Telcos ordered to submit users' call, internet logs - report

Summary

• The MCMC has reportedly ordered telcos to submit three months of detailed phone and internet usage records for a “Mobile Phone Data” project, raising privacy and data security concerns.

• Malaysia previously suffered its largest data breach when an MCMC contractor leaked personal information of telco customers.

The MCMC has reportedly ordered telecommunications companies to provide detailed records about their users’ phone and internet usage.

The report by South China Morning Post claimed that the instruction from the MCMC came in a letter in April, warning that non-compliance is an offence under the MCMC Act 1998 and is punishable with a fine up to RM20,000 or six months imprisonment.

It quoted unnamed sources claiming that the MCMC is seeking call and internet logs for the first three months of the year for a “Mobile Phone Data” project.

“They are asking for call records, IP call records, location, latitude and longitude.

“We have asked MCMC about transparency and accountability for the use of the data. We don’t know if MCMC will make a public statement that such an exercise is underway,” the report quoted one of the sources as purportedly saying.

The report noted that Malaysia has a poor track record for online and data security, and requiring telcos to send usage data of their customers could increase data security risks.

Malaysiakini has contacted the MCMC and the Communications Ministry for comment.

In 2017, Malaysia’s largest known data breach came to light when an anonymous internet user attempted to sell the data on an online forum.

A large portion of the data - amounting to about 126.7 million records including names, MyKad number, address, phone number, and phone brand, model, and serial number - came from telcos.

A Malaysiakini report found that the leaked telco data likely came from a database that the companies had compiled and submitted for the MCMC’s Public Cellular Blocking Service (PCBS) meant to block stolen phones from being used.

The MCMC ended its contract with Nuemera (M) Sdn Bhd, which operated PCBS, following the breach. However, police cleared the company and its staff of wrongdoing.

Council of Europe official lauds M'sian cybersecurity reform

Gobind urges united global front amid cyber threat spike

Economist: Solutions for cyberattack defence can be optimised via several steps

Agencies dismiss report claiming KLIA cyberattack disrupted travel