Myanmar: Note on New Draft Cyber Security Law The introduction of minimum sentences of imprisonment, mentioned above, is new in the current draft Law (i.e. these were not present in the February 2021 version) and these now apply very widely to Articles 84-88 and 90-100. Formally, all of these provisions provide for imprisonment “or” a fine, and so are technically not mandatory minimum imprisonment sentences. However, it seems very likely that they will in practice be treated in that way. Providing for minimum mandatory periods of imprisonment is, outside of more serious offences, not legitimate as it fails to accommodate the principle that the sentence should correspond to the gravity of the wrong done. This is especially true given the wide range of actions which could constitute a breach of any of these articles, many of which may represent very minor wrongs. And even providing for minimum mandatory periods within a sentence of imprisonment (which, technically is what these articles do), is distinctly not better practice as, again, it mitigates against the sentence reflecting the gravity of the wrong done. In line with a number of legal amendments introduced by the military regime, there are also two new security-related offences. Article 92 creates a special crime where various cyberoffences, such as hacking or inserting malware, attract more serious sanctions – namely between two and five years’ imprisonment and/or a fine up to 30 million MMK (approximately USD 16,000) – where they are done “with an intent to threaten or disturb national sovereignty, security, peace and stability, rule of law and national solidarity”. It is significant that security and peace are lumped together here with national solidarity. Article 93 covers various cybercrimes committed with the “intent of deteriorating the relationship between the country and other foreign countries or for the interests of other foreign country” and provides for even more onerous sanctions, namely between three and seven years’ imprisonment and/or a fine up to 50 million MMK (approximately USD 27,000). While it is not necessarily illegitimate to provide for harsher penalties where crimes are committed with these sorts of intent, Myanmar already has sufficient rules to protect national security online.12 And, as noted earlier, these rather harsh minimum prison sentences are very suspect given the range of actions that could potentially trigger a conviction under these provisions. Recommendations 12 See, for example, Centre for Law and Democracy, “Myanmar: Groups Plan to Reform Digital Content Restrictions”, 10 December 2017, https://www.law-democracy.org/live/myanmar-groups-plan-to-reformdigital-content-restrictions/. The Centre for Law and Democracy is a non-profit human rights organisation working internationally to provide legal expertise on foundational rights for democracy. 8