How global tech companies prop up Myanmar’s digital dictatorship

The February 1 coup which ended Myanmar’s tenuous decade-long experiment with democracy has been marred by violence on both the street and in the online world.

Known as Tatmadaw, the country’s powerful military initiated a punishing crackdown, jailing members from the former-ruling NLD party including civilian leader Aung Suu Kyi, declared a state of emergency and took control of the country.

Since the power grab, at least 860 people are estimated to have been killed at the hands of security forces, with thousands injured and hundreds subjected to torture. More than 6,000 have been detained, 80 percent of whom remain in custody.

At the same time, the digital world turned into a “parallel battlefield” between the junta and its opponents.

Shortly after taking power, the Tatmadaw drastically ramped up online repression, enacting laws to gain access to user data and prosecute its opponents. Daily notices to mobile operators and internet service providers were issued to restrict access to websites and VPNs. Smartphone data has been used as evidence for mass arrests.

Authorities would soon respond to mounting protests with a complete internet shutdown, and blocking Facebook, WhatsApp, Twitter and Instagram.

Now, according to leaked budgetary records from Myanmar’s Ministry of Home Affairs (MOHA) and Ministry of Transport and Communications (MOTC), the Tatmadaw’s efforts to suppress its own citizens has been aided by technology sold to it by Western companies.

Obtained by the research and advocacy group Justice for Myanmar (JFM), the leaks were passed onto Lighthouse Reports which initiated an investigation with several media outlets and identified 40 international manufacturers and developers.

The procurements, made between 2018 and 2021, reveal an array of spying and forensic products the government sought to acquire, from software interception systems to hack calls and messages, crack passwords, extract and decrypt mobile data, and conduct facial recognition.

“Even after the ethnic cleansing of the Rohingya in 2017, the Myanmar military has continued to obtain sophisticated electronic surveillance and digital forensic tools which it is now using to crush dissent to its coup,” Richard Horsey, Myanmar adviser to the International Crisis Group, told TRT World.

“The Myanmar military has a long history of mass surveillance against the people of Myanmar and their capabilities alarmingly increased under the military-controlled transition, when they were able to purchase technology from the West,” said JFM spokesperson Yadanar Maung.

“Now the junta has tools to extract data from phones and monitor social media, putting journalists and civil society at risk,” she told TRT World.

The sort of technology acquired by Myanmar security forces is used by police around the world to disrupt illicit activity, like drug networks and human trafficking. But many worry that such tools can be deployed by the Tatmadaw to surveil and terrorise civilians.

“This type of technology ends up being used adjacent to torture and other serious human rights violations,” said John Scott Railton of Citizen Lab, a digital rights research centre at the University of Toronto.

“For example, the information gleaned from phones through the use of digital forensic tools may be used to convict a human rights defender or a journalist of crimes in their jurisdiction”.

Under the pseudonym Myat, a Burmese student in his mid-20s arrested in late March for protesting the coup said he was assaulted by police and had his phone seized after being detained.

“When they first caught me, about 30 just beat me up quite badly. They also dragged me on the road for about 100 meters and I think I lost consciousness,” Myat told The Intercept.

Following his arrest, he was forced to unlock his smartphone before it was confiscated.

Authorities are routinely searching for anti-military content on devices that could be used against suspects, says democracy advocate Ko Ting Oo, General Secretary of the All Arakan Students’ & Youths’ Congress.

“After seizing the phone, they check all of the data on the detainee’s phone. They even check people’s phones on the bus or vehicles in their check points. They check Messenger, Viber, Facebook status,” he told the Globe and Mail.

Complicity of global tech companies

Evidence of surveillance technology being used by the Myanmar state to persecute people was revealed when it surfaced that the military used phone-hacking technology from Israeli spyware firm Cellebrite to arrest two Reuters journalists for investigating a military massacre of ten Rohingya Muslims in Rakhine State in 2017.

After the incident became public, Cellebrite claimed to have pulled out of Myanmar. The government hunted out alternatives to fill the gap.

Two Canadian companies listed in the latest budget leaks, OpenText and Magnet Forensics, say they sold equipment before the February coup and halted further sales to the country in line with Canada’s arms embargo regime.

But the acquisitions – Magnet’s AXIOM and AXIOM Cloud, and OpenText’s EnCase Forensic V8 and EnCase Mobile Investigator – made under a de jure civilian government are now likely to be powerful tools in the military’s possession, with the ability to decrypt messages, revive deleted data, bypass passwords and access cloud storage and social media accounts.

Another company is Swedish firm MSAB, which confirmed to The Intercept that it sold data extraction software in 2019 to the MOTC’s cybercrime office, which collaborates with the police.

MSAB also intended to sell phone extraction software to Myanmar’s Bureau of Special Investigations (the intelligence wing of the MOHA) via a third-party distributor MySpace International, which is owned by former Tatmadaw officer Kyaw Kyaw Htun. Following the coup, MSAB said it called off the deal.

Yet, the products it previously transferred remain with an oppressive security apparatus. Even though MSAB says that licenses for forensic devices were cancelled after the coup, its website claims products can still be used with an expired license.

Earlier this year, US digital forensics firm Oxygen Forensics confirmed that it sold one license in January 2019 but wouldn’t disclose to whom. According to an Al Jazeera 101 East documentary, some of the firm’s suite of products appear to have been channeled through resellers US SUMURI and MediaClone - which are suppliers of MySpace International.

Another is Italy’s SecurCube, which previously stated it has never directly sold any products to Myanmar. But intermediary firms which purchased its technology, like MySpace International, show up in the leaks.

MySpace International’s website is no longer reachable, but a version of the page has been archived that mentions MSAB, SecurCube and Oxygen Forensics as its suppliers, among others.

Apart from Western companies, equipment sold by Chinese and Russian firms to Myanmar have been well documented.

Last December, the Tatmadaw installed 335 Huawei surveillance cameras with facial recognition and license plate ID software as part of its “Safe City” programme. Many military personnel are sent to Russia for training in surveillance technology.

Vietnam has also been complicit in technology transfers, with officials from Vietnamese military conglomerate Viettel operating and maintaining secret military infrastructure in the country.

Earlier this month, a JFM investigation revealed Indian majority state-owned arms manufacturer Bharat Electronics Limited (BEL) suppliedat least seven shipments of radar technology and communication equipment to the junta after the coup.

The transfers were sourced from Indian export data.

BEL maintains partnerships with European companies such as Sweden’s Saab, Denmark’s Terma, Italy’s Beretta and Elettronica, French-Dutch firm Thales, and Israeli companies Israel Aerospace Industries and Elbit Systems.

Is it possible then that BEL’s radar transfer might involve technology sourced from the EU, in what would be a breach of the EU arms embargo on Myanmar?

Terma, which has an agreement with BEL for the provision of coastal surveillance radar, denied any liability in a statement to JFM. Thales has also previously sold radars to Myanmar.

BEL did not respond to TRT World’s request for comment.

Calls for a global arms embargo

One concern is the oversight of dual-use exports of items built using public EU funding, like with MSAB. However, the regulation of dual-use technology with both military and civilian applications has generally been slow to catch up with the development of new technologies.

Horsey said that deals with the Myanmar government “should have been prohibited under dual-use provisions of arms embargoes, and blocked by companies themselves if they carried out even the most basic due diligence.”

“It is clear that much stronger regulation and enforcement action is required by these countries,” he added.

To limit misuse, the EU turned to the Wassenaar Arrangement, which governs the export of dual-use products and conventional arms. However, the treaty does not dictate what member states do in practice; national bodies have final authority over approving or denying export licenses for dual-use technology.

In March, the European Parliament approved new rules for the sale and export of dual-use goods, introducing digital surveillance technologies and tools, along with new obligations for national authorities.

Yet, without global coordination it might not make much difference to those suffering under the brunt of Myanmar’s repressive surveillance state.

In February, 136 organisations demanded the UN Security Council to impose a global embargo on Myanmar. However, the UN failed to implement one, and in May it surfaced that ASEAN lobbied to undermine an embargo.

JFM and other rights groups have continued to call for urgent action.

“As the military widens its campaign of terror following the attempted coup, countries including India and Russia are profiting through arms deals, complicit in the military’s crimes,” Maung said.

“It is urgent that a global arms embargo is imposed on Myanmar to stop the bloodshed.”

“The lives of the people of Myanmar must be put above profits.”