Policy Brief cities.6 Myanmar’s peculiar political history makes it a key case one the importance of cyber security for development. On the one hand, it has recently emerged from decades of oppressive rules at the hand of the military junta, trying at the same time to develop its economy and democratize its political system. At the same time, a country that was isolated from the rest of the world is connecting to the In9ternet at an unprecedented pace. In 2011 the country was rated as the second-least connected country in the world, beating only North Korea, with an Internet penetration of under 1%.7 By the end of 2015 the number of subscribers in the country had ballooned into almost 50%, indicating an increase in internet subscribers of around 300% yearly.8 For Myanmar, a key area where underdevelopment is sought remedied through ICT is the area of e-commerce and online banking, with banking penetration in Myanmar as low as 10% in urban areas and even lower in rural areas.9 The Central Bank has already taken steps towards ensuring that this can be utilized, publishing a directive in 2013 that allows telecommunication suppliers to provide mobile money solutions as well.10 One example is Wave Money, a mobile-money operating company raised as a cooperation by the Telenor group and Yoma bank which has started operating in the country.11 Myanmar has also, in cooperation with the Asian Development Bank, started mapping the opportunities presented by e-governance for assisting in managing the large and diverse country.12 2 Threats stemming from digitalizing: in developing countries and Myanmar While connecting developing countries is potentially hugely beneficial, and able to unlock large potential for growth, there are a long list of perils involved in digitalization. The positive effects of digitalization are dependent on an environment that enables these positive effects to manifest themselves. This in turn rests on several factors, such as building digital infrastructure, making sure that this infrastructure has a sufficient capacity, regulation gaps, and ownership issues, such as monopolies or oligopolies.13 - For developing countries, the issue of cyber security is made more prominent by the fact that the very services that contribute to increased efficiency and economic gains are also the ones that are most vulnerable to attacks and penetrations. Three main areas have been identified that both hold great potential economic gains but also severe security rBackend systems that concentrate information for companies and government. This has been shown to produce great efficiency gains, but also to concentrate information which again makes it a more valuable target. - The potential of leapfrogging and cloud-computing leading to even greater concentration of information, but also new and changing security challenges. - Mobile money and e-commerce, which lets underbanked or unbanked areas access money and credit, but which also adds great potential monetary benefits for cybercriminals.14 Put in a larger context this might raise some concerning issue on the over reliance on ICT to reach development goals. Some of the issues hampering development, such as bad infrastructure and the need for regulation reform will not go away because of digitalization, in fact they might get worse. This underlines the importance of a wider set of issues, such as cyber security, as an integrated part of a development agenda, as the creation of secure networks is crucial to harvest the potential benefits. Recent developments have highlighted the vulnerabilities of developing countries. A notable case is the spread of the “WannaCry” ransomware in May 2017, that spread by using a known vulnerability in the Windows operating system. However, the updates and patches that protected against the malware was phased out for older versions.15 Generally older versions of operating systems are more common in countries that have less of the required capital needed to upgrade them, which poses an additional risk for developing countries.16 As developing countries often lack the manpower and the funding to participate in debates on Internet governance their concerns and voices risks not being heard19, and as a consequence not managed properly.17 A global trend is for cyber-campaigns to not only target industry and governments, but also Civil Society Organizations, who often do not have the resources to defend themselves against these attacks. Furthermore, these attacks are often characterized by low degree of technical sophistication, and more advanced social engineering aspects using so-called spearphishing techniques to obtain information.18 However, the tools and skills required to protect from these types of surveillance are widely available for those with the knowledge to find them. Raising awareness in developing societies about both the risks of internet connectivity, and the many cheap and free tools that mitigate these risks are an important step in building a solid civil society. Organizations such as the Tactical Technology Collective even offer these packages in Burmese (SWIA). As widespread Internet connection is a new phenomenon in Myanmar, there are plenty of unresolved issues relating to the securing and managing of this transition. A further complicating element is that Myanmar is undergoing this rapid transformation at the same time as the country is undergoing a profound political transition as well. Adding internet connectivity as the same time as the country transitions from being run by its military junta to a more democratic form of governance is heightening the risk that the technology will be used to exert government control and surveillance.19 We have identified the following key issues in the Cyber Security setup for Myanmar: Reliance on key commercial actors: As the Myanmar government is limited in both its capacity and its resources, calls have been made for large international companies to help implement security in the country. A key role is thus likely to be played by commercial actors, in particular the two large telecoms-operators in the country: Ooredoo and Telenor.20 A 2013 Human Rights Watch report stressed the risk that digital technology would be used by the regime to crack down on dissent, used for illegal surveillance and as a way to enforce censorship. The call was for companies involved in improving the ICT-infrastructure in Myanmar to refrain from cooperating with the government on matters that would undermine the rights of its citizens.21 While Ooredoo has been criticized for complying with harsh censorship regimes in other parts of the world, Telenor is seen as having one of the more advanced social responsibility policies in the world. Both do, however, have a history of shutting down its services when faced with governmental pressures.22 Cybercrime An important characteristic of cybercrime is the fluid nature of the operations, which tends to move towards the points of least