Background
The State Administrative Council (SAC) started to circulate a draft Cyber Security Law in February 2021 with the intention to replace the Electronic Transition Law (ETL) 2004, which was last amended on February 25, 2014. The revised draft of the Cyber Security Law was circulated in the following year in January 2022. This article provides an overview of the draft Cyber Security Law (January 2022 version), and explores how this law is threatening the rights of the people.
With 18 chapters and 115 Articles, the January 2022 draft Cyber Security Law would allow the authorities to access user data, block websites, order internet restrictions, and criminalise the use of Virtual Private Networks (VPNs).
In accordance with Chapter (3), Article 9 of this draft law, the objectives of this law are to be able to safely and securely use cyber sources, critical information infrastructure, and data stored with electronic technology, to be able to protect the personal information of the public following the law, to be able to safeguard and protect from harassing, cyber-attacking and cyber-fraud by using electronic technology to harm national sovereignty, peace, and stability, to be able to supervise in ensuring that cyber security services are systematically implemented in accord with the law, to prevent cyber-crimes, and to support the digital economy, to recognise and legally protect the authenticity and integrity of electronic information in conducting local and international communications using cyber sources.
Institutional Structure
The Cyber Security Central Committee would be established by the Union Government according to Article 5 of this draft law. Meanwhile, Article 7 stipulates that “With the approval of the Union Government, the Central Committee shall form the Cyber Security Steering Committee” so Cyber Security Steering Committee was involved and the Steering Committee shall form the Cyber Security Working Committee, Cyber-Crimes Working Committee, Cyber Protection Working Committee, Electronic Communication Supervision Working Committee, and Other necessary Working Committees which are set out according to Article 9 (a) (b) (c) (d) and (e) of this draft law. Furthermore, Article (10) defines “ Steering Committee shall form an investigation team with the approval of the central committee if the works outlined in this law require an investigation” so the Steering Committee has the mandate to form the investigation team.
Flow Chart of the Institutional Structure
Impacts of the Draft Cyber Security Law
A large number of businesses, local and international organisations, and individuals are deeply concerned about this draft law because it would allow the authorities to hamper the freedom of the Internet and access to information, block specific websites, and personal access data, and criminalise the use of restricted applications.
Virtual Private Networks (VPNs)
The significant fact of this draft law is that anyone who uses Virtual Private Networks (VPNs) could be criminalised. Article 62 provides that “Permission from the Ministry must be sought in line with conditions for the use of VPNs & similar tools to set up, access and use networks that are licensed under the Telecom Law”. In other words, it is illegal to use VPNs over the local communication network without the permission of the Transport and Communication Ministry. According to Article 90, it mentioned that anyone who uses the VPNs without the permission of the Ministry shall be punished by one and three-year imprisonment and five million MMK (approximately USD 2,700) or both.
The usage of VPNs is also banned in other countries such as China, Russia, Belarus, North Korea, Turkmenistan, Uganda, Iraq, Turkey, UAE, and Oman. Specifically, China has already banned the use of popular social media platforms and search engines such as Facebook and Google. Similarly, the use of VPNs is also illegal in China except for the government-approved service providers. This kind of VPN restriction is highly affecting individual freedom. On the other hand, many governments from those countries argued that these VPN restrictions are to protect their citizens.
Back to the draft law in Myanmar, Article 89 (c) described that “Encouraging or assisting access to cyber sources violates the regulations prescribed by the law”. The mobile phone shops which install VPNs, the civil society organisations that give digital security training and businesses that use social media platforms, such as Facebook, to communicate with customers could be penalised.
Whilst this Cybersecurity Law has yet to be enacted, the authorities have already blacklisted a significant number of websites, including Facebook, Twitter, and online learning platforms which are not accessible without VPNs. At military checkpoints, security forces also inspect civilians’ mobile phones to check whether they have VPN services installed. Specifically, most basic education and university students are highly dependent on online platforms to continue their education because they are reluctant to go to the formal schools that were opened by the Military Council. On the other hand, Internet restrictions and this proposed Law also limit their access to education. Therefore, digital rights groups condemned this proposed Law as a violation of the privacy of the citizens, human rights, and freedom of expression and education.
Content Limitations
In accordance with the Article 35 (f), prevention, removal, destruction, and cessation shall be made if expressions that damage an individual’s social standing and livelihood which causes in local cyberspace. However, the legal framework of Myanmar has already provided more than sufficient protection for this, and this kind of protection is no longer needed. Furthermore, Article 96 prescribed that anyone who is convicted of sharing sexually explicit content shall be punished with between one and two years imprisonment and/or with a fine of MMK 5 million MMK (USD 2,700). This law could be used to violate the freedom of expression, and right to information of the users because the citizens – not only the teachers, but also the civil society workers – could be criminalised for providing sex education, raising awareness of LGBTIQ+ issues, and other related matters. In addition, the government’s legal authority has the permission to check and take over online businesses, order for deleting content, block digital platforms such as Facebook, Instagram, etc, revoke business licences, and seize individuals’ computers or phones, all without the judicial oversight (Articles. 60, 61b, 35, 61c, 71-78, 55, 57)
Financial Restrictions
In this draft law, the Central Committee set out the policies, rules, and regulations in terms of online financial services. Article 94 provides that anyone who provides online financial services without the permission of the Central Bank of Myanmar nor is legally registered in Myanmar is subject to imprisonment of between one and three years and/or a fine of up to MMK 10 million (USD 5,300). Likewise, Article 95 mentions that anyone who is buying or selling digital currency or cryptocurrency shall be punished with imprisonment of between six months and one year and/or a fine of up to MMK 25 million (USD 13,300). The authorities also put strict rules on foreign currency transitions. Most of the foreign investments left the country resulting in the loss of jobs for Myanmar citizens due to the restriction on foreign currency transition. So this restriction ultimately affected all aspects of civic life in the country.
Operational Structure
There is a concern that the Central Committee is planning to establish the National Digital Laboratory under this draft law. To support this fact, Article 34 (e) provides “ cyber security service providers shall apply cyber security technology and required standards”. Additionally, Article 65 mentions that “the National Digital Forensic Lab and the Digital Forensic Lab will be established so that the respective authorities can be submitted to the court in the form of digital evidential materials pursuant to the stipulations”. The establishment of this Digital Laboratory is to accuse the ones who violate this law by finding evidence against them.
Recommendations from International Communities
It is clear that this draft law would completely affect every sector of the country, especially in the digital economy and free flow of information. A joint statement on 28 January 2022 by the US, EU, Australian, British, French, German, Greek, and Italian Chambers of Commerce in Myanmar and the US ICT Council for Myanmar, and Myanmar Private Equity & Venture Capital Association (PEVCA) expressed deep concern about the draft law and they remarked that this would disrupt the freedom of information and directly impact businesses’ abilities to operate legally and effectively in Myanmar. For example, France’s Total Energies, Japanese beer maker Kirin Holdings and Norway’s leading telecom operator – Telenor withdrew from Myanmar during the last two years.
Likewise, The Asia Internet Coalition, an alliance of 16 leading Internet companies in Asia issued a similar statement on 14 February 2022 noting that the draft law undermines user privacy, limiting freedom of expression and creating burdens on domestic and foreign businesses, that’s why the coalition urges the Myanmar authorities to reconsider this law. The 2022 draft version of the Myanmar Cyber Security Law is solely threatening the digital freedom of citizens. Since January 2022, more than 200 people have been arrested for social media posts supporting Myanmar opposition. In addition, anyone caught using a VPN to access the Internet at the checkpoints may also be detained. Therefore, Intergovernmental organisations and individual countries should continuously care about the development of this draft Law and respond with action-oriented approaches to Myanmar’s political conflict as this is a concern for regional peace and security.
This article is part of the inaugural report of the Asia Pacific Policy Observatory. The April 2023 edition focuses on rights, privacy, and freedom in cyberspace in the digital age. Read full report here.