Recently, the DPM, in a written Parliamentary response said foreign-based hackers and scammers can be investigated, prosecuted, and extradited to Malaysia if their illegal activities target local systems or Malaysian citizens saying this cross-border enforcement capability is explicitly embedded within Clause 2 of the Cybercrime Bill 2026.
Clause 2 primarily establishes that if a cybercriminal targets a Malaysian citizen or compromises a computer system located within Malaysia, the offense is treated under law as if it occurred on Malaysian soil.
Clause 2 serves as a legal deterrent and an asset-recovery mechanism only, but it remains bound by global diplomacy when it comes to putting handcuffs on overseas hackers.
Clause 2, however, allows Malaysian courts to issue asset restraint, cessation, and restitution orders and for law enforcement to legally freeze or seize the local infrastructure, mule accounts, or digital assets tied to those foreign syndicates even if the hacker cannot be extradited, provided the hacker or scammers have such assets in Malaysia.
A judgment in Malaysia under Clause 2 allows the government to trigger Interpol Red Notices and the moment that hacker steps out of their safe-haven country for a holiday or business trip, they face immediate arrest and extradition to Malaysia.
Extradition?
Malaysia has active bilateral extradition treaties or specific arrangements with only a select group of countries only—such as the United States, Australia, India, Hong Kong SAR, Indonesia, and Thailand.
Malaysia DOES NOT maintain formal bilateral extradition treaties with a large majority of the world's nations, including major global powers like China, Saudi Arabia, and Russia, as well as many countries across Europe, Africa, and the Americas.
Malaysia possesses the core technical capabilities to perform high-level digital forensics, trace IP addresses, and map blockchain transactions, but it operates with different domestic legal frameworks and structural limitations compared with say, the FBI or the US Secret Service when dealing with foreign tech entities.
What Malaysia is behind are its jurisdictional authority to aggressively compel immediate cooperation from foreign big-tech platforms or cross-border servers.
Jurisdictional authority hinges solely on international diplomacy rather than a unilateral domestic mandate.
E.g if a foreign scammer uses an American or European tech platform, Malaysia cannot simply issue a standard domestic Malaysian subpoena to force compliance from a corporate headquarters in California.
Instead, Malaysia must navigate the Mutual Legal Assistance Treaty (MLA) process or rely on direct law enforcement cooperation channels (like Interpol).
While tech companies often comply with emergency data requests involving life threats or severe fraud, routine data disclosures take significantly longer for Malaysia to secure than they do for the FBI.
In 2018, following the change in government, Malaysia aggressively reopened 1MDB investigations and sought international cooperation.
Malaysian investigators reportedly quickly hit a wall with several foreign nations despite the presence of MLA mechanisms.
While an MLA provides a formal legal bridge, it cannot force a sovereign country to comply if it lacks the political will, or if the request conflicts with its domestic privacy laws, ongoing independent investigations, or geopolitical interests.
Clause 2 of the Cybercrime Bill is merely a feel good provision but useless against foreign scammers and hackers.
If the offender is in a country that refuses to cooperate or lacks reciprocal laws, the provision cannot be enforced.
Furthermore, tracking, prosecuting, and extraditing individual foreign hackers or scammers is incredibly rare and resource-intensive, meaning the clause is rarely tested in practice.
Do you think Malaysia can afford and have the resources and expertise and a dedicated team to undertake this?
Let’s remain and stay as a jaguh kampung and not give the impression to the ordinary rakyat that the country has laws that allows her to catch and arrest foreign scammers and hackers.
This only happen if the country is the United States and in the Hollywood movies.
FLK (leekhean.foo@gmail.com) is a content creator under the Newswav Creator programme, where you get to express yourself, be a citizen journalist, and at the same time monetize your content & reach millions of users on Newswav. Log in to creator.newswav.com and become a Newswav Creator now!
The User Content (as defined on Newswav Terms of Use) above including the views expressed and media (pictures, videos, citations etc) were submitted & posted by the author. Newswav is solely an aggregation platform that hosts the User Content. If you have any questions about the content, copyright or other issues of the work, please contact creator@newswav.com.
