Malaysia’s MCMC Is Becoming A Spy Agency – OpEd
The Malaysian Communications and Multimedia Commission (MCMC) was established in 1998 under the Mahathir administration as a regulatory body of the internet, digital communications, and the multimedia industry under the Communications and Multimedia Commission Act 1998, and the Communications and Multimedia Act 1998. At the time, the MCMC was modelled on the National Telecommunications Commission (NTC) of the Philippines.
The MCMC is additionally charged with overseeing the Postal Services Act 1991, and licensing of the certification authorities under the Digital Signature Act 1997.
According to The Edge Malaysia (June 6), the Malaysian government has ordered all telecommunications firms (ISPs) to hand over detailed call and internet logs for the first three months of 2025 to the MCMC for the country’s “Mobile Phone Data” project. A media statement issued by the MCMC on June 6 claimed that only metadata is being collected for statistics and policy making purposes. However, an SCMP report states that the MCMC has ordered for such data as call records, IP call records, location, latitude and longitude information.
The collection of metadata is a tool used by the United States National Security Agency (NSA) after 911 for intelligence analysis. Such information is used to map communications networks, identify potential targets, and most importantly enable to agency to focus on communications content for more specific and precise analysis using other means. According to Edward Snowden, an NSA whistleblower, such metadata is used for tracking and surveillance purposes.
The NSA uses sophisticated AI software to analyse metadata. The MCMC itself has developed expertise in AI and invested large sums in development. Now the MCMC is in the business of storing metadata, which can be used to map out the behaviour of targeted people. Such data enables the building of online profiles of persons of interest, their social connections, and their behavioural history. The Guardian pointed out that the NSA can access peoples’ passwords, business data, and other commercially valuable information.
What we don’t know is the software capability of the MCMC. The MCMC is not disclosing this. Secondly, the MCMC is not disclosing what allied software and facilities it possesses to dive deeper into metadata. No real privacy assurances have been given, other than the metadata the MCMC is collecting has not personal data. We just don’t know what ‘backdoor’ search loopholes the MCMC has access to.
Malaysians can only take the MCMC on its word. Bersatu communications and new media chief Na’im Brundage, in a press conference questioned what privacy protection protocols would be employed, and what for of oversight and auditing would be implemented to prevent data misuse. Na’im went further and said there should be public consultation on the matter. Malaysians only learnt of the MCMC’s actions after international media reports.
Data security is of concern, as in 2017 there was a massive data breach of ISP data intended for the MCMC including MyKad numbers, addresses, phone numbers, and phone brands and models leaked to the public domain. Information within the MCMC has not been safe previously.
Past history of the MCMC adhering to the law is of concern
The MCMC, with the extra powers it received from the 2024 Communications and Multimedia Act amendments have led to the arbitrary detaining of individuals, conducting interrogations and publishing images, and imposing arbitrary fines may strictly fall within the framework of the act, but open up questions of fairness, transparency, and lack of oversight. There appears an abuse of the ‘good faith’ provision, where the rights to privacy, a fair trial, an may lead to perceptions of ‘guilty by accusation’ by the wider community. There are further questions as to whether the MCMC is infringing upon the right to freedom of speech and basic human rights. Some of the penalties the MCMC imposes upon individuals appears to be out of proportion to their alleged crime, as solely defined by the MCMC itself, without oversight.
The MCMC arbitrarily blocking websites without consultation with website owners, is a contentious issue. Although the MCMC has authority to block websites under Section 211 and 233 of the Communications and Multimedia Act, there is no oversight. MCMC procedures, processes, and decision lack any transparency. There is no clear path for the owners of blocked websites to challenge blocks, as there is no formal appeal process mandated. The overzealousness of the MCMC can be seen in the fact that 25% of world request for content pull downs on Tik Tok back in 2024, came from the MCMC.
Perhaps one of the biggest concerns about the MCMC are its extra-judicial and out of jurisdiction operations. The MCMC has demanded companies pull down certain materials on their platforms, under the pressure that the whole platform would be blocked in Malaysia. Evidence indicates the MCMC has also impersonated overseas judicial authorities to intimidate individuals outside of jurisdiction, thus breaking the laws of other countries.
As the MCMC is taking on this new role, similar to the NSA in the United States, people are being asked to trust the integrity of the MCMC, which has shown recklessness with current law enforcement activities. United States citizens are now experiencing intelligence agencies steering out of control outside their authority. The MCMC has never been given the legal mandate and authority to spy upon Malaysians.
