The electoral roll
was already for sale.

I am going to stay out of the politics of this entirely. I have no interest in who benefited, and the report itself does not say. What I want to talk about is the security question underneath it, because that one has an answer and almost nobody is asking it.

Disclosure before anything else: my company runs on these tools every working day, including the one named in the report. I have written before about being implicated rather than neutral, and it applies here too. I am not writing this from outside.

What the report actually says

The facts, stated carefully, because this is a topic where precision matters more than usual.

An AI company published a threat intelligence report describing an influence-as-a-service operation sold by an Istanbul-based vendor and marketed as a “military-grade, AI-driven, real-time political operations ecosystem.” The operation ran more than 1,000 accounts on X, with warm-up behaviour so they would look human before deployment, plus a dashboard for setting how many artificial views a target should receive. It ran a synthetic news site that scraped real outlets, had the model rewrite the copy, and republished it under invented bylines.

Crucially, it built constituency profiles from real census and electoral data, for micro-targeting along what the report calls racial, religious and royalty fault lines.

Four things the coverage keeps dropping, all of which matter:

There is no evidence it worked. The company said it saw no sign the operation gained significant traction or changed any outcome. The dashboard's own engagement numbers could not be verified, because they were self-reported by the vendor's tooling.

Nobody has been identified as the buyer. The report does not say who paid, or tie the activity to any particular election.

The regulator denies involvement. The report says the vendor pursued a contract with the national communications regulator and found no evidence it succeeded. The regulator has stated plainly that it was not involved in any such arrangement, that this falls outside its mandate, and that it is gathering facts.

And the vendor is a commercial seller. It was selling a product. That is worth remembering when reading its claims about its own effectiveness.

The only question I have

Everyone is debating the AI. The AI is the least interesting component.

Building the profile is trivial. Give a competent analyst the datasets and the joining is an afternoon; give a model the datasets and it is five minutes. That step was never the hard part, and it is certainly not the part you can control.

The operation had three components. The model is cheap, abundant, and getting more so. The distribution — a thousand accounts — is a commodity anyone can rent. Only one component is scarce, has a legal custodian, and could in principle be controlled.

The data. So: how does a foreign contractor come to hold Malaysia's real electoral data?

Two doors, and both are already open

The front door is legal. Under the Election (Registration of Voters) Regulations 2002, electoral roll data can be sold — normally to political parties, who are required to keep it confidential. Read that carefully. The protection on a bulk copy of the national voter file is a promise, not a technical control. Once a copy is issued it sits on staff laptops, with campaign vendors, in group chats, for as long as anyone keeps it.

The back door was forced years ago. In 2022 a seller offered what was claimed to be the full roll — some 22 million voters — for around US$2,000 in cryptocurrency. In a separate incident, more than 800,000 selfies and identity-card images from the voter registration system were put up for sale. Another dump combined roughly 13 million voters' names, identity numbers, addresses and mobile numbers with customer records from a bank and a broadcaster. The Commission at the time publicly warned purchasers of voter data to make sure it did not reach crime syndicates — a sentence that confirms the legal channel and its failure at the same time.

So the honest answer to my own question is that nobody needed to steal anything in 2026. The scarce input was commoditised four years ago, at roughly the price of a mid-range phone.

This is a custody failure, not a hacking story

Four specific weaknesses, none of which involve artificial intelligence at all.

Bulk, full-fidelity distribution. Multiple recipients each hold a complete copy of a national identity dataset. The more copies exist, the more certain the leak — that is arithmetic, not pessimism.

Contractual protection instead of technical protection. Confidentiality obligations bind the recipient. They do nothing to the laptop, the intern, the consultant, or the person who buys the laptop second-hand.

No downstream visibility. Once a copy leaves, its movement is invisible. There is no way to know how many copies exist today. Nobody can answer that question, which is itself the finding.

Permanent identifiers. You can rotate a password. You cannot reissue an identity-card number, a date of birth, or most people's address. A voter roll breach does not expire. The 2022 copy is still accurate enough to target on in 2026, and will be in 2031.

The cheapest control nobody uses

If I could ask for exactly one thing, it would not be an AI regulation. It would be this.

Watermark every issued copy. Seed each recipient's copy with a small number of unique, harmless canary records — entries that exist only in that copy. When an abused or resold copy surfaces, you look at which canaries it contains and you know precisely whose copy it was.

Mailing-list brokers have done this for a century. Map publishers put fake streets in their atlases for the same reason. Dictionary editors insert invented words. It costs almost nothing, requires no new technology, and converts an unenforceable promise into an evidentiary trail.

Without it, a leaked roll is an orphan. Everyone denies it, nobody can be shown to be wrong, and the investigation ends there. You cannot enforce a confidentiality obligation you have no way to attribute.

Pair it with the obvious companions: issue the minimum fields needed rather than everything, log who received what and when, and require deletion at a fixed date with attestation.

Why nobody here caught the accounts

The second question people keep asking is why no local body detected a thousand fake accounts. There are structural answers, and they are not about effort.

The evidence lives inside the platforms. Detecting coordinated inauthentic behaviour needs account creation times, device fingerprints, network patterns and follower graphs. A regulator sees the public surface only — which is exactly what warm-up behaviour is designed to defeat.

The old tells are dead. Bot detection used to rely on clumsy repeated language, robotic posting rhythm and brand-new accounts. Generated text removes the first. Warm-up removes the third. Residential proxies remove the network signal. What remains needs platform-side data.

The licensing regime governs content, not authenticity. Since the start of this year, platforms above eight million Malaysian users are treated as licensed, with real penalties attached. The lever exists. But it is built around harmful content, not around coordinated networks — there is no explicit duty to detect, report or disclose them.

And enforcement follows detection cost. Acting on one offending post is cheap, fast and legally clean. Finding a thousand accounts that behave like people is expensive, invisible, and depends on cooperation that cannot be compelled. Effort flows to the cheap end — the same mechanism I described when the cost of looking collapsed on the tax side, running in the opposite direction.

Which leaves the asymmetry that actually explains this entire episode. The model provider had logs. The data supply chain has none. We know which system was used, which requests it refused, and the fact that the operator negotiated around one refusal rather than stopping. We know all that because the operator rented his intelligence from a company that reads its own records and chose to publish them. Nobody can say where he got the roll, because no equivalent record exists anywhere.

And note what follows. If that operator had run an open-weight model on his own hardware — which is the direction the whole industry is moving, and where I said last week I would put my own bet — there would have been no vendor, no logs, no report, and no statement from anybody. Malaysia found out by accident of architecture.

To be fair

We do not know how this operator got the data. The report does not say, and the company could not know — it can see what entered its system, not where it came from. Published aggregate statistics alone could support constituency-level profiling. It is entirely possible no roll copy was involved and the vendor simply oversold the fidelity of what it had, which would be consistent with dashboard numbers it could not substantiate either.

Open electoral data is genuinely valuable. A public roll is how citizens check for phantom voters. Published results by polling district are how outcomes get audited. The answer is not secrecy — it is granularity, friction and attribution.

And the regulator's constraints are real. Asking why it does not run bot detection is a bit like asking a traffic authority to inspect engines it never sees. The data it would need belongs to companies in other countries.

The bottom line

Malaysian businesses have underspent on security for years on the belief that nobody would bother targeting us. This story says the opposite at national scale: somebody built a product, gave it a marketing name, and went looking for buyers.

But the part worth acting on is the least dramatic part. The AI in this story behaved better than the filing cabinet did. It refused something, logged it, and the refusal was published. The national voter file has no such record, no watermark, no expiry and no way to tell whose copy went where.

Everyone is busy regulating the layer that left evidence. The layer that left none is the one that was actually for sale.