Myanmar’s Military Struggles to Control the Virtual Battlefield Crisis Group Asia Report N°314, 18 May 2021 Page 27 prisoners and search their social media profiles in order to identify other activists and issue warrants for their arrest. As this lawyer noted: “In some cases, detainees’ messaging applications have been active after they’ve been arrested because the police are carrying out investigations on their phone”.132 The most effective means of restricting further access to such tools is to include them in an arms embargo covering all branches of the Myanmar government while it is under military control. Given that a UN arms embargo is unlikely due to a lack of consensus in the Security Council, like-minded countries should introduce or broaden bilateral embargoes to cover such sales, and agree on a common list of prohibited items. Beyond military equipment, they should ensure that such embargoes cover “dual-use” items – those that can have civilian or military applications, including for law enforcement – particularly digital tools that could be used for surveillance, data retrieval and other acts of repression targeting the opposition. They should also strengthen enforcement by better policing the sale of such technologies through middlemen, a modus operandi which is often used to avoid sanctions, scrutiny or due diligence requirements, and has been common practice in Myanmar in the past.133 Considering some of the technologies that the military has already acquired require regular licensing and software updates or maintenance, the relevant companies should cease providing this support in order to undermine the effectiveness of their products at the hands of the military regime. Meanwhile, outside actors should immediately suspend any technical cooperation with nominally civilian branches of the government on cybersecurity or related issues. B. Keeping Myanmar’s Internet Open and Its Users Safe Foreign governments and technology companies have a responsibility to do what they can to ensure the internet is as widely available as possible, information is accessible and users are safe. To begin with, they should consistently prioritise the issue in their public statements about the situation in Myanmar, condemning the regime for its digital repression, emphasising that internet access is an economic and humanitarian necessity, and calling for full restoration of connectivity. As long as the Tatmadaw keeps the internet on to some degree, there are also several other steps governments and companies can take. Filtering restrictions put in place by the regime mean VPNs are an essential tool for finding and sharing information on events inside the country. The military is taking steps to restrict access to free VPNs, which are also less secure than paid options. For most internet users in Myanmar, however, paid VPNs are unaffordable or simply inaccessible because they need to be purchased online, and credit cards are uncommon. Making secure VPNs available to all users is not feasible, but VPN providers should follow the lead of companies like NordVPN, which have set up programs to provide emergency access to high-risk individuals.134 Governments and civil society outside Myanmar should push to get as many users as possible in Myanmar access to secure VPNs through 132 Crisis Group interview, human rights lawyer, April 2021. See “Myanmar’s military deploys digital arsenal of repression in crackdown”, op. cit., for further discussions of the use of resellers and apparent violations of sanctions. 134 See, for example, “Emergency VPN and the situation in Myanmar”, NordVPN, n.d. 133