Myanmar: Analysis of Draft Cyber Security Law (section 11). Finally, the Executive Committee, again with the agreement of the Central Committee, shall form investigation teams as needed (section 12). It is legitimate for government-controlled bodies to undertake policy work, even where that impacts on human rights such as freedom of expression. However, international standards call for any direct regulation or implementation of policy which affects freedom of expression to be done by actors which are independent of government. Otherwise, political considerations are likely to influence regulatory decisions, rather than being made in the overall public interest, which will then undermine the free flow of information and ideas in society (i.e. freedom of expression). The Central Committee, in particular, does undertake a number of policy tasks. However, its duties also include direct regulatory responsibilities. For example, pursuant to section 6(h) of the draft Law, it is responsible for the following: Inform, restrict and limit local and international cyber security service provider operators and organisations to act in accordance with the cyber security guidelines and programs of critical information infrastructures. Section 6(g) is even more intrusive, providing for the Central Committee to: In order to effectively implement objectives contained in this law, determine the information storage of business and operators from the online communication sector in which the public engages through national cyber space.7 The regulatory powers of the Executive Committee are even more explicit, as it “permits, rejects, and sanctions of the license of services” under the law (section 10(k)) and also “scrutinises and permits cyber security teams or organisations” and sanctions those formed without permission (section 10(o)). The exercise of these sorts of regulatory powers by bodies which are not independent of government, as is the case with the Central Committee and Executive Committee, is not legitimate according to international law. Beyond these general regulatory powers, specific powers are allocated to different institutional structures which are very intrusive in nature. Sections 43, 45 and 46 allocate broad and fairly undefined powers to the three mandatory Working Committees. For example, under section 43(b), they are tasked with “preventing any other consequences of cyber security threats, cyber attacks, cyber terrorism, cyber fraud, or cyber incidents from occurring”, while under section 43(e) they are tasked with “Investigating and taking actions against” these sorts of threats. It is not exactly clear how far these powers go, but they at least extend to inspecting the computers not only of anyone considered to be directly “related to” any of these threats, but also of any other party who is “related with” the first party, subject only to an obligation to return the computer after assessing it (sections 45 and 46). These are extensive and highly intrusive powers 7 Note that there are two versions of section 6(g) in the translation we are using, one before section 6(h) and one after. This is the second one. The Centre for Law and Democracy is a non-profit human rights organisation working internationally to provide legal expertise on foundational rights for democracy -3-