Despite Malaysia’s insistence that its long-standing non-alignment policy extends to cyberspace, analysts say the country’s reliance on American and Chinese technology could make such a stance difficult to sustain amid the rivalry between the two superpowers.

Defence Minister Mohamed Khaled Nordin said on Monday that Malaysia would “always remain neutral” in cyberspace, arguing that cyber threats could come from non-state actors and should not be viewed solely through the lens of geopolitical contestation.

“As a principle of the country, we are non-aligned. We are neutral, and it goes into every domain,” Nordin told reporters at the Cyber Digital Services, Defence & Security Asia 2026 event. “Cyberattacks can come from anybody from anywhere, and it may not come from a state actor.”Analysts warn, however, that Malaysia’s reliance on foreign technology could leave critical systems exposed to disruptions if a major power confrontation were to result in sanctions, export controls and other curbs.

“Neutrality in foreign policy does not make our digital systems neutral,” said Murugason R. Thangaratnam, a cybersecurity consultant and adjunct professor at the University Malaysia of Computer Science and Engineering.

He cited Malaysia’s telecommunications networks, cloud services and defence systems, as well as other critical infrastructure that relied on technology from the US, China and elsewhere.

“Malaysia need not take a side to be pushed towards one,” he said. “Malaysia can remain politically non-aligned, but in cyberspace non-alignment is a policy aspiration, not a technical reality.”Malaysia has previously faced the ripple effects of the superpower tech rivalry.

In March last year, then investment, trade and industry minister Tengku Zafrul Abdul Aziz said the US had asked Malaysia to closely track high-end Nvidia chips entering the country amid concerns that some could be diverted to China in violation of Washington’s export controls.

In July, Malaysia introduced a Strategic Trade Permit requirement for the export, transhipment and transit of high-performance AI chips of US origin, including those not listed as strategic items. The Investment, Trade and Industry Ministry said the measure was intended to close regulatory gaps as it reviewed whether chips should be added to Malaysia’s Strategic Items List.

In recent years, Malaysia has sought to avoid dependence on any single tech supplier.

The country’s first 5G network, operated by Digital Nasional, was built using equipment from Swedish tech giant Ericsson, while its second 5G network was developed in partnership with ZTE, a partially state-owned Chinese tech company. Malaysian mobile telecoms services provider U Mobile also opted to partner with Chinese multinational corporation Huawei Technologies to deploy the second 5G network.

Farlina Said, director of cyber and technology policy at the Institute of Strategic and International Studies Malaysia, said the country could be considered technologically non-aligned, with infrastructure such as its 5G networks drawing on innovation from East and West.

“The landscape may differ if we are looking at military applications,” Farlina said, explaining that in the sensitive security domain, Malaysia must consider the compatibility of systems used by its partners.

Diversification was important to prevent a single point of failure, and for international investors to feel safe and secure about their systems in Malaysia, she added.

Ainiuddin Wahid Abdul Wahab, a professor from the Department of Computer Systems and Technology at Universiti Malaya, said that having a diversified tech supply chain did not mean that Malaysia would not face any risks.

Any major power conflict, sanctions and export controls could affect operating systems, security patches and cloud services, forcing organisations to move to other technological ecosystems or face serious disruptions, Wahab said.

“The biggest risk is not the hardware but the lifeline that keeps it running, such as cloud services, software updates and proprietary standards,” he added.

“The safeguard is to map our dependencies and prepare backup plans early.”In 2021, the Malaysian government announced a push to expand cloud services across the public sector. Its government cloud programme uses four commercial providers: Microsoft Azure, Google Cloud, TM Cloud Alpha and Amazon Web Services.

Farlina noted that under the US CLOUD Act, Washington could require foreign entities to hand over data, raising questions over digital sovereignty during a geopolitical crisis.

“There are incidents which illustrate how legal orders could still apply across borders, especially if companies are headquartered in the specific [US] state,” she said.

Last year, a Microsoft France executive told a Senate inquiry in Paris that he could not guarantee that data belonging to citizens of France would never be handed to a foreign authority without the approval of the French government.

In a further example of the blurred tech boundaries, theg of a partnership agreement in July between Malaysia’s National Cyber Security Agency and Huawei Technologies Malaysia covering areas ranging from cryptology to AI security has prompted concerns of Washington’s possible objection.

In 2023, the US and European Union warned Malaysia of national security and investment risks over its 5G roll-out and Huawei’s potential role in the network, with US ambassador Brian McFeeters warning that “untrusted suppliers” could expose the Southeast Asian country’s infrastructure to security risks.

Ultimately, Malaysia has to ensure that its critical digital infrastructure can continue to function even during a political crisis between the major powers, according to Murugason.

“Malaysia does not need to choose between Washington and Beijing,” he said. “It needs to ensure that, in a crisis, no one else can make that choice for us.”