Myanmar’s Military Struggles to Control the Virtual Battlefield Crisis Group Asia Report N°314, 18 May 2021 Page 12 At the same time, the NLD government began to push for stronger lawful interception powers that would enable it to gain direct access to user data from mobile operators and internet service providers. In December 2020, mobile operator Telenor warned at a briefing in Yangon that without sufficient safeguards, the plan would create “an opportunity for misuse and breach of customers’ human rights”. The telecoms giant said it had so far been reviewing government requests for user data on a case-by-case basis, and had rejected some, but under the proposed regime the government would be able to collect the information directly.53 Budget documents show that a lawful interception program was already well under way by the time of Telenor’s disclosure, with the ministry of transport and communications receiving the equivalent of $4.6 million in early 2019 to carry out the initiative.54 The government also launched a SIM card registration program in 2020, enabling it to better track individuals’ online conduct, despite warnings from some in the industry and digital rights proponents of the potential for abuse. The program required all users to re-register their SIM cards by uploading their national ID or passport, and limited users to a maximum of two cards. Although SIM registration was previously a requirement, it was common practice to purchase a card that had already been registered under another person’s name. Mobile operators and digital rights advocacy groups warned there was a lack of clarity over how the information gathered from users would be stored and used, highlighted that many people in the country (such as the Rohingya) lack any ID, and questioned whether it was wise to chill access to information amid the COVID-19 pandemic and given the restrictions already created by the Rakhine internet shutdown.55 The government ignored these reservations, and more than 34 million SIM cards were reportedly deactivated. “This was a massive surveillance operation, essentially, with no safeguards”, said one source.56 Prior to being removed from office, the NLD government was also in the process of creating a biometrics database for telephone users, which would have included their fingerprints and a scan of their ID.57 Another initiative would have created “e-IDs” – a system that is not controversial in principle, but under Myanmar’s laws implied that the authorities, including the military, could have had access to personal data with few checks and balances.58 tary regime in February 2021. See “Myanmar’s Legal Framework for Cybersecurity Needs to Be Built to International Standards”, Myanmar Centre for Responsible Business, 12 February 2021. 53 “Telenor Myanmar 7th Sustainability Briefing”, Telenor Myanmar, 3 December 2020. For further discussion, see “Telenor says government is seeking direct access to customers’ personal data”, Myanmar Now, 12 December 2020. 54 “The Rise of Online Censorship and Surveillance in Myanmar: A Quantitative and Qualitative Study”, Open Technology Fund, November 2020. 55 See, for example, “Millions in Myanmar risk having mobile phones cut off after SIM registration deadline”, Myanmar Times, 29 April 2020. 56 Crisis Group interview, digital rights advocate, March 2021. See also “Telenor Myanmar 7th Sustainability Briefing”, op. cit.; and “Telecoms ministry says it has deactivated more than 34 million SIM cards”, Myanmar Now, 27 October 2020. 57 “Myanmar diverts special telecoms fund to biometrics database”, Myanmar Times, 11 June 2020. 58 “e-ID System Working Committee discusses finishing touches to contract with Austrian company”, Global New Light of Myanmar, 2 November 2019; “Myanmar to receive Austrian loan for national e-ID system”, Myanmar Times, 28 May 2020.