Articles

Pokemon Go has officially arrived in Malaysia. This augmented reality mobile app game has taken the world by storm and become a worldwide phenomenon since its debut in July 2016. It has more daily active users than Twitter and is fast becoming one of the most downloaded mobile app games ever. Pokémon Go is an augmented reality game that uses GPS on smartphones to identify players’ (in the game, such players are called “trainers”) physical location and shows trainers a map of their real-life surroundings. The game combines real-life surrounding places such as parks or buildings with virtual characters or objects that appear on the smartphone. The goal is to collect and train virtual Pokémon characters. The more Pokémon the trainer catches, the higher his or her ranking rises. Like all things, what comes with a wildly popular and innovative technology is always a series of fascinating legal issues that it raises. For Pokemon Go, some have raised concerns about its impact on privacy, property rights, trespass, public safety and liability. To make matter worse, the game has been linked to serious crimes such as kidnapping, robberies and sexual offences. Privacy When it was first launched, the Pokémon Go app requested permission to access and control all of the data associated with the trainer’s Google account (including emails, calendar entries, photos and even stored documents). This had caused some privacy concerns to the trainers and Niantic (Pokémon Go’s developer) has since remedied this by restricting access to only Google IDs and email addresses. However, the app still tracks the location data every time a trainer uses the app. Due to the nature of the game, most trainers leave the app and GPS on at all times while waiting for some rare Pokémon to appear. This means that, effectively, the movements of trainers could be tracked whenever and wherever they go. The app has access to a lot of data which if falls into the wrong hands, could lead to a privacy nightmare for trainers. The app also has a feature which places “gyms” at certain locations to attract trainers to battle against each other. There are news reports claiming that gyms that are placed at private residences and business premises have attracted dozens to hundreds of trainers, which potentially infringe the privacy and peace and quiet enjoyment of individuals and businesses. Also, as the app allows trainers to turn on their cameras when playing the game, there is a possibility that perverts or paedophiles may use their cameras to take pictures of girls or young children in public places on the pretext of playing the game. Trespass and Unlawful Assembly The game also places PokéStops at certain places that invite trainers to catch Pokémon at PokéStops. While most PokéStops are found in public places, do be mindful that not all public places are freely open to the members of public without any form of restrictions. For example, you cannot simply walk into the military bases, prisons and certain government-controlled offices without a proper permit. Anyone who does so can be found guilty of wilful trespass on government property under Section 22 Minor Offences Act 1955 (Revised 1987). For PokéStops that are found in private residences, you are also not allowed to climb over the fence or gate of your neighbour’s yard to catch Pokémon, as that would constitute a criminal trespass on private property under Section 441 Penal Code, which if convicted, you can be jailed up to 6 months or fined up to RM3,000 or both. If there is a wake or funeral proceeding, you can be found guilty of criminal trespass if your act of entering the area insults the religion of any person or disturbs the performance of a funeral ceremony, and you can be jailed up to 1 year or fined under Section 297 Penal Code. If you together with a group of friends (more than 5) gather at a place, all of you might commit a crime of unlawful assembly, if your intention is to commit an offence there or if the police ask you to leave but you stay on and you resist the execution of any legal process by the police. You and your friends can be jailed up to 6 months or fined under Section 141 Penal Code. Nuisance Even if you do not walk into someone’s house but you loiter around the perimeter of the house and create a lot of noise late into the night, the house owner can sue you for the tort of private nuisance if your activity interferes with his quiet enjoyment and use of the house. Both trespass and nuisance are also civil wrongs which allow the property owner or lawful occupier to sue you for compensation. If you cause any property damage, you will also be responsible for that. Pokemon Go Developer’s Liability It has also been reported that some trainers had suffered injuries while playing Pokemon Go (running into physical surroundings such as trees or lamp posts, getting into car accidents, falling off cliffs). Can the trainers sue Niantic for such injuries by arguing that it is predictable that trainers would stare at their phones while walking distractedly and ignore oncoming cars and natural hazards? Such argument might be weak, considering that Pokémon Go has put in place certain warnings and safeguards to warn trainers “be mindful of surroundings and play at their own risk”. This is very much like if an individual gets hit by a car while text-walking, and assuming no fault on the part of the driver, the individual only has himself to blame for his injury. The Terms of Service also includes disclaimers against any damage, injury or death that may occur during the use of the game. All trainers are required to agree to the Terms of Service in order to play the game. Pokemon Go Occupiers’ Liability Some small businesses and organisations are riding on the popularity of Pokemon Go by paying the game a daily fee

The issue of the need to maintain net neutrality and an open Internet concept has been a considerable debate for years, with the most recent development being the landmark ruling of the US Court of Appeals for the District of Columbia Circuit on 14 June 2016 in favour of net neutrality. Net neutrality is a principle which requires all Internet Service Providers (“ISPs”) to treat all sources of online content equally and provide all consumers with the right to access the content on a non-discriminatory basis. The idea behind net neutrality is that the Internet should remain open and neutral with uninhibited access to online content without the ISPs being allowed to block, impair or establish fast/slow lanes on the delivery of online content to consumers. However, ISPs argue that they have the right to optimise the use of the network resources and that Internet traffic or traffic prioritisation measures are necessary to ensure a reasonable quality of service standard for all Internet users, especially as Internet traffic continues to grow. The Open Internet Rules in the US In the US, the Federal Communications Commission (“FCC”) has developed Open Internet Rules, which are designed to protect free expression, innovation and economic growth on the Internet, as well as to promote investment in broadband networks. The Open Internet Rules are also intended to ensure that consumers and businesses alike have access to a fast, fair and open Internet. The FCC’s Open Internet Rules came into force on 12 June 2015 and apply to both fixed and mobile broadband Internet access services, which is classified as a “telecommunications service” by the FCC. Essentially, the Open Internet Rules set out five bright-line rules, as follows: (a) No blocking: ISPs are not allowed to block access to lawful online content, applications, services or non-harmful devices; (b) No throttling: ISPs are not allowed to impair or degrade lawful Internet traffic on the basis of content, applications, services or non-harmful devices; (c) No paid prioritisation: ISPs are not allowed to favour some lawful Internet traffic over other lawful traffic in exchange for consideration of any kind (in other words, ISPs are not allowed to provide “fast lanes” to certain content/service providers who are willing to pay in exchange for fast lanes); (d) No unreasonable interference: ISPs are not allowed to interfere unreasonably with their end users’ ability to use broadband Internet access services, or with their edge providers’ ability to make lawful online content, applications, services and devices available to end users; and (e) Enhanced transparency: ISPs must publicly disclose accurate information regarding the network management practices, performance and commercial terms of its broadband Internet access services to allow end users to make informed choices and for content, application and service providers to develop, maintain and market Internet offerings. As many as 4 million Americans have overwhelmingly voted to support the FCC’s initiative in keeping a free and fair Internet. Many tech giants like Google, Facebook and Netflix have also rallied in favour of the Open Internet Rules. It is said that without net neutrality, ISPs may choose to deliver certain online content at a slower speed, for example, making the video streaming on Netflix or YouTube buffer, unless they pay extra to get in the fast lane. However, the Open Internet Rules were not welcomed by the ISPs and they brought a case against the FCC. They argued, amongst others, that as broadband is an information service, as opposed to a telecommunications service, hence the FCC lacked statutory authority to create the Open Internet Rules and impose them on ISPs. They also argued that some of the rules were unconstitutionally vague and ran afoul of the US Constitution. The US Court of Appeals rejected the ISPs’ arguments and held in favour of the Open Internet Rules. The court held that: FCC had the authority to reclassify broadband as a telecommunications service. This was based on the evidence that consumers generally viewed broadband as essential communication and information platform that transmits data of their own choosing to their desired destination, as opposed to a mere information service; interconnection arrangements are derivative of the broadband Internet access service and hence, they could be regulated under the law; FCC had the authority to come up with measures to encourage the deployment of broadband infrastructure and rules to govern ISPs’ treatment of Internet traffic; and the Open Internet Rules generally require ISPs to offer a standardised service that transmits data on a non-discriminatory basis. Such equal access rule did not run afoul of the First Amendment to the US Constitution (which affirms the right to freedom of expression). This decision affirmed the US Government’s view that broadband is a utility that should be made equally available to all consumers, rather than a luxury that does not require government supervision. This decision marks a landslide victory for net neutrality in the US and an enormous win for consumers. With this decision, all ISPs must treat all Internet traffic equally, and this assures a level playing field for all online content and benefit both consumers and online content developers alike. President Obama – The Man behind the Push for Net Neutrality Rules The current US President, Barack Obama, is known as an ardent supporter of net neutrality. He has been instrumental in calling on the FCC to take up the strongest possible rules to protect net neutrality. In an open letter to the FCC in November 2014, he wrote, “an open Internet is essential to the American economy, and increasingly to our very way of life. By lowering the cost of launching a new idea, igniting new political movements, and bringing communities closer together, it has been one of the most significant democratizing influences the world has even known… The Internet has been one of the greatest gifts our economy and our society has ever known… there is no higher calling than protecting an open, accessible and free Internet.” Net Neutrality Concept in Malaysia & ASEAN In ASEAN, Singapore’s telecommunications

Facebook, arguably the world’s most successful and influential social networking site, has just turned 10 last month. On 4 February 2004, Mark Zuckerberg launched The Facebook from his Harvard dorm room. Originally intended to just serve as a social networking site exclusively for university and college students in the United States, Facebook has since grown by leaps and bounds to become the largest social networking site in the world. Facebook has attracted 1.23 billion users worldwide so far, and reportedly earned $7.9 billion in revenue in 2013. Facebook made a grand entrance into Nasdaq stock exchange when it went public in May 2012 by having one of the largest initial public offerings in Internet history, and it continues to make headlines every now and then, the latest being the acquisition of WhatsApp for a whopping $19 billion (Facebook bought Instagram for $1 billion in April 2012, just before it went public). This article is not intended to talk about how awesome Facebook is, or the benefits or changes that Facebook has brought to our daily lives (for better or worse). This article is meant to set out the various social and legal implications arising from the rapid growth and widespread use of Facebook in the last 10 years. In this article, reference will be made to Facebook’s Statement of Rights and Responsibilities (“Facebook’s Terms”), which is essentially the main document that sets out the terms of use that governs the relationship between Facebook with users and others who interact with Facebook. Violation of any provisions under Facebook’s Terms will result in the individual’s Facebook account being terminated or suspended. Posting third party content Very often, we find users posting contents such as text, graphics, photos or videos not belonging to theirs on Facebook without realising that such actions could potentially amount to infringement of copyright law which can result in both criminal and civil liability. According to Facebook’s Terms, users are not allowed to post content that infringes or violates someone else’s rights or otherwise violates the law. Facebook has set up a special tool to enable users to report to Facebook if their intellectual property rights have been infringed by other users. Facebook has the right to take down the infringing content upon receipt of such a report. It also states that repeated or continuous infringement of other’s intellectual property rights may result in the individual’s Facebook account being terminated or disabled by Facebook. Who owns and controls your content? When Facebook first started, it tried to claim ownership over all contents posted on Facebook. This had, of course, resulted in much criticism, which prompted Facebook to change its terms of use. The Facebook’s Terms now state that all users own all of the content and information they post on Facebook, and they give Facebook a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any content that users post on Facebook. Facebook also tried to remove a sentence from the Facebook’s Terms saying that “the license will automatically end when the user removes the content”, and this had again caused an uproar, forcing Facebook to restore that particular sentence. Disclosure of sensitive or confidential information The ease of posting information online and the desire to share (or show-off) information have resulted in instances where users (knowingly or unintentionally) leak sensitive or confidential information (such as trade secret, corporate intelligence or financial disclosure in violation of securities laws) to the public. We all know what once information gets published on the Internet, it will never get deleted. The instantaneous and far-reaching nature of social networking makes it difficult for users to recall information that has gone public. The implication can be very serious because for information to remain confidential, it must have the necessary “quality of confidence”. The confidential information will lose its confidential nature the moment it is disclosed to the public. Defamation Lawsuits alleging defamation based on content posted on social networking sites such as Facebook are on the rise. A defamation claim may be actionable when a person has published words which connote any imputation which may tend “to lower the other person in the estimation of right-thinking members of society generally”, “cut him off from society” or “to expose him to hatred, contempt or ridicule”. Courts have ruled that posting on Facebook amounts to a publication to the world at large. Facebook’s Terms require users not to post content that is hate speech, threatening, or pornographic; incites violence, or contains nudity or graphic or gratuitous violence. Users should, therefore, avoid making statements that are harmful, offensive or inflammatory. Cyber-stalking and cyber-bullying Stalking and bullying that used to only take place in real life, are now also happening on the Internet, particularly on social networking sites. Many users tend to post too much of personal information on their profile pages, which enables anyone with access to that information to stalk them. What is more worrying is, many users are not aware that everything posted on Facebook is by default made public, and it is up to the users to restrict the access to the information to just friends or family. Cyber-bullying can take many forms, such as posting hurtful or threatening messages on users’ page, spreading false rumours online, starting pages to ridicule or spread gossip about individuals, or circulating embarrassing or compromising pictures about individuals. It has been reported in the newspapers that many teenagers have committed suicide or suffered from anxiety and depression due to cyber-stalking and cyber-bullying that they had experienced on social networking sites. Facebook’s Terms explicitly state that users are not allowed to bully, intimidate or harass any other users on Facebook, or use Facebook to do anything unlawful, misleading, malicious or discriminatory. Electronic discovery Lawyers and prosecutors have resorted to fishing for evidence from information posted on Facebook. Some have even applied for court orders to obtain such information. In one instance, a photo of a wife hugging an unidentified man on Facebook was accepted as evidence to support a

This marks a new series of articles that I am writing, with the aim of providing you with a snapshot of important legal developments to keep you informed of the significant legal developments in the technology, media and telecommunications sphere in Malaysia on a quarterly basis. Issuance of Compounding Regulations pursuant to the Personal Data Protection Act 2010 On 15 March 2016, the Commissioner issued the Personal Data Protection (Compounding of Offences) Regulations 2016 (“Compounding Regulations”). The Compounding Regulations provides a list of offences which are prescribed to be “compoundable offences”. For offences which are compoundable, the Commissioner may offer data users an opportunity to pay a monetary penalty (which penalty can be up to half of the maximum fine stipulated in the Personal Data Protection Act 2010 (“PDPA”) within the time period stipulated in the offer. If no payment is received within the stipulated period, prosecution for the offence will be instituted against the data user. It is important to note that only some and not all offences under the PDPA and its regulations are compoundable. The issuance of the Compounding Regulations points to the focus of the Commissioner and the Personal Data Protection Department (“PDP Department”) moving to the next phase of implementation of the PDPA, namely investigation and enforcement. Most data users would favour the use of compounds as it is likely to reduce the penalties for not complying with the PDPA significantly, as well as save both the prosecution’s and alleged offender’s time and costs, as parties would be spared the time and expense of court proceedings. Malaysia to step up cybersecurity measures in the capital market and national defence sectors On 21 March 2016, the Securities Commission Malaysia (“SC”) published a consultation paper seeking public feedback on the proposed regulatory framework relating to the management of cyber security risk by capital market participants. The SC recognises that with the increased dependency on information technology and Internet connectivity, there is a need to put in place cyber security policies and procedures to safeguard and protect the confidentiality, integrity and availability of information systems used by capital market participants. Sound management of cybersecurity risk has been identified as a critical component to further strengthen the resilience of the Malaysian capital markets. Towards this objective, the SC intends to introduce regulatory requirements to guide the capital market participants to achieve a certain state of cybersecurity resilience. The SC recommends that the board of directors of capital market participants set a clear direction and give adequate priority in their respective board’s agenda for the effective management of cybersecurity risk and require their senior management to develop and implement appropriate cybersecurity frameworks (which includes policies, procedures, awareness programmes and risk reporting mechanisms) throughout their organisations. On the defence front, the Deputy Defence Minister Datuk Seri Mohd Johari Baharum, during his keynote address at the Cyber Security Conference in conjunction with the 15th Defence Services Asia Exhibition and Conference on 20 April 2016, proposed a three-pronged approach to enhance cybersecurity in Malaysia. The three-pronged approach consists of: reorientation of the design philosophy of the Information Communications Technology (ICT) systems, in particular focusing on cyber defence systems to ensure all computing systems reflect uniform reliance; establishment of inter-disciplinary centres, specifically on the need to connect academia, the private sector, national laboratories and the government in sharing information and offering innovative and creative solutions; and getting the military defence and security community to provide “leadership by example” and “provide support to the national and global efforts in meeting cybersecurity challenges to the defence and security domains”. The above announcement was made in response to the rising threat of cyber-attacks in Malaysia. Cyber Security Malaysia (a government agency tasked with being Malaysia’s Cyber Security Reference and Specialist Centre) reported that 11,900 cybersecurity-related cases were recorded in 2015, as compared to only 1,038 cases recorded in 2007, which may lead to some legislative reforms to bolster and/or to introduce new legislation that deals with cybersecurity threats to Malaysia’s critical information infrastructure. Land Public Transport Commission to regulate ride-sharing and taxi-booking apps by Q4 of 2016 Following an endorsement by the Special Economic Committee chaired by the Prime Minister of Malaysia, ride-sharing and taxi-booking apps such as Uber and Grab may be subject to a new regulatory framework to be introduced by the Land Public Transport Commission (“SPAD”) by Q4 of 2016. This proposal was made in response to the rising tide of a new form of competition introduced by these third party ride-sharing and taxi-booking apps and complaints filed by the incumbent taxi companies. Although no draft of the regulatory framework has yet been circulated, it is understood that for the conventional taxi industry, a profit-sharing concept or guaranteed percentage of the day’s income for the taxi drivers will be introduced. For the private car drivers, they would be required to obtain a public service vehicle license and register themselves with SPAD for vetting purposes, before they are allowed to offer their services. Private car drivers are also required to send their vehicles for annual inspections and take up passenger insurance coverage, much like what taxi drivers are currently required to adhere to. It is also understood that this third-party ride-sharing and taxi-booking companies may be subject to local taxation laws when the regulatory framework is introduced, as the government has realised that there is a potentially massive outflow of the Ringgit due to the widespread use of these booking apps. Several laws, such as the Land Public Transport Act 2010, Road Transport Act 1987 and Communications and Multimedia Act 1998, will need to be amended to facilitate these new changes. The Amendment Bills may be tabled in Parliament during its sitting in October 2016, and “if everything goes well, a new dawn of taxi industry may begin the end of the year,” SPAD chairman said. Spectrum reallocation in the telecommunications industry On 27 January 2016, the Prime Minister of Malaysia, Dato Sri Mohd Najib bin Razak, during the Budget 2016 recalibration, announced that

Taxi-booking services such as MyTeksi and Easy Taxi, as well as ride-sharing booking services such as Uber and GrabCar, have been touted as the game changers as they set to revolutionise and transform the taxi-booking system and practice in the taxi industry. These ride-sharing services leverage on smartphone technology to connect passengers to drivers in a reliable, affordable and safe way. Many have lauded the introduction of these services into the market as they set to solve the taxi woes, end the frustration and ease the pain when it comes to booking a taxi. Features such as real-time GPS tracking and cashless payment system on these services give a greater level of confidence, convenience and security to passengers and drivers. Protests and Bans The reality is, change often brings resistance. The ride-sharing business model is not short of controversy. Uber is facing a number of court cases worldwide and its service is banned in several countries. Incumbent taxi drivers are up in arms, claiming that Uber engages in unfair competition and bulldozes its ways through the system by using drivers and cars not licensed/authorised by law. Some have claimed that as these drivers do not have passenger liability insurance, this will put the passengers’ safety at risk. Authorities around the world continue to crack down on Uber’s and GrabCar’s drivers and some drivers had been unfortunately harassed and attacked by other taxi drivers. Legality of Ride-Sharing MyTeksi and Easy Taxi are essentially taxi-booking services, where passengers can summon taxis through mobile apps. They both work with licensed taxi drivers, and do not charge passengers anything extra. Passengers will pay the metered fare as regulated by the government. From the look of it, it appears that they work within the boundaries of the law. Uber and GrabCar, on the other hand, are described as ride-sharing services. Uber and GrabCar partner with private vehicle owners, licensed for-hire chauffeur-driven limousine and commercially licensed rental car companies. Their drivers do not use a taxi meter, but rather they use a mobile app to calculate fares based on distance travelled and time is taken, which apparently are much cheaper than the regulated metered fare. In Malaysia, there is no express prohibition under the law which prohibits someone from using a software to connect its users to drivers for rides on private cars. Under the Land Public Transport Act 2010, no person shall operate or provide a public vehicle service using a class of public service vehicles unless he holds an operator’s licence issued under the Act. A person is deemed to be operating or providing a public service vehicle service if he uses or drives a public service vehicle or employs one or more persons to use or drive a public service vehicle and he owns the said vehicle or is responsible to maintain or operate the said vehicle. “Public service vehicle” includes a motor vehicle used for carrying persons on any journey in consideration of a single fare. It appears that Uber and GrabCar do not fall within the above scope. Uber and GrabCar also claim that they are just a technology company that facilitates the ride-sharing services and not a transportation company. Their drivers, however, appear to fall within the above scope and are potentially liable under the Act, which attracts fine up to RM10,000 and/or imprisonment up to 1 year. Their vehicles can also be confiscated. Legalising Ride-Sharing Services Governments in several jurisdictions have taken steps to create a regulatory framework for the ride-sharing market. In the US, California is the first jurisdiction that legalizes the ride-sharing services through the creation of a new category of public transportation service known as “Transportation Network Company” (“TNC”). A TNC is a company that uses an online-enabled platform to connect passengers with drivers using their private vehicles. Some of the conditions that must be met before a company can be licensed as a TNC include driver background checks, driver training, minimum insurance coverage, the maximum age limit of the vehicle, the requirement to install a GPS tracking device, etc. The TNC model ensures a level playing field is established by preventing ride-sharing services from undertaking specific taxi related activities (rank, hail, pre-booked and cash transactions). A High Court in London recently delivered a landmark judgment, saying that Uber’s app does not operate in the same way as “taxi meter”, and therefore Uber’s service is not considered as providing taxi service. In May 2015, the Philippines became the first country in Asia to legalise and regulate the ride-sharing services nationwide by adopting California’s TNC model. In Singapore, the Third-Party Taxi Booking Service Providers Act 2015, which regulates taxi-booking services, came into force on 1 September 2015. The Singapore Government has also announced that the next phase will involve the review of the ride-sharing services. On 8 October 2015, Didi Kuaidi, the largest ride-sharing company in China, received the first official car booking license for its ride-sharing service from Shanghai’s Municipal Transportation Commission. According to the regulations, Didi Kuaidi is required to do in-house screening and training of all its potential drivers as well as to make sure that all the private cars registered on its platform are certified and properly licensed by the authority and that each vehicle, driver and passenger must be insured. Uber China is said to be actively preparing documents for its own application in Shanghai. In Australia, ride-sharing companies will be able to legally operate in the state of Canberra from 30 October 2015 onwards. In Malaysia, a Bill to amend the Land Public Transport Act 2010 is expected to be tabled in Parliament in October 2015. The amendments would include provisions to regulate mobile app providers offering any public transport, commercial transport and delivery services as well as to deal with mobile apps that facilitate car-pooling or the charging of passengers using unlicensed vehicles. It would be interesting to see if the Bill is a move to legalise ride-sharing services or a move to allow the authorities to exert control

It was recently reported that the Malaysian Communications and Multimedia Commision (“MCMC”) had received six complaints regarding the supply and sale of devices that can hack into WiFi connections. Three cases have since been sentenced by the courts and the other three will soon be brought to the courts soon. Most of the WiFi hacking incidents were carried out by using devices such as WiFi booster and WiFi cracker, which can amplify signals to attract WiFi signals within a distance of one to three kilometres. The MCMC said that a person who uses, has in possession or sells this type of non-standard equipment or device can be charged under Section 239 of the Communications and Multimedia Act 1998 (“CMA”), and will be fined up to RM100,000 and/or jailed up to 2 years upon conviction. A person who possesses, obtains or creates an equipment or device designed to fraudulently use or obtain any network facilities, network service, applications service or content applications service can also be charged under Section 232 of the CMA, which upon conviction, will be fined up to RM300,000 and/or jailed up to 3 years. There is also another form of “stealing” WiFi connections without having to use any equipment or device such as WiFi booster or WiFi cracker. It has been established that using another person’s unsecured WiFi connection without his or her consent and knowledge is known as “piggybacking” or “mooching”. If a person’s WiFi connection is not secured by a password, any person can actually connect to the account, without the person’s consent and knowledge. WiFi piggybacking normally happens when a person uses his neighbour’s WiFi connection without permission, or when a person sitting in a car near a WiFi hotspot to access the WiFi connection. The issue on WiFi piggybacking remains controversial. Some argue that it is harmless, because it is no different to sitting behind another passenger on a train, and reading his newspaper over his shoulder, or enjoying the music a neighbour is playing in his backyard. Others, however, argue that it is unethical, because it is akin to entering a home just because the door is unlocked, or hanging on the outside of a bus to get a free ride (Source: Wikipedia – Piggybacking (Internet Access)). Let’s take a look at what has happened around the world in respect of WiFi piggybacking. In the United States, most of the states prohibit unauthorised access to computer networks which include open WiFi networks. In 2005, a man in Florida was charged with unauthorised access to a computer network because he was using a resident’s WiFi connection from a car parked outside. In 2007, a man in Michigan was fined for using a cafe’s WiFi connection from a car parked nearby to check his email every day. In Singapore, a 17 years old teenager was arrested for tapping into his neighbour’s WiFi connection. Apparently, he went outside his house to piggyback on any available WiFi connection after his mother had confiscated his computer modem. He was seen chatting online when a passerby asked what he was doing, became suspicious, and later called the police. He pleaded guilty and was sentenced to 18 months’ probation under the Computer Misuse Act. In the United Kingdom, a man was also convicted for dishonestly obtaining an electronic communication service when he was found repeatedly trying to gain access to a neighbour’s WiFi connection with a laptop from his car. In Malaysia, no one has been arrested or charged for WiFi piggybacking so far. Our Computer Crimes Act 1997 is very similar to the Computer Misuse Act in Singapore and the United Kingdom, which means WiFi piggybacking could potentially constitute a criminal offence under Malaysian law. Section 3 of the Computer Crimes Act 1997 states that a person who: causes a computer to perform any function with intent to secure access to any program or data held in any computer; the access he intends to secure is unauthorised; and he knows at the time when he causes the computer to perform the function that that is the case, will be fined up to RM50,000 and/or jailed up to 5 years upon conviction. This section is also targeted at hackers who hack into other’s computer network or system. One peculiar feature of this Computer Crimes Act 1997 is that it has extra-territorial scope. The Computer Crimes Act 1997 states that regardless of the person’s nationality or citizenship, where an offence is committed by the person in any place outside Malaysia, in which the computer, program or data that he accessed was in Malaysia, or capable of being connected to or sent to or used by or with a computer in Malaysia, he may be charged under the Computer Crimes Act 1997 as if it was committed at any place within Malaysia. What this means is that a foreign hacker may be charged in Malaysia if he hacks into a computer, program or data in Malaysia. It will be interesting to see how the enforcement authorities will enforce the law against people who piggyback on other’s WiFi connection, especially with the Government’s plan to increase public WiFi hotspot to make it freely available to the people across the nation. From a technological point of view, it might do no harm to you sharing your WiFi connection with others. However, from a legal perspective, that may attract several problems. For example, sharing your home WiFi connection with neighbours may violate your Internet Service Provider’s terms of service. That is because usually home WiFi package only allows WiFi connection to be shared within home users only (as opposed to those business WiFi package used by cafés, offices and shopping malls which allows them to share with the public). Another legal implication that may arise from allowing WiFi connection freely available is that you may be liable for the conduct of the person using your WiFi connection since you are the subscriber of the WiFi connection. While it is clear that unauthorised access

In this world, nothing is certain except death and taxes – Benjamin Franklin (1706-90), one of the Founding Fathers of the United States. In October 2014, the Hungarian government submitted its proposed tax law for 2015. One of the features under that tax law is the introduction of “Internet tax” that will be imposed on Internet users at a rate of HUF 150 (approximately USD 0.60) for every gigabyte of data or part thereof. For example, downloading a movie in HD quality (8.5 GB) would attract a tax charge of approximately USD 5. This proposal has caused an uproar and received negative criticisms from the public and the industry players. It was even condemned by the European Union. Some people perceived this as a way for the Hungarian government to control the Internet and stifle free expression and access to information. The Hungarian government was later pressured into changing its stance slightly, by stating that this new tax will be capped at HUF 700 (approximately USD 2.8) for home users and HUF 5,000 (USD 20) for business users, with Internet Service Providers (“ISPs”) expected to pick up the rest of the tab. That did not help much as the public still believed that the ISPs will pass on the costs of complying with this law onto the consumers eventually. The Hungarian government has finally backed down and decided to shelve this law after large-scale protests from its people. From the inception of the Internet until the late 1990s, the Internet was free of regulation by governments all over the world. However, things began to change when government realized that Internet services is a potential source of tax revenue, especially in the e-commerce sphere where the world is becoming one big marketplace. As a result, many governments have amended their tax law to accommodate to this new way of doing business. In the United States, President Bill Clinton signed the Internet Tax Freedom Act into law in 1998, in an effort to promote and preserve the commercial, educational and informational potential of the Internet. This law bans federal, state and local governments from imposing tax on internet access and other discriminatory Internet-only taxes such as bit tax, bandwidth tax and email tax. The law also prohibits multiple taxes on e-commerce, although it does not exempt sales tax made through online transactions. A tax on internet access is not the same thing as a tax on internet sales. The former is what the Hungarian government was trying to introduce, whereas the latter is becoming a norm in many parts of the world. Likewise, the Malaysian government is not left out when it comes to taxing the internet sales. In March 2013, the Inland Revenue Board of Malaysia (“IRB Malaysia”) published a “Guidelines on Taxation of Electronic Commerce” (“E-Commerce Guidelines”) which as the name suggests, aims to provide guidance on the tax treatment of e-commerce transactions. E-commerce is defined to mean any commercial transaction conducted through electronic networks including the provision of information, promotion, marketing, supply order or delivery of goods or services although payment and delivery of such goods and services may be conducted off-line. The IRB Malaysia acknowledged that as there are no specific provisions under the Income Tax Act 1967 (“ITA”) that address e-commerce transactions, hence it is hoped that the E-Commerce Guidelines will provide the much needed guidance to clear the confusion as to whether online businesses need to pay income tax or not. The E-Commerce Guidelines adopts the principle of neutrality where both conventional and online businesses are subject to the same tax treatment under the ITA. What this means is that there is no difference between a seller who sells goods in a physical shop and a seller who sells goods on a website (online shop) – both of them need to pay income tax. With the coming into force of the E-Commerce Guidelines, it signals an end of the tax-free ride era enjoyed by e-commerce players since the beginning of the e-commerce industry in 1997. In general, income of a person accruing in or derived from Malaysia is subject to income tax in Malaysia. Where business operations are carried out in Malaysia, the income attributable to those business operations is deemed to be derived from Malaysia. Whether an income is considered to be derived from Malaysia or not is subject to the business operations test i.e. whether there are substantial business activities being carried out in Malaysia. Para 5.1 of the E-Commerce Guidelines states that a server/website by itself does not carry any meaning in determining derivation of income. Para 5.2 provides 3 examples of situations where income from e-commerce is deemed to be derived from Malaysia even though the company conducts business through a website which is hosted on a server located outside Malaysia. Para 6 examines the various permutations of e-commerce business models with varying assumptions, in each case, stating the IRB Malaysia’s position on whether or not business income is deemed to be derived from Malaysia. With the impending coming into force of the Goods and Services Tax (“GST”) Act 2014, the Royal Malaysian Customs Department, the authority tasked with administering, assessing, collecting and enforcing payment of GST, has also published a “Guide on E-Commerce” and a “Guide on Web Hosting Services” in August 2014 to assist e-commerce players and web hosting service providers in understanding the GST and its implications on their businesses. GST is a form of consumption tax i.e. it is charged on all taxable supplies of goods and services in Malaysia except those specifically exempted. GST is also charged on importation of goods and services into Malaysia. All provisions of services whether it originates in the country or imported from other countries also fall under the scope of GST. These include services provided via the internet. In Malaysia, a person who is registered under the GST Act 2014 is known as a “registered person”. A registered person is required to charge GST (“output tax”) on his taxable supply

We live in an age where information and communications technology (ICT) has brought much improvement to human life. The digital revolution has revolutionised the way we live, study, work and play. Today’s computers and smartphones have enabled us to communicate with each other easily and obtain information from the Internet effortlessly. We can also use these electronic devices to take and share photos instantly, stream videos online and listen to music wherever and whenever we want. Parliament has enacted a series of cyber laws to address the various issues that may arise from the use of ICT. One of them is the Copyright (Amendment) Act 2012 (Amendment Act) which came into force on March 1, 2012. KEY FEATURES OF THE AMENDMENT ACT The Amendment Act aims to fulfil the requirements that will allow Malaysia to accede to the WIPO Copyright Treaty and WIPO Phonograms and Performance Treaty as well as to keep the Copyright Act 1987 abreast with new developments and international standards. (1) Notification of copyright Under the Amendment Act, the owner or licensee of a copyrighted work may notify the Controller of Copyright (controller) of the copyright in the work by providing the prescribed particulars and paying a fee. Notification is not mandatory. Upon notification, the particulars of the work such as the personal particulars of the copyright owner, a statutory declaration that the applicant is the owner, the category, title, name of the owner, date and place of the first publication of the work, will be recorded and maintained on the Register of Copyright. An advantage of notifying the copyright to the controller is that the certificate of notification issued by the controller constitutes prima facie evidence of the owner’s claim to the copyright and is admissible in court. This will assist copyright owners in discharging the burden of establishing their claim of copyright in a work, which is often a daunting task. (2) Anti-camcording It is now an offence for any person who operates an audiovisual recording device in a screening room (such as a cinema or theatre) to record any film in whole or in part. Anyone who attempts to do so commits an offence. (3) Circumvention of technological protection measures The Amendment Act makes it an offence for anyone to circumvent, or cause or authorise anyone to circumvent, technological protection measures used by copyright owners to protect their works, such as passwords, encryption, access codes, and watermarking. Such technological protection measures are necessary to prevent copying and restrict access to copyright works. It is also an offence for anyone to manufacture, import, distribute or possess any technology, device or component which is used, designed or produced for the purpose of enabling or facilitating the circumvention of technological protection measures. (4) Liabilities of service providers The Amendment Act also introduces new liabilities for service providers. “Service providers” are persons who provide services relating to, or connection for the access, transmission or routing of, data. It includes providers and operators of facilities for online services and network access and is arguably wide enough to cover Internet service providers and website operators. The Amendment Act exempts a service provider from liability for copyright infringement for certain activities such as transmitting, routing or providing connections of an electronic copy of the work through its primary networks or system caching, as parliament recognises that these activities are necessary to provide efficient access to data. A copyright owner whose work has been infringed on a network may request the service provider to remove or disable access to the infringing electronic copy on the network. The service provider must then remove or disable access to the infringing copy within 48 hours. The person whose electronic copy of the work was removed or to which access has been disabled may issue a counter notification to the service provider to request that the copy or access to it is restored on the network. The service provider must promptly provide the owner with a copy of the counter notification and inform him that the removed copy or access to it will be restored in 10 days unless confirmation is given by the owner that he has filed an injunction against the issuer of the counter notification stopping him from infringing activity on the network. The Amendment Act requires the copyright owner and the issuer of the counter notification to compensate the service provider for any loss incurred by complying with their notifications. CONCLUSION The Amendment Act keeps copyright law relevant in the ICT age. It demonstrates the government’s commitment to ensuring stronger protection for copyright owners and is a practical approach to combating copyright piracy in modern Malaysia. ***** About the author: This article was written by Edwin Lee Yong Cieh, Partner of LPP Law – law firm in Kuala Lumpur, Malaysia (+6016 928 6130, [email protected]). Feel free to contact him if you have any queries. This article was first published in CHIP Magazine Malaysia. The view expressed in this article is intended to provide a general guide to the subject matter and does not constitute professional legal advice. You are advised to seek proper legal advice for your specific situation.

Special Cyber Court The number of cybercrime cases in Malaysia has increased at an average of 10,000 cases reported every year. It was reported that in 2015 alone, CyberSecurity Malaysia received 3,752 cases of online fraud and hacking along with a staggering figure of 191,096 reports of malicious malware and botnet infections. CyberSecurity Malaysia believes that there are many more cases that may have gone unreported or unnoticed by the victims. From the statistics garnered, an average of 30 Malaysian Internet users fall victim to cybercrimes every day, and fraud and intrusion cases appear to be the most common offences faced by Malaysians. According to a UK based market research firm Juniper Research, global cybercrime losses are projected to reach USD 2 Trillion by 2019. Based on statistics given by the Malaysian Government, Malaysia lost RM179.3 million to cybercrime in 2015. In light of the increasing threat in cybercrime and the need for effectively dealing with cybercrime cases, the Government has announced the establishment of the Special Cyber Court. The 1st Special Cyber Court, based at the Kuala Lumpur Court Complex came into operation on 1 September 2016. Owing to the high rates of cybercrime in other States, subsequent phases will see the establishment of Special Cyber Courts in Selangor and Johor, followed by the remaining States within the next couple of years. Functions of Special Cyber Court The purpose of this initiative is to provide the judicial system with sufficient and adequate means of handling cybercrime offences, such as hacking, online fraud/scamming, botnet attacks, online defamation, sedition and harassment, web-defacement, theft of online information, cyber gambling and pornography, etc. The Special Cyber Court will deploy specialised and trained judges to hear cases relating to cybercrime and other computer related civil matters. The Special Cyber Court is expected to function in the same way as other special courts such as those that are already in place to deal with intellectual property, corruption, environmental as well as anti-profiteering matters. Interestingly, in the same statement that was released regarding the establishment of the Special Cyber Court, a statement was also made that the Government will also set up a special team to assist the authorities in tracing slanderous and seditious statements made on social media and on the Internet. The combination of these two messages suggests that anti-government sentiment in the form of statements on social media is one of the drivers behind the establishment of the Special Cyber Court. The Special Cyber Court is already in operation and it currently hears cases related to cybercrime. Its ambit will ultimately extend to civil and tort related matters as well, as per the Practice Direction No.5 of 2016 issued by the Chief Registrar of the Federal Court of Malaysia. The first judge to sit in the Special Cyber Court is Tuan Zaman bin Mohamad Noor. Benefits of Special Cyber Court The establishment of the Special Cyber Court will hopefully help expedite disposal of cybercrime cases, strengthen the legal institutions in Malaysia as well as reduce cybercrimes. The Special Cyber Court will be equipped with appropriate tools and equipment to handle evidence gathered in cybercrime cases. Judges, prosecutors and other relevant stakeholders will be given training to ensure that they are equipped with the necessary IT knowledge and skills which will help them in understanding the complex subject matter of cybercrime. Way forward for Special Cyber Court The Government’s initiative in introducing the Special Cyber Court to combat the rising trend of cybercrimes is indeed commendable and marks a step in the right direction. To ensure the successful implementation of the Special Cyber Court, it is hoped that the Government will: put in place the necessary legal frameworks (processes, procedures and practices) to enable and support the establishment of the Special Cyber Court; make amendments to certain cyber laws on the practices and procedures for handling cybercrime cases, electronic and digital forensics evidence; train judges, prosecutors, lawyers and other relevant stakeholders in the field of cybercrime and computer forensics so that they can understand the nuances and issues pertaining to detection, investigation, prosecution of cybercrimes and have better appreciation and analysis of the evidence and submissions presented in courts; and conduct case studies and analysis to learn the lessons and past experiences of cyber court in other jurisdictions. The introduction of the Special Cyber Court marks a significant milestone for Malaysia, as it is the first specialised court in this region designed to only handle cybercrime cases. It shows the Government’s commitment in fighting cybercrimes, and we hope that with this initiative, the public awareness towards protecting themselves from cybercrime threats will also increase. Electronic Court While cyber court is still a very new concept, many countries including Malaysia have introduced electronic court (“E-Court”). Essentially, E-Court utilises supportive technology to facilitate the day-in day-out functions of a court. The aim of the system is to efficiently speed up the disposal of cases using technology. The shift towards computerisation of the courts system in Malaysia began in 2009 and the E-Court system was fully implemented in main Court Complexes in Kuala Lumpur, Shah Alam, Ipoh, Penang, Johor Bharu, Sabah, Sarawak and Putrajaya in March 2011. To date, more than one million cases and six million documents have been filed online via the E-Court system. 4 Types of Mechanism The E-Court system in Malaysia currently has 4 types of mechanism, as follows: Video Conferencing System (VCS); Case Management System (CMS); Community and Advocate Portal System (CAP); and Case Recording and Transcribing (CRT). The E-Court system as a whole aims to use technology to address problems which have plagued the judicial system for years. Since the introduction of the E-Court system, 80% of the pending cases were reduced in the first 12 months. It also recorded a 50% reduction in days required for trial, judgment, filing and service. The E-Court system enables courts and lawyers to be more efficient in observing a strict schedule and effective case management system. E-Court also presents a huge step towards

Some months ago, our Deputy Communications and Multimedia Minister Datuk Jailani Johari was quoted as saying that admins of group chat/messaging applications (such as WhatsApp, WeChat, Telegram, Viber, etc.) can be held responsible for offences (such as spreading of fake news, libel, fraud, exposure of classified information) committed by users in the group chat under the Communications and Multimedia Act 1998 (“CMA”). The Malaysian Communications and Multimedia Commission has even published an advisory note for group chat admins which sets out the Dos’ and Don’ts as a group chat admin. Some of the rules are such as requiring admins to comment on posts to ensure discussions stay on track; check posts regularly; consider removing or blocking those who persist in making inappropriate posts, etc. When the news first broke out, it sparked a lot of discussions on the social media and the news was even covered by foreign media, with many questioned the motive behind such move and the effectiveness of such enforcement if it ever happens. In fact, a disclaimer notice by WhatsApp group admins was making its round in many group chats that reads as follows: “I and other group admins do not allow or support any form of WhatsApp messages that display information that is pornographic, incorrect, libellous, seditious, false or inappropriate and as determined in accordance with/ by the Communication and Multimedia Act 1998. All WhatsApp messages displayed by individuals or myself in this group are not my responsibility, it is the responsibility of every individual in this group.” Putting aside whether the above disclaimer notice has any legal effect or not, one question that came to everyone’s mind was, can a WhatsApp group admin go to jail because of a message sent by a member in the group? The Deputy Minister did not specify clearly which provision under the CMA will such action be taken, but I believe he was referring to Section 233(1) of the CMA. Section 233(1) of the CMA reads as follows: (1) A person who – (a) by means of any network facilities or network service or applications service knowingly initiates the transmission of, any comment, request, suggestion or other communication which is obscene, indecent, false, menacing or offensive in character with intent to annoy, abuse, threaten or harass another person; or (b) initiates a communication using any applications service, whether continuously, repeatedly or otherwise, during which communication may or may not ensue, with or without disclosing his identity and with intent to annoy, abuse, threaten or harass any person at any number or electronic address, commits an offence. Whoever that commits the above offence can be fined up to RM50,000 and/or jailed up to 1 year. There are two important elements that must be fulfilled in order for the prosecution to use Section 233 against an offender, namely “knowingly initiates” and “with intent to commit an offence”. What that means is that the offensive message must have been knowingly initiated by the sender who had the intention to send out such a message. A group chat admin plays the role as an organiser of the group chat, not as a moderator. All messages sent in a group chat are transmitted instantaneously. It is not like the message will have to be first approved by the group chat admin before it goes online. Hence, if a user within the group sends out an offensive message, the group chat admin has no power to delete or cancel that message before it reaches everyone in the group. When that happens, how can the admin be responsible for a message not initiated by him and without his intention? A High Court judge in New Delhi in the case of Ashish Bhalla vs Suresh Chawdhury & Ors made the following remarks: “I am unable to understand as to how the Administrator of a Group can be held liable for defamation even if any, by the statements made by a member of the Group. To make an Administrator of an online platform liable for defamation would be like making the manufacturer of the newsprint on which defamatory statements are published liable for defamation. When an online platform is created, the creator thereof cannot expect any of the members thereof to indulge in defamation and defamatory statements made by any member of the group cannot make the Administrator liable therefor. It is not as if without the Administrator’s approval of each of the statements, the statements cannot be posted by any of the members of the Group on the said platform.” Based on the above analysis, it is my humble opinion that the proposal to take legal action against group chat admins is not a viable option. The authorities should instead go after the sender of the message, as displayed in the cases below: Muslim Ahmad was convicted under Section 233 CMA for making offensive comments “damn your sultan”, “your sultan kantoi”, “what’s the kantoi with your sultan” against the then Sultan of Perak on the Internet. Rutinin Suhaimin was convicted under Section 233 CMA for posting a derogatory statement “Sultan Perak sudah gilaaaaaaa!!!!!!!” on the Sultan Perak’s website. Ahmad Abd Jalil was convicted under Section 233 CMA for saying “Sultan Johor kulitnya putih seperti kulit babi” on his Facebook’s account. A man in Johor Bahru who goes by the name of Pa Ya was arrested for uploading a crude photo insulting the Prime Minister in a WhatsApp group. A man in Penang was arrested for writing a malicious statement about the Sultan of Johor through WhatsApp. Many of these messaging apps encrypt the messages, so it is unlikely that the law enforcement authorities are able to read your messages on these messaging apps. The authorities would usually take actions only upon receiving complaints against the contents where the complainants show screenshots of the contents to the authorities. The authorities may also request these messaging apps to provide assistance provided certain conditions are met. ***** About the author: This article was written by Edwin Lee Yong