This article first appeared in Digital Edge, The Edge Malaysia Weekly on June 8, 2026 - June 14, 2026

In March, Kuala Lumpur City Hall (DBKL) announced that 10,000 closed-circuit television (CCTV) cameras, jointly operated by DBKL and the Royal Malaysia Police (PDRM), had been installed in public areas and integrated into DBKL’s Kuala Lumpur Command & Control Centre (KLCCC) as part of its smart city initiative.

While the system promises enhanced security and improved city services, its implementation has raised concerns among activists about privacy and the extent of surveillance in public spaces. Such concerns have become more pressing as biometric identification and large-scale data collection are increasingly integrated into public surveillance systems in the name of safety and smart city infrastructure.

Minister in the Prime Minister’s Department (Federal Territories) Hannah Yeoh tells Digital Edge in an email interview that the CCTVs are supported by 16 artificial intelligence (AI) analytics, designed to empower Kuala Lumpur’s smart city systems, including KLCCC and its function as a unified municipal command hub.

Part of a broader RM500 million investment in AI-powered city surveillance since 2020, the system “does not merely record. It detects, analyses and triggers real-time actions, enabling faster and more coordinated responses between agencies”, Kuala Lumpur Mayor Datuk Seri Fadlun Mak Ujud was reported as saying.

The adoption of AI surveillance tools is not new in Malaysia. Johor Bahru launched more than 1,500 AI-powered CCTVs as of January; Penang announced plans to have 5,000 cameras by 2030 last year; and Cyberjaya announced plans to deploy 375 automated number plate recognition devices over the next three years in May. What sets DBKL’s system apart is the sheer number of CCTVs.

DBKL’s 10,000 CCTVs are supplied by ITMAX System Bhd (KL:ITMAX), as part of its 10-year contract starting in 2024, with recorded data jointly owned by both DBKL and PDRM. In DBKL’s official Facebook post in late March announcing the CCTVs, Yeoh highlights facial recognition technology as a key feature for crime detection.

“The implementation of 10,000 CCTV cameras by DBKL raises important privacy and human rights concerns, particularly if the system involves facial recognition technology, AI analytics or biometric data collection,” says Datuk Seri Mohd Hishamudin Md Yunus, chairman of the Human Rights Commission of Malaysia (Suhakam).

Large-scale surveillance systems should be accompanied by clear legislation, independent oversight, robust data protection measures and transparency around the use of facial recognition technology, he emphasises.

“Once [facial data is] collected and stored, such data may potentially be used to identify individuals in real time, track their movements, analyse behavioural patterns or monitor their participation in public activities and gatherings,” says Mohd Hishamudin.

But for DBKL, the strongest justification for the deployment of these cameras remains public safety. Yeoh points out that before the KLCCC system was implemented, there was a high rate of street crime in major public hotspots in the capital. “These incidents primarily involved snatch thefts, robberies, vandalism, public altercations and suspicious activities in high-risk zones and popular tourist destinations,” she says. Yeoh did not elaborate on what “suspicious activities” entail.

In Fadlun’s April address at the City Hall, he said there has been a 50% reduction in overall crimes, with a 57.6% reduction for just snatch thefts, following the deployment of the surveillance network.

In an article in Sinar Harian, Kuala Lumpur police chief Datuk Fadil Marsus had cited this 57.6% from data gathered from the beginning to the end of 2025.

“Data shows that snatch theft cases fell from 368 in 2024 to 156 last year. Robbery cases also declined by 20.8%, from 475 in 2024 to 376 … CCTVs around Kuala Lumpur act as a ‘force multiplier’, enabling police to respond more swiftly,” said Fadil.

“Real-time monitoring and high-quality recordings improve case resolution rates and serve as strong evidence in court.”

Yeoh notes that the 50% reduction in crimes, as cited by Fadlun, is only an estimate derived from comparative analyses conducted by the police in CCTV coverage zones. Detailed crime statistics, such as what the rate was and has been reduced to, remain under the purview of the police and cannot be shared publicly.

Nevertheless, the cameras have proved valuable in reducing snatch thefts and street robberies by identifying suspects, detecting suspicious behaviour, recording vehicles involved in criminal incidents and monitoring emergencies, she says.

“Beyond its role as a robust crime deterrent, the CCTV framework serves as a critical source of digital evidence to substantiate police investigations, accelerate the response times of emergency security services and bolster public confidence in overall safety in the federal capital,” Yeoh adds.

The 10,000-camera deployment is part of KL’s broader smart city transformation agenda. The infrastructure includes 4K-resolution cameras, AI-enabled analytics capabilities, mounting systems, communications networks, power infrastructure, maintenance services and supporting data centre facilities. Behind the cameras sits a wider digital architecture comprising high-capacity servers capable of storing footage for up to 60 days and a suite of AI analytics engines designed to support various security and operational functions.

“While the KLCCC CCTV network significantly bolsters public safety and crime prevention in close collaboration with PDRM, the actual scope of this system is far more extensive, encompassing the entirety of integrated smart city operations,” says Yeoh.

The result is a surveillance network that doubles as a centralised urban management platform. The cameras not only monitor public activity for possible crimes and public safety but also help in other smart city functions like traffic management.

Yeoh explains that, as a smart city command centre, KLCCC utilises data from thousands of cameras that are consolidated into a single operational hub where city officials can monitor traffic conditions, coordinate emergency responses, oversee infrastructure maintenance and facilitate inter-agency cooperation.

Globally, cities have increasingly embraced integrated surveillance systems as advanced technologies like AI prove viable in bolstering existing infrastructure.

Beijing, Seoul and London are examples of large cities with AI-integrated CCTV systems, with public safety and crime detection as their key contribution.

For KLCCC, DBKL promises that the CCTVs will also support real-time traffic management, accident detection, flash flood monitoring, crowd management, infrastructure maintenance and municipal enforcement operations.

Yeoh says when a flash flood occurs, operators can identify affected areas, monitor water levels and coordinate emergency services. During sporting events or public celebrations, the authorities can monitor crowd movements and respond accordingly. This system will also assist DBKL in detecting unauthorised parking and unlicensed businesses, among others.

But Suhakam’s Mohd Hishamudin says the question is, how far does the surveillance go and will it become intrusive? This is especially concerning when it comes to biometric information such as facial recognition data.

In other words, while these cameras can be used to track thieves and criminals, their ability to monitor public gatherings could potentially be used to undermine the right to peaceful assembly and protest. This concern reflects the broader global debates on facial recognition technology.

Unlike passwords or identity cards, biometric characteristics cannot be changed if compromised. Once a person’s face becomes a data point in a surveillance ecosystem, that information is difficult to remove or change. And since these cameras are placed in public areas, citizens or tourists could have their data recorded without explicit consent.

For Mohd Hishamudin and other civil liberty advocates, the concern is not necessarily what the technology does today but what it may be capable of tomorrow. He calls it “function creep”, or the gradual expansion of technologies beyond their original purpose and scope.

In this case, a system deployed to prevent crime may later be used for traffic enforcement. Then, immigration monitoring. Then, crowd analysis. Then, political intelligence gathering.

Each expansion may appear reasonable in isolation, but collectively, it could be harmful to civil rights. Mohd Hishamudin says function creep is the most significant concern about large-scale surveillance systems globally. He explains that, for activists, there is legitimate concern that infrastructure introduced for public safety could eventually be used to monitor journalists, protesters, migrants, refugees, vagrants, street vendors or other vulnerable communities.

“Such systems could potentially be used to identify, track or displace populations perceived as ‘undesirable’ from public spaces and city centres. This raises serious concerns about equality, non-discrimination, abuse of power and the disproportionate targeting of vulnerable groups.”

The concern becomes particularly acute when AI analytics and facial recognition capabilities are involved. Questions such as who has access to this biometric data, how long this data is retained, whether it is shared across agencies or vendors, and the oversight mechanisms in place are the key focus of this debate.

Lawyer Izwan Zakaria of Izwan & Partners, a law firm for technology companies, says undocumented migrants and refugees are key examples of individuals who face a greater risk from surveillance systems. He points out that Malaysia is not a signatory to the 1951 Refugee Convention and thus, refugees possess limited legal protection under domestic law.

A facial recognition system accessible across agencies could potentially become a powerful immigration enforcement tool regardless of its original purpose.

DBKL’s broader city management objectives include maintaining public order and urban aesthetics. Izwan says advanced surveillance technologies could enable the targeting or displacement of homeless individuals from prominent public spaces without formal legal processes. He adds that ethnic minorities also feature prominently in international discussions about AI-based biometric recognition systems, even in countries like the US.

“This is made worse as facial recognition systems implemented in other jurisdictions have documented accuracy disparities across demographics. Those with darker skin tones, women and older individuals are consistently misidentified at higher rates,” says Izwan.

“If the AI system used for analytics is not independently audited and its accuracy benchmarks are not publicly disclosed, citizens bear the downstream risk of false matches with zero visibility into the system.”

He notes that false positives can have significant consequences. A mistaken identification may result in questioning, investigation or detention for crimes a person did not commit. And for minorities or vulnerable individuals, the options to challenge these errors could be costly or impossible.

For Izwan, the biggest legal concern when it comes to widespread monitoring and AI-based surveillance is the legal gaps found in Malaysia’s Personal Data Protection Act 2010 (PDPA). He points out that while the PDPA regulates private-sector handling of personal information, government agencies are exempt from its provisions.

“Malaysia’s legal framework has a fundamental blind spot. The PDPA 2010 (Act 709), Malaysia’s primary data protection statute, explicitly excludes the federal and state governments from its scope. Consequently, government agencies operating CCTV networks in public spaces are categorically outside the PDPA’s reach,” he says.

To illustrate, Izwan notes that private entities such as shopping malls are subject to data protection obligations, including principles related to consent, disclosure, retention and security. But such standards are not legally binding for DBKL or other government entities or agencies.

“The practical result is such that a shopping mall operating cameras in its car park has more legal accountability under Malaysian law than PDRM and DBKL operating 10,000 cameras across the capital,” he says.

He adds that the exemption is not unique to Malaysia, noting that Singapore has a similar provision. However, Singapore has also built a more comprehensive ecosystem of AI governance frameworks and regulatory guidance mechanisms.

“While Singapore’s PDPA is also government-­exempt on the same terms as Malaysia’s, it has issued more structured advisory guidelines through the [Personal Data Protection Commission] and it has a National AI Strategy framework that addresses algorithmic accountability, at least at a policy level,” says Izwan.

“Malaysia has none of these architectures. There is no biometric data law, no surveillance commissioner, no proportionality requirement in statute and no mandatory public interest test before deployment.”

Until such legal gaps are addressed, the function creep of DBKL’s KLCCC systems remains a cause for concern for vulnerable individuals, he adds.

Efforts to address the gaps in the PDPA have been an ongoing effort. In 2024, the most recent amendments to the PDPA were passed, with the final stages taking place this month.

Amendments to the PDPA coming into effect include the mandatory appointment of a data protection officer, a new framework requiring organisations to inform the Personal Data Protection Commissioner and affected individuals in the event of a data breach and the right for data subjects to request for their data to be transferred to another group.

However, there are no current explicit efforts to directly address the government’s exemption from the PDPA, despite calls from civil society organisations like Suhakam for independent oversight mechanisms.

For its part, DBKL has acknowledged some of these concerns. Yeoh stresses that the KLCCC system is not designed for personal monitoring.

“The KLCCC CCTV system is engineered exclusively for public safety, traffic management and smart municipal operations, rather than the monitoring of private individuals … the AI is explicitly not utilised for personal profiling, mass surveillance or arbitrary tracking of individuals,” she adds.

The AI functions currently support operational analytics rather than personal profiling, she continues, reiterating that this includes traffic congestion detection, accident mapping, flood monitoring, crowd density analysis and the identification of suspicious objects or movements.

Yeoh points to the existing framework of laws and policies governing data collection and the ethical use of data, including the PDPA 2010, Communications and Multimedia Act 1998, Computer Crimes Act 1997, Official Secrets Act 1972, Local Government Act 1976, Police Act 1967, Criminal Procedure Code, National Cyber Security Policy and National Artificial Intelligence Framework.

Adherence to these policies is especially strict for all personnel, vendors and contractors involved with KLCCC, who are subject to strict security controls, confidentiality obligations and system access restrictions, according to Yeoh.

She says DBKL wants the public to see the KLCCC as a tool for responsible technological modernisation rather than an encroachment on civil liberties.

Ultimately, this debate on Kuala Lumpur’s 10,000 cameras is not about the cameras themselves.

Most Malaysians already live in an environment saturated with surveillance technologies, Izwan points out. Banks collect fingerprints. Telecommunications service providers verify identities using biometric information. Airports deploy automated screening systems. Smartphones continuously generate location data.

The concern lies solely in governance and transparency. Mohd Hishamudin argues that the central concern is where legitimate security ends and excessive surveillance begins.

“A human rights-based approach requires that surveillance measures comply with the principles of legality, necessity, proportionality, accountability and non-discrimination. The line is crossed when surveillance becomes indiscriminate, continuous, opaque or lacking in independent oversight and legal limitations,” he stresses.

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.