Malaysia needs a cyber warfare legal framework for true cyber resilience — Yusmadi Yusoff

NOVEMBER 3 — Malaysia has a law to protect its critical systems. It has no law to answer when another state attacks them. Today's warning from the Prime Minister shows why that gap must close.

The Prime Minister has named a cyber warfare threat

When Prime Minister Datuk Seri Anwar Ibrahim told the Dewan Rakyat this morning that Malaysia is “certainly among those considered potential targets” of cyber and hybrid threats, he was describing more than crime. He was describing the possibility of cyber warfare: hostile action, likely state-linked, aimed at disrupting a nation's infrastructure and bending its will.

He gave two reasons. Our data centre and digital capacity now rivals Europe's. And our principled stand on Palestine and Gaza has made us unpopular in some capitals. Both are sources of national pride. Both also make us a target, at a time when attacks on portals, public registries and government systems have shaken Europe, the United States and Japan.

The government moved quickly: a special National Security Council meeting on Monday, a meeting of all departments under the Chief Secretary, a Bank Negara session with every financial institution, and a closed-door MKN briefing for MPs. These are the right first steps. But a nation cannot brief its way through a war. It needs law. And on cyber warfare, Malaysia has almost none.

Resilience without a warfare framework is incomplete

The Cyber Security Act 2024 (Act 854), in force since 26 August 2024, was a genuine milestone. It created a National Cyber Security Committee chaired by the Prime Minister, gave NACSA statutory teeth, and placed duties on National Critical Information Infrastructure (NCII) entities across eleven sectors: codes of practice, risk assessments, audits and incident notification.

But it is a resilience and compliance statute. It asks whether our critical operators are secure and whether they report incidents. It does not ask the question my doctoral research keeps returning to: what may Malaysia lawfully do when the attacker is a foreign state or its proxy, and the aim is coercion rather than theft?

Resilience is not only the ability to absorb a blow. It is also the ability to deter, respond and recover within the law. Without a cyber warfare legal framework, our resilience is half-built. Five gaps stand out:

1. No legal definition of cyber warfare. Our statutes do not distinguish a cyber crime, a cyber incident and a cyber attack by a state. Without that line, every response is improvised.
2. No threshold or escalation ladder. There is no legal test for when a cyber operation becomes a national emergency, or when it may amount to a use of force or armed attack under international law.
3. No attribution process. No statute says who decides that a state is behind an attack, on what evidence, and with what consequences.
4. No legal basis for response. The powers of NACSA, MKN, the Ministry of Defence and the Armed Forces to respond, including lawful countermeasures and active defence, are not set out in law.
5. No protection for civilians in cyber conflict. Our framework does not commit Malaysia, in law, to the principles of distinction and proportionality when it defends itself in cyberspace.

Estonia and Singapore treat cyber as a domain of war

Estonia learned the hard way. The 2007 attacks that paralysed its banks, media and ministries turned a small digital state into a global reference point on cyber warfare. It folded cyber into national defence: a military cyber command, a volunteer Cyber Defence Unit within its Defence League, NATO's cyber defence centre of excellence in Tallinn, and a “data embassy” abroad so the state can keep running if its own servers fall. For Estonia, cyber resilience and cyber defence are one policy.

Singapore built its framework in layers. Its 2018 Cybersecurity Act, the model for our own, protects critical infrastructure, and a 2024 amendment extended it to cloud, data centres and other digital foundations. But Singapore did not stop at regulation. It made Digital Defence a pillar of its Total Defence doctrine, and in 2022 created the Digital and Intelligence Service as a fourth branch of its armed forces. Its civilian resilience law sits alongside a clear military role in cyberspace.

The lesson is not to copy either state. It is that both treat cyberspace as a domain where war can be waged, and legislate accordingly. Malaysia still treats it mainly as a domain of compliance.

What a Malaysian Cyber Warfare Legal Framework should contain

I propose that the government begin drafting a Cyber Warfare Legal Framework, either as a dedicated National Cyber Defence Act or as a new Part of the Cyber Security Act 2024, with these elements:

1. Definitions and thresholds. Define cyber attack, state-sponsored cyber operation and cyber warfare, and set a clear ladder: cyber incident, national cyber emergency, and an attack amounting to use of force or armed attack under the UN Charter.
2. A statutory cyber emergency regime. Set out who may declare a national cyber emergency, the powers it unlocks (binding directions to operators, mandatory information sharing, emergency takedowns), and firm sunset clauses with parliamentary oversight.
3. Attribution and lawful response. Create a formal attribution process led by MKN, with a legal basis for proportionate responses, from diplomatic action and lawful countermeasures to the inherent right of self-defence, consistent with international law.
4. A legislated chain of command. Define the roles of NACSA, MKN, the Ministry of Defence and the Malaysian Armed Forces, including the point at which a cyber attack becomes a defence matter and the Armed Forces' cyber units take the lead.
5. Humanitarian safeguards. Commit Malaysia in law to distinction, proportionality and precaution in cyber operations, and to the protection of hospitals, water, power and other civilian infrastructure.
6. Whole-of-society resilience. Widen the Act's reach to data centres, cloud and supply-chain vendors, and create a national cyber preparedness plan and a volunteer cyber reserve that draws on our universities and industry. The Prime Minister himself pointed to the EU's whole-of-society Preparedness Union Strategy.

The framework should be reviewed alongside the Computer Crimes Act 1997, the Communications and Multimedia Act 1998, the Personal Data Protection Act 2010 and the Armed Forces Act 1972, so that our laws speak with one voice. Clear law protects both security and liberty. Emergency powers improvised in a crisis protect neither.

From a national framework to an international one

A national cyber warfare framework can harden our defences and clarify our response. It cannot stop a foreign state from attacking. That is where international law falls short. There is still no binding treaty that clearly prohibits state cyber attacks on civilian infrastructure, or defines where espionage ends and armed attack begins in cyberspace. Voluntary norms agreed at the United Nations are a start, but they bind no one.

This vacuum invites what I call cyber colonisation: the use of digital dominance to coerce, extract from and subordinate less powerful nations. Countries of the Global South, building data centres and digital economies as Malaysia is, are the most exposed.

Malaysia is well placed to lead here. Our foreign policy is independent, our voice on justice for Gaza is heard across the Global South, and our standing in ASEAN is strong. We should champion an ASEAN position on cyber peace and push, at the UN, for a binding international treaty that protects civilian infrastructure and outlaws cyber colonisation. A nation that speaks for justice offline should also speak for it online.

Legislate before the attack, not after

Estonia built its cyber defence after it was attacked. Singapore built its framework before the worst could happen. Malaysia now has a choice between those two paths, and the Prime Minister's warning today tells us there is little time to choose.

The Cyber Security Act 2024 gave us the foundation of resilience. A Cyber Warfare Legal Framework would complete it: one that defines the threat, governs our response, protects civilians, and stands for peace in a domain where the strong are tempted to rule unchecked.

We must not wait for the next attack to write the law that should have answered it.

* Yusmadi Yusoff is a PhD in Law candidate at the Ahmad Ibrahim Kulliyyah of Laws, IIUM, researching the advancement of Malaysia's cyber warfare legal framework in comparison with Estonia and Singapore. He is a senior lawyer, a former Senator and a former Member of Parliament.

** This is the personal opinion of the writer or publication and does not necessarily represent the views of Malay Mail.