[Feature Article] A Greener Cloud for Malaysia?

A Greener Cloud for Malaysia?

Published by The Star on 6 Mar 2025

by Thulasy Suppiah, Managing Partner

Data centers are the backbone of our digital world, but their insatiable hunger for energy presents a growing challenge for Malaysia. As our nation becomes a data center hub, attracting significant investment and promising economic growth, we must confront a critical question: how can we power this digital revolution sustainably?

Data centers are energy intensive, consuming far more power per square foot than typical commercial buildings. This poses a significant strain on our energy resources, particularly as demand continues to surge. Research from Kenanga projects data center electricity demand in Malaysia could exceed a staggering 5,000MW by 2035—equivalent to 20% of our total generating capacity. This projection highlights the potential for data centers to become a major consumer of electricity, raising concerns about our ability to meet this growing demand sustainably.

While the economic benefits of data centers are undeniable, we cannot afford to ignore their environmental impact. Attracting investment should not come at the expense of our long-term sustainability goals. A balanced approach is required, one that prioritizes both economic growth and environmental responsibility.

What concrete steps can we take? Firstly, the industry must embrace energy efficiency. This means implementing advanced cooling technologies, optimizing server utilization, and leveraging AI-powered energy management systems. We also need to accelerate the integration of renewable energy sources, exploring innovative solutions like incorporating data centers into smart grids, enabling them to act as energy storage facilities.

Secondly, we need a more comprehensive approach to environmental impact assessments. Current assessments often overlook the long-term effects of data center construction and the considerable carbon footprint of server production. We need robust regulations that address these often-hidden environmental costs, including responsible resource management and e-waste recycling.

Finally, and perhaps most importantly, we need collaboration. Government agencies, energy providers, data center operators, and environmental experts must work together to develop a sustainable framework for data center growth in Malaysia. While the Malaysian Investment Development Authority (MIDA) Guideline for Sustainable Development of Data Centres provides a solid framework, continued efforts are needed to ensure its effective implementation and to foster a collaborative approach to sustainable data center development in Malaysia. This framework should include clear guidelines, incentives for sustainable practices, and transparent reporting of energy consumption and emissions.

Malaysia has the potential to become a regional leader in sustainable data center development. However, this requires a shift in mindset. We must move beyond simply attracting investment and focus on building a truly sustainable digital ecosystem. By prioritizing energy efficiency, renewable energy integration, and responsible environmental practices, we can power the digital future without compromising the health of our planet.

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

[BM] Pemakluman Perkhidmatan Masyarakat

Pemakluman Perkhidmatan Masyarakat

SCAM: Cara-Cara Untuk Tidak Tertipu (Dengan Pengetahuan Undang-Undang)

Makluman khidmat masyarakat ini dibawakan kepada anda oleh: Suppiah & Partners

Apakah scam?

Skim penipuan yang direka untuk menipu seseorang. Biasanya, matlamat utama penipu adalah keuntungan kewangan atau maklumat peribadi.

Menurut Gogolook, syarikat teknologi amanah terkemuka, Malaysia kehilangan sejumlah RM 54 Bilion (3% daripada KDNK Malaysia) akibat penipuan dalam setahun. Penyelidikan menunjukkan kira-kira 70% mangsa penipuan tidak melaporkan kes mereka kepada pihak berkuasa.

Bagaimanakah scam selalunya dilakukan?

E-MEL

Anda mungkin menganggap e-mel yang anda terima hanyalah e-mel biasa, tetapi dalam dunia digital hari ini, anda boleh terjebak dengan penipuan hanya dengan membalas e-mel anda.

E-mel scam ini selalunya kelihatan seperti e-mel biasa yang anda terima setiap hari, tetapi sebenarnya maklumat peribadi anda seperti butiran perbankan, kata laluan atau data peribadi yang lain sedang dicuri.

Salah satu jenis e-mel scam yang biasa digunakan adalah ‘email phishing’. E-mel jenis ini berpura-pura menjadi organisasi yang sah, menggesa anda untuk bertindak balas dengan cepat.

Contoh:

  1. E-mel Phishing daripada “Bank”
    E-mel yang mendakwa ia daripada bank akan menggesa anda untuk klik pautan bagi melindungi akaun anda atau akaun anda akan disekat.
  2. KWSP atau Penipuan Bayaran Balik Cukai
    E-mel atau panggilan palsu yang menyatakan anda layak untuk pengeluaran KWSP atau bayaran balik cukai LHDN, meminta anda memberikan butiran peribadi.
  3. Penipuan Cinta
    Penipu pada aplikasi temu janji atau media sosial berpura-pura menjalinkan hubungan sebelum meminta wang kerana “kecemasan keluarga” atau alasan lain.

Cara-cara mengesan scam

  1. Semak Alamat E-mel (Spoofing)
    Scammer sering menggunakan alamat e-mel palsu atau mencurigakan yang kelihatan serupa dengan alamat e-mel sebenar. Sentiasa semak e-mel pengirim dengan teliti. Jika ia daripada bank atau syarikat, sahkan e-mel rasmi di laman web mereka. Jika ia daripada seseorang yang anda kenali, hubungi mereka untuk mengesahkan.

    E-mel yang sah:
    moneybank@gmail.com
    E-mel penipu:
    m0neybank@gmail.com

  2. Mendesak
    E-mel penipuan selalunya cuba untuk membuat anda panik. Mereka mungkin mengatakan akaun anda akan dikunci atau anda mesti bertindak segera. Ini adalah helah untuk membuat anda bertindak tanpa berfikir. Pastikan anda bertenang dan sahkan informasi sebelum melakukan apa-apa.
  3. Invois Palsu dan Permintaan Pembayaran
    Tujuan utama scammer adalah wang. Berhati-hati dengan e-mel yang meminta pembayaran atau invois. Sentiasa semak semula sebelum membuat sebarang pemindahan wang.
  4. Bahasa dan Tatabahasa yang lemah
    Organisasi yang sah akan menggunakan tatabahasa dan bahasa profesional yang betul dalam e-mel mereka. E-mel penipuan selalunya mempunyai kesilapan menaip, frasa pelik atau ayat janggal—sesuatu yang orang ramai cenderung untuk terlepas pandang.

PANGGILAN TELEFON

Scam melalui panggilan telefon dibuat untuk menipu seseorang untuk mendedahkan maklumat sensitif mereka.

Pada masa yang maju ini, setiap rekayat di Malaysia pasti pernah mendapat panggilan scam.

Panggilan ini boleh datang melalui telefon peribadi anda atau pun telefon pejabat anda.

Penipu biasanya mendapat nombor telefon anda daripada kebocoran data, laman web syarikat anda atau platform media sosial seperti Facebook atau LinkedIn.

Contoh:

Panggilan telefon daripada nombor yang tidak dikenali memberitahu tentang aktiviti haram yang dipautkan ke nombor telefon anda.

  1. Panggilan Telefon daripada “Pegawai Bank”
    Pemanggil yang berpura-pura menjadi wakil bank, memberi amaran kepada anda tentang transaksi yang tidak dibenarkan dan meminta butiran perbankan anda untuk “menyelesaikan isu.”
  2. Panggilan Polis atau SPRM Palsu
    Pemanggil yang berpura-pura menjadi polis, SPRM atau Bank Negara, mendakwa anda terlibat dalam jenayah dan mesti memindahkan wang untuk “tujuan penyiasatan.”
  3. Penipuan Amal Jariah
    Mesej atau panggilan meminta derma untuk badan amal yang menggunakan cerita emosi untuk menekan orang ramai supaya memindahkan wang.

Cara-cara mengesan scam

  1. Nombor Tidak Diketahui
    Scammer biasanya membuat panggilan daripada nombor yang anda tidak kenali. Mereka melakukan ini untuk mengelakkan pengesanan dan diblok. Berhati-hati jika anda menerima panggilan daripada nombor yang tidak dikenali.
  2. Menyamar sebagai Organisasi
    SebenarPenipu sering berpura-pura menjadi daripada organisasi yang dipercayai seperti LHDN atau bank kerana orang ramai lebih cenderung mempercayainya. Jika anda menerima panggilan yang mendakwa sebagai daripada syarikat atau badan kerajaan, sahkan ia sebelum berkongsi sebarang butiran.
  3. Mewujudkan Rasa Terdesak
    Mereka akan cuba membuat anda panik dengan mengatakan terdapat masalah—seperti transaksi yang mencurigakan, bil tidak dibayar atau masalah undang-undang. Matlamat mereka adalah untuk menekan anda supaya bertindak balas dengan cepat tanpa berfikir.
  4. Meminta Maklumat Peribadi
    Syarikat yang sah tidak akan meminta butiran perbankan anda, kata laluan atau OTP melalui telefon. Jika pemanggil meminta ini, ia adalah satu penipuan. Tutup telefon segera.
  5. Gunakan Aplikasi ID Pemanggil
    Alat yang berguna untuk membantu mengenal pasti nombor yang tidak dikenali ialah aplikasi Whoscall, yang boleh anda muat turun pada telefon anda. Ia membantu mengesan dan menyekat kemungkinan panggilan penipuan.

WHATSAPP

Anda tidak perlu memberikan seseorang nombor telefon anda untuk mereka memilikinya.

Hampir semua rakyat Malaysia menggunakan aplikasi WhatsApp untuk berbual tentang hal-hal peribadi, kerja, atau komunikasi bersama universiti kerana ia adalah percuma, cekap dan mudah untuk digunakan. Ini merupakan sebab utama sasaran scammer.

Scammer sering mendapat nombor telefon daripada kebocoran data atau platform media sosial seperti Facebook atau LinkedIn.

Contoh:

Mesej yang dihantar daripada nombor yang tidak dikenali tentang memenangi hadiah atau mesej daripada orang tersayang yang meminta bantuan.

  1. Penipuan Penghantaran Bungkusan
    Mesej atau panggilan yang mendakwa bungkusan anda tersekat di kastam atau memerlukan bayaran tambahan sebelum ia boleh dikeluarkan.
  2. Penipuan Tawaran Kerja
    Mesej yang menawarkan pekerjaan bergaji tinggi dengan kerja minimum, memerlukan anda membayar “yuran pemprosesan” terlebih dahulu.
  3. WhatsApp di hijack
    Seorang penipu yang berpura-pura menjadi rakan atau ahli keluarga, meminta kod pengesahan yang dihantar ke telefon anda untuk mendapatkan akses ke akaun WhatsApp anda.

Cara-cara mengesan scam

  1. Mesej dari nombor yang tidak diketahui
    Scammer sering menghubungi anda daripada nombor yang tidak dikenali. Jika anda menerima mesej daripada nombor yang tidak dikenali, berhati- hati— terutamanya jika mereka meminta butiran peribadi atau wang.
  2. Mewujudkan rasa terdesak
    Scammer akan cuba membuat anda panik dengan mengatakan sesuatu yang mendesak— seperti masalah dengan akaun bank anda, hadiah yang mesti anda tuntut dengan segera, atau rakan yang menghadapi masalah. Mereka mahu anda bertindak pantas tanpa berfikir.
  3. Menyamar sebagai seseorang yang anda kenali
    Helah biasa mereka ialah berpura-pura menjadi rakan atau ahli keluarga yang telah “menukar nombor telefon mereka.” Mereka mungkin meminta wang atau maklumat sensitif. Sentiasa sahkan dengan menghubungi rakan tersebut secara langsung sebelum membalas.
  4. Panduan scam WhatsApp
    WhatsApp sediakan sumber rasmi tentang cara mengenali dan mengelakkan scam.

Anda boleh mengetahui tentang mesej yang mencurigakan, fail palsu dan petua untuk kekal selamat di sini:

https://faq.whatsapp.com/2286952358121083

Bagaimanakah Cara Untuk Mengelakkan Scam (Organisasi)

Latihan Pekerja
Cara terbaik untuk mencegah penipuan adalah melalui latihan yang betul. Syarikat harus mendidik pekerja tentang mengenali dan bertindak balas terhadap scam.

Mengadakan Bengkel Anti-Scam
Anjurkan bengkel di mana ahli profesional, seperti peguam atau wakil daripada NSRC, boleh mengajar pekerja cara mengenal pasti dan mengendalikan scam. Contoh praktikal dan kajian kes kehidupan sebenar boleh menjadikan pembelajaran lebih berkesan.

Peringatan
Orang ramai cenderung lupa dari semasa ke semasa. Oleh itu, peringatan harus kerap diberi. Gunakan e-mel atau media sosial syarikat untuk memastikan pekerja mengetahui taktik scam terkini.

Galakkan Budaya Berhati-hati
Biasakan pekerja untuk mengesahkan permintaan luar biasa, terutamanya yang melibatkan pembayaran atau maklumat peribadi. Semakan semula dengan jabatan berkaitan boleh mengelakkan kerugian besar.

Perkara yang Perlu Dilakukan Jika E-mel atau Identiti Organisasi Anda Disalahgunakan Oleh Scammer

Bertenang dan Bertindak Pantas
Menjadi sasaran scammer boleh meresahkan, tetapi panik tidak akan membantu. Perkara utama ialah bertindak balas dengan pantas dan berkesan.

Laporkan Dengan Segera
Jika e-mel atau identiti organisasi anda telah disalahgunakan dalam scam, ambil tindakan segera:

  • Hubungi talian hotline bank anda (tersedia 24/7) jika butiran kewangan terlibat.
  • Hubungi Pusat Tindak Balas Penipuan Nasional (NSRC) di 997 untuk mendapatkan bimbingan.
  • Ikut arahan mereka, yang mungkin termasuk memfailkan laporan polis.

Makluman Pekerja dan Pelanggan
Scammer boleh sambung menyasarkan organisasi anda, jadi adalah penting untuk memaklumkan kepada orang lain:

  • Beritahu HR untuk mengeluarkan amaran dalaman kepada pekerja.
  • Terbitkan notis awam di laman web dan media sosial untuk memberi amaran kepada pelanggan.
  • Nasihatkan pekerja supaya lebih berhati-hati dengan e-mel atau panggilan yang mencurigakan.

Dapatkan Nasihat Undang-undang
Jika anda tidak pasti bagaimana untuk mengendalikan keadaan, minta nasihat peguam. Peguam dapat membimbing anda tentang langkah yang perlu dilakukan, seperti mengambil tindakan undang-undang terhadap penipu atau melaksanakan langkah keselamatan siber yang lebih kukuh.

Apa yang tidak patut dilakukan?

Jangan panik
Perkara paling buruk yang boleh anda lakukan adalah panik. Apabila kita tertekan, kita tidak berfikir dengan jelas, dan itulah yang dimahukan oleh scammer. Tarik nafas dalam-dalam dan balas dengan berhati-hati.

Jangan Terlibat dengan scammer
Sesetengah orang, terutamanya individu yang lebih muda, mungkin menganggap ia menyeronokkan untuk bertindak balas dengan scammer. Tetapi scammer yang mahir pasti akan dapat mengekstrak maklumat tanpa anda sedari. Tindakan paling selamat adalah mengabaikan dan menyekat mereka.

Jangan berdiam diri
Ramai orang berasa malu, takut akan akibatnya, atau menganggap tiada peluang untuk memulihkan kerugian mereka selepas discam. Tetapi membuat laporan adalah penting—bukan sahaja untuk potensi pemulihan tetapi juga untuk memberi amaran kepada orang lain dan menghalang scam tersebut daripada berulang.


Dengan mengambil langkah yang betul dan menyebarkan kesedaran, anda boleh membantu melindungi diri anda dan organisasi anda.

Apakah Undang-undang yang Boleh Melindungi Anda?

  1. Akta Komunikasi dan Multimedia 1998 (CMA)
    Seksyen 233: Menangani penggunaan tidak wajar kemudahan atau perkhidmatan rangkaian. Ia menjenayahkan tindakan seperti menggunakan perkhidmatan rangkaian untuk menghantar kandungan palsu, tidak senonoh, lucah atau menyinggung perasaan dengan niat untuk menjengkelkan, menyalahgunakan, mengancam atau mengganggu orang lain.
    Penalti: Pesalah boleh didenda sehingga RM50,000, penjara sehingga setahun, atau kedua-duanya sekali.
  2. Akta Perlindungan Data Peribadi 2010 (PDPA)
    Tujuan: Mengawal pemprosesan data peribadi dalam transaksi komersial, memastikan privasi dan perlindungan data.
    Penalti: Ketidakpatuhan boleh mengakibatkan denda antara RM100,000 hingga RM500,000, penjara satu hingga tiga tahun, atau kedua-duanya sekali.
  3. Akta Jenayah Komputer 1997 (CCA)
    Seksyen 3: Menjenayah akses tanpa kebenaran kepada bahan komputer, biasanya dirujuk sebagai “penggodaman.”
    Seksyen 5: Menangani pengubahsuaian tanpa kebenaran kandungan komputer, seperti memperkenalkan perisian hasad atau virus.
    Penalti: Individu yang disabitkan kesalahan boleh didenda sehingga RM50,000, penjara sehingga lima tahun, atau kedua-duanya sekali.
  4. Kanun Keseksaan
    Seksyen 416: Meliputi “penipuan dengan penyamaran,” yang terpakai pada penipuan pancingan data yang mana individu menipu orang lain dengan berpura-pura menjadi orang lain.
    Penalti: Boleh dihukum penjara sehingga lima tahun, denda, atau kedua-duanya sekali. Undang-undang ini secara kolektif bertujuan untuk melindungi rakyat Malaysia daripada pelbagai bentuk jenayah siber. Jika anda percaya anda telah disasarkan atau terjejas oleh penipuan siber, adalah penting untuk melaporkan kejadian itu kepada pihak berkuasa yang berkaitan dengan segera.

Perkara yang Perlu Dilakukan Jika Anda Discam

Jika anda ditarget oleh scammer, mengambil tindakan pantas boleh membantu anda meminimumkan kerosakan dan meningkatkan peluang baikpulih. Berikut ialah perkara yang perlu anda lakukan:

Bertenang dan Proses Situasi Tersebut
Jangan panik. Scammer bergantung pada ketakutan dan kekeliruan untuk memanipulasi mangsa. Luangkan masa untuk memproses apa yang telah berlaku.

Laporkan Kejadian dengan Segera
Jika terdapat penglibatan wang, hubungi talian hotline bank anda dengan segera untuk menyekat transaksi dan melindungi akaun anda.
Hubungi Pusat Tindak Balas Scam Nasional (NSRC) di 997, yang beroperasi setiap hari dari 8 pagi hingga 8 malam, untuk bantuan dalam melaporkan dan mengendalikan kes scam.
Failkan laporan polis di balai polis terdekat untuk mendokumentasikan scam tersebut dan menyokong sebarang kemungkinan siasatan.

Lindungi Maklumat Peribadi Anda
Jika anda berkongsi butiran sensitif seperti kata laluan atau maklumat perbankan, tukar kata laluan anda dengan segera dan aktifkan pengesahan dua faktor (2FA) untuk keselamatan tambahan.
Beritahu majikan anda jika e-mel kerja atau butiran syarikat anda telah terjejas.

Beri Amaran kepada Orang Lain
Maklumkan kepada rakan sekerja dan pelanggan jika nama, e-mel atau organisasi anda telah disalahgunakan dalam scam untuk mengelakkan mangsa selanjutnya.
Keluarkan makluman kepada syarikat anda dan notis awam di laman web dan media sosial anda jika perlu.

Dapatkan Nasihat Undang-undang
Sesetengah scam mungkin melibatkan pencurian identiti, penipuan atau penyalahgunaan maklumat syarikat. Jika anda tidak pasti tentang langkah seterusnya atau memerlukan panduan tentang tindakan undang-undang, nasihat daripada paguam adalah langkah yang paling baik.

Kami dari Suppiah & Partners bersedia untuk membantu anda. Hubungi kami untuk mendapatkan nasihat undang-undang pakar dan tindakan terbaik untuk melindungi hak anda daripada insiden tersebut.

Mengambil tindakan segera boleh membuat perubahan dalam mencegah kerugian selanjutnya dan melindungi diri anda atau organisasi anda. Sentiasa berwaspada dan sentiasa sahkan sebelum membalas mesej atau panggilan yang mencurigakan.

Rujukan

  1. Akta Komunikasi dan Multimedia 1998: Akta untuk mengadakan peruntukan tentang dan mengawal selia
    industri komunikasi dan multimedia yang menjurus ke arah percantuman dan perkara-perkara yang
    bersampingan dengannya.
  2. Akta Perlindungan Data Peribadi 2010: Akta untuk mengawal selia pemprosesan data peribadi dalam
    transaksi komersial dan untuk mengadakan peruntukan bagi perkara-perkara yang berkaitan dan
    bersampingan dengannya.
  3. Akta Jenayah Komputer 1997: Akta untuk mengadakan peruntukan bagi kesalahan berhubungan dengan
    penyalahgunaan komputer.
  4. Kanun Keseksaan: Akta berkenaan dengan kesalahan-kesalahan jenayah.
  5. Statistik Scam: https://www.malaymail.com/news/malaysia/2024/10/03/scam-epidemic-malaysians-lose
    us128b-annually-equivalent-to-3pc-of-gdp-amid-rising-ai-threats/152485
  6. Scoop: https://www.scoop.my/news/246047/agong-wants-to-combat-red-tape-culture/

© 2025 Suppiah & Partners. Semua hak terpelihara. Kandungan surat berita ini bertujuan untuk tujuan maklumat sahaja dan tidak membentuk nasihat undang-undang.

Lihat Lebihan Artikel

[EN] Community / Public Service Alert

Community / Public Service Alert

SCAM: The Art of Not Getting Fooled (With Legal Know-How)

This community service alert is brought to you by: Suppiah & Partners

What Are “Scams”?

Scams are fraudulent schemes designed to deceive someone. Usually, the scammer’s main goal is monetary gain or personal information.

According to Gogolook, the leading trust tech company, Malaysia is losing a total of RM 54 Billion (3% of Malaysia’s GDP) to scams in a year. Research indicates some 70% of scam victims do not report their cases to authorities.

How Are Scams Usually Carried Out?

EMAILS

You might think the emails you receive are just regular emails, but in today’s digital world, you could fall for a scam just by replying.

Scam emails often look like normal emails you get every day, but they are actually trying to steal your personal information—such as your banking details, passwords, or other private data.

One common type of scam email is a phishing email. These emails pretend to be from a legitimate organization, urging you to respond quickly.

Examples:

  1. Phishing Emails from “Banks”
    An email claiming to be from your bank, urging you to click a link to secure your account or risk it being restricted.
  2. EPF or Tax Refund Scams
    Fake emails or calls claiming you are eligible for an EPF withdrawal or an LHDN tax refund, asking you to provide personal details.
  3. Love or Romance Scam
    Scammers on dating apps or social media pretending to form a relationship before asking for money due to a “family emergency” or other excuses.

How can we spot them?

  1. Check the Email Address (Spoofing)
    Scammers often use fake or suspicious email addresses that look similar to real ones. Always check the sender’s email carefully. If it’s from a bank or company, verify the official email on their website. If it’s from someone you know, call them to confirm.

    Legitimate Email:
    moneybank@gmail.com
    Scammer email:
    m0neybank@gmail.com

  2. Sense of Urgency
    Scam emails often try to make you panic. They might say your account will be locked or that you must act immediately. This is a trick to make you act without thinking. Stay calm and verify before doing anything.
  3. Fake Invoices and Payment Requests
    Many scammers are after one thing—money. Be extra cautious with emails asking for payments or invoices. Always double-check before making any transfers.
  4. Poor Language and Grammar
    Legitimate organizations use proper grammar and professional language in their emails. Scam emails often have typos, weird phrasing, or awkward sentences—something people tend to overlook.

PHONE CALLS

Scam phone calls are made to trick people into revealing their sensitive information.

By now, almost everyone has received a scam call at least once in their life.

These calls can come through your personal phone or even your office phone.

Scammers usually get your phone number from data leaks, your company’s website, or social media platforms like Facebook or LinkedIn.

Examples:

A phone call from an unknown number calling about an illegal activity linked to your phone number.

  1. Phone Calls from “Bank Officers” 
    A caller pretending to be from your bank, warning you about unauthorized transactions and asking for your banking details to “fix the issue.”
  2. Fake Police or MACC Calls
    A caller pretending to be from the police, MACC, or Bank Negara, claiming you are involved in a crime and must transfer money for “investigation purposes.”
  3. Fake Charity Scams
    Messages or calls asking for donations for a supposed charity, often using emotional stories to pressure people into transferring money.

How can we spot them?

  1. Unknown Numbers
    Scammers usually call from numbers you don’t recognize. They do this to avoid detection and blocking. If you receive a call from an unfamiliar number, be cautious.
  2. Impersonating
    Real Organizations
    Scammers often pretend to be from trusted organizations like LHDN or banks because people are more likely to believe them. If you get a call claiming to be from a company or government body, verify it before sharing any details.
  3. Creating a Sense of Urgency
    They will try to make you panic by saying there’s a problem—like suspicious transactions, unpaid bills, or legal trouble. Their goal is to pressure you into reacting quickly without thinking.
  4. Asking for Personal Information
    Legitimate companies will never ask for your banking details, passwords, or OTP over the phone. If a caller requests this, it’s a scam. Hang up immediately.
  5. Use Caller ID Apps
    A useful tool to help identify unknown numbers is the Whoscall app, which you can download on your phone. It helps detect and block potential scam calls.

WHATSAPP

You don’t have to give someone your phone number for them to have it.

Almost all Malaysians use WhatsApp for personal chats, work, or even university communication because it’s free, efficient, and easy to use. That’s exactly why scammers target it.

Scammers often get phone numbers from data leaks or social media platforms like Facebook or LinkedIn.

Examples:

A message sent from an unknown number about winning a prize or a message from a loved one asking for help.

  1. Parcel Delivery Scams
    A message or call claiming your parcel is stuck at customs or needs additional payment before it can be released.
  2. Job Offer Scams
    Messages offering high-paying jobs with minimal work, requiring you to pay a “processing fee” upfront.
  3. WhatsApp Hijacking
    A scammer pretending to be a friend or family member, asking for a verification code sent to your phone to gain access to your WhatsApp account.

How can we spot them?

  1. Messages from Unknown Numbers
    Scammers often contact you from numbers you don’t recognize. If you receive a message from an unknown number, be cautious—especially if they ask for personal details or money.
  2. Creating a Sense of Urgency
    Scammers try to make you panic by saying something urgent—like a problem with your bank account, a prize you must claim immediately, or a friend in trouble. They want you to act fast without thinking.
  3. Impersonating Someone You Know
    A common trick is pretending to be a friend or family member who has “changed their number.” They might ask for money or sensitive information. Always verify by calling the person directly before responding.
  4. WhatsApp Scam Awareness Guides
    WhatsApp provides official resources on how to recognize and avoid scams. You can learn about suspicious messages, fake files, and tips for staying safe here:

    https://faq.whatsapp.com/2286952358121083

 

How To Avoid Scams (for Employees in Organisations)?

Employee Training
The best way to prevent scams is through proper training. Companies should educate employees on recognizing and responding to scams.

Conduct Anti-Scam Workshops
Organize workshops where professionals, such as lawyers or representatives from NSRC, can teach employees how to identify and handle scams. Practical examples and real-life case studies can make learning more effective.

Regular Reminders
People tend to forget over time, so it’s important to send regular reminders. Use emails, internal newsletters, or the company’s social media to keep employees aware of the latest scam tactics.

Encourage a Culture of Caution
Make it a habit for employees to verify unusual requests, especially those involving payments or personal information. A simple double-check with the relevant department can prevent major losses.

What to Do if Your Organization’s Email or Identity Is Misused in a Scam

Stay Calm and Act Quickly
Being targeted by a scam can be distressing, but panicking won’t help. The key is to respond swiftly and effectively.

Report It Immediately
If your organization’s email or identity has been misused in a scam, take immediate action:

  • Contact your bank’s hotline (available 24/7) if financial details were involved.
  • Call the National Scam Response Centre (NSRC) at 997 for guidance.
  • Follow their instructions, which may include filing a police report.

Alert Employees and Clients
Scammers may continue targeting your organization, so it’s crucial to inform others:

  • Notify HR to issue an internal alert to employees.
  • Publish a public notice on your website and social media to warn clients.
  • Advise employees to be extra cautious about suspicious emails or calls.

Seek Legal Advice
If you’re unsure how to handle the situation, consult a lawyer. Legal counsel can guide you on necessary steps, such as taking legal action against fraudsters or implementing stronger cybersecurity measures.

What Not To Do?

Don’t Panic
The worst thing you can do is panic. When we’re stressed, we don’t think clearly, and that’s exactly what scammers want. Take a deep breath and respond carefully.

Don’t Engage with Scammers
Some people, especially younger individuals, may think it’s fun to play along when they recognize a scam. But experienced scammers are skilled at extracting information without you even realizing it. The safest approach is to ignore and block them.

Don’t Stay Silent
Many people feel embarrassed, afraid of consequences, or assume there’s no chance of recovering their losses after being scammed. But reporting is crucial—not only for potential recovery but also to warn others and prevent the scam from happening again.

By taking the right steps and spreading awareness, you can help protect yourself and others.

Are There Laws to Protect You?

  1. Communications and Multimedia Act 1998 (CMA)
    Section 233: Addresses the improper use of network facilities or services. It criminalizes actions such as using network services to transmit false, indecent, obscene, or offensive content with the intent to annoy, abuse, threaten, or harass others.
    Penalties: Offenders may face fines up to RM50,000, imprisonment for up to one year, or both.
  2. Personal Data Protection Act 2010 (PDPA)
    Purpose: Regulates the processing of personal data in commercial transactions, ensuring data privacy and protection.
    Penalties: Non-compliance can result in fines ranging from RM100,000 to RM500,000, imprisonment for one to three years, or both.
  3. Computer Crimes Act 1997 (CCA)
    Section 3: Criminalizes unauthorized access to computer material, commonly referred to as “hacking.”
    Section 5: Addresses unauthorized modification of computer contents, such as introducing malware or viruses.
    Penalties: Convicted individuals may face fines up to RM50,000, imprisonment for up to five years, or both.
  4. Penal Code
    Section 416: Covers “cheating by impersonation,” applicable to phishing scams where individuals deceive others by pretending to be someone else.
    Penalties: Punishable by imprisonment of up to five years, a fine, or both.

These laws collectively aim to protect Malaysians from various forms of cybercrime. If you believe you’ve been targeted or affected by a cyber scam, it’s crucial to report the incident to the relevant authorities promptly.

What to Do If You (Individual) Fall Victim to a Scam

If you’ve been targeted by a scam, taking quick action can help minimize the damage and improve your chances of recovery. Here’s what you should do:

Stay Calm and Assess the Situation

  • Do not panic. Scammers rely on fear and confusion to manipulate victims. Take a moment to evaluate what has happened.

Report the Incident Immediately

  • If money was involved, contact your bank’s hotline immediately to block transactions and secure your account.
  • Call the National Scam Response Centre (NSRC) at 997, available daily from 8 AM to 8 PM, for assistance in reporting and handling scam cases.
  • File a police report at your nearest police station to document the scam and support any potential investigation.

Secure Your Personal Information

  • If you shared sensitive details like passwords or banking information, change your passwords immediately and enable two-factor authentication (2FA) for added security.
  • Notify your employer if your work email or company details were compromised.

Warn Others

  • Inform colleagues and clients if your name, email, or organization has been misused in a scam to prevent further victims.
  • Issue an internal alert within your company and a public notice on your website and social media if necessary.

Seek Legal Advice

  • Some scams may involve identity theft, fraud, or misuse of company information. If you’re unsure about your next steps or need guidance on legal action, consulting a lawyer is highly recommended.
  • Suppiah & Partners is here to assist you. Contact us for expert legal advice and the best course of action to protect your rights and recover from the incident.

Taking immediate action can make a difference in preventing further losses and protecting yourself or your organization. Stay alert and always verify before responding to suspicious messages or calls.

References

  1. Communications and Multimedia Act 1998: An act to provide for and to regulate the
    converging communications and multimedia industries, and for incidental matters.
  2. Personal Data Protection Act 2010: An Act to regulate the processing of personal data in
    commercial transactions and to provide for matters connected therewith and incidental
    thereto.
  3. Computer Crimes Act 1997: An Act to provide for offences relating to the misuse of
    computers.
  4. Penal Code: An Act relating to criminal offences.
  5. Scam statistics: https://www.malaymail.com/news/malaysia/2024/10/03/scam-epidemic-malaysians-lose-us128b-annually-equivalent-to-3pc-of-gdp-amid-rising-ai-threats/152485
  6. Scoop: https://www.scoop.my/news/246047/agong-wants-to-combat-red-tape-culture/

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

Traffic Management Systems: Benefits, Considerations, And User Rights

TRAFFIC MANAGEMENT SYSTEMS:

BENEFITS, CONSIDERATIONS, AND USER RIGHTS

by Thulasy Suppiah, Managing Partner

Traffic Management Systems (TMS) are becoming increasingly vital in modern urban planning and infrastructure. These systems use a combination of sensors, cameras, and data analysis to monitor and manage traffic flow, reduce congestion, enhance road safety, and provide real-time information to both traffic authorities and road users. As cities grow and transportation demands increase, understanding the benefits and implications of TMS is crucial for stakeholders, including solution providers, users such as highway operators and government entities, and individual road users.

BENEFITS:

1. Improved Road Safety:
TMS enhances safety by identifying pedestrian and vehicle movements, employing intelligent signaling techniques, and automatically managing incidents. Real-time monitoring helps in detecting accidents and hazards, allowing for quick responses. Systems alert drivers to potential hazards like closed roadways or low visibility, encouraging safer driving practices.

2. Reduced Traffic Congestion:
One of the primary goals of TMS is to alleviate traffic bottlenecks. By using real-time data on traffic conditions and intelligent traffic control techniques, TMS optimizes traffic flow. Predictive analysis helps identify congestion-prone areas and redirect traffic accordingly.

3. Reduced Fuel Consumption and Emissions:
Efficient traffic control systems can lower fuel usage and vehicle emissions. Consistent traffic flow enables vehicles to maintain steady speeds, improving fuel efficiency. Strategic route development and congestion avoidance contribute to a more sustainable and ecologically friendly urban transportation landscape.

4. Improved Emergency Response Times:
TMS enables emergency vehicles to navigate congested areas more efficiently. Prioritizing routes using smart traffic lights and creating green corridors ensures that emergency services can reach their destinations faster, supporting rescue and emergency operations effectively.

5. Better Public Transit:
TMS prioritizes public transportation by optimizing transit routes, leading to improved service and increased ridership. This integration reduces traffic congestion and enhances transportation efficiency.

6. Decreased Noise Pollution:
By streamlining traffic flow and minimizing the need for frequent braking and acceleration, TMS helps reduce noise pollution. Smoother traffic patterns lead to quieter roadways.

7. Enhanced Accessibility for Pedestrians and Cyclists: Intelligent traffic arrangements provide dedicated lanes for cyclists and extended crossing times for pedestrians, promoting safety and convenience for non-vehicular road users.

8. Predictive Insights:
Smart traffic management systems offer predictive insights by analyzing data collected from traffic sensors. This data assists governing bodies in understanding roadway usage and making informed decisions.

CRITICAL CONSIDERATIONS FOR STAKEHOLDERS:

For Solution Providers:

Data Security and Privacy

Ensure that the TMS complies with data protection regulations, safeguarding user data from unauthorized access and misuse.

System Reliability

Implement robust testing and maintenance protocols to ensure the system operates reliably under various conditions.

Scalability and Adaptability

Design the system to be scalable and adaptable to future technological advancements and changing traffic patterns.

For Users (Highway Concessionaires, Government/Agencies/Town Councils):

System Integration

Ensure the TMS integrates seamlessly with existing infrastructure and other smart city initiatives.

Training and Support

Provide comprehensive training for personnel to effectively operate and maintain the TMS.

Performance Monitoring

Regularly monitor the system's performance to identify areas for improvement and optimization.

For Road Users:

Awareness of Rights

Understand your rights concerning data collection and usage by TMS and be informed about how traffic data affects route planning and traffic enforcement.

Safety and Compliance

Adhere to traffic regulations and be aware of real-time information provided by the TMS to ensure safe driving practices.

Feedback Mechanisms

Utilize available channels to provide feedback on the TMS, helping to improve its effectiveness and user experience.

EXAMPLES OF AI IN TRAFFIC MANAGEMENT SYSTEMS

Conclusion:

Traffic Management Systems offer numerous benefits, from enhancing safety and reducing congestion to improving environmental sustainability and emergency response times. However, successful implementation requires careful consideration of data privacy, system reliability, and stakeholder engagement. By understanding the benefits, considerations, and user rights associated with TMS, stakeholders can work together to create more efficient, safe, and sustainable urban transportation systems.

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Newsletter

[Feature Article] The Urgent Case for AI Governance

The Urgent Case for AI Governance

Published by The Star on 20 Feb 2025

by Thulasy Suppiah, Managing Partner

The escalating concerns surrounding AI and data privacy are reaching a boiling point. South Korea recently suspended new downloads of the Chinese chatbot DeepSeek over data protection violations, adding to a growing list of countries taking action. This, along with DeepSeek being blocked on other government devices and OpenAI’s €15 million fine in Italy, demands immediate and decisive government intervention. As AI becomes increasingly integrated into our lives, citizens will rightly expect their governments to be the first line of defense.

DeepSeek, the cost-effective Chinese chatbot, presents a particularly thorny challenge. While its popularity has exploded, so too have anxieties over its data collection practices, viewed by some as aligned with China’s strategic interests. Is this about privacy alone, or a new front in the US-China AI war? Clearly, AI has become a geopolitical weapon. The South Korean action, ostensibly about data protection, also reflects the broader anxieties surrounding Chinese technology and national security.

OpenAI’s hefty fine demonstrates that no one is immune to scrutiny. This penalty sends a clear message: prioritize transparency and user privacy or face the consequences. It sets a critical precedent for future enforcement.

But privacy is just the beginning. AI governance must also confront misinformation, bias, and the question of accountability. Large-scale AI models risk amplifying societal biases and becoming engines of disinformation. Deepfakes, AI-generated news, and political manipulation raise profound ethical questions. Who sets the guardrails – governments, corporations, or a global body? The time for debate is over; the time for action is now.

These developments demand proactive, not reactive, governance. Governments must anticipate, not merely respond to, the ethical, social, and economic implications of AI. The challenge? Finding a balance between fostering innovation and protecting citizens. Over-regulation stifles progress, while a hands-off approach invites disaster. Collaboration between governments, industry, researchers, and privacy advocates is not optional; it’s essential. Recent events, including the action taken in South Korea, underscore the immediate and critical need for balanced governance in the face of the AI revolution. The era of accountability has arrived.

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

Review of TR Sandah: No Respite in Sightfor Threats to Native Land Rights

Review of TR Sandah: No Respite in Sight for Threats to Native Land Rights

Published by The Star on 14 Dec 2024

by Thulasy Suppiah, Managing Partner

Southeast Asia is a data centre goldmine, and Malaysia is poised to seize a significant share. But to truly compete with regional rivals like Singapore, we need to refine our strategies and double down on our strengths.

Singapore’s established Green Data Centre Standard has set a high bar for the region, attracting environmentally conscious companies with its clear focus on energy efficiency. While Malaysia is developing its own Power Usage Effectiveness guidelines, we have a unique opportunity to leapfrog ahead by incorporating cutting-edge sustainability practices from the outset. This could position Malaysia as a leader in green data centre development.

On cybersecurity, both nations recognize the critical importance of protecting sensitive data. Malaysia’s newly enacted Cyber Security Act 2024 provides a foundation, but its effectiveness remains to be seen. Given its recent implementation, it’s crucial to ensure robust enforcement and proactive engagement with the industry. This will not only address potential vulnerabilities but also build confidence that Malaysia is committed to creating a secure and trustworthy environment for data centre operations. A clear demonstration of this commitment will be essential for attracting global players and investors in the data centre sector.

Both countries require environmental impact assessments for large-scale data centres. Malaysia’s EIA process, however, is based on legislation from 1974 – long before the data centre boom. While this provides a general framework, we need to develop more tailored assessment criteria that address the specific environmental challenges posed by data centres, including energy consumption, water usage, and waste management.

Singapore’s Call-for-Application scheme streamlines planning and aligns growth with sustainability goals. Malaysia can create an equally effective system, tailored to our unique context, providing clarity and efficiency in the development process to attract greater investment.

Malaysia has all the ingredients for success in the data centre arena: strategic location, robust infrastructure, and a growing tech talent pool. By strategically refining our regulatory landscape and showcasing our commitment to sustainability and security, we can unlock our full potential and become a global data centre leader.

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

[Feature Article] The Star Newspaper: The AI Tightrope: Balancing Innovation and Responsibility

The AI Tightrope: Balancing Innovation and Responsibility

Published by The Star on 8 Feb 2025

by Thulasy Suppiah, Managing Partner

Donald Trump’s revocation of Biden’s AI safety executive order has sent ripples through the tech world, signaling a dramatic shift in the US approach to artificial intelligence. While the US embraces a deregulated “innovate now, ask questions later” approach, where does that leave Malaysia?

Trump’s move, lauded by those who see regulation as a stifle to progress, raises valid concerns. Will a Wild West approach to AI development unleash a torrent of unforeseen consequences? Or will it spark a new era of unprecedented technological advancement?

The emergence of DeepSeek, the Chinese AI chatbot making waves globally, adds another layer of complexity. Developed at a fraction of the cost of its American rivals, DeepSeek demonstrates that innovation doesn’t always require a blank check. It also challenges the US strategy of containing China’s technological rise through chip export restrictions.

Malaysia, with its growing ambitions in the tech sector, must navigate this evolving landscape carefully. While some argue for mirroring the US’s deregulatory approach to attract investment and foster innovation, we must also consider the potential risks. Do we want to be a testing ground for potentially disruptive AI technologies, or should we prioritize a more cautious, ethical approach? Malaysia already has a foundation of ethical guidelines for AI development. We should build upon these, learning from the comprehensive frameworks being developed in Europe, like the General Data Protection Regulation (GDPR) and Artificial Intelligence (AI) Act, rather than following in Trump’s deregulatory footsteps. Regulations, when implemented thoughtfully, don’t necessarily curb innovation. Instead, they can foster a vital balance between technological advancement and the protection of fundamental rights, preventing the potential for privacy violations and other harmful consequences of unchecked AI development.

Perhaps a middle ground is possible. We can encourage responsible AI development by fostering a regulatory environment that balances innovation with safeguards. This means promoting ethical guidelines, data privacy standards, and transparency while avoiding excessive red tape that stifles creativity.

Malaysia can also leverage DeepSeek’s open-source model to build a thriving local AI ecosystem. By empowering our researchers and developers to work with and adapt this technology, we can create innovative solutions tailored to our unique needs and challenges.

Trump’s gamble on deregulation presents both opportunities and risks for Malaysia. We must carefully consider our own path, balancing the potential rewards of rapid AI development with the responsibility of mitigating potential harms. The AI revolution is upon us, and Malaysia needs to choose its role wisely.

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

Grounded By Cyber Threats Aviation’s Growing Digital Vulnerabilities

GROUNDED BY CYBER THREATS AVIATION'S

GROWING DIGITAL VULNERABILITIES

by Thulasy Suppiah, Managing Partner

A few weeks ago, Japan Airlines (JAL) suffered a major cyberattack on one of the busiest days to fly – Boxing Day. While the resulting disruptions were temporary, it highlighted yet again the fragility of IT-dependent systems.

Beginning 7.24 am local time, the attack targeted network equipment connecting internal and external systems. This led to both domestic and international flight delays, with the airline’s app, and baggage handling systems also affected. At least 24 domestic flights were delayed by more than 30 minutes.

Whilst the threat was eliminated within a few hours, JAL had to temporarily shut down the affected router and suspended ticket sales for same-day flights resulting in considerable chaos and inconvenience to travelers. The airline later confirmed that the disruption resulted from a Distributed Denial of Service (DDOS) attack — their server was flooded with internet traffic to prevent users from accessing connected online services.

As airport, airline, air navigation and other travel or transport systems embrace digital transformation, including cloud migration, Internet of Things (IoT) integration, and AI-driven automation, its attack surface has expanded significantly. This makes the sector an attractive target for cybercriminals, nation-state actors and hacktivists.

In July last year, an enormous IT outage linked to a faulty CrowdStrike update, disrupted airlines globally, grounding over 10,000 flights and highlighting the industry’s reliance on interconnected digital systems. Though not a cyberattack, it had huge implications on airport systems and flights worldwide.

In June, Indonesia faced one of its worst cyberattacks with more than 40 government agencies impacted, and disrupting operations at major airports.

In 2018, Hong Kong’s national flag carrier, Cathay Pacific Airways admitted to a data breach involving the extensive personal data of some 9.4 million customers. Passengers’ personal information such as passport information including their nationality and date of birth; phone number; credit card information; identity card number; and even historical travel information was exposed.

In another ransomware attack last year, operations at Japan’s largest and busiest terminal port in the city of Nagoya were paralysed – making it unable to load and unload containers for three days. Located just 7 km south of the terminal is Chubu International Airport, an air gateway that operates in coordination with the sea port. The attack on The Nagoya Port Unified Terminal System (NUTS) – such a critical infrastructure in Japan, handling 10 percent of the nation’s trade – highpoints the significant ripple effects such incidents could have on essential services and supply chains not just in Japan but for the global economy.

Skift – an online source for travel news – highlighted an Imperva 2024 Bad Bot Report, which found that the travel industry suffered the second-highest volume of account takeover attempts in 2023. Around 11% of all cyberattacks targeted the sector and Cornelis Jan G, a Senior Cyber Threat and OSINT Analyst, from the Netherlands, says the aviation industry can expect to face an escalation in cyber threats in the next 12 to 24 months.

“State-sponsored groups will continue to target aviation for strategic intelligence and economic espionage, while cybercrime syndicates will increase their focus on ransomware and supply chain attacks,” he wrote in an article (Reference Item 9). He believes the industry will benefit from increased investment in AI-driven threat detection technologies, and a focus on a zero-trust architecture which limits lateral movement within networks. Callie Guenther, a cyber-threat research senior manager at Critical Start, in a comment to Infosecurity Magazine about the Nagoya cyberattack said, organisations need to stay informed about the latest ransomware trends, leverage threat intelligence sources to understand the evolving tactics, techniques, and procedures by ransomware operators, and adjust their security strategies accordingly.

For successful implementation of cyber security in the aviation industry, AI and tech-focused law firms play an imperative role. They provide essential and tailored legal services to navigate the complexities of AI integration.

Boeing for instance relies on its legal team to ensure compliance with strict Federal Aviation Administration (FAA) regulations and safety standards. United Airlines engages legal experts to establish guidelines for its AI applications in customer service, to prevent bias in AI algorithms and to ensure fair customer interactions. They also consult on transparency measures to let customers know how their data is used. Delta Airlines seeks risk management advice for AI predictive maintenance to mitigate potential liability issues related to operational failures.

Airbus engages legal services to negotiate contracts with its software vendors. These contracts are necessary to define the scope of work, data ownership and liability for AI-driven analytics. This is essential for the interests of both the aircraft company and the vendor, and to ensure compliance with aviation regulations.

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Newsletter

[Feature Article] Opportunities for Affordable AI Development

Opportunities for Affordable AI Development

Published by The Star on 31 Jan 2025
Published by New Straits Times on 31 Jan 2025: Use DeepSeek model to thrive in AI sector

by Thulasy Suppiah, Managing Partner

The shockwaves from DeepSeek’s emergence in the AI arena are being felt far beyond Silicon Valley – and they should be. This Chinese-developed chatbot isn’t just another competitor; it’s a wake-up call, and frankly, a bit of a humbling experience for the American tech giants who thought they had the game sewn up. DeepSeek’s success throws a wrench into the US-China AI war and presents both a challenge and an enormous opportunity for nations like ours, looking to carve out a space in this rapidly evolving landscape. It’s a testament to Asian innovation, with China leading the charge and India hot on its heels, fresh from its recent space program triumphs. Looks like the future of tech might not be so Western-centric after all.

One of DeepSeek’s most disruptive features is its cost-effectiveness. Built for a fraction of the price of its American rivals, it undercuts the assumption that massive budgets and top-tier hardware are essential for AI dominance. This has sent shivers down the spines of industry giants like Nvidia, whose stock plummeted after DeepSeek’s release. Perhaps Silicon Valley needs a lesson in frugality?

But beyond the financial implications, DeepSeek challenges the very notion of how we build and access AI. Its open-source nature and low API costs mean practically zero switching costs for users. This accessibility could democratize AI development, shifting power away from large corporations and empowering smaller players.

Where does Malaysia fit into this evolving landscape? We have a unique opportunity to position ourselves as a hub for affordable and accessible AI development. Instead of trying to compete head-on with the giants, we can focus on building a thriving ecosystem that leverages DeepSeek’s open-source model.

Imagine Malaysian startups and researchers building innovative applications on top of DeepSeek, tailored to local needs and languages. Imagine a vibrant community of developers contributing to and refining the model, making AI more inclusive and accessible for all.

This approach requires a shift in mindset. We need to embrace open-source technologies, invest in training and development for our workforce, and create a regulatory environment that fosters innovation and collaboration. We also need to address legitimate concerns about data security and privacy, ensuring responsible AI development.

DeepSeek’s arrival is a wake-up call. The AI landscape is changing rapidly, and Malaysia has a choice: we can be swept aside by the tide, or we can ride the wave and become a leader in this exciting new era.

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

Cyber Threats Unmasked: Malaysia’s Legal Safeguards

CYBER THREATS UNMASKED:

MALAYSIA'S LEGAL SAFEGUARDS

brought to you by Suppiah & Partners

The cybersecurity landscape continues to evolve with various emerging threats, such as AI-driven cyberattacks and deepfake scams that leverage advanced technologies for malicious purposes.

Organisations must remain vigilant against these evolving threats while adhering to local regulations that govern cybersecurity practices in Malaysia.

DDOS ATTACK

DESCRIPTION

A Distributed Denial-of-Service (DDoS) attack aims to disrupt normal traffic by overwhelming a web property with massive requests from multiple devices (botnet).

CHARACTERISTICS

  • Utilizes multiple compromised devices (bots).
  • Targets network bandwidth or application resources.
  • Does not require access to internal systems.

OPERATIONAL / BUSINESS IMPACT

  • Service outages.
  • Loss of revenue.
  • Damage to reputation.

PREVENTIVE MEASURES / RESPONSES

  • Use of DDoS mitigation services.
  • Traffic filtering and rate limiting.
  • Regular system updates.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Governed by the Cyber Security Act 2024, which mandates compliance for NCII sectors.
  • Non-compliance can lead to fines up to 500,000 ringgit or imprisonment for up to ten years.

THE HOOLIGAN

Like a hooligan, a DDoS attacker causes chaos and disruption, overwhelming systems and services with no intention of directly stealing but instead creating noise and destruction.

RANSOMWARE ATTACK

DESCRIPTION

Ransomware is malicious software that encrypts files and systems, rendering them inaccessible until a ransom is paid.

CHARACTERISTICS

  • Encrypts data and demands payment for decryption.
  • Requires access to internal systems, often via phishing.
  • Typically demands payment in cryptocurrency.

OPERATIONAL / BUSINESS IMPACT

  • Data loss.
  • Operational downtime.
  • Significant financial costs for recovery and ransom payment.

PREVENTIVE MEASURES / RESPONSES

  • Regular backups and disaster recovery plans.
  • Employee training on phishing.
  • Endpoint protection solutions.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Subject to the Cyber Security Act 2024; organizations must notify incidents within six hours.
  • Penalties for failing to report can include fines up to 500,000 ringgit or imprisonment for up to ten years.
  • Subject to the Computer Crimes Act 1997 penalties (fines, imprisonment) could apply for any unauthorised modification of the contents of any computer.

THE KIDNAPPER

Encrypting critical data and demanding ransom mirrors a kidnapper holding a victim hostage for financial gain.

RANSOM DDOS (RDDOS) ATTACK

DESCRIPTION

A Ransom DDoS attack threatens to launch a DDoS attack unless a ransom is paid, without encrypting any data.

CHARACTERISTICS

  • Threatens service disruption rather than data encryption.
  • May follow an actual DDoS attack or be a threat.
  • Payment often requested in untraceable forms like Bitcoin.

OPERATIONAL / BUSINESS IMPACT

  • Service disruption without prior notice.
  • Potential financial losses from ransom payments.

PREVENTIVE MEASURES / RESPONSES

  • Implementing robust network security measures.
  • Monitoring traffic patterns for anomalies.
  • Having an incident response plan in place.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Governed by the Cyber Security Act 2024; compliance with incident reporting is mandatory.
  • Legal repercussions for non-compliance include fines and imprisonment.

THE EXTORTIONIST

The RDDoS attacker threatens service disruption unless a ransom is paid, akin to an extortionist intimidating victims without necessarily carrying out their threat.

PHISHING

DESCRIPTION

Phishing involves tricking individuals into providing sensitive information by masquerading as a trustworthy entity.

CHARACTERISTICS

  • Often conducted via email or instant messaging.
  • Uses deceptive links or attachments.
  • Targets personal and financial information.

OPERATIONAL / BUSINESS IMPACT

  • Financial loss.
  • Identity theft.
  • Loss of trust in digital communications.

PREVENTIVE MEASURES / RESPONSES

  • User education on recognizing phishing attempts.
  • Implementation of email filtering technologies.
  • Multi-factor authentication (MFA). Software updates.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Governed by the Personal Data Protection Act (PDPA) 2010, which requires organizations to protect personal data. Non-compliance can lead to fines up to RM300,000.
  • Subject to Section 17(3) of the Electronic Commerce Act 2006.

THE CON ARTIST

Phishing attackers rely on deception and impersonation to trick victims into revealing sensitive information, much like a skilled con artist manipulates trust to defraud.

SQL INJECTION

DESCRIPTION

SQL Injection involves inserting malicious SQL queries into input fields to manipulate databases.

CHARACTERISTICS

  • Targets web applications with database backends.
  • Can extract, modify, or delete data.
  • Often due to improper input validation.

OPERATIONAL / BUSINESS IMPACT

  • Data breaches.
  • Loss of sensitive information.
  • Potential legal liabilities.

PREVENTIVE MEASURES / RESPONSES

  • Use of prepared statements and parameterized queries.
  • Regular security testing and code reviews.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Subject to the Computer Crimes Act 1997, which criminalizes unauthorized access and data manipulation. Penalties include fines and imprisonment.

THE SAFECRACKER

Exploiting vulnerabilities in databases to extract, modify, or delete data is akin to a safecracker breaking into a vault to steal valuables.

MAN-IN-THE-MIDDLE (MITM)

DESCRIPTION

MITM attacks involve intercepting communication between two parties without their knowledge.

CHARACTERISTICS

  • Can occur over unsecured networks (e.g., public Wi-Fi).
  • Often uses spoofing techniques.

OPERATIONAL / BUSINESS IMPACT

  • Eavesdropping on sensitive data.
  • Data manipulation.

PREVENTIVE MEASURES / RESPONSES

  • Use of encryption protocols (e.g., HTTPS).
  • VPN usage on public networks.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Covered under the Computer Crimes Act 1997; unauthorized interception of communications is illegal. Penalties can include fines and imprisonment.

THE SPY

Intercepting communication and manipulating it without the parties’ knowledge resembles a spy or eavesdropper gathering intelligence secretly.

MALWARE

DESCRIPTION

Malware refers to malicious software designed to harm or exploit any programmable device or network.

CHARACTERISTICS

  • Includes viruses, worms, trojans, ransomware, etc.
  • Can steal data or damage systems.

OPERATIONAL / BUSINESS IMPACT

  • Data loss or corruption.
  • System downtime.

PREVENTIVE MEASURES / RESPONSES

  • Antivirus software deployment.
  • Regular updates and patches.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • The Cyber Security Act 2024 includes provisions against malware distribution; violators may face penalties including fines and imprisonment.

THE SABOTEUR

Malware acts like a saboteur, infiltrating systems and causing damage, stealing information, or corrupting operations from within.

ZERO-DAY EXPLOIT

DESCRIPTION

A zero-day exploit takes advantage of a previously unknown vulnerability before it is patched by developers.

CHARACTERISTICS

  • Highly effective as there are no defenses available at the time of attack.

OPERATIONAL / BUSINESS IMPACT

  • Significant risk as exploits can lead to unauthorized access or data breaches.

PREVENTIVE MEASURES / RESPONSES

  • Timely software updates and patch management practices.
  • The usage of firewalls.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Subject to the Computer Crimes Act 1997; exploitation of vulnerabilities can lead to legal consequences including fines and imprisonment.

THE OPPORTUNIST

Exploiting unknown vulnerabilities before they are patched mirrors an opportunist who strikes when their target is unprepared.

SOCIAL ENGINEERING ATTACK

DESCRIPTION

Social engineering involves manipulating individuals into divulging confidential information through deception.

CHARACTERISTICS

  • Relies on psychological manipulation rather than technical skills.

OPERATIONAL / BUSINESS IMPACT

  • Compromised sensitive information.
  • Financial loss.

PREVENTIVE MEASURES / RESPONSES

  • User awareness training on social engineering tactics.
  • Verification processes for sensitive requests.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Covered under various laws including the PDPA; organizations must safeguard personal data against such tactics. Violations may result in legal action and fines.

THE MASTER MANIPULATOR

Using psychological tricks to gain sensitive information mimics a manipulator exploiting trust and emotions for their gain.

SUPPLY CHAIN ATTACK

DESCRIPTION

Supply chain attacks target vulnerabilities within third party vendors or partners to compromise an organization indirectly.

CHARACTERISTICS

  • Exploits trust relationships between organizations.
  • Can affect multiple entities simultaneously.

OPERATIONAL / BUSINESS IMPACT

  • Data breaches.
  • Operational disruptions.
  • Financial losses.

PREVENTIVE MEASURES / RESPONSES

  • Thorough vetting of suppliers.
  • Continuous monitoring of third-party security practices.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Subject to the Cyber Security Act 2024; organizations must ensure third-party compliance with cybersecurity standards, with penalties for non compliance.

THE SABOTAGE SPECIALIST

Targeting trusted suppliers or partners to indirectly harm an organization is similar to a specialist who infiltrates indirectly to cause systemic harm.

AI-DRIVEN CYBERATTACKS

DESCRIPTION

Cybercriminals use AI tools to automate attacks, create personalized phishing emails, and adapt tactics in real-time.

CHARACTERISTICS

  • Highly sophisticated attacks that evade traditional detection methods.

OPERATIONAL / BUSINESS IMPACT

  • Increased difficulty in detecting threats.
  • Potentially higher success rates for attackers.
  • Rapid pace of the attack poses difficulty to effectively respond.

PREVENTIVE MEASURES / RESPONSES

  • Invest in advanced AI based detection tools.
  • Regularly update security protocols.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • No specific laws yet; however, general cybersecurity laws apply as AI-driven attacks fall under existing cybercrime regulations.

THE HIGH-TECH FRAUDSTER

Leveraging AI for personalized phishing, automation, and real-time adaptability mirrors a high-tech fraudster using advanced tools to outsmart traditional defenses.

DEEPFAKE SCAMS

DESCRIPTION

Deepfake technology creates realistic audio or video impersonations used in scams or social engineering attacks.

CHARACTERISTICS

  • Can convincingly impersonate trusted individuals.
  • Exploits trust within organizations.

OPERATIONAL / BUSINESS IMPACT

  • Financial fraud.
  • Compromised sensitive information.

PREVENTIVE MEASURES / RESPONSES

  • Employee training on recognizing deepfake content.
  • Verification processes for unusual requests.

LEGAL PROTECTIONS / CONSIDERATIONS IN MALAYSIA

  • Not specifically regulated; falls under general fraud laws and PDPA if personal data is involved.
  • Subject to Section 211(1) of the Communications and Multimedia Act 1998 penalties could apply for content which is indecent, obscene, false, menacing, or offensive in character with intent to annoy, abuse, threaten or harass any person.

THE IMPERSONATOR

Creating realistic fake identities to deceive others resembles an impersonator or forger who mimics others for fraudulent purposes.

© 2025 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Newsletter