Malaysia

Partly Free
60
100
A Obstacles to Access 19 25
B Limits on Content 21 35
C Violations of User Rights 20 40
Last Year's Score & Status
61 100 Partly Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the methodology and report acknowledgements.
Malaysia_hero_map

header1 Key Developments, June 1, 2023 - May 31, 2024

Internet freedom declined in Malaysia during the coverage period, as the Malaysian Communications and Multimedia Commission (MCMC) ordered internet service providers (ISPs) to block the websites of several media outlets perceived to be critical of the government, as well as Grindr, an LGBT+ dating app. Additionally, criminal prosecutions and investigations for social media posts—especially those with content that criticizes religion, the royal institution, and the government or pertaining to race and sexuality—and other forms of online expression continue to threaten individuals. Users, particularly LGBT+ people, and more recently, journalists, continue to face both online and offline harassment for their online posts.

  • During the coverage period, the MCMC blocked news outlets and blogs perceived to be critical of the government, including MalaysiaNow, UtusanTV, TV Pertiwi, and Asia Sentinel (see B1).
  • In February 2024, the government released an updated version of the 1989 Code of Ethics for Journalists, sharing that it would be used to help the Ministry of Communications determine whether the government would issue and revoke media passes to journalists, in turn effectively granting—or barring—them access to the parliament and government events based on the code (see B6).
  • In September 2023, Mohamad Azlan Ibrahim, a 47-year-old man, was sentenced to six months in prison and fined 10,000 ringgits ($2,140) for an August 2023 Facebook post he made that insulted the Sultan of Selangor and for refusing to turn over the password to his Facebook account when requested to do so by the police (see C3).
  • In April 2024, the parliament passed the Cyber Security Act, under which authorities can collect any information relevant to matters of cybersecurity, including by searching and seizing any relevant properties without a warrant. The act also assigns penalties for noncompliance, including fines of up to 200,000 ringgits ($41,900) and prison sentences of up to three years (see C5).
  • In July 2023, Thuzar Maung, a refugee from Myanmar and prominent critic of the Myanmar junta with a large social media following, was forcibly disappeared in Malaysia along with her husband and three children. As of July 2024, their whereabouts remain unknown (see C7).

header2 Political Overview

The Barisan Nasional (BN) political coalition ruled Malaysia from independence in 1957 until 2018, maintaining power by manipulating electoral districts, appealing to ethnic nationalism, and suppressing criticism through restrictive speech laws and politicized prosecutions of opposition leaders. The BN lost to an opposition alliance in the 2018 general election, and political affairs have since been characterized by a more complex pattern of competition and cooperation among multiple coalitions, creating opportunities for reform and modest improvements to civil liberties.

A Obstacles to Access

A1 1.00-6.00 pts0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 6.006 6.006

Internet penetration rates and average connection speeds continued to increase during the coverage period, driven by developments in mobile infrastructure.

According to Malaysia’s Department of Statistics (DOSM), in 2023, 97.7 percent of individuals in Malaysia were internet users, while household internet access stood at 96.4 percent.1 DataReportal’s Digital 2024 report indicates an internet penetration rate of 97.4 percent.2

According to Ookla’s Speedtest Global Index, as of May 2024, Malaysia’s median mobile download speed was 89.86 megabits per second (Mbps), while the median mobile upload speed was 20.9 Mbps. The median fixed-line broadband download and upload speeds were 134.44 and 56.5 Mbps, respectively.3

The government initiated the five-year National Fiberisation and Connectivity Plan (NFCP) in 2019 and the five-year Jalinan Digital Negara (JENDELA) national digital infrastructure development plan in August 2020 to improve fixed-line broadband services, which has meaningfully expanded internet connectivity.4 As of the end of 2023, 2,338 of the 3,884 telecommunications towers set to upgrade broadband networks under JENDELA have been completed and are fully operational.5

As of October 2022, 96.9 percent of populated areas had access to fourth-generation (4G) networks.6 The government is also using satellite technologies, which provide broadband coverage to areas unreachable by 4G and fiber-optic technologies, to expand internet access to rural and remote areas (see A2).7

The rollout of internet infrastructure has been hindered by local authorities and bureaucracy.8 In March 2021, the government established the country’s sole state-operated fifth-generation (5G) technology infrastructure, which it licensed to telecommunications providers (see A4). In December 2023, the network reached 80 percent population coverage, and in January 2024, the government began accepting proposals from providers to develop the country’s second 5G network (see A4).

In December 2023, flooding across several states, particularly in the east, damaged 158 transmission stations, disrupting telecommunications services in Terengganu, Kelantan, Johor, Pahang, Selangor, and Sabah states.

All but seven stations were reportedly repaired by January 2024.9 During the previous coverage period, in February 2023, flooding in Johor State damaged 160 telecommunications towers, of which more than half were repaired by the next month.10 In January 2023, the Ministry of Communications and Digital (KKD) reported that it had upgraded 350 towers affected by floods since 2014 to improve resilience against future flooding, 127 of which were in Kelantan State.11

A2 1.00-3.00 pts0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 3.003 3.003

The cost of internet access remained affordable during the coverage period, though internet access is limited in rural areas. The government continues to invest in expanding infrastructure in rural areas, including the development of telecommunications towers.

According to Cable, the average monthly cost of a fixed-line broadband subscription was 149.50 ringgits ($32.34) in 2023, while the average cost of 1 gigabyte (GB) of mobile data was 1.33 ringgits ($0.28).1

Several initiatives have been introduced by the current administration to reduce the digital divide.2 The Unity Package mobile internet plan, introduced in February 2023, is offered to youth, people with low incomes, senior citizens, and persons with disabilities, and includes six months of 30 GB of data at speeds of 3 Mbps for 30 ringgits ($6.71).3 In March 2023, a Unity Package home internet package was rolled out for residents of public housing and the People’s Housing Project, and provides a two-year contract for unlimited data at speeds of 100 Mbps for 69 ringgits ($14.93).4

The 2017 Mandatory Standard on Access Pricing (MSAP), which caps the wholesale prices service providers can charge, was originally set to expire in December 2020 but was extended to December 2022.5 A new MSAP—which came into force in March 2023 and will expire at the end of 2025—further reduces the price of wholesale high-speed (100 Mbps) broadband services offered to telecommunications providers from 515 ringgits ($115.15) in 2020 to 254.26 ringgits ($56.85) in 2023.6

Internet use is more prevalent in cities. According to a survey by Malaysia’s Department of Statistics (DOSM), in 2023, 98.4 percent of households in urban areas had access to the internet, compared to 89.4 percent in rural areas.7 This gap was wider for fixed-line broadband services: 54 percent of urban households had access compared to only 24.2 percent of rural households in 2023.

In December 2021, the MCMC announced planned improvements to digital infrastructure in rural areas, including the implementation of satellite-based broadband service. Phase one of the 5-year JENDELA project (see A1)—which included broadband expansion reaching 839 rural and interior locations—was completed in December 2022.8 Phase 2 of JENDELA—which will likely involve the use of satellite internet technologies to address continued internet connectivity gaps—had yet to be launched as of the end of the coverage period.9

Gender disparities in internet access are declining. According to DOSM, in 2023, 98.2 percent of men used the internet, compared to 97.2 percent of women.10

A3 1.00-6.00 pts0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 5.005 6.006

There were no reported cases of government-imposed access restrictions during this coverage period. The last major reported incident occurred in 2012.1 However, a partly state-owned company continues to dominate network infrastructure.

Telekom Malaysia, the country’s largest telecommunications company, retains a fixed-line broadband monopoly and owns the country’s last-mile connections (see A4).2 As of May 2024, the government retained 20.1 percent of indirect shares in Telekom Malaysia, which was formerly state-owned, while government-linked company Khazanah held 20.1 percent of direct shares.3

The nonprofit Malaysia Internet Exchange allows service providers to exchange local traffic more efficiently.4 Malaysia has several connections to the international internet, making the network more resilient.5

A4 1.00-6.00 pts0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 4.004 6.006

According to MCMC data, 351 network-facilities providers owned or operated internet infrastructure in 2021, an increase from 220 providers in 2019.1

Telekom Malaysia is the dominant fixed-line broadband provider, having a 90 percent share as of July 2021.2 Fiber-optic home broadband service is provided by Astro IPTV. Other providers of fixed-line broadband and mobile internet service include CelcomDigi, TIME Internet, Tune Talk, and Yes, a wireless 4G provider.3

In 2021, Maxis held the largest share of the telecommunications market as the largest mobile provider, followed by Digi and Celcom. Telekom Malaysia remained the dominant fixed-line broadband provider, trailed by TIME.4

In June 2022, the MCMC approved the proposed merger of Digi and Celcom, Malaysia’s second- and third-largest mobile service operators, after the companies signed a merger agreement in June 2021.5 In response to concerns about reduction of competition, Digi and Celcom submitted proposed remedies to the MCMC in June 2022.6 In their respective annual reports in 2021, Digi recorded 10.3 million customers7 and Celcom recorded 9.6 million customers.8 The merger was completed in November 2022, creating CelcomDigi, Malaysia’s largest service provider by number of subscribers.9 Parent companies Axiata and Telenor retain equal stakes of 33.1 percent in the new company.10 While existing customers of Digi and Celcom remain separated on the respective existing networks, new customers can only subscribe to CelcomDigi packages, and retail stores have merged in terms of services.11

The government established the Digital Nasional Berhad (DNB) in March 2021 to be the sole 5G provider in Malaysia. Later, amid concerns about the lack of transparency and competition in the 5G market—as the sole 5G provider in the country, the DNB licensed 5G access to service providers—the government agreed to reduce its stake in the DNB to 30 percent once DNB achieved a population coverage of 80 percent.12 Additionally, the government announced that once DNB reached 80 percent population coverage, the MCMC would accept proposals from telecommunciations companies for the establishment of a second 5G network to foster competition and prevent the country’s reliability on a single network.

In January 2024, once the target coverage was reached, the Ministry of Finance’s remaining 70 percent equity in DNB was offered to be split among five major telecommunications companies—CelcomDigi, Maxis, Telekom Malaysia, U-Mobile, and YTL Communications—reportedly to prevent corporate interest from taking over the mandate of DNB and ensure the accessibility of high-speed internet across Malaysia.13 However, in August 2024, after Telekom Malaysia failed to meet the deadline for the acquisition agreement, the remaining four companies each acquired a 16.3 stake in DNB, while the Ministry of Finance holds the largest share, at 34.9 percent.14 In August 2024, CelcomDigi shared that it had submitted a proposal to develop the country’s second 5G network under the dual-network model.15

A5 1.00-4.00 pts0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 1.001 4.004

The Malaysian Communications and Multimedia Commission (MCMC), a regulator that oversees service providers, apparently lacks transparency in its decision-making processes and exercise of powers, despite its multistakeholder advisory board.

The MCMC has taken steps to curtail online speech and has not always addressed internet-related issues in a fair manner. During the coverage period, the MCMC ordered the blocking of four news sites perceived to be critical of the government, as well as blogs belonging to writer Murray Hunter and longtime politician Wee Choo Keong (see B1).

The Ministry of Communications and Digital (KKD), which, under the Communications and Multimedia Act (CMA) 1998, had the authority to license the ownership and operation of network facilities, oversaw the MCMC until recently. However, since a December 2023 cabinet reshuffle split the KKD into two ministries—the Ministry of Communications and the Ministry of Digital—the MCMC has been overseen by the Ministry of Communications.1

The Malaysian Communications and Multimedia Commission Act (MCMC Act) 1998 states the MCMC should consist of a chairperson, appointed by the KKD (now Ministry of Communications), three members representing the government, and between two and five members from other sectors. All members are appointed by the Minister of Communications (formerly KKD minister).2 It is unclear how candidates are selected. As of the end of the coverage period, there are five commission members, two of whom have backgrounds in law and academia.3

During the previous coverage period, in March 2023, Tan Sri Mohamad Salim bin Fateh Din was appointed MCMC chairman. He was previously chairman from 2010 to 2014,4 and again between June 2022 and December 2022. He had briefly resigned after the change of government in December 2022—during which Datuk Muhammad Azmi was appointed interim chairman—but was reappointed chair three months later by the KKD and has served in the position since.5

The government’s rollout of 5G infrastructure has been criticized for limiting competition and lacking transparency (see A4).6 In July 2021, the DNB awarded a 10-year contract amounting to 11 billion ringgits ($2.6 billion) to Ericsson to deploy 5G network infrastructure, despite transparency and procurement concerns.7 In December 2022, Prime Minister Anwar Ibrahim ordered a review of the 5G rollout tender process amid calls from activists urging the Malaysian Anti-Corruption Commission (MACC) to investigate the DNB.8

B Limits on Content

B1 1.00-6.00 pts0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content, particularly material that is protected by international human rights standards? 3.003 6.006

Score Change: The score declined from 4 to 3 due to the blocking of news websites perceived to be critical of the government.

The government does not systematically block or filter online content. However, in recent years, the MCMC has increasingly coordinated with social media platforms to take down content criticizing religion, the royal institution, and the government, or pertaining to race and sexuality.1 Additionally, news media sites perceived to be critical of the government were blocked during the coverage period.

The MCMC has not released an official list of blocked sites, though internet service providers are required to comply with any blocking directives issued to them by the MCMC. As such, users are often alerted to blocks only when they try to access the blocked sites themselves.

In June 2023, ahead of the August state elections, daily news site MalaysiaNow was blocked for three days, the first accredited media outlet to be blocked by the government since 2016.2 In August 2023, UtusanTV’s website was blocked at the orders of the MCMC for “violat[ing] the National Law” five days before the state elections, and unblocked two months later in October.3 Also in August, the MCMC issued a blocking order against the TikTok page and website of TV Pertiwi after it carried an interview with a controversial political analyst; both remained blocked through the end of the coverage period.4 In April 2024, Sinar Project reported that several ISPs had implemented MCMC–ordered blocks against Asia Sentinel’s website since late December 2023.5 According to the Open Observatory for Network Interference (OONI), the blocks continued through the end of the coverage period.6

In September 2023, the MCMC threatened to take action against MalaysiaNow’s website if it didn’t remove or amend articles it had published about an argument between members of the parliament during a session of the body’s lower house, the Dewan Rakyat (see B2).7 MalaysiaNow stood by its reporting, and various journalists and press freedom organizations spoke out against the government ministry’s attempts to suppress critical speech.8 As of the end of the coverage period, the MCMC has yet to take additional action against the outlet.

Internet users who voiced political criticisms on personal blogs also faced blocking during the coverage period. In October 2023, the MCMC reportedly ordered ISPs to block prominent writer Murray Hunter’s Substack blog;9 the site remained blocked through the end of the coverage period.10 In July 2023, Sinar Project reported that a few ISPs had implemented MCMC–ordered blocks against a blog run by former parliamentarian Wee Choo Keong.11 According to OONI, the blocks remained in place through end of the coverage period.12

The MCMC continued to target LGBT+ related content during the coverage period. In April 2024, Sinar Project reported that seven ISPs had implemented MCMC–ordered blocks against Grindr, an LGBT+ dating app.13 According to OONI, the blocks remained in place through end of the coverage period.14

Additionally, websites hosting LGBT+ content that were previously blocked—including the official website of the International Lesbian, Gay, Bisexual, Trans and Intersex Association (ILGA), Planet Romeo, Gay Star News, and Utopia Asia—remained blocked through the end of the coverage period.

In February 2023, the MCMC issued a directive to service providers requiring them to block the ability to send or receive URLs through text messages, as part of an effort to curb online scams, beginning May 2, 2023.15 Four telecommunications companies were reported to have applied this directive, including Maxis, which said that it will be carried out in phases, first between individuals, then business users.16

There are no specific restrictions on the use of virtual private networks (VPNs).

B2 1.00-4.00 pts0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content, particularly material that is protected by international human rights standards? 2.002 4.004

The MCMC increasingly instructs websites and social media platforms to remove content, particularly content that touches on race, religion, and royalty, which are locally known as the 3Rs (see B1).1 The MCMC may choose to exercise this power at its own discretion,2 and officials have indicated that they might seek additional authority to force content removals.3

Between July and December 2023, Facebook restricted access to 4,700 pieces of content reported by the MCMC, including content insulting religion in violation of Section 298A of the penal code and content containing government criticism in violation of CMA Sections 233(1)(a) and 211 (see C2).4 The period saw highest number of removals in Malaysia in Meta’s recorded history.

During that same period, Google received 73 content removal requests from the government, the largest number of government requests it had received from Malaysia during a six-month period in its recorded history.5 Between July and December 2023, across Asia, TikTok received the highest number of government requests from Malaysia, totaling 1,862 requests relating to 6,231 pieces of content. Of the content “actioned on,” 2,514 were removed or restricted due to local law violations.6

In September 2023, the MCMC requested MalaysiaNow to remove or amend articles it had published about an argument between members of the parliament during a Dewan Rakyat session, threatening to take action against its website (see B1). Though the outlet did not take down the articles, its website remained available through the end of the coverage period.

In March 2023, the independent film Mentega Terbang (Butterfly) was removed from the online streaming service Viu for its portrayal of Islam after the company was contacted by the MCMC. The MCMC stated that it did not have jurisdiction to censor the film, as movies and television dramas fall outside the MCMC’s scope.7 The film’s production team was also investigated for religious provocation (see C3) and received harassment and death threats on social media (see C7).8

In September 2023, the Ministry of Home Affairs (KDN) banned “the exhibition, display, distribution, possession, circulation or sale of the film,” for being “contrary to public interest throughout Malaysia.”9

Intermediaries risk liability for some content posted by users, though it is not clear whether this leads them to remove more content than necessary. In 2012, the parliament passed an amendment to the Evidence Act 1950 that holds intermediaries liable for seditious content posted anonymously on their networks or websites.10 This includes hosts of online forums, news outlets, and blogging services, as well as businesses providing Wi-Fi services.11 The amendment holds individuals liable if they “facilitate” the publication of the offending content, and holds the owner of the computer the content was published from liable, whether or not they are the author.12

B3 1.00-4.00 pts0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 2.002 4.004

Content blocking and removal requests are generally nontransparent and lack judicial oversight or effective avenues for appeal.

Blocks are implemented on the authority of the MCMC, which reports to the Ministry of Communications (see A5). No list of affected sites is provided by the MCMC (see B1). A person whose content is blocked can request that the MCMC provide a reason for the decision, and the MCMC is required to comply within 30 days of receipt.1

Under Section 263(2) of the CMA, the authorities are given the power to request that internet service providers disable access to sites that contain illegal content on revenue or national security grounds, under what is commonly known as an “access blocking order” (see B1).2 The CMA does not prescribe a process on how to challenge or appeal an access blocking order.

Sections 120 and 121 of the CMA provide a channel to appeal against a direction or decision, but not a determination, of the MCMC, via the Appeal Tribunal and judicial review. The Court of Appeal clarified that judicial review under Section 121 of the CMA is not intended to be applied generally; instead, it is only intended to apply to decisions and actions of the MCMC under “Part V–Powers and Procedures of the MCMC.”3

In April 2024, the MCMC and the Malaysian police force issued a joint statement calling on Meta and TikTok to prepare a comprehensive strategy to better moderate sensitive content online, and to separately ramp up their efforts in moderating content relating to the 3Rs. The statement did not specify how the request would be enforced.4

In July 2024, after the end of the coverage period, the MCMC announced that effective August 1, social media and communications platforms would be required to apply for licenses from the ministry if they have more than 8 million users in the country. Platforms that fail to meet the licensing requirement by January 1, 2025 will face legal action from the ministry.5

Revisions to the Malaysian Communications and Multimedia Content Code—a voluntary industry code that participants may nevertheless be fined for breaking—which took effect at the end of May 2022, extended it to cover online service providers. The revised code also loosened restrictions on nonsexual nudity and imposed prohibitions on advertising targeted at children.6 It remains to be seen whether the revisions will drive service providers to remove content more frequently.

In October 2020, the MCMC warned that legal action could be taken against owners of accounts which mimic government agencies, prominent news outlets, and public figures.7

B4 1.00-4.00 pts0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 2.002 4.004

Self-censorship is common among online journalists and ordinary users, particularly in regard to sensitive issues such as Islam’s official status, race, the monarchy, and the preferential treatment enjoyed by the bumiputera—the term for ethnic Malays and other Indigenous people—over Chinese and Indian minorities.1 The MCMC has explicitly warned individuals against posting comments online relating to the 3Rs. Individuals discussing these issues may face questioning or prosecution.2

Observers have reported on a sustained media crackdown under Prime Minister Anwar Ibrahim (see B1 and B2).3 Additionally, journalists reporting against the ruling government and government officials often face harassment and intimidation in the form of police questionings and threats of defamation suits (see C3).4

During the coverage period, media outlets perceived to be critical of the government were blocked by the MCMC (see B1) and risked having their press passes and media licenses revoked (see B6).

B5 1.00-4.00 pts0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 2.002 4.004

Online content manipulation persists, especially around tense political moments such as elections.

Both government and opposition figures have been known to pay online commentators, known as “cybertroopers,” to generate favorable content and denigrate their opponents. Ahead of the August 2023 elections, researchers identified coordinated networks of social media accounts allegedly linked to both the Pakatan Harapan–Barisan Nasional (PH–BN) ruling coalition and the opposition PN coalition; the networks, which featured suspected fake accounts, were active across Facebook and X.1 During the previous coverage period, in May 2023, an aide to the prime minister openly called for progovernment cybertroopers to keep people informed on the government’s policies, and instructed press secretaries to work with cybertroopers affiliated with the United Malays National Organisation (UMNO) in preparation for the state elections.2

Ahead of the November 2022 general election, Meta’s Quarterly Adversarial Threat Report, published in August 2022, revealed a network of inauthentic accounts and pages posing as independent media and attempting to manipulate public discourse in support of the police and then ruling PN government coalition.3 Meta’s research identified links to the the Royal Malaysia Police (PDRM), which denied involvement.4

After the November 2022 elections, suspected paid commentators drove a rise in anti–Chinese Malaysian and anti–DAP sentiments online (see B7), including several viral videos that used threatening language and discussed the May 13, 1969, riots and were labeled as paid partnerships on TikTok, leading to allegations that the PN engaged professional agencies to coordinate their spread.5

The government has taken several steps to combat what it characterizes as “false news.” In 2017, it launched Sebenarnya.my, a fact-checking portal that encouraged social media users to verify the content of all news reports shared on popular platforms with the slogan, “not sure, don’t share.”6 Officials have claimed Sebenarnya.my is nonpartisan,7 and the portal reportedly does not fact-check political content.8 A study published in the Journal of Current Southeast Asian Affairs found that that between March 2017 and April 2020, the portal largely fact-checked social media posts circulating domestically and “clearly focuse[d] on issues related to governmental actions and policies while secondarily using the site also for more general information.”9 The PN coalition that took power in March 2020 launched a 24-hour news channel in June 2020 to combat purportedly false news.10 Concerns have been raised about the government’s potential to misuse the channel to spread state propaganda.11

In December 2023, after a cabinet reshuffle, the Department of Community Communications (J–KOM) was moved from under the Prime Minister’s Department to the Ministry of Communications (see A5).12 J–KOM was previously known as the Special Affairs Department (JASA), and under the BN coalition had been a department that disseminated information and conducted strategic communication on behalf of the government. Opposition members had considered it to be a propaganda tool of the BN coalition. Once rebranded as J–KOM, in December 2020, the Dewan Rakyat reduced its budget by more than 50 percent and instructed that the funding be used for COVID-19 related information.13

In March 2021, the Ministry of Health issued the Policy on the Prohibition of Making Public Statements MOH 2021, a gag order which prohibits members of the civil service from commenting on public policy and government decisions on social media without prior approval.14

B6 1.00-3.00 pts0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 2.002 3.003

Many online platforms struggle to stay economically viable, and government restrictions occasionally contribute to difficult market conditions. In the past, news sites have faced significant financial penalties due to defamation charges from political leaders.

In February 2024, the government released an updated version of the 1989 Code of Ethics for Journalists, reportedly meant to address the evolving media landscape and take “quasi-journalists,” like bloggers, online forum moderators, and social media influencers, into account. While the minister of communications clarified that the code would not serve as legal regulation, he shared that it would be used to help the ministry determine whether the government would issue and revoke media passes to journalists, thereby effectively granting—or barring—them access to the parliament and government events based on the code.1

In February 2024, the Malaysian cabinet approved the drafting of a Malaysian Media Council Bill, which would establish a media council to regulate the media industry, as well as dispute-resolution mechanisms for public complaints against the media.2

Previously, in September 2021, the parliament restricted media coverage of its proceedings to only 16 media agencies without disclosing a reason. Organizations not named in the list included news sites such as Free Malaysia Today, the Vibes, the Malaysian Insight, Malaysia Gazette, and the Malaysian Reserve.3

For instance, in July 2020, the government investigated Al Jazeera over a documentary it had released covering authorities’ mistreatment of migrants during the COVID-19 pandemic, announcing that the outlet had flouted the Film Act 1981 by not applying for a license to produce the documentary. At the time, then communications minister Saifuddin Abdullah said that all video producers needed a license “regardless of whether they are mainstream media agencies or personal media that broadcast films on social media platforms or traditional channels.”4 However, Saifuddin later clarified that social media users were free to produce and upload videos without a license, though he did not provide further clarity on whether media organizations needed a license to produce video content.5

Online outlets are not subject to the licensing restrictions that limit print outlets from publishing.6 In 2016, Malaysiakini was investigated for receiving foreign funds under Section 124C of the penal code, which prohibits activities detrimental to parliamentary democracy and carries a mandatory prison term of up to 15 years.7

In November 2023, the Information Department revoked the media passes of Harakah and Harakah Daily, the official press bodies of the Malaysian Islamic Party (PAS), after they published an article earlier that month titled, “Malaysia di bawah Anwar ragu-ragu sokong Palestin?” (Malaysia under Anwar is hesitant to support Palestine?). The department shared that the passes were revoked due to the outlets’ allegedly misleading and unethical reporting.8

B7 1.00-4.00 pts0-4 pts
Does the online information landscape lack diversity and reliability? 3.003 4.004

Digital media is more diverse than traditional media in Malaysia. More established sites such as Malaysiakini and the Malay Mail Online have been joined by smaller platforms that contribute to the diversity of information.1

Several digital news platforms are among the country’s most popular websites.2 However, online self-censorship around controversial issues such as Islam’s official status, race, and the monarchy limit the diversity of viewpoints available about those topics (see B4). Addtionally, during the coverage period, the MCMC blocked several news outlets perceived to be critical of the government, as well as blogs by promiment writers and politicians (see B1).

Expanded internet access has led to the emergence of a vibrant blogosphere. English and Malay are the dominant languages, and many civil society groups, including those representing ethnic minorities, have a dynamic online presence. Websites in Chinese, Tamil, and other minority languages are also increasing in number and influence.

Social media and communications platforms continue to be an important avenue for accessing a wide array of information.3

LGBT+ Malaysians face widespread discrimination and harassment, limiting online content.4 There is an active podcast catering to LGBT+ listeners, although its hosts remain anonymous for fear of reprisal; several LGBT+ websites are blocked, including Grindr, which was newly blocked during the coverage period (see B1).5

During the politically unstable period after the November 2022 elections, during which no coalition commanded a lower-house majority, local groups warned that anti–Chinese Malaysian and anti–Democratic Action Party (DAP) sentiments were increasing, driven by suspected coordinated paid commentators on social media (see B5).6 Many of the posts discussed the racial riots of May 13, 1969, to evoke fear and division, and TikTok videos threatened a return to such violence, showing images of weapons and calling for Malays to beware of the DAP and Pakatan Harapan (PH). Several of these viral videos were labeled as paid partnerships on TikTok (see B5).7

B8 1.00-6.00 pts0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 5.005 6.006

Digital tools remain available for users and have helped expose and undercut the government’s control over traditional media. Social media has been a particularly effective tool for mobilization. However, restrictive laws around free expression and the threat of criminal prosecution could limit some online mobilization.

In February 2024, the Coalition for Clean and Fair Elections (Bersih) organized online to promote and hold the #Reformasi100Peratus (100 Percent Reform) rally,1 which demanded that the government deliver promised reforms—including separating the roles of public prosecutor and attorney general, limiting the length of the prime minister’s term in office, and passing a Political Finance Act. Later that month, the prime minister shared that the government was considering and planning to implement some of the proposals shared by the coalition.2

Women’s March Malaysia (#WMMY24) was held on March 9, 2024, and was organized through online mobilization efforts on its official website, X, and Instagram accounts.3 Four participants in the march were summoned by police after the event under Section 111 of the Criminal Procedure Code.4 After the 2023 Women’s March, several organizers, speakers, and participants were summoned in the middle of the night for investigation under Section 9 of the Peaceful Assembly Act 2012 and Section 14 of the Minor Offences Act 1995.5

In June 2023, former premier Mahathir Mohamad was summoned for investigation regarding whether he violated Section 124B of the penal code by “committing an activity detrimental to parliamentary democracy by any means, directly or indirectly.”6 He had led a Malay proclamation initiative which called for political unity among Malays and gathered over 20,000 signatures between March and May 2023.7

During the previous coverage period, a group of government contract doctors known as Mogok Doktor Kontrak called for a three-day strike in April 2023 to protest the long-standing contract system and low wages. On the second day of the strike, shortly after announcing that the first day of the strike had been successful, the group’s Instagram account was apparently deactivated for unknown reasons.8

C Violations of User Rights

C1 1.00-6.00 pts0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 2.002 6.006

The constitution provides citizens with “the right to freedom of speech and expression” under Article 10 but allows for limitations on those rights.1 However, a number of laws also undermine freedom of expression (see C2).

The PH government kept its pledge to abolish the Anti-Fake News Act in December 2019,2 which the previous BN coalition had passed in May 2018, ostensibly to curb the spread of purportedly false news, especially through social media. The sweeping law threatened to seriously restrict free expression online,3 and activists argued that it was meant to silence criticism of the government and was vulnerable to abuse (see C2).4

The minister of home affairs has absolute discretion under Section 7(1) of the Printing Presses and Publications Act 1984 to ban media on the grounds of public order, morality, security, public interest, or national interest.

C2 1.00-4.00 pts0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities, particularly those that are protected under international human rights standards? 1.001 4.004

A number of laws impose criminal and civil penalties for online activities. The government exercises tight control over online, as well as print and broadcast, media through laws like the Official Secrets Act 1972 and the Sedition Act. Violations can be punished with fines and several years in prison.

Amendments passed in 2015 widened the scope of the Sedition Act, requiring users to remove online content that is considered seditious and obligating the court to issue an order blocking access to unidentifiable seditious content.1 The maximum penalty in general sedition cases is now seven years in prison, up from three years before the amendments. A provision also imposes up to 20 years in prison for seditious activities that result in physical harm or destruction of property.2 In 2015, the Federal Court rejected a constitutional challenge to the Sedition Act.3

The Anti-Fake News Act 2018, which was repealed in December 2019, covered news, information, data, reports, images, or recordings in any form that are wholly or partly false.4 Despite its repeal, the government can still use other laws, including the penal code, to punish purported misinformation (see C3), as the culture minister noted in October 2021.5

The Emergency (Essential Powers) (No. 2) Ordinance 2021 was enacted in March 2021 and revoked that December, after the expiration of the COVID-19-related state of emergency.6 The ordinance, which bore strong resemblance to the repealed Anti-Fake News Act, criminalized spreading purportedly false news relating to COVID-19 or to the Emergency Proclamation.7 People charged under the law faced a fine of up to 100,000 ringgits ($24,000), imprisonment of up to three years, or both; a convicted individual may also have been ordered to apologize to those affected by their activities.8 While the MCMC noted several measures that would prevent the ordinance from being used arbitrarily, activists worried that the law could be inconsistently enforced because of the ambiguity of what constitutes “fake news.”9

Defamation is a criminal offense under Sections 499 to 520 of the penal code. Media outlets benefit from stronger protections under the Defamation Act 1957 if they can prove that the content is accurate and was published without malice;10 bloggers, who lack this protection, are at greater risk for defamation charges. Section 505(b) of the penal code criminalizes statements intended to cause “fear or alarm to the public” or to “commit an offense against the State or public tranquility” with imprisonment up to two years, a fine, or both.

The government has also pursued prosecutions for online content under the CMA. The act’s broadly worded Section 211 bans content deemed “indecent, obscene, false, threatening, or offensive.” Spreading such content on the internet constitutes “improper use of network facilities or network service” under Section 233.

In March 2023, the government announced its intention to amend the CMA 1998 and the MCMC Act 1998 to tackle sensitive social media commentary regarding the 3Rs.11 Also in March 2023, the government announced that it was considering increasing the penalties for violating Section 233 of the CMA, as well as studying amendments that would give more power to the MCMC to remove social media accounts that violate the CMA. Currently, the MCMC does not have the power to act on these accounts and relies on cooperation from social media platforms.12 In December 2023, the minister of communications shared that the ministry was still receiving feedback from relevant stakeholders;13 as of the end of the coverage period, draft amendments to the CMA and MCMC Act have yet to be presented before the parliament.

C3 1.00-6.00 pts0-6 pts
Are individuals penalized for online activities, particularly those that are protected under international human rights standards? 3.003 6.006

During the coverage period, internet users were arrested and prosecuted for online speech. Content critical of Islam, the monarchy, or the government, or touching on sensitive racial issues can lead to arrest and prosecution.

Several individuals were arrested and prosecuted during the coverage period for insulting the monarchy, often under Section 233 of the CMA or the Sedition Act.1 According to human rights organization Voice of the Malaysian People (Suara Rakyat Malaysia), 25 individuals were arrested under Section 233 of the CMA in 2023.2

In September 2023, Mohamad Azlan Ibrahim, a 47-year-old man, was sentenced to six months in prison and fined 10,000 ringgits ($2,140) for a Facebook post he made the previous month that insulted the Sultan of Selangor—and for refusing to turn over the password to his Facebook account when asked by the police.3 In August 2023, a Facebook user was arrested and remanded for four days under Section 233 and Section 4(1) of the Sedition Act 1948 for an allegedly seditious post that insulted the king.4

In April 2024, activist and politican Badrul Hisham Shaharin, commonly known as Chegubard, pled not guilty to charges of inciting hatred and defamation, filed against him under Section 4(1) of the Sedition Act 1948 for making Facebook posts in January 2024 that allegedly insulted the king. If found guilty, he could face up to three years in prison and fines of up to 5,000 ringgits ($1,070).5 The trial is set for November 2024. Also in April 2024, Chegubard was arrested and remanded for two days under Section 233 and Section 4(1) of the Sedition Act 1948 after he posted comments on Facebook about alleged discussions, reported on by Bloomberg, between the prime minister and prominent businessmen about building a casino in a private town in Johor State.6

Journalists, activists, and internet users are also routinely investigated, charged, and prosecuted for criticizing the government, political parties, and other official bodies.

In March 2024, police opened an investigation into local news anchor Muhammed Ahmad Hamdan for a letter he published in the New Straits Times—which described an encounter he had had with “rude, arrogant, and unprofessional” police officers outside of his home7—under Section 233 and Section 504 of the penal code. The police also investigated two editors at the publication.8

In April 2024, the MCMC filed a police report against prominent writer Murray Hunter over an article he published, in which he referred to the Royal Malaysian Police as a “completely politicized institution under the present government” and described the MCMC as “acting far beyond its statutory powers in self-interest.”9 The same month, the MCMC filed a police report against three online activists—Chegubard, Salim Iskandar, and Wan Muhammad Azri—and seized their phones under Section 233 of the CMA for posts they shared on TikTok, Facebook, and YouTube that similarly accused the MCMC of making politicized regulatory decisions.10

The government also continued to investigate internet users under the penal code and the CMA for online speech deemed insulting to Islam and the prophet Muhammad. In March 2024, Facebook user Chiok Wai Loong was sentenced to six months in prison and fined 12,000 ringgits ($2,567) under Section 233 of the CMA for posting “offensive” content online for reacting to a photo posted on Facebook that depicted a pair of socks with the word “Allah” written on them.11

In July 2023, Mohamad Rizal van Geyzel, cofounder of Crackhouse Comedy Club, was fined 8,000 ringgits ($1,710) under Section 233 of the CMA after videos of him performing a stand-up routine—in which he allegedly discussed sensitive racial issues and that were deemed offensive—were uploaded on social media.12

In January 2024, the director and the producer of independent film Mentega Terbang (Butterfly) were charged under Section 298 of the penal code for intentionally hurting religious sentiments—a blasphemy charge—due to the film’s portrayal of Islam. Both were granted conditional bail, which imposed a gag order prohibiting them from commenting on the case. In May 2024, their lawyers applied for the case to be moved from the Magistrates’ Court to the High Court; if found guilty, they can face sentences of up to one year in prison and indeterminate fines.13 In September 2023, the Ministry of Home Affairs (KDN) banned “the exhibition, display, distribution, possession, circulation or sale of the film,” for being “contrary to public interest throughout Malaysia” (see B1).14 Previously, in March 2023, the MCMC announced that the film had been removed from Viu, an online streaming platform; the regulatory body does not have jurisdiction over movie censorship on streaming platforms.15 Several members of the production team and their families faced online harassment and death threats following the film’s online release in 2021 (see C7).

C4 1.00-4.00 pts0-4 pts
Does the government place restrictions on anonymous communication or encryption? 3.003 4.004

Anonymous online communication and encryption are not prohibited in Malaysia.

Since 2006, the MCMC has mandated that all service providers register prepaid SIM cards upon purchase.1 The MCMC issued fines of over 20 million ringgits ($4.5 million) for noncompliance with this regulation in 2021.2 Legal-name registration is not required for bloggers or customers at cybercafés. It is a criminal offense under Section 507 of the penal code to commit criminal intimidation by anonymous communication.

Users can largely use encryption tools as they please, although a number of laws allow police to access encryption and decryption codes when conducting searches, including the Computer Crimes Act (CCA), the criminal procedure code, and the CMA.3

C5 1.00-6.00 pts0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 2.002 6.006

Privacy protections in Malaysia are poor. It is difficult to ascertain the extent of government surveillance of users’ internet activities.1

Legal provisions allow the police, prosecutors, and the communications minister to intercept online and mobile communications. The laws are generally interpreted to require network operators and service providers to assist law enforcement and intelligence agencies in surveillance efforts, even where clear procedures are lacking. A court order is not required for emergency interception, which applies to cases with national security implications.

In April 2024, the parliament passed the Cyber Security Act, and in August 2024, the act came into effect. Under the act, authorities can collect any information relevant to matters of cybersecurity, including by searching and seizing any relevant properties without a warrant. Individuals and companies, including internet intermediaries, who do not comply with requests for relevant information, documents, or electronic media can face fines up to 200,000 ringgits ($41,900) and sentences of up to three years in prison.2 Human rights organization Article 19 has raised concerns that the act’s vague provisions give the “government unaccountable control of computer-related activities,” and could be used to limit free expression online.3

Under the Security Offenses (Special Measures) Act 2012, a police officer with the rank of superintendent of police or above may intercept communications without the authorization of the public prosecutor in urgent cases.4

In May 2020, Israeli news site CTech reported on documents in an Israeli court case revealing that, in April 2018, officials from the then ruling BN coalition signed a 6.3 million ringgit ($1.5 million) deal to purchase surveillance technology from Israeli cybersecurity startup Senpai for use by the Malaysian intelligence agency.5 The deal was signed just over a month before the May 2018 election, and the technology was allegedly planned for use surveilling the political opposition ahead of the vote. Former prime minister Najib Razak denied the allegations.6

Citizen Lab reported in December 2020 that the government may be a customer of Circles, a surveillance firm whose products could be used to snoop on the location, texts, and calls of targeted phones.7 In 2013, Citizen Lab reported that FinFisher—described by distributor Gamma International as providing “governmental IT intrusion and remote monitoring solutions”—was detected on servers in Malaysia.8 The software potentially allows the server to steal passwords, tap Skype calls, and record audio and video without the permission of its targets.9 Citizen Lab also identified “a Malaysian election–related document” that it characterized as a “booby-trapped candidate list” containing spyware.10 Because the spyware is only marketed to governments, “it is reasonable to assume that some government actor is responsible,” the group concluded. A separate Citizen Lab report published in 2014 asserted that a Malaysian government agency was a “current or former user” of the Remote Control System spyware marketed by the Milan-based Hacking Team.11 In 2016, the prime minister’s office denied having purchased this spyware but could not confirm whether other government agencies had done so.12

Social media monitoring continues to be a concern, and several government agencies and officials have announced that they are monitoring platforms for content related to race, religion, royalty, and false information.13 For instance, the MCMC regularly monitors social media activity in the country to remove violating content and investigate violating individuals.14

In October 2018, Israeli newspaper Haaretz reported that Malaysia had previously purchased sophisticated surveillance technology from Israeli firms that can monitor and analyze social media and other open-source information.15 Previously, the US–based company Snaptrends also reportedly discussed its social media monitoring technology with Malaysian authorities.16

Amid the COVID-19 pandemic, the government rolled out several smartphone apps that access personal information for contact-tracing purposes. The MySejahtera app launched by the Ministry of Health—which enables access to personal information for infectious disease contact-tracing, scheduling appointments at health clinics, vaccination purposes, and cross-border travel—was mandatory to enter businesses until May 2022,17 raising privacy concerns,18 and remained in use through the end of the coverage period. The Health Ministry assured users that their data is secure and would not be misused,19 though the app was exploited to send unsolicited texts and emails to app users in October 2021. In July 2024, after the end of the coverage period, the Health Ministry announced that individuals who test positive for COVID-19 would no longer need to report their test results to the app.20

Internet users raised similar concerns about a “conversion therapy” app distributed by the Department for Islamic Development Malaysia since 2016, which requests permissions to access sensitive user data.21 The app was removed from the Google Play store in March 2022.22

In March 2023, Google’s Threat Analysis Group found that users in Malaysia were targeted by spyware through a link shortener sent over short-message service (SMS) that redirected users to pages hosting Android and iOS exploits before redirecting to a news site.23 Google did not share the source of the spyware, the numbers or identities of the victims, or actors who were involved.24

C6 1.00-6.00 pts0-6 pts
Does monitoring and collection of user data by service providers and other technology companies infringe on users’ right to privacy? 4.004 6.006

The law protects against using individual data for commercial purposes, but there are no provisions specifically addressing online privacy.1 In some cases, service providers are required to aid the government in monitoring user communications.2

The CCA mandates that providers give police access to user information once a warrant is obtained. Providers that fail to comply can face up to three years’ imprisonment and fines of up to 25,000 ringgits ($5,600).3 Section 116 of the criminal code allows the police to access user information, which is defined as “the necessary password, encryption code, decryption code, software or hardware, and any other means,” when conducting a criminal investigation.4 Depending on the offense being investigated, the criminal procedure code does not always require police to obtain a warrant. Section 116c allows the public prosecutor to force service providers to collect and retain specific user communications or data. The prosecutor can also authorize a police officer to install devices to collect such information.

The Malaysian Personal Data Protection Act (PDPA) 2010, which regulates the processing of personal data in commercial transactions, came into effect in 2013. The law makes it illegal for commercial organizations to sell personal information or allow third parties to use it. Those convicted of violating the law can be fined up to 100,000 ringgits ($22,360) or sentenced up to one year in prison. The federal and state governments are exempted from the law, as are entities that process data outside Malaysia.5 The act requires that information about Malaysians be stored locally and limits conditions under which it can be transferred abroad, though the extent to which those rules are enforced is unclear.6

In July 2024, the upper house of the parliament, the Dewan Negara, passed amendments to the PDPA that, among other new provisions, increases the penalties for companies found to be in breach of personal data protection principles, requires companies to notify the Personal Data Protection Comissioner when a data breach occurs, and expands the definition of sensitive personal data to include biometric data, effectively requiring companies to comply with stricter security policies when handling such data.7

Between July and December 2022, Facebook received 59 requests for information from the government relating to 208 users. Facebook complied with 86 percent of the requests.8

Between November 2018 and November 2019, the Inland Revenue Board of Malaysia attempted to request the personal data of customers under the loyalty program offered by Genting Malaysia Berhad in order to widen its tax base, reduce tax evasion, and increase tax collections.9 After Genting Malaysia filed for judicial review, the High Court ruled in December 2021 that blanket demands for personal data without the consent of the customer are not allowed under the PDPA.10

C7 1.00-5.00 pts0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? 3.003 5.005

Intimidation and physical violence against individuals in retaliation for their online activities has been a problem in Malaysia. Journalists, activists, and members of marginalized communities, such as LGBT+ people, sometimes face online harassment.

In November 2023, a 30-year-old freelance journalist from Bangladesh who had reported on a crime syndicate in Malaysia was kidnapped for three days, potentially by members of the syndicate, and tortured for information about his reporting.1

In July 2023, Thuzar Maung, a prominent Myanmar refugee and critic of the Myanmar junta with a large social media following, was forcibly disappeared in Malaysia along with her husband and three children.2 As of July 2024, their whereabouts remain unknown.3

Users sometimes face offline retaliation for online posts related to government officials.4 During the previous coverage period, in June 2022, former senator Siti Aishah Shaik Ismail was arrested after her TikTok video criticizing the removal of subsidies by the government went viral; police officers raided her home in the course of her arrest.5

Users also continue to face online retaliation, including doxing and threats, for their online posts.6 In May 2024, several Tamil online journalists were reportedly on the receiving end of a slanderous online campaign led by a local newspaper owner and local politicians; the journalists were also allegedly threatened by the newspaper owner.7

LGBT+ users also have been subjected to harassment, homophobic slurs, and hateful content online.8 A study released in December 2021 found that almost 90 percent of LGBT+ Malaysians surveyed reported being affected in some way by online harassment.9 In December 2021, a Malaysian actor and TikTok influencer faced online criticism for appearing in a gay romance web series that was used to promote the gay dating app Blued.10 Artists who featured drag performers and LGBT+ dancers in music videos have also faced online harassment.11

Members of the production team for the film Mentega Terbang (Butterfly)—which was released online via the streaming service Viu before being taken down in March 2023 (see B2)—and their families were harassed online, received death threats, and were targeted with offline violence, in addition to being investigated for religious provocation (see C3).12

C8 1.00-3.00 pts0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 2.002 3.003

Technical attacks aimed at suppressing political information online were not reported during the coverage period, though such attacks have been recorded in the past.

In March 2024, Malaysia’s minister of defense claimed that as Malaysia continues to publicly declare its support for Palestinians amid the Israel-Hamas war,1 Malaysia’s national security system has faced a significant increase in cyberattacks, with an average of 3,000 attacks per day.2

In January 2024, R00TK1T—an internationally recognized hacking group that claims to “stand with Israel,” and that has attacked a number of Lebanese and Iranian websites since November 20233—announced on Telegram that it would be carrying out a cyberattack campaign against Malaysian digital infrastructure.4

In February 2024, R00TK1T claimed to have hacked Maxis, though the communications operator later said that it did not find evidence of such a breach. The hacking group then threatened to further attack Maxis and release more sensitive data if the operator continued to fail to acknowledge the attack.5 In March 2024, the Department of Personal Data Protection shared its findings from its investigation into the attack, announcing that no personal data had been compromised and that “only the Maxis Interactive Retail Assistant (MIRA) Queue Management System at a specific Maxis branch was affected.”6

The National Cyber Security Agency (NACSA) was formed in February 2017 as the country’s lead cybersecurity organization. The National Cyber Security Policy was formulated in 2016 to address the risks to critical sectors of the economy.7

On Malaysia

See all data, scores & information on this country or territory.

See More
  • Population

    33,940,000
  • Global Freedom Score

    53 100 partly free
  • Internet Freedom Score

    60 100 partly free
  • Freedom in the World Status

    Partly Free
  • Networks Restricted

    No
  • Websites Blocked

    Yes
  • Pro-government Commentators

    Yes
  • Users Arrested

    Yes