Under Clause 2 of the Cyber Crime Bill 2026, Malaysia can take legal action against overseas cybercriminals if their offences involve local systems or victims.
KUALA LUMPUR: Legal action can be taken against cybercriminals operating overseas if their offences involve Malaysian systems or their victims are Malaysian citizens.
Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi said Clause 2 of the Cyber Crime Bill 2026 provides for legal action to be taken against offenders abroad as though the offences had been committed in Malaysia.
“The government is leveraging existing international cooperation mechanisms to ensure that foreign-based criminals can be investigated, prosecuted and, where the requirements are met, extradited to Malaysia,” he said in a written reply posted on the Parliament website.
He was responding to a question from Datuk Shamshulkahar Mohd Deli (BN-Jempol) on whether the existing legal framework on cybercrime was adequate to address AI-powered online scams, including identity impersonation, deepfakes and digital manipulation, as well as the specific provisions being strengthened to expedite action against syndicates and protect victims.
Ahmad Zahid, who is also Rural and Regional Development Minister, said the Bill, passed by Parliament in July, was drafted to repeal the Computer Crimes Act 1997 (Act 563), while addressing gaps in the law, including cross-border cybercrime and the misuse of AI technology.
He said Clause 23 of the Bill expanded the scope of offences involving impersonation through computer systems to address increasingly complex deepfake threats.
“Existing laws are no longer sufficient to deal with deepfakes, which can produce fake videos, images and voices that are difficult to distinguish from genuine ones and can be used to defraud and deceive the public.
“Hence, Clause 23 expands the scope of offences relating to impersonation using computer systems,” he said.
To expedite action against cybercrime syndicates, he said the Bill also provided investigative powers under Clauses 38 to 41, covering the preservation and disclosure of data, the collection of traffic data and the interception of communications, subject to prescribed safeguards.
Ahmad Zahid said these powers were important because digital evidence could be deleted, altered or transferred within a short period, requiring prompt investigative action.
In terms of victim protection, Clause 54 empowers the court to issue orders to prevent or stop violations of the law upon application by the Public Prosecutor or an authorised officer, regardless of whether the suspect has been charged.
“Such orders include cessation orders, restitution orders for victims, compliance orders and asset restraint orders to prevent the dissipation of assets, such as proceeds from scams,” he said.
Overall, Ahmad Zahid said enforcement of the Cyber Crime Bill 2026 would strengthen enforcement agencies through more responsive investigative powers and provisions for extraterritorial jurisdiction to curb cybercrime, including AI-enabled online scams.
