Sun, May 23, 2021 page7

• How Myanmar’s military took hold of the telecommunications sector to spy on citizens

  Documents reveal that telecom and Internet firms were ordered to deploy intercept spyware before the Feb. 1 coup

  • By Fanny Potkin and Poppy McPherson / Reuters
  • • 
    • 
    • 

  In the months before the Myanmar military’s Feb. 1 coup, the country’s telecom and Internet service providers were ordered to install intercept spyware that would allow the army to eavesdrop on the communications of Burmese, sources with direct knowledge of the plan told Reuters.

  The technology gives the military the power to listen in on calls, read text messages and e-mails, and track the locations of users without the assistance of telecom and Internet firms, the sources said.

  The directives were part of a sweeping effort by the army to deploy electronic surveillance systems and exert control over the Internet with the aim of keeping tabs on political opponents, squashing protests and cutting off channels for any future dissent, they added.

  

  Illustration: Louise Ting

  Decisionmakers at the civilian Ministry of Transport and Communications, which delivered the orders, were former military officials, one industry executive with direct knowledge of the plans and another briefed on the matter said.

  “They presented it as coming from the civilian government, but we knew the army would have control and were told you could not refuse,” the executive said, adding that officials from the military-controlled Ministry of Home Affairs also attended the meetings.

  More than a dozen people with knowledge of the intercept spyware have been interviewed by Reuters. All asked to remain anonymous, citing fear of retribution from the military junta.

  Neither representatives for the junta nor those for politicians attempting to form a new civilian government responded to requests for comment.

  Budget documents from the past two years for the previous government led by Burmese State Counselor Aung San Suu Kyi, which were not disclosed publicly, contain details of a planned US$4 million purchase of intercept spyware products and parts, as well as sophisticated data extraction and telephone hacking technology.

  The documents were provided by the advocacy group Justice for Myanmar and were independently verified.

  Reuters was not able to establish to what extent senior non-military personnel in Aung San Suu Kyi’s government had been involved in the order to install the intercept.

  The idea of a so-called “lawful intercept” was first suggested by Burmese authorities to the telecommunications sector in late 2019, but pressure to install such technology came only late last year, several sources said, adding that they were warned not to talk about it.

  The intercept plans were flagged publicly by Norway’s Telenor in an annual update on its Burmese business, which is one of the country’s largest telecom firms with 18 million customers out of a population of 54 million.

  Telenor in a briefing on Dec. 3 last year and a statement posted on its Web sites said that it was concerned about the authorities’ plans for a lawful intercept able to “directly access each operator and ISP’s systems without case-by-case approval,” as Myanmar did not have sufficient laws and regulations to protect customers’ rights to privacy and freedom of expression.

  In addition to Telenor, the affected companies include three other telecoms in the country: Myanma Posts and Telecommunications (MPT), a large state-backed operator; Mytel, a venture between the military and Viettel, which is owned by Vietnam’s Ministry of National Defense; and Qatar’s Ooredoo. MPT and Mytel have been put under the full control of the junta, the sources said. There are about a dozen Internet service providers in Myanmar.

  Telenor declined to respond to questions from Reuters, citing unspecified security concerns for its employees. MPT, Mytel, Ooredoo and Viettel also did not respond to requests for comment.

  Many governments allow what are commonly called “lawful intercepts” to be used by law enforcement agencies to catch criminals, but in most democratic countries and even some authoritarian regimes, such technology is not ordinarily employed without any kind of legal process, cybersecurity experts say.

  Myanmar’s military, in contrast, is directly operating invasive spyware without legal or regulatory safeguards to protect human rights, industry executives and activists said.

  Even before the coup, the military wielded outsized influence in the democratically elected civilian government. It held an unelected quarter of parliamentary seats, and the Burmese constitution gave it control of several key ministries. It also held influence over other ministries through the appointment of former army officers. That has become total control since the coup.

  TRACING AND MONITORING

  Not every telecom and Internet service provider has installed the full intercept spyware, three sources at firms with knowledge of the surveillance systems said.

  However, military and intelligence agencies are tracing SIM cards and intercepting calls, two of those sources said.

  One said that calls being redirected to other numbers and connecting without a dial tone were among the signs of interception.

  There is evidence of monitoring spyware being used to prosecute people who have been involved in protests, a legal source said.

  A senior civil servant who is aiding ousted politicians seeking to form a parallel government also said that their group has been warned by junta members who are sympathetic to the protesters that phone numbers are being traced.

  “We have to change SIM cards all the time,” the source said.

  The intercept products outlined in the government budget documents enable the bulk collection of phone metadata — who users call, when they call and for how long — in addition to specific content that might be targeted, the Amnesty International Security Lab and three other technology experts said.

  CABLES CUT

  Among the military’s first actions on Feb. 1 was to break into data centers nationwide at midnight and slash Internet cables. These were seen in photographs of severed cables shown to Reuters by employees at three firms.

  At one data center where employees resisted, soldiers held them at gunpoint and also smashed monitors to threaten them, one source who was briefed on the matter said.

  Though the Internet was mostly restored within hours, the military began shutting it down nightly. Within days, the army had secretly ordered telecoms to block the phone numbers of activists, junta opponents and human rights lawyers based on lists provided by soldiers, three industry sources briefed on the matter said.

  Those orders have not been previously reported.

  The sources added that operators are required by law to share customer lists with authorities.

  The army also directed the blocking of specific Web sites. Facebook, which was used by half the country and quickly became crucial to protest organizers, was among the first to be banned, followed by news sites and other social media platforms.

  When opposition grew in March, the military cut access to mobile data altogether, leaving most people without access to the Internet.

  “Firms have to obey the orders. Everyone knows that if you don’t, they can just come in with guns and cut the wires. That is even more effective than any intercept,” one industry source said.

  Telenor and Ooredoo executives who protested were told to stay quiet or the companies would face losing their licenses, four sources said.

  ARMY’S TIGHTENING GRIP

  Under previous juntas that ruled between 1963 and 2011, activists and journalists were routinely wiretapped and smartphones were scarce.

  As Myanmar opened up after Aung San Suu Kyi’s release from house arrest, it became a telecom success story with a thriving, if nascent, digital economy. Mobile phone use soared.

  The civilian government’s first known move toward nationwide surveillance came in 2018, with the establishment of a social media monitoring system it said was aimed at preventing the influence of foreign forces. It followed that with a biometric SIM card registration drive last year, saying that multiple SIM card use was undesirable and a central database was necessary.

  However, authorities are seeking more power over telecommunications.

  The communications ministry proposed a new law on Feb. 10 stating that Internet and telecom firms would be required to keep a broad range of user data for up to three years and remove or block any content deemed to be disrupting “unity, stabilization, and peace,” with possible jail terms for those who do not comply.

  Last month, the junta began ordering telecom operators to unblock certain Web sites and apps, starting with the apps of local banks, three people briefed on the development said.

  Microsoft Office, Gmail, Google Drive and YouTube have also since been unblocked.

  Asked about the unblocking, a Microsoft representative said the company had not engaged with officials in Myanmar.

  Google did not respond to requests for comment.

  Industry sources and activists believe these moves are part of an attempt by the junta to establish its version of the Internet, akin to what China has done with the “Great Firewall.”

  “The military wants to control the Internet so it will be a safe zone, but only for them. We’ve gone back five years in time,” an industry executive said.
• Most Popular

  • 1

    Taipei to join Japan, US response to rare earth ban

  • 2

    EVA investigating flight attendant’s death after sickness on board

  • 3

    Calls for reform after drunk woman publicly assaulted in Taipei station

  • 4

    Aging population reshaping Taiwan’s housing market, real-estate brokers say

  • 5

    EVA investigating death of flight crew who fell ill on duty