The Malaysian Bar has applauded the Government for its efforts in drafting the Cyber Security Bill 2024, which was tabled for the first reading in Parliament on 25 March 2024 and had been scheduled for a second reading today (26 March 2024). With a staggering 80% of nations globally having enacted legislation to combat cybercrimes, the introduction of this Bill is undoubtedly opportune said the Bar.
The Bill seeks to “enhance the national cyber security by providing for the establishment of the National Cyber Security Committee, duties and powers of the Chief Executive of the National Cyber Security Agency, functions and duties of the national critical information infrastructure sector leads and national critical information infrastructure entities and the management of cyber security threats and cyber security incidents to national critical information infrastructures, to regulate the cyber security service providers through licensing, and to provide for related matters”.
Nevertheless, the Malaysian Bar is of the view that several changes to the Bill are necessary in order to ensure that it is capable of addressing cybersecurity issues in a just and meaningful manner. As such it proposes the following changes to the Bill:
(1) Amendments to the provisions concerning the National Cyber Security Agency (“NACSA”):
(a) NACSA should be defined in the Bill. While section 4 of the Bill defines the “Chief Executive” to mean the “Chief Executive of the National Cyber Security Agency”, NACSA itself is not defined.
(b) There should be a separate section providing for the functions and powers of NACSA. The Malaysian Bar proposes that the duties and powers of the Chief Executive as per subsection 10(b), (c), (d) and (e) of the Bill should be listed as the functions of NACSA instead of the Chief Executive. Further, in parallel with the drafting of a separate section describing the functions of NACSA, subsections 10(b), (c), (d) and (e) of the Bill should be removed.
(2) Removal of subsection 2(2) of the Bill. The Federal and State Governments should not be immune from prosecution.
(3) Amendment to section 4 of the Bill. The definition of “authorized officer” should be amended to “police officer of the rank of Inspector and above”.
(4) Amendment to paragraph 5(2)(l) of the Bill, from “not more than two other persons” to “five other persons who shall be appointed by the Committee from among persons of standing and experience in cyber security”.
(5) Removal of section 40 (“Search and seizure without warrant”), section 55 (“Obligation of secrecy”), and section 56 (“Protection against suit and legal proceedings”).
(6) Amendments to section 58 of the Bill:
(a) To replace all mentions of the word “firm” with “partnership”.
(b) To amend subsection 58(b) by replacing “if the company, limited liability partnership, firm, society or other body of persons is found guilty of the offence, shall be deemed to be guilty of the offence and shall be liable to the same punishment or penalty as an individual, unless …” with “it shall be a defence if …”. This is because the current formulation of subsection 58(b) deems individuals guilty upon the finding of guilt of a body corporate. The two main elements of a crime, namely mens rea (guilty mind) and actus reus (guilty act) cannot be imputed, inferred or presumed. These elements must be proven by the prosecution.(c) Removal of section 59 of the Bill, which holds a person liable for another person’s actions. As explained in the preceding paragraph, mens rea (guilty mind) and actus reus (guilty act) cannot be imputed, inferred or presumed, and must be proven by the prosecution.
The Malaysian Bar said it had also sent a letter to Gobind Singh Deo, the Minister of Digital, in order to communicate its comments regarding the Bill, as enumerated in the foregoing.
The Malaysian Bar said it firmly believes that its proposals would improve and strengthen the Bill and highly encourages the Madani Government to consider and incorporate these proposals.
