9/22/26, 11:13 AM Myanmar Telecom Risk, Part 1 of 4: Surveillance and the Law after the takeover in Mawlamyine, Taunggyi, Myitkyina, and other cities, as part of a plan to extend coverage to every state and region.12 At checkpoints, the military uses what it calls the Person Scrutinization and Monitoring System (PSMS), which combines database queries, facial recognition, and national ID validation. Its use has been reported at road checkpoints, at Yangon and Tachileik airports, and on express trains. It is also used at hotel check-in, where it became mandatory in June 2026 under the Guest List Information System.13 The Monitoring Committee The monitoring relies on both people and equipment. On 28 April 2026, the government formed a committee to monitor the internet around the clock. Its chairman is Deputy Home Affairs Minister Major General Min Thu, a former head of the Military Intelligence IT department. It draws members from the communications, legal affairs, and information ministries, the Central Bank, and Military Intelligence. The law obliges telecommunications operators and banks to cooperate with it. By the government's own count, 21,369 online users were targeted between 2024 and May 2026, and almost 20,000 of them were prosecuted on counter-terrorism charges.14 Shutdowns remain a routine instrument, and Access Now logged 95 in Myanmar in 2025, the highest figure for any country. It attributed 76 to the military.15 Some areas of Kachin, Sagaing, and Rakhine have had no service for over a year.13 The Cybersecurity Law The State Administration Council enacted Cybersecurity Law No. 1/2025 on 1 January 2025, and Notification 113/2025 brought it into effect on 30 July 2025.16 An earlier 2022 draft proposed prison terms of up to three years for individual VPN users. That penalty does not appear in the final text, which is otherwise broader in scope than the draft, and four of its provisions merit attention. Extraterritorial reach. The law applies to offenses connected to Myanmar wherever they are committed, meaning Myanmar citizens living abroad can be charged.17 VPN services. Setting up or providing a VPN service without ministry approval carries a prison term of one to six months and a fine of MMK 1 million to 10 million. Organizations face a minimum fine of MMK 10 million. The text does not make individual VPN use an offense.16,18 Platform registration. A digital platform with more than 100,000 users in Myanmar must register locally, retain user data for up to three years, and provide it to authorized bodies upon written request. Failure to register exposes the platform to fines starting at MMK 100 million and to blocking. 16,17,18 Licensed security providers. Only Myanmar-registered companies may provide cybersecurity services under licenses valid for three to ten years.17 In practice, the older laws still do most of the work. In February 2021, the military suspended the privacy safeguards in the 2017 Law Protecting the Privacy and Security of Citizens and inserted Section 505A into the Penal Code. It also amended the Electronic Transactions Law to criminalize https://www.search-risk.com/insights/myanmar-telecom-risk-part-1-4-surveillance-and-law 19 3/9