Media Council warns Cybercrimes Bill 2026 threatens press freedom without safeguards

On Monday, June 29, Malaysia's Media Council issued a formal warning about legislation moving swiftly through Parliament. The Cybercrimes Bill 2026, tabled for its first reading just a week earlier, poses a genuine threat to press freedom and the confidential relationships that underpin democratic accountability—unless lawmakers insert specific legal protections before voting, the council said.

The bill itself has a straightforward purpose. Deputy Prime Minister Ahmad Zahid Hamidi explained that it would replace the Computer Crimes Act 1997, a law now two decades old and inadequate for the scale and sophistication of modern cyber threats. Malaysia, he noted, has international obligations to tackle cross-border cybercrime, and the new legislation would give the National Cyber Security Agency, housed within the Prime Minister's Department, the regulatory and enforcement powers needed to meet that challenge. The second and third readings were scheduled for July 1—less than 48 hours after the Media Council's statement.

But the council's concern cuts deeper than cybercrime prevention. The bill's investigative powers, concentrated in Part VII, create mechanisms that could chill the very activities a free press depends on. Clause 40 allows prosecutors alone to authorize real-time collection of traffic data—the digital footprints of who communicates with whom—without a judge's sign-off. Service providers are barred from even telling anyone the power has been used. Similar provisions in Clauses 38, 39, and 41 permit the preservation and interception of communications, and in some cases allow access to computer systems without prior judicial authorization. These are not narrow tools aimed at serious criminals. They are broad instruments that could sweep up journalists contacting sources, lawyers advising clients, and whistleblowers seeking confidential counsel.

The Media Council does not oppose cybercrime legislation. It supports the government's stated goal. But it argues that laws designed to protect Malaysians from digital threats must also protect the constitutional liberties that make a functioning democracy possible. Confidential communications between journalists and their sources, between lawyers and clients, between citizens and those they trust with sensitive information—these relationships are not luxuries. They are structural necessities. Without them, investigative journalism withers. Whistleblowers stay silent. People stop seeking legal advice. Public confidence in institutions erodes.

The council's specific proposal is procedural but consequential: refer the bill to a Parliamentary Select Committee for further study, consultation, and debate before passage. It also outlined concrete safeguards that should be written into the law. Powers involving interception, computer access, and real-time data collection should require prior judicial approval, except in narrowly defined emergencies followed by prompt court review. Data obtained under these powers should have defined retention periods and be subject to regular review. Their use should be limited to serious offences outside the cybercrime context. The government should report periodically on how often these powers are deployed. And the law must explicitly protect material that could reveal privileged communications or identify journalistic sources.

The timing is tight. Parliament is scheduled to vote on the bill's second and third readings on July 1. The Media Council's call for committee review is, in effect, a plea to slow down—to let Parliament do the deliberative work that legislation of this scope demands. Whether lawmakers will heed that call remains uncertain. The bill addresses a real problem. But the council's warning names a real risk: that in solving one problem, Parliament could create another.