Myanmar’s Military Struggles to Control the Virtual Battlefield Crisis Group Asia Report N°314, 18 May 2021 Page 15 ered steam on 6 February, the ministry shut down the internet for more than 24 hours to thwart online coordination, before reinstating access on the afternoon of Sunday 7 February, prior to the start of the working week.66 The availability of free VPNs in Myanmar meant the regime’s orders to filter websites and block access to social media platforms only had limited effect.67 The ministry has since been ordering mobile operators and service providers to restrict access to thousands of internet protocol (IP) addresses used by VPNs, as well as sites from where VPNs can be downloaded, but this task has proven impossible: although it provides them with long lists of IP addresses for filtering almost every day, the sheer number of VPNs available means that free versions are easily accessible and widely used.68 Social media monitoring continues to show elevated levels of engagement with content from news organisations, suggesting that most users are having little trouble circumventing the controls in order to view Facebook.69 (At the same time, free VPNs and censorship circumvention apps often come at the cost of speed and/ or security, and are usually not suitable for those at high risk of surveillance.) The military’s next tactic was to enact legal changes to restrict freedom of expression and gain access to user data. Its very first public act of law-making after taking power was to distribute a draft Cyber Security Law – based on the NLD government’s version – to mobile operators and internet service providers on 9 February. The law would have required tech companies to onshore their data and provide it to the government at any time on vague national security grounds; it also introduced new categories of offence for spreading “misinformation” or “disinformation” that could result in a three-year prison sentence.70 The draft provoked strong public opposition from activists and businesses, and behind the scenes even some bureaucrats within 66 See “Directive to temporarily block social media service Facebook”, 4 February 2021; “Directive to block social media services Twitter and Instagram, until further notice”, 5 February 2021; and “Directive to temporarily shut down data network”, 6 February 2021. All are available at “Directives from authorities in Myanmar – February-April 2021” on the Telenor website. 67 Data from one source showed a massive 7,200 per cent increase in VPN demand in Myanmar on 4 February, the day that restrictions on Facebook access were put into effect. Similarly, the censorship-bypassing application Psiphon experienced a huge rise in users after the coup and has been among the most downloaded applications since then. See “VPN demand surges around the world”, Top10VPN, 4 February 2021; “The battle for Myanmar plays out on Twitter, TikTok and Telegram”, Deutsche Welle, 20 April 2021. 68 The Telenor website referenced in fn 65 contains a list of directives from the ministry of transport and communications to mobile operators and internet service providers up to 14 February, when Telenor said it could no longer publicise the directives, apparently due to threats from the authorities. Those identified as “Directive to temporarily (but open ended) block IP addresses” reflect efforts to stop VPN use. The ministry has continued to issue directives to block VPN IP addresses since 14 February. Crisis Group interviews, March 2021. 69 Social media monitoring shows the top news story each day on Facebook in January 2021 typically had from 50,000 to 80,000 interactions. In February, this total reached around 300,000 to 400,000 interactions. 70 Onshoring data refers to keeping it in locally based data centres. This change would be significant in Myanmar because it would mean the authorities could gain access to data more easily than if it is kept abroad. “Civil society, businesses condemn junta’s draft Cyber Security Law”, Frontier Myanmar, 11 February 2021. See also “Telenor Group’s response to proposed Myanmar Cyber Security Bill”, Telenor, 15 February 2021.