IN order to combat online harm and cybercrime more effectively, it is necessary to disrupt the four elements of online harm and cybercrimes.
These elements are:
1. Anonymity
2. Access to network facilities
3. Access to accounts or payment systems
4. Targeting information
As correctly pointed out by Communications Minister Fahmi Fadzil, joint agencies are required to tackle these elements as they fall under different regulators, sometimes with overlaps between several.
Generally speaking, we find that a high proportion of online harm and cybercrimes are committed using social media platforms or OTT platforms.
This is mainly because of the ease of concealing one’s identity, huge reach and lack of proper regulation of these platforms in Malaysia.
It seems that there are two sets of laws operating: one in the non-digital space and one in the digital one which is less evolved leading to criminal empowerment in the digital space.
While these platforms are heavily regulated in the European Union, US, Vietnam, Indonesia and even Singapore, sadly they have been enjoying exemptions from licensing or even proper registration in Malaysia.
This has led to a lack of legal accountability under Malaysian law to be subject to such platforms.
For example, Section 263 of the Communications and Multimedia Act 1998 (CMA) imposes legal obligations on telecommunication service providers and other licensees to use their best efforts to stop or prevent criminal activity or their network including any attempted breach of Malaysian laws.
This is in addition to their legal duty and licence requirements to assist law enforcement where there has been a legal breach.
To more effectively combat online harm and cybercrime – including child sexual abuse material (CSAM), scams, cyberbullying and online gambling – all OTT platforms must be regulated as they are in other countries.
In fact, you may notice if you look at many of these platforms and read their terms and conditions of use or content control rules, you will notice that nothing is written there mentioning that the user must comply with local laws.
Even a simple condition that a user must comply with local or national laws is not found. This can give the impression that a user does not need to comply with Malaysian laws but only follow the message of “platforms laws and standards which do not always represent Malaysian laws”.
This is surprising because it raises a question of digital sovereignty and all who use those platforms in Malaysia or in Malaysia’s digital space must comply with local laws, yet such an important requirement is not found in many of the moderation rules, house rules or terms or conditions of use.
In addition, regulation of OTT platforms will ensure that these platforms are legally required to respond to user complaints of cyberbullying, scams, CSAM, and online gambling promptly and effectively, under a legal obligation to protect children and the public from such content.
This legal obligation means these platforms are held liable if they ignore complaints or do little to protect their users whom they profit from by monetising their data.
The imposition of a legal regulatory framework will lead to a much higher level of commitment of these platforms to protect their uses.
In the EU, for example, fines based on a percentage of the platforms’ gross revenue can be imposed.
This highlights the seriousness of the EU regulators and EU digital sovereignty framework towards platforms taking seriously shared responsibility for effectively combating online harm and cybersecurity threats.
Such fines are certainly effective in showing regulatory seriousness towards platforms using their best efforts to prevent cybercrime on their proprietary platforms.
These moves are necessary because these platforms require users to consent to the monetisation of their personal data as a precondition to using their services.
This allows them to sell the data to third parties and should the data fall in the wrong hands, the data can be used for targeting individuals as potential victims of cybercrime.
The “mandatory consent” to monetise data creates an increased risk to the safety of a user.
This is the targeting information that makes anyone vulnerable to cybercrime, not only the people one would expect to be soft targets.
Everyone is a potential target and the more targeting info the criminal has the more likely he or she will be able to effectuate a scam or crime.
It is, therefore, critical that all digital services providers operating in Malaysian digital space be licensed or regulated to ensure the same level of protection is afforded to all Malaysians as citizens in the EU, US and other countries, which uphold their national sovereignty. – July 26, 2024
Derek Fernandez is a prominent lawyer and cybersecurity expert. He is also a commissioner for the Malaysian Communications and Multimedia Commission