5 · 2018 resistance. Countries that have few laws covering cybercrime, or insufficient enforcement of these laws, are being used as staging arenas for attacks on other nations in the region. Myanmar is one of the countries that have been identified as such a country in the South-Eastern Asian region.23 29More concerning for domestic stability in Myanmar is the connection between these cybercriminal elements and various political forces operating in the country. The lack of government provided security, as well as law and order, has resulted in an environment that spurs the growth of criminal gangs, and connects them to the political elite.24 The government has criminalized hacking, but the law, dating back to 2004, is ill-suited to more recent challenges. At the same time, a new cybercrime law has been in development for some time, yet it is not implemented as of this date.25 development on the issue of cyber security, a starting point is mapping the landscape of digital infrastructure and its trajectory. The infrastructure in Myanmar is disproportionately based on mobile broadband access and not fixed broadband. The World Bank has highlighted this as an issue in several developing countries, as wireless alternatives are not a full substitute for fixed-line networks, often being more expensive and slower. This creates a subdivision of the Internet coverage into different leagues, with developing countries stuck with a lower quality coverage.34 Slower speeds again raises the vulnerability to attacks like DDOS-ing. Sub-par connection speeds also undermine the ability to use newer technologies that could potentially help development, one prominent example being the Blockchain technology.35 Social issues Myanmar is one of the most ethnically and culturally diverse countries in the region, with a persistent tension between the Burman central government and the various minorities.25 A glaring problem in Myanmar’s online world is in this sense the addition of social media to an already combustible ethnic situation. This mixture has already led to violent riots with two casualties as the result of rumors spread online. A field study made by the SWIA revealed that most of hate speech was directed towards the Muslim majority, with a significant part of the hate speech including calls for violence and even killing of Muslims.26 Myanmar is a typical case of early-stage internet development, while there has been an immense growth in spreading internet coverage nationally, the underlying structure and backbone of the Internet remains weak. This is important as most of the websites, both foreign and domestic, are based on servers outside the borders of Myanmar. A stable connection to the outside world is thus important to gain access to most of the websites residents want to access. Up until very recently Myanmar was served by a single submarine cable, creating both large vulnerabilities in the infrastructure and slow connection.36 The cultural and ethnic tensions in cyberspace feeds into existing political fissures. Myanmar has at multiple points in its history seen control over information and access being used politically by actors. In the run-up to 2010 elections Myanmar was on the receiving end of what was at the time one of the largest Distributed Denial Of Service-attacks (DDoS) ever recorded.27 While the source of the attacks has not been made public to this date, strong suspicion has been directed towards the Burmese military junta that governed the country, particularly as dissident websites hosted outside of Myanmar had been targeted earlier in the year.28 While blocking and denying access to websites have stopped, there are concerns over the rise of vigilante groups pushing a nationalistic and authoritarian agenda by attacking websites and news outlets that are critical of the government, or in some way positive to the country’s Muslim minority.29 International outlook The trend in the region is like that in the broader world, as data is being used increasingly as a tool for states to promote their interests. Operations against Vietnam that coincided with rulings unfavorable to China on South China Sea issues shows that data is being politicized in the region. A 2015 FireEye investigation into the APT 30-group found that the group had been active in targeting ASEAN member-states (like Myanmar) for several years. While the group’s targets are like those of the Chinese government, the group has not as of yet been definitely linked to any actor.30 A similar pattern vas evident in the 2015 Arbor Networks investigation into the “Trochilus”campaign.31 42While both reports are hesitant at attributing China directly, other experts have hinted toward China being the likely culprit. As long as Myanmar was a pariah-state globally its relationship with its giant northern neighbor resembled that of a client state. However, the recent democratization has changed the relationship between the two countries, with Myanmar backpedaling on former agreements.32 The state of Cyber Security in Myanmar When addressing the question of Myanmar’s preparedness and In general Myanmar’s cyber security “Maturity” is among the worst in the Asia-Pacific region. Reports have pointed to large issues and gaps in the approach to the issue. Beyond the military aspect of cyber security Myanmar is among the lowest scoring countries in all categories in a ASPI-report, highlighting a long list of issues that needs to be addressed.37 A shortage in skilled labor is one of the main issues, as the ICT sector is regulated and run by a small group of public employees tasked with managing the rapid transition. The digital transformation, coupled with the democratic transition, is dependent on the development of a long list of technical standards and regulation, as well as reinventing the educational system to meet new demands. On top of this the interconnected nature of the ICT sector, and the fact that Myanmar has already become entangled with foreign actors after years of isolation, points to the scope of the challenge Myanmar is facing to make the transition run smoothly.38 Moreover, while the government drafted a master plan for telecommunications in 2015 its implementation has been severely postponed and uneven, undermining the efforts at creating a sound political environment. This is mirrored in the regulatory sector wherein the existing rules and regulations are aimed at control and censorship, and not on cybercrime and related issues.39 A subdivision of the political and regulatory capacity is a country’s participation in international fora’s and programs. This is an area of particular importance in cyberspace, where the government challenges are often global in nature. One of the main ways for countries with less developed cyber security maturity is to engage in cooperation between Computer Emergency Response Teams (CERT’s). There are some regional initiatives enabling this, such as the APCERT which covers the Asia-Pacific Region and where Myanmar is a member. This is a positive, both for the development of capabilities within countries and to foster cooperation and information-sharing between countries and national CERT’s.40 While Myanmar participates in APCERT, as well as some bilateral capacity building programs with India and Singapore, among other. The country has not so far engaged other countries beyond capacity-building programs.41 3