In the final adopted law, penalties for individual use have been removed, focusing instead on unlicensed VPN vendors, with punishments including fines and up to six months in prison (Art. 70). This shift may indicate a response to business concerns, particularly from industries reliant on VPNs for secure operations and data protection, which align with the right to privacy and freedom from surveillance. It may also indicate that the military’s deployment of advanced Chinese surveillance technology capable of blocking VPNs is sufficiently controlling digital activity, enabling mass surveillance and arbitrary interference with digital freedoms. Freedom of expression criminalised The new Cyber Security Law imposes vague, overbroad restrictions that violate the right to freedom of expression. Provisions require digital platforms like Facebook to censor content deemed to disrupt “peace”, spread “rumours”, disclose “unsuitable” information, or incite “terrorism”, code in Myanmar for pro-democratic opposition groups (Arts. 31a-g). Failure to comply with these vague prohibitions results in penalties, including the potential blocking of the platform, turning providers into censors (Arts. 32, 52). A new offence penalising the distribution of “information unsuitable for public viewing” threatens free expression with up to six months imprisonment (Art. 72). This vague clause risks criminalising dissent and restricting access to vital information. Similarly, a provision targeting “unwanted or unsolicited messages” with penalties of up to two years creates further risks, as it may be misapplied to legitimate communications and activism (Art. 68g). The addition of a seventh criminal defamation offence to Myanmar’s law books, punishable by up to two years (Art. 68f), perpetuates the military’s ability to prosecute critics. This aligns with a long-standing pattern in Myanmar of using defamation laws to restrict digital freedom and silence dissent. While some explicit offences from the 2022 draft, such as penalties for sharing sexually explicit content and spreading misinformation to cause panic, have been removed, these minor changes do little to address the law’s overall chilling effect (2022v Arts. 91, 96). The broadly worded provisions signal an intent to tighten control over Myanmar’s digital landscape, facilitating arbitrary enforcement and repression. Undermining fair trial The Cyber Security Law further undermines fair trial rights and due process, granting militarycontrolled bodies unchecked authority with minimal judicial oversight. One of the most alarming provisions is the assertion of universal jurisdiction, allowing the military to prosecute individuals globally for alleged cyberspace offences linked to Myanmar (Art. 3.a.2). This includes but does not appear to be limited to Myanmar citizens living abroad, and exposes exiled activists and journalists to significant risks (Art. 3.b). Decision-making authority is concentrated in an unnamed government department (Art. 27a), with appeals adjudicated by a military-controlled committee rather than a court (Arts. 57-59). The department’s power to impose severe penalties, such as fines, license revocations, or