Parliament has just introduced the Cybercrimes Bill 2026 for its first reading on 22 June 2026 to to replace the Computer Crimes Act 1997. It enhances old provisions and introduces new provisions relating to computer crimes. Such provisions include-
– Access to computer system without authority (ss. 9 and 10)
– Access without authority with intent to commit or facilitate a further offence involving fraud, dishonesty or injury (s. 11)
– Interception of non-public computer data transmission without authority (s. 12)
– Computer data interference, including damaging, deleting, altering, suppressing or denying access to computer data (s. 13)
– Computer system interference by seriously hindering the functioning, lawful use or operation of a computer system (s. 14)
– Misuse of devices, programs, passwords, access credentials, electronic signatures or similar computer data intended for committing an offence (s. 15)
– Computer-related forgery involving inauthentic computer data intended to be acted upon as authentic (s. 16)
– Computer-related fraud involving computer data, system interference or deception causing loss of property (s. 17)
– Disclosure of National Digital Identity Service password or other means of access to facilitate an offence (ss. 18 and 19)
– Obtaining, retaining, supplying, transmitting or making available National Digital Identity Service credentials to commit or facilitate an offence (ss. 18 and 20)
– Wrongful communication of a number, code, password or other means of access to a computer system (s. 21)
– Identity theft involving another person’s identity information by means of a computer system (s. 22)
– Transmitting, distributing, publishing, selling or making available computer-generated or manipulated visual or audio content that falsely appears authentic, with intent to commit or facilitate an offence (s. 23)
– Dissemination of intimate images by means of a computer system (s. 24)
– Offences affecting or involving national critical information infrastructure or national critical information infrastructure entities (s. 25)
The Sessions Court has jurisdiction to try all the above offences. In overcoming the jurisdictional limitation provided by s. 121 of the Criminal Procedure Code, s. 2 states that the Act shall apply if the victim is a Malaysian citizen. That may mean that the charge may also be heard where the victim is located.
The interesting provisions are ss. 23 and 24, which may cover AI-generated and deepfake-type content. S. 23 deals with manipulated visual or audio content that falsely appears authentic or truthful. S. 24 covers intimate images, including AI-generated, manipulated, altered or synthesised images.
An earlier version of this update was published by Foong Cheng Leong on LinkedIn.
Leave a Reply