Articles

Trademarks are generally protected under trademark legislation (for a registered trademark) and common law tort of passing off (for unregistered trademark). Brand owners are always encouraged to have their trademarks registered because that will enhance their protection in the sense that registered trademark owners will enjoy exclusive rights in connection with the class of goods/services for which the trademarks are registered in. Courts in many jurisdictions, including Malaysia, have recognized that the protection of trademark laws extends to the use of trademark over the Internet. However, in this Internet age where the use of the trademark (whether authorized or unauthorized) is becoming so prevalent, registering trademark alone is not enough when it comes to protecting and enforcing trademark rights. The Internet presents many opportunities and challenges to brand owners. Brand owners will need to develop and implement strong brand management and protection strategy, alongside with continuously monitor, protect and enforce their trademark rights to prevent misappropriation of the goodwill and reputation in their trademarks. This article outlines several forms of trademark infringement that currently take place on the Internet. Cyber Squatting “Cybersquatting” is a form of trademark infringement. It refers to an act of registering, trafficking in or using a trademark belonging to someone else with bad faith intent to profit from such an act. For example, in 2008, an individual from Ipoh registered www.google.my as his domain name. When Google Inc. found out about that, Google Inc. filed a complaint against that individual and won the case because Google managed to prove that the domain name was identical with its trademark and that the individual had registered and/or used the domain name in bad faith. If a domain name dispute involves generic top-level domains (gTLDs)(e.g. .biz, .com, .info, .mobi, .name, .net, .org), the trademark owner can file a complaint with any of the approved dispute resolution service providers accredited by the Internet Corporation for Assigned Names and Numbers (ICANN) under the Uniform Domain Name Dispute Resolution Policy (UDRP). If a domain name dispute involves country code top-level domains (ccTLDs) (e.g. .my), the trademark owner can file a complaint with the Regional Centre for Arbitration Kuala Lumpur under the Mynic’s Domain Name Dispute Resolution Policy (MyDRP). Auction Sites Trademark owners have brought legal suits against large auction sites for allowing their users to misappropriate legitimate trademarks on their sites to attract buyers to buy counterfeit goods. In Tiffany v eBay (2010), Tiffany brought a trademark infringement suit against eBay for the sale of non-genuine jewellery of the auction site. The US Court of Appeals rejected the claim of direct infringement on the basis that eBay used the mark to describe the genuine Tiffany goods offered for sale on the site. The court held that eBay’s alleged knowledge of the availability of counterfeit goods on the site was not a basis of such a claim and to impose liability on such grounds would unduly inhibit the lawful resale of genuine Tiffany goods. The fact that eBay also removed those listings involving the sale of counterfeit goods upon being notified by Tiffany and suspended repeat offenders showed that eBay had not contributed to the infringement. Similarly, in L’Oréal v eBay (2009), the UK court decided that L’Oréal failed to prove that eBay had procured sellers’ particular acts of infringement and that eBay was not under a legal duty to prevent infringement and that mere facilitation with knowledge and intention to profit was not enough to establish a joint liability trademark claim. These two cases show that, while there is no doubt that the individual sellers have infringed the trademark rights by selling counterfeit goods online, it is difficult to also argue that the auction sites are jointly liable with the sellers. Virtual World Trademark infringement also takes place in virtual world online games such as Second Life, an online social community created by Linden Labs. Second Life facilitates and encourages user-generated content, which can be sold to other users for virtual currency, which can, in turn, be exchanged for real currency. There is a real risk that users may create and sell digital content which infringes the trademark rights of real-life brands. For that reason, many real-life brands have established themselves within Second Life. In the US case of Taser International Inc v Linden Research Inc (2009), Taser filed a trademark infringement suit against Linden as Second Life’s users have created and sold virtual guns bearing Taser brand in Second Life. The case was settled out of court subsequently. This case goes to show that brand owners will now have to also monitor the unauthorized use of their trademarks in both physical and virtual worlds. Social Media The popularity and the use of online social networking sites such as Facebook, Twitter, YouTube and LinkedIn have grown exponentially across almost all jurisdictions around the world. The username features on social networking sites have created a new form of cybersquatting. For example, a user who has registered an account on Facebook is given a vanity URL for his profile page. Hence, instead of www.facebook.com/id=8473659, a user’s vanity URL is known as www.facebook.com/yourname. This obviously posed a new risk to brand owners as users could, theoretically, choose a name consisting of a trademark not belonging to them. In light of this risk, many real-life brand owners have established an official Facebook page. Facebook has established a mechanism for reporting infringing usernames. If a brand owner discovers that a third party’s username consists of his registered trademark, he can complain to Facebook by using the forms provided by Facebook and ask Facebook to remove the contentious page or disable access to that page. To further ensure that only brand owners get to keep their username, Facebook’s usernames are not transferable (hence eliminating the problem of registering the username in bad faith with the intent to profit from such act) and that usernames which have been removed will no longer be made available to other users. Similarly, on Twitter, each user is given a username upon

The rapid growth of digital technology and the proliferation of the Internet have challenged the traditional notion of intellectual property rights protection, particularly with respect to copyright. Copyright Online Originally, the Internet only offered access to the World Wide Web, which was merely a collection of interconnected documents and resources. However, today, the Internet offers various services, ranging from email, file transfer, online gaming and e-commerce to social networking. Internet users have more control over the creation of content as they can easily create web pages and blogs and web profiles on social networking sites. While the Internet enables works to be made available to a wide audience at minimal cost, the ease of access to these works also means that works are easily copied, stored and distributed to others without the consent and knowledge of the owners of these works. The amendment to the Copyright Act 1987 (“Amendment”) seeks to address the challenges that the Internet has posed to copyright law. The Amendment also aims to fulfil the requirements that will allow Malaysia to accede to the WIPO Copyright Treaty and WIPO Phonograms and Performance Treaty as well as to keep the Copyright Act 1987 abreast with new developments and international standards. This article discusses two main features under the Amendment, namely (i) the circumvention of technological protection measures and electronic right management information systems; and (ii) the liability of Internet Service Providers. Circumvention of technological protection measures for copyright Certain copyright owners put in additional self-help technical measures such as access control measures and copy control measures (such as passwords, encryption, access codes) to restrict access to or prevent copying of their works. The Amendment makes it an offence for anyone to circumvent, or cause or authorize anyone to circumvent, technological protection measures used by copyright owners to protect their works. It is also an offence for anyone to manufacture, import, distribute or possess any technology, device or component which is used, designed or produced for the purpose of enabling or facilitating the circumvention of technological protection measures. Circumvention of electronic right management information systems Some copyright owners also implement electronic right management information systems to protect their works. Electronic right management information systems (such as electronic watermarking placed in the copyrighted work) are electronic means used by copyright owners to identify and track the utilization of their works as well as to set terms relating to the use of their works. The Amendment makes it an offence for anyone to do certain acts which he knows or has reasonable grounds to know that such acts will induce, enable, facilitate or conceal copyright infringement. The prohibited acts are: the removal or alteration of any electronic right management information without permission; or the distribution, importation for distribution or communication to the public without permission, of works or copies of works knowing that electronic right management information has been removed or altered without permission. Liability of Internet Service Providers Prior to the Amendment, there was no specific indemnity provision to indemnify the liability of Internet Service Providers (“ISPs”) in relation to civil suits brought by copyright owners. Arguably, ISPs may be jointly and severally liable with the copyright infringers as the Copyright Act 1987 is drafted so widely to catch both primary and secondary copyright infringers. The issue is, whether a person can be liable for copyright infringement simply by providing the gateway to the Internet or hosting web pages in which copyright infringing materials are available on the web pages. The Amendment now provides safe harbour provisions to protect and indemnify ISPs against any claims of copyright infringement in relation to the use of the services of intermediaries by third parties for infringing activities under copyright law. “Service provider” means a person who provides services relating to, or provides a connection for the access, transmission or routing of, data. It includes providers and operators of facilities for online services and network access and is arguably wide enough to cover ISPs which include website operators, web hosting, server and cloud computing providers. The Amendment exempts an ISP from liability for copyright infringement for certain activities such as transmitting, routing or providing connections of an electronic copy of the work through its primary networks or system caching, as Parliament recognises that these activities are necessary to provide efficient access of data. It states that an ISP will not be liable for transmission or transient storage provided: (a) the work is not initiated by the ISP; (b) the transmission is done through an automatic technical process; (c) the ISP does not select the recipient; (d) the ISP does not make any modification to the content of the work; or (e) there is no notice given by the copyright owner. Nevertheless, the court has the power to order the ISP to disable access to the account and/or terminate the account. As for storage and information location services, the ISP will not be liable for infringing materials stored on its network at the direction of the user or for providing hyperlink or directory or an information location service such as a search engine if: (a) the ISP has no actual knowledge of the infringing materials and/or is not aware of the facts that make the infringing activity apparent; (b) the ISP does not receive any direct financial benefit and has no right to control the infringing activity; and (c) the ISP responded timely to the take-down notice from the copyright owner. Notice and Take-Down Procedure When Copyright is Infringed A copyright owner whose work has been infringed on a network may give a notice to the ISP to remove or disable access to the infringing electronic materials on the network. The ISP must then remove or disable access to the infringing materials within 48 hours. It is an offence to give false notice. The person whose electronic copy of the materials was removed or to which access has been disabled may issue a counter notification to the ISP to request that the copy

Imagine this. You just bought a laptop two weeks back. But now the battery is emitting smoke and your hard disk has caught fire. Plus, you have an ugly burn mark left on your legs! And, all this despite the fact that the seller had guaranteed you that the laptop was in good condition and that he would give you your money back if it was not! Well, luckily in Malaysia, there are 3 POSSIBLE WAYS for you to take. You can assert three different claims against the seller and manufacturer as provided under the Malaysian law: product warranties, guarantees and liabilities. Now, it’s important to note that all three are usually categorized under “warranty”. But from the legal perspective, there are some differences between them. Trader’s liability under the law of supply of goods or services in Malaysia is generally governed by two legislation, namely the Sale of Goods Act 1957 (“SOGA”) and Consumer Protection Act 1999 (“CPA”). Both legislation provide for the obligations of the seller and the rights of the buyer. Product Warranties Warranties in the legal sense are optional obligations of the seller, which is why he – aka The Seller – can formulate them the way he wants. These are usually terms that are expressly stated in the contract between the seller and buyer. These terms can be made orally, in writing or by way of advertisement. Therefore, any statement made by the seller becomes an express warranty, especially if the buyer relies upon it to purchase the product. The seller is legally obliged to fulfil his warranties should the buyer decide to claim for the warranties. Some common examples of product warranties are such as limited, extended or lifetime warranty period, money back or satisfaction guarantee, insurance coverage, etc. The seller would also set out under what type of conditions the product can be returned, replaced or repaired, and cases in which the seller would not be liable for. Consumers are advised to read the product warranties carefully, as those fine print can often contain some pitfalls, and that certain things are excluded from the warranties. For example, the seller may provide warranty for the battery but not for the hard disk; or that labour, transport or spare parts charges would have to be borne by you. Certain product warranties contain a clause which states that; “This warranty becomes null and void if any sticker is tampered with; or if the damage is caused by misuse, abuse or accident; the attachment of any unauthorized accessory; alteration to the product; improper installation, etc.” Therefore, you have to ensure that the product is not tampered with, either by yourself or by anyone else. Also, please do keep the warranty card and the receipt of purchase. This is to help the manufacturers keep track of the product and to keep them informed of the expiry date of the warranty. Product Guarantees Guarantees are rights given to consumers under the law, and they are referred to as implied warranties. An implied warranty is based on an assumption that there is an understanding of some sort of guarantee between buyer and seller. Under implied warranties, the warranty is based upon the buyer’s reasonable expectations about the products. When the warranty is breached, the seller must either repair, refund or replace the product. When a buyer purchases a product, there is an implied warranty that the product must be of acceptable quality, unless the seller makes it clear to the buyer that the product is sold on an “as is, whereas” basis or “with faults”. A product will be considered to be of acceptable quality if it is: Fit and suitable for all the purposes for which the product is commonly used; Acceptable in appearance and finish; Free from minor defects; Safe; and Durable. Hence, when a buyer purchases a laptop, he is under a reasonable expectation that the laptop will be of acceptable quality within a reasonable period of time. If the laptop explodes without default, negligence or omission on the part of the buyer, that laptop is not of acceptable quality. There is also an implied warranty that the product will be; The same as the description or sample was shown to the buyer; That the product will be fit for a particular purpose when a buyer relies upon the seller to choose the product to fit a specific request; The seller has the right to sell the product and when the ownership of the product passes to the buyer, the buyer has the right to possess the product free from any interference; Where the price for the product is not stated in the contract, the buyer is expected to only pay for the reasonable price of the product; and lastly, The seller and manufacturer have an obligation to ensure that they provide repairs and spare parts for a reasonable period of time after the product is sold. Product liabilities Referring to the horror scenario above, what remedies do you have in the event you have suffered personal injury caused by a defective product? Under the law, any person (including non-buyer) who suffers death or personal injury caused by a defective product, or his property is damaged by the defective product, can claim for compensation from the manufacturer directly. It is logical that a manufacturer should be made liable for defective products because (a) they manufacture the products and (b) they have control over the quality and safety of them. Plus… Liability can be imposed without a contractual relationship and proof of fault. In addition to suing the manufacturer under breach of an implied warranty under product safety, a buyer may also sue the manufacturer for breach of contract and breach of duty of care under the tort of negligence. Conclusion The CPA, being a piece of legislation enacted to protect the consumers’ rights and interests, states it clearly that the provisions under the CPA cannot be contracted out. In other words, traders cannot, by way of limitation

In December 2014, it was reported in the news that the Ministry of Domestic Trade, Cooperatives and Consumerism had said that under the Consumer Protection (Electronic Trade Transactions) Regulations 2012 (“Electronic Trade Regulations”), online traders must first register themselves with the Companies Commission of Malaysia before they can start selling and trading on online marketplaces or their own e-commerce websites. The e-commerce industry is booming. The Alibaba Group, a Chinese e-commerce company founded by Jack Ma, claimed the title for the largest global IPO ever when it got listed on the New York Stock Exchange in September 2014. On the date of its IPO, Alibaba’s market value was measured at US$ 231 billion. In this part of the world, Malaysia and Singapore generate almost half of total online retail sales in Southeast Asia, and both countries are expected to record double-digit growth over the next few years. This article is therefore intended to set out some basic legal aspects that every online trader/operator should take note of, before venturing into, or continuing with, the e-commerce business. The Electronic Trade Regulations apply to individual person and business that sells and supplies goods or services via a website or an online marketplace (e.g. an online trader), as well as online marketplace operator (e.g. an e-commerce/marketplace website operator). One of the requirements under the Electronic Trade Regulations is that the individual person or business must disclose the business name (either the name of the owner, business or company) and the registration number of the business or company, if applicable. Furthermore, since Malaysian laws view online business as no different from physical business i.e. both are accorded with the same kind of legal treatment, it comes as no surprise that the Government now requires all online traders/operators to follow the same steps like what a physical trader/operator would take. As a matter of fact, doing business online includes many of the same business/legal risks and challenges that any brick and mortar business faces. Registration of business Apart from coming up with a business model that can be monetized, the first step that every online trader/operator would usually take is to register his business. There are several legal structures that an online trader/operator can choose, with each of them attracting different legal implications. Examples of the legal structures are such as sole proprietorship, partnership (general or limited liability), limited company (e.g. Sdn Bhd or Bhd) as well as a foreign company. Issues such as transferability, management, number of members, shares ownership, constitution, capital and liability, borrowing powers, security over assets and dissolutions must be thoroughly considered and discussed before deciding which legal structure to form. Accounting, taxes and other record-keeping requirements An e-commerce business, like any other business, must keep and maintain accurate records of its business transactions and accounts, and make sure that the business and accounting records are completely separated from personal financial records. An online trader/business may also enter into various types of online contracts for online services that he procures in order to conduct business. Copies of these contracts must be kept for future reference. Such records must also be kept in accordance with the minimum retention periods as prescribed by the relevant laws (for example, the Companies Act 1965, the Income Tax Act 1967 and the Goods and Services Tax Act 2014 requires that certain records must be kept for at least 7 years whereas the Customs Act 1967 requires that records pertaining to importation of goods must be kept for at least 6 years), so that in the event of an audit or investigation, the online trader/operator would be able to produce the records as evidence. Depending on the legal structure that an online trader/operator chooses, he may have to follow certain annual processes and procedures as required by law to keep the structure active and valid. For example, every limited company must file an annual return (accompanied by copies of documents, certificates, financial statements) with the Companies Commission of Malaysia within one month after the Annual General Meeting every year. Every company must also keep at its registered office a register of its directors, managers and secretaries containing all personal particulars and information relating to shareholdings, charges, accounts, minute books, share certificates book as well as a set of company common seal. The online trader/operator must also pay taxes to the Inland Revenue Board and the Royal Malaysian Customs Department, where applicable. Online Contracts Website terms of use and privacy policy are the two most common documents that will usually be put up on an e-commerce website. Website terms of use contain terms that essentially work as a form of contract that governs the terms under which users use the website. The terms of use should set out the responsibilities of both users and website operator; how users can use the website (including the materials on the website); the copyright ownership of the website (including the user-generated contents); the liabilities disclaimer and the limited warranties/indemnities that the website operator is willing to give as well as a refund/cancellation policy (if it is an e-commerce website) or a social media and comment moderation policy (if the website allows user reviews or it hosts a blog/forum). A privacy policy, on the other hand, sets out the manner in which the users’ personal data will be collected, processed and disclosed. If website cookies are used to collect personal data, that must also be disclosed accordingly in the privacy policy. All online traders/businesses must make sure that they comply with the obligations set out under the Personal Data Protection Act 2010 if they collect and process personal data in Malaysia (regardless of whether their users are Malaysians or non-Malaysians). The website terms of use and privacy policy are essentially online contracts that bind both the user and the trader/operator. Like any other contracts that a trader/operator would sign in the physical world, the contracts must be properly drafted and vetted. This is to make sure that the terms are consistent with

So, you have launched your technology startup. What’s next? Launching a startup is just the beginning of a long and often uncertain journey. Not only you will have to put in extremely long hours and spend a lot of money into developing and fine-tuning your product or service, but you will also have to learn how to manage your startup and run it like any other kind of business. Managing Your Employees No one can build a startup entirely on his own. You will have to start bringing people into your team and working with other people at some point in time. Jason Baptiste in his book, “The Ultralight Startup” says that “people are the most important asset of a startup. They breed perseverance, come up with great ideas, and let you build for the long haul and ultimately succeed. Once you have great people on board with what you are doing, everything will fall into place over time”. When you hire new employees, make sure that you put in place a proper letter of offer or employment agreement which sets out all the relevant terms of employment to prevent uncertainty liability and unnecessary dispute in the future. Clauses such as termination grounds, notice period, salary and other benefits, non-solicitation, confidentiality, limitations on the employee’s ability to compete with your business after the employee leaves employment, protection of intellectual property, etc should always be clearly set out in a letter of offer or employment agreement. You must also make employees provident fund (EPF) and social security fund (Socso) contributions to your employees as well as comply with the prescribed minimum wage and minimum retirement age requirements. The prominent business management guru Peter Drucker once said, “the most valuable asset of a 21st-century institution, whether business or non-business, will be its knowledge workers and their productivity.” In today’s knowledge economy, it is the people who create intangible assets such as intellectual property, patents, brands, designs, etc. If you manage your employees well, they will become your valuable asset, but if you don’t, they can also become your biggest liability. Intellectual Property Rights Protection If people are the most valuable asset in an organisation, then the next most valuable asset must be the intellectual property created by the people. This is particularly true in a technology startup where it is the innovative product or service that forms the core asset which generates profits for the startup. You should have a good understanding of intellectual property rights so that you will appreciate how to realise the full economic value of your intellectual property and incorporate them into your business strategies. Trade secrets are basically confidential information that is not publicly available, such as ideas, designs, methodologies, processes, marketing plans, methods of business operation, pricing policies, etc. One of the ways to protect the value of a trade secret is to enter into a non-disclosure agreement prior to the disclosure of any confidential information. In addition, you will also need to put in place a proper information protection program. If your invention provides a new way of doing something or offers a new technical solution to a problem in the field of technology, your invention can be protected as a patent. You should also register your brand as a trademark. If you are in the business of product design, the three-dimensional features such as the shape and configuration of your product, or two-dimensional features, such as pattern and ornamentation of your product can be protected as an industrial design. Copyright is a form of protection that is granted to authors of literary, dramatic, musical and artistic works. Copyright does not protect the idea, but rather the expression of an idea. Director Duties A company, while it is recognised as a legal person in the eyes of the law, cannot act on its own. Ultimately, the day-to-day affairs of a company will still have to be run and managed by a group of natural person i.e. directors, officers and shareholders. The Companies Act 1965 and the common law set out certain statutory and fiduciary duties of a director: Duty to act in good faith and for proper purpose in the best interest of the company with reasonable skill and care Duty to make independent assessment of the information, professional or expert opinions presented to him Duty to ensure dividends are declared from profit and not capital Duty to seek shareholders’ approval at the general meeting before carrying out any arrangement or transaction of substantial value relating to the company Duty to keep proper accounts and registers and to make the same available for inspection when required Duty of fidelity i.e. being faithful and loyal to the company Duty not to profit secretly from the company, or place himself in a position of conflict of interest between his duties to the company and his personal interests Duty not to fetter his discretion by agreeing, either with one another or with third parties, on how to vote at future board meetings Breach of any of the above duties may result in the director being judged as unfit to remain in the management of a company and lead to his disqualification as a director. He may also face civil and criminal liabilities and in certain cases, personally liable for the loss or damage suffered by the company. Financing the Business The growth in the technology startup ecosystem has attracted investors and fund seekers alike. Startups usually face challenges in raising enough money to fund their working capital, research and development as well as a marketing expenditure. Before you start looking for funding, you should first be sure that your business is ready to raise funding. Investors will look at three key factors when considering a startup for potential investment: people, product and market. Issues such as whether you have a strong management team, whether you have developed a good product or service and whether your product or service has gone through market validation must first be dealt

So you have an innovative idea and you are very confident that your idea is of a revolutionary nature that will change the world and become the next big thing. You think it is about time to turn that idea into reality. So you quit your job and start a company. Launching a startup requires far more than just a good idea. You need to come up with a business model, write a business plan, design your sales and marketing strategies, hire people, make good use of your assets as well as look for funding to finance your startup. All of these require your careful analysis and attention since they all bring along different types of risks, including legal risk. Many entrepreneurs do not realise the importance of having a strong legal foundation for their startup until it is too late. They fail to appreciate that launching a startup is as much about the structure as it is the product or service. Entrepreneurs who seek legal advice at the early stage of their business enjoy the benefit of avoiding any unnecessary legal pitfalls. Duties to Previous Employers Many entrepreneurs were once employees of another company before launching their own startups. It is very important for the entrepreneurs to make sure that they do not breach their duties to their previous employers when starting their own companies. Such post-employment duties are usually found in the form of assignment of intellectual property (IP), confidentiality obligation, non-compete and non-solicitation covenants. Assignment of IP – Many companies (particularly technology-based companies) require employees to sign IP assignment agreements which provide that the employee agrees that any inventions, ideas, work product or other development conceived or developed during the course of the employee’s employment will belong to the employer. Even in the absence of a written agreement, the Copyright Act 1987 and the Patents Act 1983 state that, unless otherwise agreed by the parties, the employer is deemed to be the first owner of the work made in the course of the employee’s employment. In other words, if you had invented an invention or written a source code as part of your job, you cannot bring along with you and use it when you leave the company. Confidentiality Obligation – Under the common law, an employee owes a duty to maintain the secrets and confidential information of an employer, whether or not there is a written agreement to that effect, and such obligation continues even after the employee has left employment. Certain things like trade secrets and customer lists are considered confidential information. The employee must refrain from disclosing or using such information for the purpose of operating a new startup. Non-compete and non-solicitation covenants – Depending on the position of the employee, certain employment agreements also include covenants from the employee not to compete with the business, or to solicit employees, customers or suppliers of the former employer for a period of time after the employee has left employment. Generally, non-solicitation covenants are enforceable if properly drafted. As for non-compete covenants, usually, such covenants are void to the extent of the restraint unless such covenants are drafted in such a way as to include an element of the use of confidential information belonging to the former employer. There is generally no restriction on stopping an ex-employee from making any use of experiences or skills that he had acquired in the course of his employment or starting a business to compete with his former employer’s business. Legal structure, licenses, permits Startups may run their business through different legal structures, such as sole proprietorships, partnerships or companies. Sole proprietorships/conventional partnerships enjoy flexibility in administration as in there is no issuance of shares, no formal requirement to submit financial statements to the Companies Commission of Malaysia (CCM) and no need to hold Annual General Meetings. However, sole proprietorships/conventional partnerships do not enjoy the benefit of limited liability like what a private limited company would enjoy. The owners of a private limited company will only be liable for the company’s debts up to the amount of their shareholder investments, except in cases where they are found to be personally liable by law, such as fraud or breach of directors’ fiduciary duties. In light of this, startups should consider setting up their business through a limited liability partnership (LLP). The LLP is a hybrid between conventional partnership and company whereby the partners enjoy both flexibilities in terms of administration and the limited liability status. However, if you hope to attract investors, a private limited company might be a better structure. Depending on the location and nature of your startup, there may be federal, state and/or local licensing and permit requirements that you must follow before launching your startup. Co-founders agreement, shareholders agreement If you have one or more than one co-founders, it would be good to put a co-founders/shareholders agreement (depending on the legal structure) in place. The agreement should address each party’s role, duties and obligations in the startup, how profit and equity will be divided, the voting process, board composition, how the shares will be broken down and at what price the shares will be sold if a founder leaves, how the startup can be dissolved, etc. Whether you are bringing in an investment or hiring an employee or developer, it is important to have a written agreement in place at the outset to avoid disputes in the future (Remember the movie “The Social Network”)? Some startups issue shares to key personnel under a share option scheme to incentivize them to work towards the success of the business. This should also be properly documented. What’s in a name? Names are always important. The power of words should never be underestimated. The company name must contain the word “Sendirian” or “Sdn.” and “Berhad” or “Bhd.” For LLP, the name must end with the words “Perkongsian Liabiliti Terhad” or “PLT”. The company/partnership name must not be the same as any other company/partnership in Malaysia. The law prohibits or regulates

Professor Chris Reed in his article “What is a Signature?” states that the principal function of a signature is to provide evidence of three matters: (i) the identity of the signatory; (ii) the intention to make a signature to indicate agreement and willingness to be bound by the contents of the document; and (iii) that the signatory adopts the contents. In other words, the signature demonstrates that the signatory had the intention to authenticate the document, which serves as a form of evidence in the event of a dispute. Generally, many people still prefer to sign on a printed form of contract. While this approach is widely adopted, it comes with several risks and challenges. How does the recipient know the signature is not forged? How does the signatory know that his signature is linked with the contract or that the contract that he agreed is the contract he “signed”? It is a recognized fact that physical documents can be easily altered and signatures can be forged. With the advancement of technology and wide availability of online E-Signature services, it is, therefore, a high time for us to examine an alternative form of signing via electronic means, known as “E-Signature”. Since contracts can be prepared electronically, it is only natural that signing should also take place electronically. Types of E-Signature Since a traditional handwritten signature is not possible on an electronic contract, people have used several different methods to indicate their E-Signatures, including: typing the signatory’s name or a placing a unique representation of mark into the signature area; scanning a physical manuscript signature; pasting a scanned version/image file of the signatory’s signature into the signature area; signing with a special pen on a pad which is used to measure and record the actions of the person as he signs; clicking on a website button/ticking off a tick box to this effect (for e.g. “I Agree”, “I Accept”, “Confirm Order”); inserting an E-Signature via an online E-Signature service; attaching a digital signature created by cryptographic means whereby the sender affixes the signature using his private key and the recipient checks the signature using his public key (more commonly known as “digital signature”). I would not recommend the first 3 methods as they provide very little security against forgery and misuse, and they are more vulnerable to identity theft if the communication is intercepted. Legal Status of E-Signature The issue is whether E-Signature is legally recognized under the law. In 1996, the United Nations published the UNCITRAL Model Law on Electronic Commerce which was highly influential in the development of E-Signature around the world. It was the first model law that sets forth the principle of non-discrimination in order to ensure that a document is not denied legal effect, validity or enforceability solely on the grounds that it is in electronic form. Subsequent to this, the UN further published UNCITRAL Model Law on Electronic Signatures (2001) and the United Nations Convention on the Use of Electronic Communications in International Contracts (2005) to affirm the notion that electronic contracts and electronic signatures are as valid and enforceable as their paper-based equivalents. As a result of this, many countries around the world have enacted their own legislation to give effect to the validity and enforceability of electronic contracts and electronic signatures. In Malaysia, the Electronic Commerce Act 2006 (”Act”) recognizes “any letter, character, number, sound or symbol or any combination thereof created in the electronic form adopted by a person as a signature” as an E-Signature. The Act also states that if the document is created electronically, it can now be signed by an E-Signature. This is, of course, subject to the conditions that the E-Signature has to be attached to or is associated with the electronic document, adequately identify the person and adequately indicate the person’s approval of the contents in the electronic document and be reliable. Reliability of an E-Signature is established when the means of creating the E-Signature is linked to and under the control of that person only and as long as any alteration made to the E-Signature or to that document after the time of signing is detectable. Under Malaysian law, a handwritten signature is not necessarily required for a valid contract. Contracts are generally valid if parties have reached an agreement and intend to be bound by the agreement, whether they agree verbally, electronically or in writing. The Act specifically confirms that contracts cannot be denied enforceability merely because they are concluded electronically, although certain documents and deeds may require additional formal requirements such as notarization or attestation (for example, power of attorney, wills and codicils, trust documents, negotiable instruments, real property transfers, statutory declarations, bills of sale, etc). The principles behind the use of signatures have not changed, what the law does is to facilitate paperless signing via electronic means. Why Use E-Signature Service? Using E-Signature service in high value or important transactions can provide the level of assurance needed, build trust in the underlying system as well as improve overall customer satisfaction as the documents are more securely held and the signing process is carried out more efficiently. A good quality E-Signature service can offer the following features: Signature authentication: Anyone who signs a document via an E-Signature service must have log-in information or have received in his email account a request for signature so that you know exactly the identity of the person who signs your document. Signature affixation: Each signature on a contract is imposed and affixed to the contract. There is an audit trail that tracks who has opened, viewed and signed the document and when. The audit trail is appended to all signed documents and forms a court-admissible document log. Signature integrity: The service allows any changes to the contents to be detected more easily, showing whether the contents have been altered/tampered during and after the signing process and ensuring that the contents remain confidential and secure. Court-admissible transactions log: The service creates a comprehensive transaction log that shows the

In response to the rising tide of cyber security threats in Malaysia, the Parliament has, over the years, passed a slew of cyber legislation to deal with activities in the cyberspace and to tackle cyber attacks. There has yet to be a stand-alone cyber security legislation and there is no news that the Parliament is planning to enact one. In this article, we set out a brief description of the relevant cyber legislation and their relevance to cybersecurity as well as the cybersecurity framework that is currently in place in Malaysia. Existing Laws That Deal with Cyber Security Communications and Multimedia Act 1998 (“CMA”) As the main cyber law in Malaysia, the CMA provides for and regulates the converging areas of communications and multimedia. In particular, the CMA regulates various activities carried out by licensees (i.e. network facilities providers, network service providers, applications service providers and content applications service providers) as well as those utilising the services provided by licensees. One of the objects of the CMA is to ensure information security and network reliability and integrity in Malaysia. Computer Crimes Act 1997 (“CCA”) The CCA criminalizes the act of hacking, spreading of computer viruses and wrongful communication of any means of access to a computer to an unauthorized person. Depending on the type of offence committed, the fines range from RM25,000 to RM150,000 and imprisonment of 3 to 10 years or both. Digital Signatures Act 1997 (“DSA”) The DSA is an enabling law that allows for the development of, among others, electronic transactions, by providing an avenue for secure online transactions through the use of digital signatures. The legal recognition of digital signatures allows electronic communications to be transmitted securely, especially on the Internet. It is an identity verification procedure using encryption techniques to prevent forgery and interception of communication. Electronic Commerce Act 2006 (“ECA”) The object of the ECA is to provide for legal recognition of electronic messages in commercial transactions, the use of the electronic messages to fulfil legal requirements and to enable and facilitate commercial transactions via electronic means. It confers legal recognition to the formation of a contract via electronic means; recognizes electronic messages and electronic signatures; deems certain electronic document to be considered original as well as provides that the retention of documents in electronic format fulfils the requirements of the law, provided certain qualifying criteria are met. Personal Data Protection Act 2010 (“PDPA”) The PDPA regulates the processing of personal data in commercial transactions and for matters connected therewith and incidental thereto. The PDPA applies to anyone who processes and has control over or authorizes the processing of any personal data in respect of commercial transactions. The PDPA sets out 7 personal data protection principles, of which the most relevant one in the context of cybersecurity would be the Security Principle i.e. appropriate technical and organisational security measures shall be taken to prevent unauthorised or unlawful processing of personal data and accidental loss, misuse, modification or unauthorised disclosure of personal data. National Cyber Security Policy (“NCSP”) In addition to legislative measures, the Government has also rolled out the NCSP to strengthen Malaysia’s Critical National Information Infrastructure (“CNII”) and facilitate Malaysia’s drive towards attaining a developed nation status by the year 2020. The NCSP addresses, among other things, risks to the CNII, which concern the networked information systems of ten sectors, namely, Defence and Security; Transportation; Banking and Finance; Health Services; Emergency Services; Energy; Information and Communications; Government; Food and Agricultural; and Water. These CNII sectors have been identified based on the fact that their incapacitation would cause substantial damage to national interests and security and potentially collapse the nation’s economy. The NCSP sets out a number of “policy thrusts” to ensure the effectiveness of cybersecurity controls over vital assets. These “policy thrusts” would require the collaboration of different government agencies in ensuring effective governance and proper regulatory framework. The NCSP also requires the CNII sectors to ensure compliance with information security standards and technology-specific guidelines to a level commensurate with the risks. On top of that, the NCSP also aims to increase the technological capabilities to resolve cyber crimes through improving digital forensic lab facilities. Malaysia has identified the ISO/IEC 27001 as the baseline standard for information security and has proposed for all CNII sectors to be ISO/IEC 27001 Information Security Management Systems (“ISMS”) certified. Government Agencies/Units That Deal with Cyber Security Cyber Security Malaysia Cyber Security Malaysia (formerly known as the National ICT Security and Emergency Response Centre (“NISER”)), is a national cybersecurity specialist agency formed under the Ministry of Science, Technology & Innovation. Cyber Security Malaysia is tasked with the roles of monitoring the National e-Security aspect, providing specialized cybersecurity services and identifying possible areas that may be detrimental to national security and public safety. MyCERT and Cyber999 Malaysia Computer Emergency Response Team (“MyCERT”) addresses the computer security concerns of Malaysia’s Internet users and aims to reduce the probability of cybersecurity attacks. The agency was formed under Cyber Security Malaysia to provide a point of contact for Internet users who are affected by cybersecurity incidents. MyCERT provides assistance for users who are affected by the intrusion, identity theft, malware infection, cyber harassment and other computer security related incidents. MyCERT collaborates with other law enforcement agencies and regulators such as the Royal Malaysian Police, Securities Commission, Central Bank of Malaysia, along with Internet Service Providers and various computer security response teams around the world. Operated by MyCERT, Cyber999 is a computer security incident handling and response help centre relating to detection, interpretation and response to computer security incidents. Aside from that, it also alerts Internet users in Malaysia in the event of a cybersecurity threat or malware outbreak. CyberCSI As Cyber Security Malaysia’s Outreach & Corporate Commitment Department, CyberCSI provides full-fledged digital forensics investigations and examinations in the areas of audio and video forensics. The agency regularly works with law enforcement agencies, government-linked companies and private companies. The agency also has a team of analysts who have been gazetted under the

Let’s talk about electronic evidence (“E-Evidence”) and electronic forensics (“E-Forensics”) in this article. In Malaysia, the Evidence Act 1950 (“EA”) is the main legislation governing the forms of evidence, how evidence is to be proved and tendered to the court, its relevancy as well as its effects. Section 3 of the EA defines evidence as (a) all statements which the court permits or requires to be made before it by witnesses in relation to matters of fact under inquiry (i.e. oral evidence), and (b) all documents produced for the inspection by the court (i.e. documentary evidence). “Document” is defined to mean any matter expressed, described or howsoever represented, upon any substance, material, thing or article. As such, documentary evidence would include all forms of written, printed and electronic evidence. Information technology has caused a paradigm shift in the way individuals and organizations create, collect, share and store data and information. These data and information are stored electronically and may become important “evidence” in the event of a dispute. E-Evidence (which includes digital evidence) is any probative information stored or transmitted in digital form that a party to a court case may use at trial. The question then is whether such E-Evidence is legally recognized under Malaysian laws. The short answer to that is, yes, it is legally recognized Admissibility of E-Evidence A document produced by a computer and a statement contained therein is admissible as documentary evidence under Sections 90A, 90B and 90C of the EA. The court will determine if the evidence is relevant, reliable and authentic. E-Evidence by nature is very fragile and is easily manipulated, altered, forged, damaged or destroyed. It is prone to damage or alteration as well as destruction if it is not properly handled. Therefore, it is technically challenging in establishing the authenticity and reliability of such evidence. Section 90A provides that a document is admissible if it was produced by the computer in the course of its ordinary use. There are 2 methods to satisfy this condition. The first method is by getting the person in charge of the operation of the computer or the conduct of the activities for which that computer was used to give a piece of oral evidence that the document was produced by the computer in the course of its ordinary use. An example is shown in the case of Gnanasegaran a/l Perarajasingam v Public Prosecutor where a bank officer who was in charge of all the operations of the bank branch gave an oral testimony that the bank statements were produced by a computer at his branch. The second method is used in a situation where there is no way to bring a witness to the court to give oral evidence. In this case, the person who wants to bring up such evidence must produce a certificate signed by a person who is in charge of the operation of the computer or the conduct of the activities for which that computer was used to prove that the document was produced by the computer in the course of its ordinary use. Once the certificate is produced, there is a presumption that the computer referred to in the certificate was in good working order and was operating properly in all respects throughout the material part of the period during which the document was produced. The evidential burden of disapproving it would be on the party challenging its credibility. Other Types of E-Evidence E-Evidence includes computer generated/produced documents, computer printouts, computer outputs, computer-based/related evidence, electronic data and electronic documents. This has been recognized since 1993 when the law was amended to accept this type of E-Evidence. However, technology has changed so much that there is now a new emerging sub-category of E-Evidence called digital evidence, which refers to evidence is available in digital form or binary form. Some of the examples include chat-room and web-browsing histories, ISP records, digital photographs, video and audio files, cloud data storage facility, GPS tracks, computer hard-drives as well as local and virtual databases. Some digital evidence cannot be printed out. How would the court treat this type of evidence? In certain countries, their courts recognize the use of certain software to obtain and secure digital evidence and accept testimonials given by digital forensics experts. Authenticity of E-Evidence Once the document is admissible as a piece of evidence, the court will then need to assess the authenticity and relevancy of such evidence. Section 90B says that the court may draw any reasonable inference from circumstances relating to the document or the statement, including the manner and purpose of its creation, or its accuracy, in assessing whether the evidence is authentic and reliable. This would be essentially a question of fact and the parties would need to bring in circumstantial evidence to strengthen such evidence. The court recognizes that although the oral testimony and certificate are two means of authenticating E-Evidence, they are not sufficient to ensure the originality and genuineness of E-Evidence. The court will also examine the collection, preservation and discovery of the E-Evidence to ensure that the contents of the E-Evidence are authentic. E-Forensics Other than calling the maker or witness to the court, another authentication method is by getting an expert opinion from the digital forensics experts (Section 45 of the EA). These experts are trained and skilled in investigating and preserving E-Evidence to ensure that the chain of custody of such evidence is preserved in its original and authentic form up to the time when the evidence is produced in court. While there is no specific provision under the EA that provides for the admissibility of digital forensics evidence, our courts have accepted digital forensics findings as expert opinions provided the experts follow the procedures when giving the evidence. Getting help from the digital forensics experts is important especially in cases where the electronic data is deleted or destroyed. These experts have the necessary tools and expertise in retrieving the lost data. Recognising the need for the development of digital