5/23/22, 2:07 AM Stay or go? Telenor’s Myanmar dilemma | Frontier Myanmar Although Telenor has shared user data with Myanmar authorities on a case-by-case basis since entering the market in 2014 – for example, when such data was needed for an investigation into a serious crime – the company may now be forced to hand over data about regime opponents. “The operators must provide this information, which we request in order to arrest or check a person, or action will be taken against them,” said a police officer involved in the surveillance of the protest movement who asked to remain anonymous. The requests for information can include the identity document used to register a SIM card, cell tower records that can be used to trace a person’s movements, and a customer’s home address and call history, according to the police officer. The officer, who is part of a new cybersecurity team within the police force, confirmed that they could access this information from all four mobile operators in Myanmar. Sources in two different companies in the telecom industry acknowledged independently of each other that they share this data with the authorities. “We have no choice but to comply,” a senior official in one company said. All of this creates a significant dilemma for Telenor – but would its exit be good for users? ‘Broad powers of interception’ Telenor’s ability to push back against regime diktats is limited by Myanmar law. In 2013, the same year that Telenor was awarded its licence, Myanmar passed a new Telecommunications Law that paved the way for foreign investment in the sector and broke the monopoly of state-owned operator MPT. But it did not enshrine data security or protect privacy rights; instead, it granted authorities’ sweeping access to user data. In the first five years after Telenor’s launch this seemed to matter little. But since 2019, the company has been forced to comply with requests to shut down internet access and block websites, including media outlets reporting on the military’s human rights abuses against the Rohingya minority and, later, anti-coup demonstrators. When the Myanmar government introduced mandatory SIM-card registration in 2019, which requires providing a national ID card or passport, Telenor expressed concern at a lack of protection for privacy rights. Nonetheless, the company terminated unregistered SIM-cards in June last year. The one area where it has more discretion is on requests to hand over historical user data. At a briefing in December 2020, it said that it had received 327 such requests in Myanmar, of which it complied with 217 that were “related to life-or-death situations such as murder, drug and missing person investigations”. However, the number of requests – and the company’s compliance with them – appear to have risen rapidly in the year before the coup. In 2020, Telenor agreed to 91 out of 97 requests for historical user data in Myanmar, according to its annual Authority Request Disclosure Report. As one request can cover several people, it is unclear how many individuals had their user data shared with the authorities. Sources interviewed by Frontier and Danwatch say the requests for user data have not increased significantly since the coup. The new regime has, however, made further legal changes that could make it more difficult for Telenor – as well as other mobile operators and internet service providers – to push back against data requests. The regime has repealed sections of the Law Protecting the Privacy and Security of Citizens, but of greater concern are recent amendments to the Electronic Transactions Law that grant the authorities almost unlimited access to user data without even basic safeguards. Free Expression Myanmar, an advocacy group, said that under the February 15 amendment there are no limitations on the type or scale of the data that can be intercepted, and no rules on how intercepted data should be handled, or for how long. The amendment “represents a significant risk to civic space” it said, adding that the regime now has “broad powers of interception without even the most basic safeguards for misuse”. More harm than good? While some critics have argued that Telenor invested too early in a country still heavily under the influence of the military, others applaud the company’s efforts to bring affordable phone and internet services to Myanmar. https://www.frontiermyanmar.net/en/stay-or-go-telenors-myanmar-dilemma/ 2/9