CYBER THREAT ANALYSIS Myanmar, officially known as the Republic of the Union of Myanmar and formerly known as Burma, was historically composed of several territories containing sovereign states, which were united under British colonial rule from 1824 to 1948. In 1947, prior to the country gaining its independence from British rule, Bogyoke Aung Sang — the father of the pro-Democracy leader Daw Aung San Suu Kyi — met with the various ethnic leaders of the territories to unite them under one country through the signing of the Panglong Agreement. However, Bogyoke Aung Sang was assassinated before the completion of the agreement, causing domestic disputes between the territories. During this time, U Nu became prime minister and presented an ethnic mix in his party to present a united front: a Shan president, a Bama prime minister, and a Karen commander-in-chief and air force chief. This cabinet lasted until 1962, when General Ne Win — the former prime minister of Myanmar from 1958 to 1960 — led a military coup to take control over the government, thus leading the nation to be under the control of the Burma Socialist Programme Party, a one-party totalitarian state, until 1988. Myanmar has created three constitutions, officially known as the Constitution of the Republic of the Union of Myanmar, in the history of the country — 1947, 1974, and 2008. The first two constitutions outlined the branches of government and outlined the responsibilities of the legislature. However, both of these constitutions were overridden by the military in the 1962 and 1988 coups, respectively. The latest iteration of the constitution paved the way for the democratic proceedings in recent years; however, as part of the regulation, the Tatmadaw was automatically provisioned 25% of the seats in regional parliaments, giving them effective veto power for any proposed bill and total control of the Ministries of Home Affairs, Defence, and Border Affairs. Introduction of a New Cybersecurity Law On February 9, 2021, the State Administrative Council, which was created after the February 1, 2021 coup, released a draft cybersecurity law to telecommunications providers that operate within the country. The proposed bill immediately sparked backlash from telecommunications providers, social media companies, journalists, and human rights organizations due to its allowance for the Myanmar military to have access to user data and its vague verbiage that could allow the military to prosecute users for purported infractions, such as speaking out against the government or organizing pro-democracy movements. We were unable to view an original copy of the bill; however, according to Human Rights Watch and Reporters Without Borders, the bill contains the following components: www.recordedfuture.com | Recorded Future ® • Article 29 allows the government to order an account’s “interception, removal, destruction or cessation” in the event that the account content is “causing hate or disrupting unity, stabilization and peace”, has posts related to “disinformation”, or contains comments going “against any existing law”. • Article 30 states that online service providers would be required to keep user data, including the user’s “name, IP address, phone number, ID card number, and physical address, for up to three years”. • Article 51 of the bill allows the State Administrative Council to “temporarily prohibit any online service provision, including shutting down communication networks, temporarily control devices related to online service provision, and issue a final ban on any online service provider in Myanmar”. • Article 65 of the bill states that “anyone who posts ‘misinformation or disinformation’ faces up to three years in prison … if they are found to have done so with the intent of causing public panic, loss of trust or social division”. This also extends to users who were found to have created a “fake account, website, or web portal”. • The bill also allows the military to conduct unspecified “interventions” in order to keep public order, investigate crimes, and safeguard public life, property, and public welfare. Despite these censorship laws, and attempts by the government to require social media users to enter their personally identifiable information when registering accounts, internet users in Myanmar have continued to use social media to share news, stories, and content related to pro-Democracy movements. The proliferation of social media in the country, especially Facebook, has led to the government cracking down on Facebook and their subgroups in an attempt to remove statements of anti-military sentiment during the coup. Government Control of Internet Connectivity Starting on February 1, 2021, internet connectivity nationwide was limited and internet activity dropped by approximately 50%, as the coup unfolded and government leaders were taken into custody. By February 13, nationwide internet blackouts were implemented from approximately 1:00 AM to 9:00 AM, local time. During this time period, internet use was reduced to approximately 15% of its normal traffic. CTA-2021-0324 2