Myanmar’s military junta has passed its long-threatened Cybersecurity Law, which aims to tighten its control over vital arteries of communication amid the country’s intensifying civil war.
According to the text of the law, which has been published in parts in the last two editions of the state-run Global New Light of Myanmar, the purpose of the law is to “effectively investigate and take action against cyber crimes” and to “protect and safeguard the sovereignty and stability of the nation from being harmed by cyber threats, cyberattacks, or cyber misuse through the application of electronic technologies.”
Myanmar’s government has been considering cyber-security legislation for some time – a draft framework was circulated for comments in 2019 – but the passage of the law is a clear reaction to the mass protests and armed uprising against the military’s seizure of power in February 2021. Social media networks and messaging apps – mostly Facebook, but increasingly X and Telegram – have been vital to the resistance groups that are opposing military rule, as well as to the public at large, controlling these channels of communication has become a priority for the junta.
It is unclear whether and how the version of the law that came into effect on January 1 might differ from the earlier drafts that have done the rounds in the four years since the coup. But according to an analysis of a draft version of the legislation published by Access Now in January 2022, the Cybersecurity Law “confers overbroad powers to the junta to censor expression online and undermine data protection, with no prospect for independent oversight or effective remedy.” The passage of the law would “effectively extinguish any remaining avenues for dissent and expression against an increasingly violent regime.”
Among the various repressive tools that have been confirmed to be included in the final version of the Cybersecurity Law, perhaps the most significant is a provision penalizing the unauthorized provision of virtual private networks (VPNs) in Myanmar. VPNs have become a vital technology in post-coup Myanmar: with the media being brought nearly exclusively under state control, and most of the country’s journalists in prison, underground, or in some form of exile, they are widely used to circumvent internet restrictions, and both gain access to information and send information out of the country.
Although the military has begun blocking access to VPNs, the law sets out a penalty of six months in prison and a fine for “unauthorized VPN installation or service.” An earlier draft of the law also mandated prison terms of up to three years for users of VPNs, though this was not mentioned in the state media reports on the Cybersecurity Law and it is unclear if it is contained in the final version of the legislation.
As well as provisions banning online gambling and various forms of online crime, the law also mandates prison terms of up to six months, as well as fines, for distributing, transferring, copying, or selling information via digital means that is “inappropriate for the public.” It also states that any person convicted of cyber-misuse of computer programs can be imprisoned for up to two years. Crucially, the law also states that “Myanmar citizens residing in foreign countries shall be liable to punishment under this law if they commit any offense,” which effectively extends the provisions of the law to the large diaspora of exiled junta opponents, including much of the nation’s independent media.
As with the punishments for using VPNs, a number of provisions contained in earlier versions of the law have not been mentioned in the state media reporting on the law’s enactment. These include provisions compelling internet providers to prevent or remove any content deemed to “cause hatred, destroy unity and tranquility,” any “untruthful news or rumors,” or anything that is “inappropriate” to Myanmar’s culture, and those forcing internet companies to hand over user data to the military.
Given that the full text of the final Cybersecurity Law is not yet available, it is unclear whether these provisions are in the version that is now in effect. (While the text of the law is being published in parts in the Global New Light of Myanmar, with “instalments” appearing today and yesterday, the relevant sections have not yet appeared.)
In any event, even if changes have been made to earlier drafts, the passage of the Cybersecurity Law marks the latest step in a steady reversion to the airless constriction of past eras of military rule, ratcheted up by the added urgency of wartime emergency.
