Commentary: Myanmar junta’s internet controls expose citizens to cyber threats

SINGAPORE: For Myanmar, access to online information has always been limited even during the relatively open political period of around 2016 to 2021, partially due to the slow digital infrastructure development compared to the rest of Southeast Asia.
In 2023, Myanmar registered a 44 per cent internet penetration rate and 15 million social media users, whereas its immediate neighbour Thailand had reached 85 per cent internet penetration and over 52 million social media users. However, since the coup d’etat of 2021, cyberspace has been further constricted by regulation.
Shortly after usurping power, Myanmar’s State Administration Council (SAC) blocked access to Facebook – which is so ubiquitous and popular that it is often called “the internet” – and other websites and messaging applications, aiming to cut off communication channels of the resistance forces and control information flow.
Consequently, Myanmar people turned to virtual private networks (VPNs) as a way to circumvent the censorship. VPNs provide an encrypted route such that a user in Myanmar would be recognised as accessing the internet from another country.
The meme below illustrates the popularity of VPNs among the people.
Equating Burmese identity with 20 VPN applications is, of course, said in jest, but the real-world number is still high. Digital rights activists estimate that Myanmar citizens have an average of 5 VPN applications installed on their phones.
Between late May and early June this year, experts and cyber analysts started to observe that the SAC has been actively blocking access to VPNs. At the end of May, the Transport and Communications Ministry ordered a nationwide ban on access to Facebook, Instagram, X, WhatsApp and VPN services, according to news reports from Voice of America (VOA).
This crackdown is one of the extrajudicial executions of the Cybersecurity Law drafted in 2022 by the junta, which was never fully enacted. On the ground, the security forces have been randomly checking, searching and even arresting people for having VPNs on their phones.
However, despite the physical harassment and the blatant violation of people’s freedom of speech and opinion, and right to information, it is hard to imagine that the junta’s attempt to ban VPN services will stop people from utilising the tool to stay connected online.
Indeed, the VPN ban will likely push people, desperately seeking information or social connection, toward alternatives even from obscured sources which would expose them to even more cyber threats. Local experts shared anonymously with this author that they have detected a spike in phishing links being advertised as links for various new and free VPN services.
The use of phishing tactics – which deceive people into allowing private data to be compromised or stolen – is not uncommon in post-coup Myanmar. Anti-junta activists and high-profile political figures have regularly been targeted by phishing attacks through Telegram, or even directly to their email inbox.
These phishing attempts usually aim to gain unauthorised access to the targets’ accounts and on-device files, compromising their digital security.
Now that there seems to be a trend of phishing targeted at general citizens, the impact can be more widespread.
“The beauty of phishing and, really, any cyberattack is that it’s really difficult to identify the perpetrator. Combining it with the lack of awareness of data hygiene in Myanmar, then you have a perfect environment for cybercriminals to operate,” said a digital activist in an interview with this author.
While it is difficult to gauge an entire population’s level of data literacy, a UNICEF report on digital literacy education in ASEAN countries’ schools can serve as a baseline for the extent to which citizens, especially the youths, have been equipped with digital skills.
The report, published in early 2020, found that only 25 per cent of respondents from Myanmar were learning digital skills at school compared to at least 50 per cent in the rest of the region.
The number is expected to be even lower now due to the combined impact of the COVID-19 pandemic and the coup that displaced swathes of the young generation out of the education system.
More troubling possibilities were raised in other interviews. One expert suggested that the spread of phishing to the general public instead of the previous targeting of activists could be part of the junta’s strategy to monitor and eliminate emerging threats against its regime from the resistance forces.
Another expert alluded to potential collusion between the junta and China since “some of the links inspected have source code saved in Burmese – or even Chinese.”
The impact of the citizen-wide ban on VPNs, websites, and social media platforms is difficult to quantify, and exposure to phishing is one of many emerging threats that people are facing day-to-day in Myanmar.
However, it is imperative to note that, unlike some high-profile political activists and civil society organisations who can afford to tighten their cybersecurity measures through various means, citizens largely remain unprotected from – and possibly unaware of – bad actors in cyberspace.
The desperate need for access to information and online modes of communication, combined with low digital literacy, makes whistleblowing a challenge.
For example, the image below is a post shared on a Facebook page called Free VPN in Myanmar, flagging the risks of free VPNs. Unfortunately, it is overshadowed by more posts advertising free and paid VPNs that are still working in Myanmar.
In the end, there seems to be no viable solution to the issue of digital rights without addressing the bigger issue of how the Myanmar junta has repeatedly violated the rights and freedoms of the people since it has taken over the country. This may require a collective and comprehensive effort from the international community to apply pressure on the regime.
Surachanee Sriyai is a Visiting Fellow with the Media, Technology and Society Programme at ISEAS – Yusof Ishak Institute. This commentary first appeared on ISEAS – Yusof Ishak Institute’s blog, Fulcrum.