Produced by a Computer

The point

A Malaysian court will shortly be asked to receive a video of a man that no camera ever recorded. It may already have happened, in a case where nobody thought to ask.

The court will reach for section 90A. Section 90C leaves it nowhere else to go. Section 90A will admit the recording on proof that a computer produced it in the course of its ordinary use, and that proof will be truthful, because a computer did produce it in the course of its ordinary use. That is what the machine is for.

This is not a hypothetical dressed as a problem. The leading Federal Court authority on section 90A, Ahmad Najib Aris v PP, was itself a case about closed-circuit audio-video recordings.¹ The apex court has already applied this section to recorded images. It has simply never been asked what happens when the recording records nothing.

The scale is not hypothetical either. Malaysians lost RM5.37 billion to online scams between 2024 and May 2026.² Losses nearly doubled between 2024 and 2025, from RM1.57 billion to RM2.97 billion. RM830 million went in the first five months of 2026. Reported cases of online fraud rose from 35,368 to 66,204 in a year.³ Fraudulent investment schemes account for RM2.68 billion, and the delivery mechanism for that category is the impersonation of trusted figures. The Royal Malaysia Police has confirmed detecting deepfake investment videos featuring the Prime Minister, senior management of Petronas and a sitting Member of Parliament, believed to come from a single syndicate and presented as government-endorsed.⁴

The legislative response has been about circulation. The Online Safety Act 2025 came into force in January 2026. An Artificial Intelligence Bill has been announced. Both ask what may be published and by whom.

Neither asks what a court does when the thing arrives as an exhibit.

This paper is written for litigators first and legislators second. Parts II to VI set out the law and where it fails. Part VII is a working method for practice today. Parts VIII and IX propose reform and set out what the courts can do without waiting for it.

It does not address whether the malicious creation of synthetic depictions should be a discrete offence, or what platforms should owe. Those are questions about conduct. This is a question about proof.

What the section says

Sections 90A to 90C were inserted into the Evidence Act 1950 in 1993. The mischief was real. Before the amendment a party tendering a computer printout met the rule against hearsay and the best evidence rule at the same door. The amendment cut through both, and was drafted generously so that it would.

The material is a document, and it is primary evidence

"Document" under the Act extends to a photographic or other visual recording, including a recording of a photographic or other visual transmission over a distance, and to any matter recorded, stored, processed, retrieved or produced by a computer.⁵ A video file is a document. A voice recording is a document. Section 62 provides that primary evidence means the document itself produced for the inspection of the court, and a document produced by a computer is primary evidence. Printouts of emails and WhatsApp messages fall within the definition and are admissible as primary evidence under section 64: Mok Yii Chek v Sovo Sdn Bhd & Ors.⁶

"Computer" is now defined by reference to the Computer Crimes Act 1997, the earlier definition having been repealed by the Evidence (Amendment) (No 2) Act 2012. It means an electronic, magnetic, optical, electrochemical or other data processing device, or a group of such interconnected or related devices, performing logical, arithmetic or storage functions, together with related storage and communications facilities, excluding automated typewriters, typesetters, portable calculators and similar non-programmable devices.⁷

A machine running a diffusion or transformer model is a data processing device performing logical and arithmetic functions. It is not an automated typewriter. There is no escape at the definition.

One condition of admissibility

Ordinary use is a condition precedent. Nothing in the subsection requires the tendering party to show that the contents correspond to anything in the world.

Two routes to prove it

In Gnanasegaran Pararajasingam v PP the Court of Appeal held the certificate permissive rather than mandatory. Shaik Daud Ismail JCA identified two ways of proving ordinary use: a certificate, or oral evidence.⁸ The Federal Court affirmed that position in Ahmad Najib Aris.

The Court of Appeal in Hanafi Mat Hassan v PP then explained what the oral route actually requires, and the passage matters more than any other sentence in this area.

So a witness taking the oral route must swear that the machine was in good working order and operating properly. Hold that thought until Part IV.

The machinery

Three consequences, and litigators should hold them together. The certificate proves itself, and the certifier need not be called. The presumption of proper operation then attaches. And human intervention is removed as a limiting criterion.

The deeming provision

The closing words deem the condition precedent satisfied. Radhakrishna observed that subsections (1) and (6) appear incompatible, and that (6) was for a time treated as a way of circumventing the certificate requirement altogether.⁹

The courts reconciled them by confining subsection (6). The Court of Appeal in Hanafi held that subsection (6) "can only apply to a document which was not produced by a computer in the ordinary course of its use, or, in other words, to a document which does not come within the scope of s.90A(1)." The Federal Court in Ahmad Najib Aris settled the distinction.

That is the state of the authorities and it should be stated precisely, because the gloss is judicial and the text is wider than the gloss.

Weight, and the overriding provision

Section 90B governs weight, not admissibility. In estimating the weight to be attached to a document admitted by virtue of section 90A, the court may draw any reasonable inference from circumstances relating to the document, including the manner and purpose of its creation, and shall have regard to the interval of time between the occurrence or existence of the facts stated and the supply of the information into the computer, and to whether any person concerned had an incentive to conceal or misrepresent.

Section 90C provides that sections 90A and 90B prevail notwithstanding anything inconsistent in the Act or in any other written law. There is no route around the Chapter where it applies.

The bar on the accused

Section 90A(7) bars an accused from tendering a computer-produced document where he was responsible for the management of the operation of that computer, or for the conduct of the activities for which it was used, or was involved directly or indirectly in the production of the document. The purpose is to stop an accused manufacturing self-corroborating records.

Authenticity is not admissibility

The foundation of this paper is not mine. It was stated in 2012 and it has not been answered.

She made the point concretely. In a stockbroking dispute the mere production of a section 90A certificate was sufficient to admit contract notes, contra statements and monthly statements as proof of their contents, without any concern about authenticity, and in circumstances where the defendant disputed authenticity.¹⁰

The practitioner literature makes the same point about images. A section 90A certificate proving that a photograph was printed from computer data proves that the data produced the printed image. It does not prove that the object photographed exists, or that it is what it appears to be, or that it relates to the accused.¹¹

What did the authenticating work instead

Two things, neither of them the statute.

The first is physics. A photograph tendered in 1993 had a causal chain behind it. Light left an object, passed through a lens, struck a sensor. That chain was never proved because it never needed to be. It was a fact about the world.

The second is cross-examination. Malaysian practice authenticates depictive material by identification, and treats an unchallenged identification as sufficient.

In Abdul Rahman Mohd v PP the police photographer issued two section 90A certificates recording that the images were taken on a digital camera, stored on a memory card, copied to a compact disc and printed on a Fujifilm printer. Counsel for the appellant submitted that the certificates proved only that the photographs were printed in the ordinary use of the computer and nothing else. That submission is the argument of this paper, made in 2021. The Court of Appeal held that what is required of a witness through whom a photograph is tendered is first-hand knowledge of what is shown in the photograph, rather than first-hand knowledge of the taking of the photograph.¹²

In Ahmad Azhar bin Othman v Rozana binti Misbun the investigating officer certified that he was responsible for the management of the operation of the police computer that produced the exhibit. Defence counsel did not put to him in cross-examination that he was not. The point was treated as conceded.¹³

Four assumptions that synthesis has falsified

The 1993 scheme is coherent. It is coherent because four propositions were, in 1993, too obvious to state. Each has now failed.

1. The computer is a conduit, not an author

The model in the drafter's mind was a machine that stores, sorts, calculates and prints. Facts about the world go in. A document comes out. The value of the document derives from the value of what was supplied. The machine adds only the risk of distortion, and ordinary use answers that risk.

Foong Cheng Leong puts the original purpose the same way: section 90A was to admit documents generated by a computer where no human intervention was involved, a bank statement or a CCTV recording, and it has since expanded to all forms of electronic evidence.¹⁴

A generative model is not a conduit. Nothing about the world is supplied to it at the point of production. It samples from a learned distribution and returns an artefact with no referent. It is an author.

Subsection (5) makes this worse rather than better. The deeming provision was included so that the absence of a human would not defeat admissibility for unattended systems and automated logging. Applied to generative output, a provision drafted to stop the absence of a human defeating admissibility now stops the absence of a human raising any question at all.

2. Ordinary use implies reliability

Why did ordinary use work as a test? Not as a technical guarantee. It worked as a proxy for an incentive. A bank's ledger system produces reliable ledgers because the bank depends on their accuracy. An airline's booking system, a hospital's records, a telephone company's call logs: in each case ordinary use implies an institution whose own interests are served by the system being right.

A generative model in the course of its ordinary use produces synthesis. It is performing correctly, to specification, and to the satisfaction of its operator, at the moment it fabricates. No institution's interests are served by correspondence to reality, because correspondence to reality is not what the system is for.

3. There is a person responsible for the operation of the computer

Subsection (2) presupposes a custodian. In 1993 that person worked in the data processing department and their name was on the door.

Take the equivalent question for a synthetic video made with consumer tools. The weights were trained by a company incorporated abroad on a corpus it has not disclosed. They were fine-tuned by a third party and published on a model repository. Inference ran on capacity rented from a cloud provider in a third jurisdiction. The system was invoked through an interface by an account holder who supplied no verified identity. The output was re-encoded and trimmed on a laptop.

There is no person responsible for the management of the operation of that computer. There are five, in four jurisdictions, and none of them will sign for a Malaysian court.

The Gnanasegaran route does not rescue this. A witness may truthfully testify that they opened an application, typed an instruction, received a file, and that this is how the application ordinarily behaves. That is good evidence of ordinary use. It is not evidence that anything depicted occurred, and the section does not ask for any.

Subsection (4) is worse than unhelpful. It presumes the computer was in good working order and operating properly in all respects. The drafter identified malfunction as the route by which a computer document might mislead. Generative systems introduce a second route the drafter had no reason to contemplate: perfect function, no referent. Read literally, subsection (4) presumes the sound operation of a fabrication engine and treats that soundness as supporting the document.

The oral route arrives at the same place by a different door. Hanafi requires the witness to prove the matters presumed under subsection (4). For a generative model the witness can do so honestly and on oath. The machine was working perfectly. That is the problem, not the answer.

4. There was an occurrence

Section 90B directs the court to the interval between the occurrence or existence of the facts stated and the supply of the information into the computer. It presupposes an occurrence and a supply.

Where the exhibit is synthetic there is neither. The court is invited to measure the interval between an event that did not happen and an input that was never made.

The failure runs both ways

A. The fabricated gets in

Trace the path. The tendering party proves ordinary use, by certificate or orally. Where a certificate is given it is prima facie proof without proof of signature, so the certifier need not attend. The presumption under subsection (4) attaches. Section 90C forecloses inconsistent provisions elsewhere. The document is admissible as evidence of the facts it states.

At no point is the party required to account for the provenance of the content. The gateway examines custody of the machine. It does not examine the origin of what the machine emitted.

The remedy is an attack on weight under section 90B, which operates after admission, on material the tribunal has already seen. It requires the opponent to know the exhibit is synthetic, to say so, and to prove it. That requires forensic capacity. Malaysia has limited accredited capability in synthetic media forensics and, so far as I am aware, no accreditation standard for it at all. The burden of detection falls on the party least equipped to bear it, at the latest stage at which it can be discharged.

B. The genuine gets impeached

The second failure will arrive sooner, in greater volume, and will do more damage.

Chesney and Citron named it the liar's dividend. Once the public understands that convincing fabrication is cheap, the assertion that material might be fabricated acquires a credibility it has not earned.¹⁵ The dividend is paid to the party with something to hide, and it is paid automatically.

Malaysia's exposure is structurally worse than that of jurisdictions requiring affirmative authentication of recorded evidence, and the reason is the conflation in Part III. Section 90A never required proof that a recording was genuine. Practice therefore never developed a settled method of proving it, because practice never needed one. When the challenge comes, the prosecution will find the statute equips it to prove the wrong thing.

This is not confined to exotic cases. Closed-circuit television, dashboard cameras, telephone video and voice recordings are central to ordinary criminal practice. Sexual offences. Robbery. Corruption. Causing death by dangerous driving. Domestic violence. In each the recording is frequently the strongest item in the case.

C. Section 114A

Malaysia already has a provision that reasons from appearance to identity. Section 114A, inserted in 2012, presumes a person to be the publisher of material on a site or account bearing their name, photograph or pseudonym, unless they prove otherwise.¹⁶

The provision was criticised on enactment for reasons unconnected with synthetic media. It becomes materially more dangerous when photographs can be generated and accounts fabricated at negligible cost. A presumption reasoning from appearance to responsibility works poorly where appearance is manufacturable. The interaction has not, so far as I am aware, been judicially considered.

D. Section 90A(7), from the other side

Subsection (7) was drafted against one risk: the accused who manufactures a record. It did not contemplate the accused who needs computer evidence to rebut a computer fabrication.

Take an accused whose defence is that the prosecution's video is synthetic, and who wishes to tender data from his own telephone placing him elsewhere, or his own analysis of the metadata of the impugned file. Read literally, subsection (7) may bar both.

Practitioners already work around this and the routes are at Part VII.G. The narrower observation is this. The subsection was drafted with one direction of risk in view. The era it now governs presents risk in both.

The gateway objection

The strongest objection to everything above is Approfit, and it should be met rather than avoided.

In Approfit Sdn Bhd v Kent Sing Construction Sdn Bhd & Ors, considering whether an automated cashier's receipt was a document produced by a computer, Richard Malanjum J held that only certain categories of document, where there is no human intervention, such as bank statements, were captured by section 90A. That followed the English approach distinguishing computer evidence produced with and without human intervention.¹⁷ The practical corollary is well known to practitioners: you do not need a section 90A certificate merely because your exhibit came out of a printer.

So which is a generative output? A human types a prompt. The machine composes. Is the result produced by a computer, engaging section 90A, or is it a human work made with a very capable pen?

There is a genuine tension in the materials. Approfit reads section 90A as reaching only material produced without human intervention. Section 90A(5) deems a document to be produced by a computer whether or not there was any direct or indirect human intervention. The judicial test and the statutory deeming point in opposite directions, and a prompted generative output sits exactly where they diverge.

The question is open. No Malaysian court has considered it. Foong Cheng Leong observes that different courts take different approaches to section 90A generally, which does not encourage confidence that this one will be answered uniformly.¹⁸

The objection does not rescue the position, because the failure exists on either branch.

If generative output falls within section 90A, it is admitted on proof of ordinary use, and provenance is never tested. That is Part V.A.

If it falls outside section 90A, it is proved as an ordinary document, and Malaysian law has no provenance machinery there either. Authentication of depictive material then rests on identification by a witness with first-hand knowledge of what is shown, under Abdul Rahman Mohd, and on the opponent's failure to challenge. That is worse, not better.

What the objection cannot do is remove the material from the Act altogether. The Computer Crimes Act definition, now imported into the Evidence Act, captures any data processing device performing logical, arithmetic or storage functions. A machine running a generative model is within it.

The litigator's part

A working method under the law as it stands. No amendment, no new practice direction. Nothing here is legal advice for any particular matter.

A. The first hour: preserve and hash

The moment digital material comes into your possession, take a cryptographic hash of it and record the value, the algorithm and the time. Do this before you open it, copy it, or send it to anyone.

This costs a minute. Without it you cannot later prove the file was not altered while in your own custody, and in a contested authenticity case that will be put to you.

Item 7 deserves emphasis. Enhancement of poor recordings is routine and is increasingly done with tools that interpolate rather than sharpen. A tool that invents plausible pixels to fill in a low-resolution face is doing generative work. It is almost never disclosed, and the question is almost never asked.

B. Tendering depictive material

The foundation below consolidates existing Malaysian practice and adds the provenance layer the era now requires. The first nine steps follow the sequence set out by Arik Zakri. Steps 10 and 11 are my addition.¹⁹

For audio, add transcription in the original language before translation, identification of each speaker by a witness with personal knowledge, and attestation that the transcript matches the recording. Voice identification requires strict proof where identity is disputed: PP v Zul Hassan.²⁰

Draft the certificate to the exhibit, not to a category. Name the document, the person responsible, the computer, the storage media and the date. Abdul Rahman Mohd shows what an adequate certificate recites: the camera, the memory card, the compact disc and the printer, each identified.

C. Opposing: where the objections lie

1. The responsible person

This is the primary attack and it is established. Admissibility may be challenged on the ground that the witness is not the person responsible for the management of the operation of the computer: Ahmad Azhar bin Othman v Rozana binti Misbun. Foong Cheng Leong's cross-examination sequence works the witness back through the chain until he concedes he does not manage the server, did not enter the data, and cannot vouch for the contents.²¹

The extension for a synthesis case is at paragraph E.

2. The certifier will not be there

Section 90A(3)(b) makes the certificate prima facie proof without proof of signature. The certifier need not be called. If you want to cross-examine that person you must say so, and you must say so before the certificate goes in.

This follows from the structure of the section rather than from any authority I have found, and it should be tested. The practical rule is safe either way: object at tender, apply for the certifier's attendance, get a ruling. Once the certificate is admitted and the presumption attaches, you are arguing weight.

3. The transfer layers

A video that travels from camera to memory card to laptop to optical disc to printed still has been produced several times. Each stage is a separate act of computer production and, on the better view, each requires its own compliance. Multiple devices operating together are deemed a single computer, but the deeming does not dissolve the transfers.²²

Abdul Rahman Mohd is instructive here too. Two certificates were issued for one set of photographs, covering camera, card, disc and printer. That is what compliance across the layers looks like, and most exhibits do not have it.

Practitioners rarely certify every layer. That is a live objection today on ordinary grounds. It is also, and this is the point, exactly where a fabrication or a substitution would be introduced. The existing technical objection and the new authenticity objection point at the same seam. Work it.

4. Screenshots

A screenshot of a screen is secondary evidence of what the screen displayed. It carries no date on its face beyond what the application chose to render, it does not identify the other party except by the name in the witness's own contact book, and it can be fabricated by anyone with a text editor. The Industrial Court declined to attach weight to a WhatsApp snapshot on precisely those grounds.²³

Screenshots are admitted. They should rarely be believed on their own.

5. Enhancement

Ask, always, whether the exhibit was enhanced, by whom, with what tool, and whether the unenhanced original exists. If the answer is that a tool improved the image, the follow-up is whether the tool added information that was not in the original. Frequently it did.

D. The warning

E. Cross-examination: the responsible-person line, extended

The established line establishes that the witness does not manage the machine. The extension establishes that nobody does, and that the witness cannot say what the machine did.

F. When the client says the video is fake

This instruction is now common, and most of the time the client is wrong. Handle it in a fixed order.

Point 6 is the discipline. The liar's dividend is available to your client and it is not in his long-term interest to draw on it. A synthesis challenge that fails is worse than no challenge, because it tells the court the defence will say anything.

G. Working around section 90A(7)

Where the accused needs computer material of his own, the subsection is an obstacle rather than a wall. The recognised routes are these.²⁴

Do this early. Each route depends on steps taken during investigation, not at trial.

H. Directions to seek at case management

Direction 6 does the work of the reform proposed in Part VIII, by consent, in a single case. Ask for it.

Reform

Six principles. An illustrative draft is at Appendix A.

1. Separate records from depictions

Section 90A should continue to govern computer-processed records: ledgers, logs, telemetry, database extracts. A distinct provision should govern computer-generated or computer-altered depictive material, meaning material purporting to represent a person, object, place, event or utterance in visual or auditory form.

The distinction is doctrinally sound, not merely convenient. A record is testimonial by proxy. Its reliability comes from an institution's dependence on accuracy. A recording is different in kind. Its force comes from a causal chain to the world. Generative media presents with the appearance of the second and the provenance of neither. It also resolves the gateway uncertainty in Part VI, which is a second reason to do it.

2. Provenance, not ordinary use

For depictive material tendered as evidence of what it depicts, the gateway should be an account from capture to tender: the capturing device and circumstances, the time of acquisition, a hash taken at the earliest practicable point, a custody log, and disclosure of processing.

This is not onerous. It is what a competent investigator already does. The reform is requiring it.

3. Presumptions that track provenance, not machine health

The subsection (4) presumption should have no application to depictive material, and neither should the deeming in subsection (6). In their place, a rebuttable presumption of authenticity where either a verifiable provenance record accompanies the material and verifies against it, or an unbroken hash-verified chain is shown from a source under the control of a witness. Absent both, the material is not inadmissible. It simply attracts no presumption.

4. A duty to disclose processing

A party tendering depictive material should state whether any generative, restorative or enhancement process has been applied. Undisclosed processing, later established, should go to admissibility and not merely to weight.

This is the cheapest reform here and probably the most useful. It disciplines a practice that already exists and is already invisible.

5. Notice and particularisation of a synthesis challenge

A party contending that depictive material is synthetic should give notice within a prescribed period, stating the parts affected, the features relied on, any expert to be called, and any alternative account of the material's origin.

The model is section 402A of the Criminal Procedure Code. An accused relying on alibi gives notice in writing, and the prosecution is given a reasonable opportunity to investigate. Where notice was not given at case management, the evidence may still be adduced provided notice is given and the prosecution has reasonable time to investigate.²⁵

The court should retain a discretion to permit late notice, as it does under section 402A.

6. Gatekeeping of synthetic media expertise

Opinion evidence on synthesis should state the method or detector used, the material on which it was validated, and its known error rates on material of the relevant kind, having regard to compression, resolution and generator family. Section 45 already requires expertise to be established. What is missing is any standard against which it is measured.

This borrows the discipline that proposed Federal Rule of Evidence 707 attempts to impose on machine-generated evidence generally, and applies it narrowly, where the need is already demonstrated.

The comparative position

Three points, briefly.

The United States has not solved this. Proposed Rule 707 went out for comment through 16 February 2026. The Advisory Committee recorded greater overall concerns on 7 May 2026. On 3 and 4 June 2026 the Standing Committee declined to recommend action and returned it for revision, together with the deepfakes question. A proposed Rule 901(c) has been drafted and not approved.²⁶ The best-resourced evidence rule-making apparatus in the common law world has worked on this for three years and has not landed it.

The European Union has legislated for labelling, not for proof. Article 50 of the AI Act applies from 2 August 2026 and requires marking of content that appears to depict a real person, even where no deception is intended.²⁷ Where it applies it assists provenance. Where a criminal fabrication is produced it does not apply.

Singapore has legislated narrowly, for elections, and again for circulation rather than proof.²⁸

What the courts can do now

Legislation takes years. The cases are arriving. Four measures need no amendment.

1. Certificates to address processing. A practice direction requiring any certificate under section 90A(2) in respect of audio-visual material to state whether generative or enhancement processing was applied.
2. Early hash disclosure. At case management, disclosure of the hash of the file as tendered and, where available, as first captured. It costs nothing and forecloses a great deal of argument.
3. Directions on synthesis challenges. A direction that a party intending to contend synthesis must say so and particularise before trial. This rests on ordinary case management powers, not on section 90A or 90B, and it is the more secure for it.
4. Judicial and prosecutorial education. The least expensive measure and much the most important. A judge who knows to ask where a video came from is worth more than any amendment.

Conclusion

In 1993 Parliament asked a good question. Was this document produced by the computer in the course of its ordinary use? For material that recorded the world, an affirmative answer told you a great deal, because ordinary use stood proxy for an institution that depended on being right.

For material that composes the world rather than recording it, the same answer tells you nothing. The most confident affirmative answer, given in respect of the most capable system operating most faithfully to specification, should worry a court more than a hesitant one.

Radhakrishna wrote in 2012 that the courts and the profession had not appreciated the distinction between authenticity and admissibility. Fourteen years later the profession has an urgent reason to appreciate it.

Malaysia is drafting artificial intelligence legislation in a year when recorded scam losses passed RM2.97 billion and the police confirmed synthetic videos of the Prime Minister circulating as investment solicitations. The evidential question belongs in that Bill, or in a targeted amendment moving alongside it.

If it is not put there deliberately it will be answered anyway. Case by case. By courts without a framework. In proceedings where liberty is at stake. On exhibits that no camera made.

Draft section 90AA

Illustrative only. Offered to show the shape of the reform in Part VIII, not as settled drafting.

Subsection (2) disapplies the deeming in section 90A(6) as well as the presumption in 90A(4), because on the authorities the deeming is what allows ordinary use to be assumed rather than proved. Subsection (8) is expressed rather than left to construction, because the objection it answers is the one on which the proposal otherwise founders.

Authorities and collation

Authorities are tiered by how they were verified. Tier one has been checked against more than one independent source, including a peer-reviewed article which quotes the statutory text and the relevant judicial passages. Tier two is drawn from published practitioner materials and is attributed as such in the text.

One caveat applies to everything. The statutory text here was verified against an article published in 2012. That verifies the 2012 text. Collation against Act 56 as currently in force remains necessary before citation.

Tier one: cross-checked

Tier two: practitioner materials, attributed in text

Other items

Notes