4  4.4   operators comply with requests for data in cases related to human trafficking, terrorism, and drug offenses. There are inconsistent policies for handling data requests from law enforcement. One operator mentioned that they have an in-house policy regarding lawful interception, allowing them to provide data to the government in serious criminal cases. This operator has a specific department for lawful interception to review requests. Requests must have an authorised signature of Ministry of Communications Information Technology to be reviewed by the operator before providing any data. A mobile network operator’s regional office noted that little scrutiny is applied when law enforcement requests location data or call records. The information is usually provided. One operator has designated a small internal team to review the legitimacy of any data requests received from law enforcement. C. Surveillance and Lawful Interception: Recommendations for ICT Companies The following section focuses on the use of ICT for surveillance, rather than physical surveillance. (See also Chapter 4.3 on Privacy) General  Understand Myanmar’s history: ICT companies that operate within those parts of  the ICT value chain that may be subject to surveillance requests from the Government should understand the extensive historical level of surveillance in the country and its often severe consequences. The population and civil society organisations are therefore justifiably sensitive to the possibility of continued surveillance, and the current lack of appropriate legal safeguards on surveillance. Understand the wider global discussion about surveillance: Just as foreign companies coming into Myanmar need to understand the historical context around surveillance and its connotations for the population and its customers, local companies also need to understand the wider context of the active, on-going debate around surveillance and its implications for human rights. Tower Construction  Be aware of the possibility of interception and misuse of base stations: It is possible for other actors to intercept signals sent from cell towers by setting up technology that essentially pretends to be a base station and collects the information 395. There is some evidence this being done elsewhere to locate activists and political opposition 396. There are different types of hardware that can act as a base station and enable interception of mobile signals. The devices do not necessarily have to be in the vicinity of the cell tower or real base station to work. Tower 395 One such example is an International Mobile Subscriber Identity (IMSI) catcher which works by masquerading as a base station, in order to track a mobile phone’s location in real time. IMSI catchers are subject to export control in the US and EU. 396 For example, during the 2014 Euromaidan protests in Ukraine, protestors in the vicinity of one march in the Ukrainian capital Kiev were sent unsigned text messages reading: “Dear subscriber, you are registered as a participant in a mass disturbance”. Local mobile operators denied sending the message to their subscribers on behalf of the government, and one insisted that the messages were sent from a “pirate base station”. Heather Murphy, “Ominous Text Message Sent To Protesters in Kiev Sends Chill Around The Internet” New York Times (22 January 2014). 176 PAGE CHAPTER 4.4: SURVEILLANCE – LAWFUL INTERCEPTION & OTHER SURVEILLANCE METHODS