Myanmar’s military junta quietly making sweeping changes to internet laws to allow mass surveillance

Myanmar’s military junta has quietly made sweeping changes to internet regulations to allow mass surveillance and allow people to be jailed for publishing criticism of the government or using a virtual private network or encryptions.

The little-publicised legal amendments came after the generals who ousted Aung San Suu Kyi were forced to shelve a punitive cybersecurity bill following a backlash from business and criticism from Western governments.

The move is part of a series of attacks on Internet freedoms since the coup of Feb 1. The military regime has for several weeks blocked social media websites and imposed its own data network shutdown every night from 1am to 9am, amid escalation of arrests of democracy supporters and fears about a worsening crackdown on civic space.

Earlier last week all mobile internet was cut off indefinitely, leaving only WiFi services operating. The shutdown appears designed to prevent protesters and journalists from livestreaming street violence by the security forces and makes it even harder for people and businesses to communicate.

Telenor, one of Myanmar's main mobile operators, on Wednesday confirmed that its mobile internet network has been shut since Monday March 15 and said it had "protested this development" to the telecoms regulator. "We strongly believe that the network should be kept open at all times to ensure people's basic rights of freedom of expression and opinion," it said.

The crackdown presents multinational telecoms operators, including Norway's Telenor and Qatar's Ooredoo, and foreign investors in the sector including Britain's development finance institution, the CDC Group, in a dilemma as they balance their need to comply with junta orders and their commitment to respecting human rights.

The regime initially sent a draft cybersecurity law to banks and telecom operators a week after the coup, asking for urgent comments by February 15.

The proposal was immediately denounced by supporters of Aung San Suu Kyi as an attempt to crush the protest movement.

“We [protesters] are worried about it,” a protester in Yangon who goes by the name Miles told the Telegraph.

“If you read the [draft] cyber law thoroughly, there is only one thing you have to understand - your existence means jail. If someone checks my phone or my friend’s phone… there is a reason to put us into jail for up to three years,” he added.

But the plans also provoked an unprecedented backlash, with Myanmar’s top national and local business organisations publicly criticising the bill and warning of its detrimental impact on the country’s digital economy and investment prospects.

According to an English translation of the draft law provided by an industry source, the security bill would have granted the state huge powers over data access, surveillance and content and service control, including determining the place for online service providers to store user data and instructing providers to remove online content.

In particular, business groups said they were concerned requirements for service providers to disclose user information to the authorities “at any point in time and without justifiable reasons or an authorisation from an independent judicial body of competent jurisdiction”, and to remove, prevent or destroy any content which may be deemed to cause “hatred and destroy peace and unity”.

The American, British, European, New Zealand chambers of commerce collectively objected to the bill in a joint statement raising concerns about a number of privacy, data access and content control powers under the draft legislation.

Telenor said it “is of the strong opinion that the Cyber Security Bill should not be passed”, citing freedom of speech and expression and personal privacy and security concerns.

“Passing the proposed Bill during a state of emergency and granting such broad powers to a temporary administration is not appropriate,” it added.

And the Myanmar Centre for Responsible Business, a widely-respected NGO, warned that adopting the proposed bill would not only affect civil society, but also “greatly increase the risk for companies in Myanmar, to the extent that some responsible international investors, particularly in the ICT sector, may exit the market altogether, or delay or terminate plans to invest or supply services.”

Two senior industry sources in Yangon, who spoke on condition of anonymity, told the Daily Telegraph that the junta had not directly responded to the concerns about the cyber security bill.

But both believed that the electronic transactions law amendment, quietly adopted last month, was intended to be a climbdown by the regime.

According to an English translation of a copy of both proposals, the amendment includes, among other clauses, criminal provisions proposed in the cybersecurity bill, such as spreading false information, damaging foreign relations and various forms of personal data management.

Free Expression Myanmar, a Yangon-based advocacy group, said much of the amendments' wording “has been copied from” the cybersecurity draft law and could allow long prison terms to be handed down for offences varying from political activists sharing information, to journalists writing news critical of the junta or internet users for using VPNs or encryption.

“The vague and broad nature of the new crimes and their long prison sentences will serve as a significant threat to the right to freedom of expression, to digital rights generally, and to civic space as a whole,” the advocacy group warns.

“The electronic transactions law amendment combines broad powers of interception with vague digital crimes.

The result is a framework that both enables mass surveillance while simultaneously ensuring comparatively long prison terms for those who are deemed to have stepped out of line,” a Myanmar-focused legal expert who has studied both proposals said.

“We may expect to see a digital space laced with fear due to clear privacy intrusions followed by arbitrary arrests of social media users,” he added.