I was asked by The Malay Mail to comment on laws relating to request of passwords of computer devices and online accounts and also the arrest of Patrick Teoh, a veteran radio personality. Patrick had allegedly posted certain disparaging comments about the Crown Prince of Johor and was arrested by the police for doing so. His remanded was extended because, among others, he had forgotten his email password.
Datuk Joshua Kevin, Rajsurian Pillai, Fong Choong Fook and I were interviewed by The Malay Mail. My answers are reproduced below with some modifications. The full answers can be viewed at The Malay Mail’s website.
Can the police search my phone and ask for my passwords?
Specifically on passwords, lawyer Foong Cheng Leong confirmed that authorities can request for passwords as part of investigations to allow for digital forensic tests to be conducted on the device, in order to obtain sufficient evidence to prove their case in court.
“It is generally to determine whether a particular message or conduct originated from that device.
“The authorities are given the power to do so for most offences, including in Patrick Teoh’s case which falls under the Communications and Multimedia Act 1998,” said Foong, who is co-deputy chair of the Bar Council’s Cyber Law Committee. Teoh’s case was probed under Section 233 of the CMA.
Under Section 249 of the Communications and Multimedia Act 1998 (CMA) which is similar to the Criminal Procedure Code’s Section 116B, police investigators who are conducting a search are to be given access to computerised data, with access again defined as including passwords, encryption codes, decryption codes, hardware or software.
While the term “computerised data” in both the CPC’s Section 116B and the CMA’s Section 249 is not defined, Foong confirmed that this would apply to passwords to social media accounts, email accounts, log-in passwords for computers, and codes to unlock a smartphone’s screen.
What happens if I refuse to reveal my passwords?
For those who refuse to give their passwords to digital devices or social media accounts to the police during investigations, Foong pointed out that such action may be considered a crime.
“A refusal to comply with the search may amount to an offence under, among others, Section 186 of the Penal Code i.e. voluntary obstruction of a public servant’s duty to discharge of his public functions.
“If it’s a search warrant by the Court, it may amount to contempt of court. However, such affected person may apply to set aside the Court warrant,” he said.
When asked whether the right to privacy or data protection could be cited to refuse the giving up of such passwords to investigators, Foong said that such rights are generally not taken into account during a search and seizure but noted a High Court case [Chong Chieng Jen v. Mohd Irwan Hafiz Md Radzi & Anor  1 CLJ 355] where the judge had said the court should consider the right to privacy when issuing a search warrant.
Asked if an individual could provide the password only for the investigation period for investigations with their presence, Foong said the device would generally be taken and sent to another department for forensic tests and the person being investigated is “generally not given the right to sit and watch how the investigation is done”.
“Further, the right to do search and seizure is very wide. They can search the entire computer for all relevant information,” he said, adding that a person who was investigated could opt to sue later on if the search was wrongfully done.
What if I forget my passwords?
Foong said it is a reasonable scenario for anyone to have forgotten their passwords to online accounts as passwords could be saved by the internet browser on a device, adding that authorities could in such cases still access the online account if they have access to the computer which were used to access the account.
“This is because that person’s computer generally would have saved the password unless that person has set it to do otherwise,” he said.
Foong highlighted however that even if an individual refuses to or is unable to furnish passwords to online accounts, they may still find that they are considered under the law as the publisher of the content of an offence unless they can prove they are not the publisher.
“The accused may take the position that they were not the originator of the message or did not do the act and there is no electronic evidence to prove that.
“Nevertheless, the prosecution may still rely on the presumption of publication under Section 114A of the Evidence Act 1950. The presumption of publication provides that a person deemed to be a publisher of a content unless proven otherwise by him or her,” he said.