos Bhd in an effort to combat cybercrime
Malaysians need to be even more proactive about safety (Shafi, 2010). With such collaboration and efforts, CyberSe-
measures (New Sabah Times, 2009). In 2010, phishing attacks curity Malaysia is able to work closely with trusted and
were reported as being on the rise and considered to be reliable international information security experts (The Star,
one of the major threats to the country (The Star, 2010b). 2010c; AsiaOne, 2011) has also suggested that the nation
However, these attacks can be prevented as well as eradi- needs a dedicated ‘cybercourt’ in view of the high increase in
cated if the public is educated and the financial institutions, cybercrime in the country (Patrick, 2009).
Bank Negara Malaysia (National Bank), the respective
ministries and the law enforcement agencies collaborate to 2.2. The Malaysian Communications and Multimedia
address these issues. The financial institutions may also Commissions (MCMCs)
deploy a phishing fraud-detection service that proactively
monitors e-mail traffic and provides immediate notification The Malaysian Communications and Multimedia Commis-
upon the discovery of new phishing e-mails (Sani, 2004; sions (MCMCs) are governed by the Malaysian Communica-
Naples and Maher, 2002). tions and Multimedia Commission Act 1998 and its objectives
Hence, the obligation to combat cybercrime is not only include supervising and regulating the communications and
confined to government or law enforcement but extends to multimedia activities in Malaysia. The role of MCMC is to
the private sectors, organisations and individuals. The efforts regulate according to the Communications and Multimedia
taken by the Ministry of Science, Technology and Innovation Act 1998, Digital Signature Act 1997, Postal Services Act 1991
(MOSTI) and CyberSecurity Malaysia, the Malaysian Commu- and Strategic Trade Act 2010. It covers telecoms, broadcasters
nications and Multimedia Commissions (MCMCs), the Royal and ISPs; postal and courier services and digital certification
Malaysian Police (RMP) are explained below. authorities (Iskandar, 2012). This Commission has identified
twenty (20) Internet crimes which the Attorney General can
2.1. Ministry of Science, Technology and Innovation prosecute. The cases cover a range of offences provided
(MOSTI) and CyberSecurity Malaysia under the CMA 1998, such as abuse of religion, pornography,
phishing and sedition. Besides taking the culprits to court, the
In order to combat cybercrime activities and deal with infor- Malaysian Communications and Multimedia Commission
mation communication technology (ICT) related matters, the (MCMC) will also block access to phishing, fraud, illegal
Ministry of Science, Technology and Innovation (MOSTI) has investment and pornography websites (Malaysia Today, 2011).
adopted a National ICT Policy framework which includes Besides that, the MCMC has also set up a bureau to receive
designing the National CyberSecurity Policy (NCSP). This NCSP complaints to identify and probe those responsible for
seeks to address the risk to the Critical National Information providing and disseminating illegal content. The Commis-
Infrastructure (CNII) which comprises the networked infor- sions have worked hard in the past two years investigating
mation systems of ten critical sectors. There are also eight websites and social networking pages containing offensive
policy thrusts under the NCSP which include reviewing and articles such as insulting comments on Islam and Allah
enhancing Malaysia’s cyberlaws (NITC, 2012). CyberSecurity (Mustaza, 2010). Nevertheless, there is still white-collar
Malaysia, an agency, was appointed to manage and receive cybercrime which is not sufficiently reported due to reluc-
reports on Internet-related problems through its 24-h tance or ignorance (Borneo Post Online, 2011).
c o m p u t e r l a w & s e c u r i t y r e v i e w 2 9 ( 2 0 1 3 ) 6 6 e7 6 69
2.3. The Royal Malaysian Police (RMP) In addition, staffs at government agencies have also been
trained and tested on their readiness to cope with cyber
The Royal Malaysian Police through its Department of attacks. In between June 24 and August 2 of 2010, thirty-four
Commercial Crime Investigation (otherwise known as ‘Jaba- organisations from nine Critical National Information Infra-
tan Siasatan Jenayah Komersial’) (JSJK) has established an structure (CNII) sectors took part in the Cyber Crisis Exercises
Investigation of Cybercrime and Multimedia Unit to investi- which were also known as X-Maya. The X-Maya was carried
gate cases. Besides that, a College of RMP and a Computer out and involved sectors such as health, water, banking
Forensic Laboratory were also established to provide training and finance, information and communication, energy,
to police officers and computer forensic experts. The Inspector transport, defence and security, government and agriculture
General of Police (IGP) Tan Sri Ismail Omar has said that (Timbuong, 2010). Other than that, a higher learning institu-
cybercrime unit police will be equipped with the latest high- tion such as University Sains Malaysia (USM), has also
tech resources to combat online offences effectively. They contributed by creating a Forensic Analysis and Discovery
will also come up with a new mechanism and procedures to System (FADS) to help the investigation process. This system
deal with cases involving the Internet, especially on Facebook has been well-received by government agencies, including
(Bernama, 2010a,b,c). Further, the Government is planning to the Malaysian Communications and Multimedia Commission
build an anti-terrorism academy at the Langkawi Interna- (MCMC).
tional Shooting Range in order to combat terrorism and other In order to further strengthen the efforts to fight against
global crimes. According to Home Ministry Deputy Secretary- the cybercriminals and cyber threats Malaysia has agreed to
General Datuk Abdul Rahim Mohd Radzi, the academy will join the IMPACT-alliance. IMPACT (International Multilateral
focus on applying the latest techniques to fight terrorism, Partnership Against Cyber threats) and ITU (International
human trafficking, drug smuggling, money laundering, Telecommunication Union) are two organisations that
cybercrime, biological warfare and the use of explosives. This collaborate in providing services to the globe. IMPACT has also
effort will also involve enforcement and intelligence agencies laid down five strategies namely, legal measures, interna-
from all over the world. In this regard, Bank Negara will be tional cooperation, technical and procedural matters, organ-
playing a major role and work as coordinator between isational structures and capacity building in order to achieve
multiple agencies (Zolkepli, 2010). its objectives (IMPACT, 2012).
Nevertheless, in order to achieve more effective results,
every individual should know and comply with computer
2.4. Other efforts ethics as well as being willing to adopt the principle of
self-regulation. As for the corporations, a proper system to
CyberSecurity Malaysia has introduced new Internet guide- detect the criminals and to enforce strong security protection
lines known as ‘Best Practice on Social Networking Sites (SNS)’ over the internet should be adopted. Bosses may observe
in order to control the use of social networking. It has also their employees work ethic and ensure they comply with
prepared an ‘Anti-Spam Framework of Best Practices and company policies. This is because on many occasions
Technical Guidelines’ in order to curb spamming, since there computer fraudsters or ‘perpetrators’ are employees of those
is no specific law to fight these spamming threats, although organisations. They include supervisors and managerial
the MCMC made a proposal to curb spamming as long ago as staff, computer programmers as well as clerks (Hamin, 1999).
2004 (MCMC, 2004; Khong, 2004). Until November 2012 there is Other potential cybercriminals could be terrorists, teenage
still no decision by the Government to introduce an anti-spam ‘geeks’ and those with computer skills who either inten-
law in Malaysia or proposal to modify existing cyberlaw, tionally or unintentionally commit such abuses. Computer
particularly the Communications and Multimedia Act 1998 fraud committed by employees is classified as internal fraud
and the Computer Crimes Act 1997. According to the infor- and most of it relates to the accounting systems of the
mation available at its website Malaysia has no immediate company. The offender will try to conceal his wrongful act by
plans to legislate. It will pursue this recourse when there is no entering his fraudulent activity in a normal accounting
other viable alternative (SKMM, 2012). system which leaves no visible trails to uncover. Neverthe-
This is in contrast with some other countries which have less, what is important is to prepare, not only for this but
already passed an anti spamming legislation. Among them are more serious attacks, such as those which develop when full
the UK Privacy and Electronic Communication (EC Directive) scale ‘cyberwar’ takes place. Although the solutions to such
Regulations 2003 (SI 2003 No. 2426), the Australia Spam Act attacks are multiplying, the attacks led by sophisticated
2003 and the US Controlling the Assault of Non-Solicited espionage are expanding and multiplying in strength and
Pornography and Marketing Act (CAN-SPAM Act) (Shou capacity (The Star, 2010d).
Sien, 2004). In the Asia-Pacific region, the Australian The above are some of the efforts taken by the government
Communication Authority (ACA) and the Korean Information and various organisations in controlling the threats of cyber-
Security Agency (KISA), for example, have initiated the Seoul- crimes. However, control of such threat still depends on
Melbourne Anti-Spam Agreement, a multilateral memo- the people on how well they understand the threat and can
randum of understanding (MoU) on cooperation in countering educate themselves to use computers safely and maintain the
spam with agencies from China, Hong Kong, Japan (2), Korea, confidentiality of the data or information in their possession
Malaysia, New Zealand (2), the Philippines, Thailand and or passing through their online environment. Compliance
Taiwan (ACA, 2005). The ACA and KISA will work together to with the laws and regulations will make the situation better
coordinate cooperation between the MoU members. and more protected.
70 c o m p u t e r l a w & s e c u r i t y r e v i e w 2 9 ( 2 0 1 3 ) 6 6 e7 6
of the Computer Misuse Act 1993 (CMA). He was given 30 201(1) of the Communications and Multimedia Act 1998. In
months probation but the prosecution appealed against the regulating Internet content, section 211(1) of the CMA 1998
order stating that it was an inadequate sentence. The appeal provides: “No content applications service provider, or other
was allowed. On allowing the appeal by the prosecutor, Yong person using a content applications service, shall provide
Pung How CJ in his judgment stated that the district judge was content which is indecent, obscene, false, menacing, or
wrong in giving the probation order since the inherent nature offensive in character with intent to annoy, abuse, threaten or
of offences under the CMA makes probation orders ineffec- harass any person”. This means, by virtue of section 211(2) of
tive, as keeping the offender at home in such cases does not the Act, any person who contravenes the abovementioned
guarantee that the offender will not repeat his actions. The section shall commit an offence and if convicted, shall be
learned judge also agreed with the prosecution that; liable to a fine not exceeding RM50,000 or to imprisonment for
a term not exceeding one year or both. The Act further
.the statement of facts revealed clearly that the respondent had empowers a Content Code to be drafted to deal with offensive
made a conscious decision to use his hacking skills on local or indecent content.
servers after having gained confidence from his success at Furthermore, s233 of the CMA 1998 explains on the
hacking into foreign sites. He not only gained unauthorised access consequence of improper use of network facilities or network
to the local servers, but also went further and modified the services. If a person is proved to have improperly used
programs in the server Brahms which action enabled him to a computer to communicate offensive words or threatening
access the server in future without having to hack into the system others, that act is considered as an improper use of network
again. Thereafter, he made use of SCV’s computer services for his facilities or network service or applications service. The
own purposes and even had the presence of mind to obliterate all section provides for the punishment for such offence where it
traces of his intrusions so as to avoid detection. It is pertinent that states that ‘any person who is found guilty shall be liable to
the respondent had hacked into the server Brahms only after SCV a fine not exceeding fifty thousand ringgit or imprisonment for
had rejected his application for cable subscription. .As a result, a term not exceeding one year or to both’. It was reported that
when offences such as these are committed, the courts may well in 2010, 582 investigation papers were opened and probed, 422
have to apply the principles of strict liability so that the offender’s of which were under Section 211 and 233 of the CMA 1998
state of mind is irrelevant to a finding of guilt. (Malaysia Today, 2011; Singh, 2012). Further, there are 33 cases
being investigated under CMA 1998 until March 2012
Therefore, a sentence should serve as a deterrent to stop (Iskandar, 2012). This report shows that the CMA can stand
him from repeating such offences. Although there was no alone and there is no need to refer to the Penal Code.
tangible damage to the victim companies, the crime committed From the above discussions, it can be said that the CCA and
had affected their computer systems. Therefore, the probation the CMA are beginning to be accepted and applied with the
order was quashed and the respondent was sentenced to two change of time. They can stand alone even without the Penal
months imprisonment on each of the three charges. Code. Nevertheless, the Penal Code is still relevant and is
The case of PP v Muhammad Nuzaihan was cited in Rupchand regarded as the comprehensive Code in defining the types of
Bhojwani Sunil v Public Prosecutor (SLR, 2004) where the accused crimes. Hence, the Code cannot be totally ignored.
was charged under the Penal Code. In this case, the appellant
(Sunil) had misused the Internet by downloading a company’s 3.3. The CMA 1998 vs the Sedition Act 1948
website into his own website with intent to cheat the respon-
dent (victim). He was charged under s417 of the Penal Code Internet pornography is not governed by any specific law in
(Singapore) and sentenced to 12 months imprisonment by the Malaysia. But distribution of pornographic materials over
District Court. On appeal to the High Court, the learned judge websites has been increased and the impact of this activity is
Yong Pung How CJ was of the view that ‘.[t]he current appeal very bad especially on children and young persons. According
clearly disclosed a large disparity in the nature of the offences to section 292 of the Penal Code:
committed. Muhammad Nuzaihan bin Kamal Luddin involved pure
computer misuse, as opposed to the cheating offence in this Whoever sells, lets to hire, distributes, publicly exhibits or in any
appeal’. Thus, the sentence in the case of Rupchand Bhojwani manner puts into circulation, or for purposes of sale, hire,
Sunil was reduced from 12 months to six months imprisonment. distribution, public exhibition or circulation makes, produced or
According to judge Chao Hick Tin JA in Public Prosecutor v has in his possession any obscene book, pamphlet, paper,
Syamsul Hilal bin Ismail [SGHC, 2011], ‘In that case (Rupchand), drawing, painting representation or figure or any other obscene
Yong CJ reduced the offender’s sentence for cheating object whatsoever. shall be punished with imprisonment for
(punishable under s417 of the Penal Code (Cap 224, 1985 Rev a term which may extend to three years, or with fine, or with
Ed)) from 12 months’ imprisonment to six months’ impris- both.
onment for the reason, inter alia, that the district judge had
over-emphasised the fact of Internet misuse.’ This means that those who commit this act will be charged
under the Penal Code and not under Cyberlaw regulation.
3.2. The CMA 1998 vs The Penal Code However, since the website or Internet is used to distribute the
materials and that act is considered as distribution of obscene
The CMA 1998 has several rules attached to it. For example, materials online, the question is whether the person or
there is Communications and Multimedia (Rates) (Amend- suspect can also be charged under the CMA 1998? This ques-
ment) Rules 2010 which has been made under subsection tion has not been answered to date.
72 c o m p u t e r l a w & s e c u r i t y r e v i e w 2 9 ( 2 0 1 3 ) 6 6 e7 6
There are a few cases dealing with sedition. In one case, leaders while in the second case the Magistrate’s Court of
a preacher from Sarawak had allegedly insulted Islam and the Petaling Jaya decided to grant a discharge not amounting to
Prophet Muhammad (p.b.u.h) in a video on ‘YouTube’. acquittal to the veteran singer (the defendant) as its defama-
Following this incident the IGP stated that the matter would be tion charge did not constitute a complaint (Yatim, 2006).
investigated under the Sedition Act but no detention has Similarly in the case of Raja Petra who was sued for defama-
occurred to date (Bernama, 2010b). In another case, a man was tion relating to three offending articles posted on his blog. He
arrested and detained when he posted on his Facebook page was charged under section 8(1) of the ISA (now repealed) and
messages containing insults against the Sultan of Johor and was detained in police custody for 53 days but was released on
his monarchy (Bernama, 2010c). The man was arrested in the ground of the detention being unlawful. The Federal Court
November 2009 and a report was sent to Attorney General’s has also ruled out that he is not guilty (Mageswari, 2010). The
office for further action. But in these two instances there has obvious reason in the above three cases is that the prosecution
been no clear decision as to what happened thereafter. In failed to establish the offence committed although the charge
February 2012, the Court of Appeal also ruled that the Sedition was made under the Penal Code and other traditional laws.
Act was valid when dismissing Uthayakumar’s application to Thus, it seems that relying on the Penal Code per se is not
declare that the Act was unconstitutional. He was actually sufficient if the case involves misuse of networking facilities
a former Internal Security Act detainee who had been charged or internet. The suspect can just escape liability due to this
in the Kuala Lumpur Sessions Court in December 2007 with mistake. What is obvious is that the CMA 1998 was not even
publishing a seditious letter the month before on the ‘Police applied although there was an element of misuse of
Watch Malaysia’ website It had been addressed to then-prime networking facilities and services.
minister of Britain, Gordon Brown (The Star, 2012a). Never- After these attempts failed, the prosecutor tried to charge
theless, in July 2012, the Prime Minister of Malaysia one blogger under s233(1)(a)of the CMA. He was charged of
announced that the Sedition Act will be repealed and replaced insulting the Johor royal house by posting derogatory remarks
by the National Harmony Act. According to him, the decision on his blog in 2010. However, the prosecution again failed to
to repeal the Act was motivated by a desire to find a mecha- establish prima facie case against the blogger and as a result,
nism that could ensure the best balance between the need to the blogger was acquitted by the Session Court (Singh, 2012).
guarantee freedom of speech for every citizen and the need to Contrastingly, in another case, an engineer who had posted
handle the complexity of plurality existing in the country (The offensive comments on the Internet against the Sultan of
Star, 2012b). But this proposed new law will be tabled in 2013. Perak was successfully charged under s233(1)(a) of the CMA
However, if Islamic law applies, those who insult Islam and he was found guilty of insulting the Sultan in 2009. He has
may be subjected to section 7 of the Syariah Criminal Offences been given the maximum sentence of a RM50,000 fine and one
(Federal Territory) Act 1997 and if proven guilty they shall on year’s jail for committing such offence (Sharma, 2012). In
conviction be liable to a fine not exceeding three thousand short, successful prosecution will result with the effective use
ringgit or to imprisonment for a term not exceeding two years of the CMA in cases of misuse of networking facilities.
or to both. Since blocking of websites seems to be ineffective the
MCMC is trying to stretch the application and enforcement of
3.4. The CMA 1998 vs the Defamation Act 1957 s263 of the CMA 1998 against the Internet Service Providers
(ISPs). Under this section the ISPs or the licensee shall use
There are many cases on Internet defamation. The examples their best endeavour to prevent the network facilities that
include defamation suits against bloggers Jeff Ooi and Ahir- they own or provide or the network service that they offer
udin Attan. Both were prominent bloggers and the latter was ‘from being used in, or in relation to, the commission of any
the President of the National Press Club. They were sued offence under any law of Malaysia’. ISPs are expected to
simultaneously for both blog posts and readers’ comments ‘assist the Commission or other authority as far as reasonably
(South China Morning Post, 2007). The allegedly libellous necessary in preventing the commission or attempted
content included Jeff Ooi’s blog coverage of New Straits commission of an offence under any written law of Malaysia
Times (NST) and its editors’ roles in misrepresenting or otherwise in enforcing the laws of Malaysia including, but
facts, publishing a caricature of the Prophet Muhammad and not limited to, the protection of the public revenue and pres-
plagiarism in blog posts in 2006 (Jeff Ooi’s blog). Ooi ervation of national interests’.
had previously been investigated by the Communications
and Multimedia Commission and the police concerning 3.5. The Copyright Act 1987 (also known as Copyright
comments a reader posted on his blog that were deemed (Amendment) Act 1997)
offensive to the official version of Islam in Malaysia
(Zuckerman, 2005). This Act was the first Act relating to technology and copyright
Other than the above cases, there are several unreported works. The Act was later amended and came into force in
cases on internet defamation including circulation of offen- October 2011. The latest amended Act is known as the Copy-
sive remarks on Islam Hadhari on a local weblog (Singh, 2004), right (Amendment) Act 2000. Since 1987, there are many
spreading rumours over the Internet by one veteran singer copyright cases decided based on the Act. An example is that
against another pop singer and the case of Raja Petra Raja of Syed Ahmad Jamal v Dato Bandar Kuala Lumpur (CLJ, 2011)
Kamarudin, a blogger and an editor of Malaysia Today where the plaintiff claimed that the defendant had infringed
(Mageswari and Samy, 2008). In the case of Islam Hadhari, the his moral right under s25(2) of the Copyright Act 1987. The
blogger was acquitted and became one of the opposition court held that section 25(2) of the Act prevents any person
c o m p u t e r l a w & s e c u r i t y r e v i e w 2 9 ( 2 0 1 3 ) 6 6 e7 6 73
from presenting a work without identifying the author or sections 90A, 90B and 90C of the Evidence Act 1950, infringe-
under a name other than that of the author. Removal of the ment of copyright cases and a few cases on hacking. The
unique plinth by the defendant had resulted in failure to reason for this lack of domestic legal development is not
identify the plaintiff as the author of the works. Hence, the totally clear but, based on a study, it shows that the applica-
moral right of the plaintiff to be identified as the author of the tion of the CCA 1997 in cybercrime cases has not received
works had been infringed by the defendant. The court ordered a good response from the corporate or business sectors
the defendant to pay RM 750,000.00 as damages to the plain- because both sectors are of the opinion that the law cannot
tiff’s moral right. assist them to maintain economic reputation. This is indi-
There is also a new regulation of the Copyright Tribunal cated by their reluctance or failure to lodge any police reports
which will be enforced in April 2012. These new regulations of on hacking committed by their employees. In other words,
the Copyright Tribunal will involve expanding the jurisdiction of corporate bodies, especially those on Public Listed Boards,
the tribunal on matters relating to payment of royalties to simply will not expose alleged perpetrators and allow them to
artistes (Bernama, 2012a). The Tribunal which was abolished in be sued in a court of law. For them, the company’s reputation
2003 was revived in June 2012 (The Star Online, 2012). is the priority (Hamin, 2004). From an early stage there have
also been questions about the clarity of CCA 1997 and its
3.6. The application of other cyberlaws and traditional failure to accommodate the needs of corporate victims of
laws computer crime (Betty, 1997).
The other reason is that the CCA 1997 focuses on hacking
The above discussion shows that the CCA, the CMA and the offences and not computer fraud or other cyber-related cases.
Copyright Act 1987 or Copyright (Amendment) Act 1997 have The computer fraud cases are decided under the Penal Code.
been referred to in deciding cybercrimes cases. Apart from This is where traditional law is still relevant to cybercrime. It
that in cases of cyber pornography traditional laws such as is suggested that the Malaysian Government might review the
Film Censorship Act 2002, Child Act 2001 and the Penal existing CCA 1997 so as to accommodate more cybercrime
Code will apply (Iskandar, 2012). From the above statutes, the categories. The Penal Code, despite being said to be
Copyright (Amendment) Act and the Penal Code are a comprehensive code, may need to be reviewed so as to
commonly referred to when compared to others. The Copy- accommodate the crimes of the online world. As for CMA,
right Act is the most popular Act within cyberlaw since there cases decided based on this Act should be published and
are many copyright cases decided under the Act. d (Azmi, referred to.
2004). However, this does not happen to other cyberlaw
legislation such as the Telemedicine Act, DSA, ECA, EGA and 4.1. Other relevant issues
PDPA. Although e-commerce practices are very much devel-
oped in Malaysia and issues on Internet privacy as well as data Apart from establishing sound laws and regulations other
protection have been discussed in many writings and forums, factors such as risk assessment should also be taken into
yet the application and the effectiveness of these laws have consideration. This method is important in tackling issues on
not been tested. Only recently, since June 2012, following the cybercrimes. In fact, the Malaysian Communications and
Government announcement has the PDPA entered into force Multimedia Commission (MCMC) has suggested that financial
and it is expected that the new law will boost e-commerce institutions should conduct a comprehensive risk assessment
industry in Malaysia (Bernama, 2012e). in all relevant areas of business and design suitable safe-
It is also hoped that the PDPA will be able to resolve issues guards to control the risk and monitor their effectiveness. The
pertaining to breach of privacy. Otherwise, the claim for risk assessment should be conducted on a regular basis and
breach of privacy is hard to win as was illustrated by one telco necessary adjustments made to reduce the risk (Sani, 2004).
subscriber who alleged that a telco company (the Celcom
Axiata) had released contents of her short message system
(SMS) and audio recordings of phone calls to others. The court 5. Conclusion
in this case decided that the plaintiff failed to establish her
allegation of breach of privacy due to lack of evidence and the The efforts taken by the Malaysian government and other
case was dismissed. She was even ordered to pay RM50,000 in organisations are reforming but there are still some issues
costs (Malaysian Insider, 2012). To make matters worse, the that remain unresolved, especially regarding the application
Ministry of Information, Communications and Culture has of cyberlaw. There is no doubt that existing cyberlaw has been
also affirmed that there will be no Freedom of Information Act promulgated with the intent to regulate cyber activities and to
in Malaysia (Bernama, 2012c). control cybercrime, but it seems that in some cyber-related
cases the traditional law still prevails and retains greater
recognition than cyberlaw in the application. Further, there is
4. Suggestions inactive cyberlaw not applied even after several years on the
statute book. Questions also arise as to whether, given the
Malaysia may need to refer to cybercrimes cases decided in delay in implementation, existing cyberlaw is in any case
countries like Singapore and England in order to improve the fit for purpose in accommodating new developments in
application of existing cyberlaw. The reason is due to the fact technologies and new forms of modus operandi driven by the
that most cases decided in Malaysia were mainly related to former. Not only that, there is the issue on risk assessment
software contracts, admissibility of computer evidence under which still needs to be emphasised as a means of
74 c o m p u t e r l a w & s e c u r i t y r e v i e w 2 9 ( 2 0 1 3 ) 6 6 e7 6
implementing computer security. From the above discussion, Bologna G Jack, Shaw Paul. Avoiding cyberfraud in small
it is submitted that for cyberlaw to be applied effectively the businesses: what auditors and owners need to know. Canada:
law needs to be tested and updated where necessary. The John Wiley & Sons, Inc; 2000. at 61.
Borneo Post Online. Many white-collar cyber-crimes go
enforcement authorities must be able to apply cyberlaw
unreported. Borneo Post Online. at, http://www.
effectively while demonstrating sound knowledge and theborneopost.com/?p¼95412; 22 February 2011.
understanding on the law of evidence as well as criminal Carter David L. Computer crime categories. Law Enforcement
procedural law. In short, effective implementation of cyber- Bulletin 1995;64(7):21e6. U.S Department of Justice: Federal
law depends very much on the fitness of the law itself and the Bureau of Investigation (FBI), http://www.fbi.gov/publications
readiness of the enforcement authorities to apply it. [accessed 07.03.12].
Cheng Nicholas. USM develops a better tool to fight hackers. New
Straits Times 5 March 2012.
Asst. Prof. Dr. Duryana binti Mohamed ([email protected].
Clifford Ralph D. Cyber-crime: the investigation, prosecution and
my) Department of Legal Practice, Ahmad Ibrahim Kuliyyah of definition of a computer-related crime. Carolina Academic
Laws, International Islamic University Malaysia.(IIUM). Press; 2001.
CLJ. Current Law Journal 2011;2:569.
CMA. See subsection (2) of s3 of the CMA 1993 provides, ‘If any
references damage is caused as a result of an offence under this section,
a person convicted of the offence shall be liable to a fine not
exceeding $50,000 or to imprisonment for a term not
ACA. Australian regulator leads Asia-Pacific push against spam. exceeding 7 years or to both.’ There are similarities in the
Australian Communications Authority (ACA). Media release wordings of s3(2) of the CCA 1997 and s3(3) of the CMA 1993,
no. 18e27 April 2005, via ACA, http://internet.aca.gov.au/ http://statutes.agc.gov.sg/aol/search/display/view; 1993a
ACAINTER.65650:STANDARD:662912101:pc¼PC_2975; 2005 [accessed 17.03.12].
[accessed 03.03.12]. CMA. See subsection (1)(a)(b)(2) of s4 of the CCA 1997 is similar to
Allan George, Salter Suzanne. Computer use and misuse. Journal subsection (1)(2)(4)(b) of s4 of the CMA 1993. See also
of the Computer Audit Specialist Group (CASG Journal) 1997;7. Navaseelan Balasingam v Public Prosecutor [2007] 1 SLR 767,
via University of Portsmouth, http://www.tech.port.ac.uk/ a case on illegal withdrawal from ATM machines; 1993b.
staffweb/allang/papers/pub96c.htm#5 [accessed 02.02.12]. CMA. Subsections (1)(a)(b) of s3 of the CCA 1997 is similar to
Ahzan Azrina. Dikikis rakan siber. at, http://www.bharian.com. subsection (1)(a)(b) of s1 of the CMA 1990. The CMA 1993 also
my; 20 July 2010. considered such access as an offence under subsection (1) of
AsiaOne. Big increase in cyber-crimes. AsiaOne 28 April 2011. s3, but the provision under this section 3 of the CMA 1993 is
Ashford Warwick. Cyber crime costs UK organizations £2.1m more precise which includes punishment as well; 1993c.
a year, http://www.computerweekly.com/news/2240164639/ Durbin Lindsay. Effective spam management as a vital
Cyber-crime-costs-UK-organisations-21m-a-year; 2012. component of your content security policy. In: Cybersecurity
Azmi Ida Madieha. Copyright cases and commentaries. Malaysia: conference, 3rd August 2004, Kuala Lumpur; 2004.
Sweet &Maxwell Asia; 2004. Eu Jin Foo. Cybercrime activities on the rise. New Straits Times
BBC News. High-tech crime costs UK Plc £2.4 billion. BBC News. (Computimes) 22 November 2004.
via BBC, http://news.bbc.co.uk/2/hi/business/4412685.stm; 5 Grabosky Peter. The global cyber-crime problem: the social-
April 2005. economic impact. In: Grabosky Peter, editor. Cyber-crime: the
Bernama. Copyright Act to come into force in April, says Ismail challenge in Asia. Hong Kong University Press; 2005. p. 31e41.
Sabri. Bernama 2012a. 14 March 2012. Hamin Zaiton. The sins of the Ss: spamming, spoofing, smurfing
Bernama. Cybercriminals scam victims of RM16m in Q1. and scamming in cyberspace. In: National conference on
Bernama. 18 July 2012, http://www.themalaysianinsider.com/ intellectual property and related rights, 16e17 September
malaysia/article/cyber-criminals-scammed-victims-of- 2003, Crystal Crown Hotel, Petaling Jaya; 2003.
rm16m-in-q1; 2012b. Hamin Zaiton. The role and application of the Computer Crimes
Bernama. Financial and cyber-crime most prevalent economic Act 1997. In: LawAsia IT Law conference, ‘evolving legal issues
crime in Malaysia. Bernama. 13 April 2010 at, http://www/ in IT’, 26e27 August 2004, Sutera Harbour Bay Resort, Kota
mysinchew.com/node/37655; 2010a. Kinabalu Sabah; 2004.
Bernama. Government has no plans to introduce Freedom of Hamin Zaiton. Insider computer misuse: problems and
Information Act, says minister, Bernama. New Straits Times perspectives. In: First Asia pacific conference on cyberlaw, 8e9
2012c. 13 March 2012. November 1999, University Multimedia (UMTM), Putrajaya; 1999.
Bernama. Insult on Islam: government will not keep quiet, Dr IMPACT at http://www.impact-alliance.org/home/index.html;
Mashitah. Bernama. 27 September 2010, http://www.bernama. 2012.
com.my/bernama/v5/newsindex.php?id¼530695; 2010b. Iskandar Eneng Faridah. Cybersecurity NRE executive discourse.
Bernama. OIC-CERT cyber drill coordination successful in Ministry of National Resources & Environment. at, http://
addressing targeted cyber crisis. Bernama. 24 February 2012 at, www.nre.gov.my/Malay/PusatInformasi/
http://www.cybersecurity.my/en/knowledge_bank/news/ ProgramKampusNRE/CYBER%20%20SECURITY.pdf; 2012, 4
2012/main/detail/2160/index.html; 2012d. May.
Bernama. Held: man with Facebook insulting Sultan. Bernama. 22 Jeff Ooi’s blog. Screenshots at http://jeffooi.com/ [accessed
December 2010 at, http://www.bernama.com.my/bernama/ 08.04.12].
v5/newsindex.php?id¼551839; 2010c. Karim Farah Naz. Battling streets crime a priority for government.
Bernama. Personal Data Protection Act to be enforced in June. New Straits Times 28 July 2009. at 1.
Bernama 2012e. 9 February 2012. Khong Dennis WK. The problem of spam law: a comment on the
Betty Donna L. Comment: Malaysia’s Computer Crimes Act 1997 Malaysian Communications and Multimedia Commission’s
gets tough on cybercrime but fails to advance the discussion paper on regulating unsolicited commercial
development of cyberlaws. Pacific Rim Law & Policy Journal messages. Computer Law and Security Report MayeJune 2004;
Dec 9, 1997:351. 7 Pacific Rim Law & Policy Association. 20(3). via ScienceDirect, http://www.science?_ob¼Article
c o m p u t e r l a w & s e c u r i t y r e v i e w 2 9 ( 2 0 1 3 ) 6 6 e7 6 75
Timbuong Jo. Government agencies taught to handle Micro Malaysia Sdn. Bhd, the Sasser family virus was
cyberattacks, intech. The Star 17 August 2010. at IT13. estimated by Computer Economics to be causing damage of
Utusan Malaysia. Jenayah perdagangan libatkan kerugian RM579 a whopping US$3.5 billion in 2004, http://www.niser.org.my;
juta tahun lalu. Utusan Malaysia; 3 July 2004. 5. 2003.
Wall David S. Crime and the internet. Routledge; 2002 Zolkepli Farik. Major role for Bank Negara in anti-terrorism
[chapter 1]. academy. The Star 30 September 2010:N16.
Yatim A Hafiz. Sharifah Aini granted discharge. New Straits Zuckerman Ethan. Global voices blogger Jeff Ooi questioned in
Times Online 24 January 2006. Malaysia regarding weblog. Global Voices, http://www.
Yunos Zahri, Nasir Ahmad. Cyber threats: myths or reality? globalvoicesonline.org/2005/02/28/global-voices-blogger-jeff-;
According to W.J Hoong, the National Sales Manager of Trend 28 February 2005.