The military junta has revived a draconian cybersecurity bill that would provide sweeping powers to the authorities, according to a Human Rights Watch (HRW) report.
The bill would allow the junta to access user data, block websites, order internet shutdowns, and prosecute critics and representatives of non-complying companies.
The Cybersecurity Law was initially proposed a week after the coup. The current draft, includes new provisions that would ban use of virtual private networks (VPNs), abolish the need for certain evidentiary proof at trial, and require online service providers to block or remove online criticism of junta leaders. Ten international chambers of commerce in Myanmar issued a joint statement on 28 January 2022, that said the proposed law “disrupts the free flow of information and directly impacts businesses’ abilities to operate legally and effectively in Myanmar.”
“Myanmar’s military junta has taken a terrible draft cybersecurity law and made it even worse,” said Linda Lakhdhir, Asia legal adviser at Human Rights Watch. “The junta should scrap this bill, which would further devastate free expression and access to information across the country.”
The law applies not only to social media and other content-sharing platforms, but also to digital marketplaces, search engines, financial services, data processing services, and communications services providing messaging or video calls and games.
Under a new provision, the use of VPNs to browse the internet would be a criminal offense without specific permission from an as-yet-unspecified ministry authorized to deal with cybersecurity. Use of an unauthorized VPN would be punishable by up to three years in prison. Virtual Private Networks, which allow a user access to blocked content, have played a critical role in enabling internet users in Myanmar to access sites blocked by the military since the coup and to access the internet without disclosing their true location. VPNs are also routinely used by businesses and individuals to ensure privacy and security.
Another newly added provision would allow the authorities to order Digital Platform Service providers to block or remove content about which there is a “legitimate complaint” that the content “damages a person’s social standing and livelihood.” It would not require the information to be false or require a court order. In effect, the new provision would allow the authorities to order the removal of any content critical of individual military leaders or others linked to the junta, according to HRW.
The draft law also retains provisions from the earlier draft requiring online service providers to block or remove a wide range of information on the instruction of the authorities. Prohibited content includes “misinformation and disinformation,” information “causing hate, disrupting the unity, stabilization and peace,” and statements “against any existing law.” Anyone who posts “misinformation or disinformation” faces a minimum of one year and up to three years in prison if they are found to have done so “with the intent of causing public panic, loss of trust or social division.”
According to HRW this means that any criticism of the coup or the military could be deemed as intending to cause “loss of trust” in the junta or social division, the junta could use these provisions as sweeping censorship tools.
It also believes that the law could be used to force telecommunications companies to facilitate the live interception of communications. Last May, Reuters reported that the military, through the civilian government then in power, had forced telecommunications and internet service providers to install live intercept capabilities in the months leading up to the coup.
There will also be no legal requirement for a prosecutor to bring digital evidence to the court. According to the new law, “a report or other relevant documentation” is sufficient and “shall be deemed to have been presented as evidence before the court.” This provision violates defendants’ rights to a fair trial and due process, which require that any evidence be presented against them, Human Rights Watch said.
The bill gives the authorities wide scope to block services and order internet shutdowns. The ministry assigned to implement cybersecurity matters, with approval from the junta, would be able to temporarily prohibit any digital platform provision, temporarily control devices related to provision of digital platform services, and issue a final ban on any digital service platform provider in Myanmar.
Myanmar does not have any privacy or data protection laws that regulate the collection, use, and storage of personal data to safeguard against abuse when data is collected and retained even for legitimate purposes.
