Myanmar’s Military Struggles to Control the Virtual Battlefield Crisis Group Asia Report N°314, 18 May 2021 V. Page 26 What Role for International Actors? The trajectory of the technological battle inside Myanmar will largely be determined by the decisions of the military regime. Influencing its policies is difficult, particularly as for now its sole focus is accomplishing near-term security objectives. Yet there are a number of steps international actors can take to minimise the risk of harm to internet users in Myanmar, and to limit the ability of the regime to use technology against its opponents or to build its capacity to control the online space. A. Restricting the Military’s “Digital Toolkit for Repression” Budget documents show that under the NLD government, the civilian-led ministry of transport and communications and military-controlled ministry of home affairs acquired or attempted to acquire various equipment and software from companies from a range of countries, including the U.S., Canada, Sweden and Israel. In some cases, such as sales to the police force, these transactions may have violated existing arms embargoes.127 The equipment and software in question have a range of uses, including retrieving data from phones and computers, tracking users and listening in on telephone conversations.128 Since 1 February, these are now all in the hands of the military. Such tools can easily be deployed against activists, political opponents and journalists – and already have been. In the most prominent example, technology from the Israeli firm Cellebrite was used to retrieve data from the phones of two Reuters reporters who were arrested in December 2017 in what many observers believe was a setup, after they uncovered evidence of a military massacre of Rohingya in Rakhine State.129 It is unclear whether police are continuing to use Cellebrite.130 They have, however, acquired other, similar tools since 2017.131 As the trials of the thousands who have been arrested since the coup proceed, the use of such software to retrieve data from encrypted devices is likely to increase. One human rights lawyer representing several detainees said it was now routine for police to confiscate devices from 127 “Myanmar’s military deploys digital arsenal of repression in crackdown”, op. cit. For a full list of technologies, see “Tools of Digital Repression”, Justice for Myanmar, 2 March 2021. 129 “Security-tech companies once flocked to Myanmar. One firm’s tools were used against two journalists”, The Washington Post, 4 May 2019. Both journalists were eventually released, after spending more than 500 days in prison. 130 Cellebrite has declined to comment on whether its products are still being used in Myanmar, but its local distributor has said the company halted new sales in 2020 and stopped servicing equipment it had already sold. See “Myanmar’s military deploys digital arsenal of repression in crackdown”, op. cit. 131 See “Tools of Digital Repression”, op. cit. A company named Oxygen Forensics that produces similar software to Cellebrite has confirmed licencing its product for use in Myanmar in January 2019, likely to the ministry of home affairs. It has declined to identify whether the end user of its product is from the government or private sector. It insists that when it is made aware that its products are being used “in a way that does not conform to [its end user license agreement], international law or Oxygen Forensics ideals, these licenses are noted, as are the end users, and they cannot be renewed”. The company declined to comment on whether it had done so in Myanmar. See “Filling a gap”, Mike Lewis Research (blog), 25 April 2021. 128