Myanmar: Note on New Draft Cyber Security Law A very important new development in the draft Law is the attempt to bring the use of virtual private networks or VPNs under the control of the military regime. A new Article 62 provides that to set up a VPN (or to use similar technology) on a licensed network (i.e. to use one on your Internet or mobile plan), you must first apply to the Ministry for permission. In other words, using a VPN over a local communications network is illegal absent Ministry permission. According to Article 90, a failure to respect this rule shall be punished by between one and three years’ imprisonment (i.e. a minimum of one year’s imprisonment), a fine up to five million MMK (approximately USD 2,700) or both. 6 Furthermore, various other provisions cover ancillary offences which might be deemed to relate to this, such as Article 89(c), which makes it an offence to encourage or assist someone to access a cyber source in violation of the law. This is clearly contrary to international law, which protects the rights to use anonymisation and encryption tools, including VPNs. As a practical matter, VPNs have become a lifeline for many people in Myanmar who are simply trying to exercise their rights to freedom of expression whether by expressing themselves or by accessing information provided by others.7 Content Restrictions As noted above, the February 2021 version of the draft Law already included extensive and illegitimate restrictions on the content that could be accessed and shared digitally – banning such content as “misinformation and disinformation” and even “written and verbal statement against any existing law” – and then required Internet service providers to remove this content. The very problematical existing rules have all been preserved in the current version of the draft Law and one more has been added, namely for content which may damage an individual’s social standing and livelihood (Article 35(f)). While it is legitimate to provide for appropriate protection for individuals’ reputations, via a defamation law, the Myanmar legal framework already provides more than sufficient protection for this.8 Thus, According to some sources, the authorities are already cracking down on the use of VPNs, even though the legal basis for this is not clear. See Frontier Myanmar, Daily Briefing, “VPN crackdown begins”, 27 January 2022. 7 VPNs have, for example, become essential tools to access Facebook, among other services, since the military ordered telecommunications service providers to block access to it shortly after the coup. For more information about the rise in VPN usage in Myanmar, see Beh Lih Yi, “The military has imposed information blackouts as people turn to VPN and encrypted messaging apps to skirt restrictions”, 25 February 2021, https://news.trust.org/item/20210217141412-ljfpg. 8 See Joint submission to the Universal Periodic Review of Myanmar by Arakan Journalists Association, ARTICLE 19, Athan, Centre for Law and Democracy, Free Expression Myanmar, Generation Wave, Kachin State 6 The Centre for Law and Democracy is a non-profit human rights organisation working internationally to provide legal expertise on foundational rights for democracy. 4