ICT and telecommunications companies need also to be attuned to changing political, legal or operational circumstances and have mechanisms in place to address new or emerging risks. Assessment and due diligence should continue on an ongoing basis so companies can effectively adjust their policies. For example, when renewing an operating license or business contract, companies should identify provisions that make it more difficult for the company to challenge or narrow government requests for censorship and surveillance, and seek to modify or remove those provisions. Alternatively, companies could establish human rights safeguards through separate agreements with authorities to supplement existing contracts as an interim measure. Finally, throughout all stages of investment—from conception to implementation— companies should make their home governments aware of issues they confront in Burma and seek a coordinated approach, both within the industry and on the part of their home governments, to press for human rights-compliant practices in the governance of Burma’s ICT and telecommunications sector. Government Requests for Censorship, Surveillance, and Network Shutdowns Based on the risks identified in impact assessments, ICT and telecommunications companies should develop internal human rights policies for how the company will respond to government requests to assist with censorship and surveillance. Companies should introduce internal procedures that guide whether and how the company will respond to extralegal or overbroad requests for surveillance or content restrictions, or requests the company suspects may be a prelude to further targeted human rights abuses. “Extralegal” requests include requests that do not follow proper legal channels or go beyond what is allowed in law. In such cases, companies should have policies in place for how they might challenge or resist extralegal requests, including through formal judicial review. In addition, companies should develop policies on how they might narrow overbroad requests for user data, meaning those that seek a disproportionate amount of information. If a company complies with a request, internal human rights policies should require an approach that interprets the request as narrowly as possible, and implements the request in a way that minimizes interference with the rights to freedom of expression and privacy. REFORMING TELECOMMUNICATIONS IN BURMA 18