Foreign AI election interference claims under Online Safety Act probe, ministry tells Parliament

The alleged campaign was a covert political influence operation linked to a foreign commercial actor. Its purpose was reportedly to shape political discussion by creating artificial identities and spreading tailored messages. This matters because voters may encounter manufactured activity that appears to come from real people or local groups.

Paradox said BBS Bilisim Teknolojileri used Paradox to develop core components of the operation. These reportedly included synthetic persona networks, automated bot accounts, and bespoke propaganda websites. The operation also reportedly harvested demographic census records and voter data to profile electorates across Malaysia’s 222 federal constituencies.

Paradox shut down the offending accounts and said the campaign showed no meaningful organic traction among genuine users. Malaysian authorities are seeking technical clarification and evidence from Paradox. They plan to use existing communications and cyber safety laws while preparing a dedicated AI Governance Bill.

The reported scale was nationwide: all 222 Malaysian federal parliamentary constituencies were reportedly profiled. A constituency is a voting area represented by one federal parliament member. Profiling every constituency could give an operation a detailed picture of Malaysia’s electorate, rather than focusing on one locality or political contest.

Paradox said the operation harvested demographic census records and voter data. Those datasets were reportedly used to profile electorates across the country. The article does not specify which individual voters were identified, what messages were prepared for each constituency, or whether the data was legally obtained.

The reported figure shows the breadth of the alleged activity, but it does not prove that voters were successfully persuaded. Paradox said the campaign produced no evidence of meaningful organic traction among genuine users. MCMC is seeking technical clarification and supporting evidence before making its regulatory assessment.

Malaysia is responding through the Malaysian Communications and Multimedia Commission, or MCMC, which is treating the allegations seriously. The commission has requested technical clarification and supporting evidence from Paradox. It will coordinate with federal security bodies, criminal investigators, and social media platforms where necessary.

The government says enforcement can proceed under the Communications and Multimedia Act 1998, the Online Safety Act 2025, and other statutes under MCMC’s authority. These laws are intended to provide current tools for examining harmful online activity and pursuing enforcement. The article does not identify a specific offence or confirm that police have opened a formal investigation.

The Digital Ministry is also drafting a standalone AI Governance Bill. The proposed law would address corporate accountability, risk mitigation, and developer liabilities across the AI life cycle. No firm timetable has been given for introducing it in Parliament, and MCMC has not disclosed whether Paradox has answered its queries.

BBS Bilisim Teknolojileri is described in the article as a technology firm based in Istanbul, Turkey. Paradox identified it as the commercial actor that allegedly leveraged Paradox to develop core components of a covert political influence campaign. The company denied involvement on September 11.

According to Paradox, the operation attempted to construct synthetic persona networks, automated bot accounts, and bespoke propaganda websites. It also reportedly harvested demographic census records and voter data. These elements could work together by presenting coordinated, targeted political messaging through accounts and websites designed to appear separate and authentic.

Paradox said it shuttered the offending accounts after publishing its September threat intelligence report. It also said the campaign showed no evidence of meaningful organic traction among genuine users. The article does not report a Malaysian police investigation or explain whether BBS faces proceedings in Malaysia or elsewhere.

Successful AI-driven influence could blur the line between genuine public opinion and coordinated manipulation. Voters might see apparently independent accounts supporting the same message, then mistake that activity for broad public sentiment. This matters because elections depend on people making choices using information they can reasonably assess.

For example, synthetic personas could post locally tailored claims while bots amplify them across social platforms. Propaganda websites could then make those claims appear more credible or established. Generative AI can produce many variations quickly, making the campaign seem diverse even when it is centrally coordinated. These are possible consequences, not outcomes reported in this case.

The article says Paradox found no meaningful organic traction among genuine users, so it does not establish that Malaysian voters were influenced. Still, the allegations have prompted calls for an independent investigation. Malaysia is considering an AI Governance Bill that could strengthen accountability and risk controls before similar operations gain greater reach.

Malaysian authorities may face jurisdiction problems when alleged conduct, companies, data, and online infrastructure span several countries. Domestic laws generally operate most directly within Malaysia, while foreign firms and operators may be outside local investigative reach. Evidence can also be held overseas, making access and verification slower.

In this case, Paradox is based in the United States, BBS Bilisim Teknolojileri is based in Istanbul, and the alleged activity involved online systems. Malaysia may need cooperation from foreign companies or authorities to identify operators, preserve records, or enforce penalties. The article does not describe any such cooperation or confirm a criminal investigation.

The government has not disclosed how existing statutes can effectively hold offshore technology operators and foreign-based software firms accountable beyond Malaysia’s borders. That gap is one reason the proposed AI Governance Bill matters. Its intended corporate accountability and developer-liability rules could clarify responsibilities, although no introduction date has been set.

Generative AI can lower the effort needed to produce political text, images, identities, and websites. It can also quickly adapt messages for different audiences. This matters because an influence operation may generate far more content and test more approaches than a small human team could create manually.

The alleged Malaysian campaign illustrates the mechanism described in the article. Paradox said Paradox was used to develop synthetic persona networks, automated bot accounts, and bespoke propaganda websites. Together, these tools could spread different messages through accounts that appear separate. Data about demographics and voters could help tailor those messages to particular electorates.

The article does not prove that the operation achieved influence. Paradox reported no meaningful organic traction among genuine users and shut down the offending accounts. Even so, the allegations explain why Malaysia is seeking technical evidence and drafting rules covering corporate accountability, risk mitigation, and developer liabilities.