imprisonment from one month to one year and a fine from 100,000 riels (USD 24) to two million riels (USD 480), but permits secret surveillance with approval of a “legitimate authority”. Arguably, this provision allows the monitoring of individuals’ phone calls, emails, texts and social media activity and other online correspondence without their knowledge.28 Moreover, “legitimate authority” is an undefined term, which may simply refer to administrative or internal authorisation, rather than the independent judicial oversight necessary to protect individual rights. In effect, this provision appears to give carte blanche surveillance powers to the Cambodian government. Criminalisation of expression and restriction of rights The law also introduces new criminal offences with heavy sanctions for telecommunications activity. These provisions could not only be used to criminalise freedom of expression online, but may also be further abused to “spy on high profile individuals and selectively interpret the content of their communications as criminal activity.”29 Article 80 creates a broad criminal offence that imposes high sentences. It states: “Establishment, installation, or modification of telecommunication infrastructure and network or establishment, installation and utilization of equipment in telecommunication sector, if these acts lead to national insecurity, shall be sentenced in prison from 7 (seven) years to 15 (fifteen) years.” Furthermore, Article 81 states that violation of Article 80 can lead to fines from 140 million riels (USD 33,600) to 300 million riels (USD 72,000). No telecommunication activity (the term is undefined) appears to be excluded: any form of expression, public or private, and conducted by any electronic means of communication could be criminalised if it is deemed to create “national insecurity”. Such a vaguely drafted provision, which potentially includes a wide range of legitimate expression within its scope, cannot be considered proportionate, narrowly defined, transparent or easy to understand. While such broad criminalisation of expression affects all individuals and groups in Cambodia, it is of particular concern to associations who may in their work be critical of the government and could easily be subject to targeting by authorities choosing to construe their internal or external communications as contributing to “national insecurity”. 28 Ibid. 29 Ibid. Similarly to Article 80, Article 66 includes a general prohibition on telecommunications activity stating that the “establishment, installation, utilization, and modification of telecommunication infrastructure… which may affect public order and lead to national insecurity are prohibited.” Again, there is no requirement of actual harm, but rather activity that “may” affect public order or national security. Therefore, an activity that causes no harmful or palpable consequences may be criminalised. Articles 93-95 are offences new to the Law on Telecommunications but replicate existing Criminal Code provisions on expression, whilst imposing higher penalties. Article 93, which prohibits “threats”, carries sanctions from one month to three years imprisonment and fines from 100,000 riels (USD 24) to six million riels (USD 1,440). Equally, Articles 94 and 95 further criminalise threats and impose heavy sanctions. This is problematic not least because there is a risk of conflict between these provisions and those in the Criminal Code. Article 65(b) preserves the “[r]ights to privacy, security and safety of using the telecommunications service.” However, this protection is nullified by the exception clause authorising the government to disregard it should it be “[o]therwise determined by other specific laws.” Unfortunately, in claiming to protect the right to privacy, as enshrined in the Constitution, the provision includes an exception clause, which renders it unconstitutional and a violation of the right to privacy. Excessive state control Article 7 provides that “[i]n the event of a force majeure, MPTC […] may order relevant telecommunications operators to take necessary measures,” which could likely encompass internet shutdowns. Troublingly, there is no definition of what constitutes a “force majeure”; however, this provision could be used to inhibit internet usage, including forms of messenger and means of social mobilisation.30 Further competencies are afforded to the MPTC under Article 24, which states: “Telecommunications infrastructures and networks and supporting telecommunication infrastructures shall fall under the competence of MPTC.” Under these provisions, the government appears to be granted control of the entire telecommunications industry including activity and infrastructure. This is particularly threatening to organisations and individuals who are critical of the government and whose work may be affected by the prospect of surveillance. 30 Ibid. 38 / Unshackling Expression