With a third wave of COVID-19 infections ripping through Myanmar, local residents are concerned as the country’s healthcare sector was hobbled after the military’s February coup. People who are sheltering at home use their phones to communicate with friends and loved ones, and a sense of worry has swept through the nation—the junta might be intercepting calls and text messages, and then matching that data to users’ locations.
A police officer told Frontier Myanmar on Monday that a new cybersecurity team, formed in March, is working with state- and military-owned telecom firms MPT and Mytel to track specific people’s phone conversations, texts, and geolocation data in real time, all to track down opponents of the regime. The team’s system records call details and automatically informs the monitors when specific words like “protest” and “revolution” are detected. The data gathered can be used as evidence if individuals are arrested and detained.
This arrangement, however, builds upon agreements with phone carriers established before the military seized power. “Lawful interception has always been part of the telecom companies’ contracts. Telecom companies are capable of automatically recording and transferring the data to the government,” a local IT expert with knowledge of the matter said to KrASIA. Doing so in most other countries would require a warrant, but “there is no judiciary oversight in Myanmar,” the expert said.
The pre-coup government led by Aung San Suu Kyi was eager to formulate stronger “lawful interception” powers and give state entities direct access to user data gathered by telecom firms and internet service providers, according to a report published by the International Crisis Group in May. Previously, telecom firms could review government’ user data requests on “a case-by-case basis,” the report said, but that is no longer the arrangement.
The report by Frontier Myanmar was published on the same day as a Reuters article that indicated foreign telecom executives in Myanmar have been barred from leaving the country “without permission,” and that telcos are mandated to “fully implement intercept technology” under the instruction of the junta.
Check out this collection: On the Ground in Yangon
As Myanmar’s junta develops tighter phone and internet surveillance, the industry expert who spoke to KrASIA said the tools being used to monitor calls are “not advanced,” adding that specific software is needed to crack a handset. However, he emphasized that the regime has been forcing the telecoms to provide user data in real-time, highlighting the “massive” volume of data collected from anyone who carries a phone that is connected to a working network.
The regime has also made demands for internet service providers to implement layer 7 firewalls in April, giving state security personnel access to more advanced features for filtering and intercepting traffic as well as classifying data, the expert said. “Basically, internet service providers are capable of seeing if the user is using a VPN to access a certain destination but not the actual data within the encrypted traffic. Therefore, they can ban certain websites and addresses based on the destination by using the layer 7 features of the firewalls.”
In March, a rights group, Justice for Myanmar, outlined a list of tech companies across the world that supply their products and services to Myanmar’s military, enabling it to collect digital data, hack password-protected devices, clone phones, track signals, gather social media intelligence, analyze photos, and process large amounts of data. Budget documents provided by the rights group also show that the Ministry of Transport and Communications earmarked USD 4 million in 2019 and 2020 to undertake a “lawful interception” initiative, according to a report published by Open Technology Fund last October.
Although the junta now has access to a trove of data via phone carriers that operate in Myanmar, the expert who spoke to KrASIA said the tools and software listed in the budget documents only give authorities access to metadata, and that their ability to monitor the communications of internet users or decipher encrypted conversations at a mass scale is limited.
Yet even without information gleaned from personal data in real-time, informants lurk online and pass information to the junta to pinpoint dissident activity organized on social media, and a war of words and images plays out on platforms like Facebook, Twitter, and TikTok. The people of Myanmar, unfortunately, are no stranger to micro-level control. When dial-up services were first available in the country in the early 2000s, the only way to communicate online was through a state-monitored email system, and only a small set of websites were approved for viewing.
Read this: Supporters and detractors of Myanmar’s coup take fraught conflict to TikTok, Facebook, and Twitter
