Norway’s Telenor was long seen as the most trustworthy means of communication in Myanmar. As it prepares to sell off its operations there, it may leave behind an invasive wiretapping system made in Germany.
To quash all dissent, a regime needs total control of communications: when it can eavesdrop on phone calls and intercept emails and messages as they are being exchanged, it can more easily rout out activists and target opposition figures or guerilla forces operating in hiding.
Then, in the words of the man on the grainy video call, the military “will do whatever it wants.”
He is scared, he says, afraid that his revelation might be traced back to him. The man is talking about a system that might soon be employed to spy on those opposing Myanmar’s brutal military regime, which took power last year in a coup that quickly turned bloody.
Yet, he is adamant to share the information he has despite the potential risks. “Please,” his first message to DW reads, “let me raise our voices regarding interception.”
He is talking about so-called lawful interception. Put simply, it refers to a process in which a service provider or network operator routes intercepted communications to the country’s law enforcement.
In short, this allows authorities to wiretap individuals or organizations without their knowledge.
Lawful interception
In most countries, strict procedures are put in place to prevent misuse, hence the term “lawful interception.” Law enforcement agencies generally need to obtain a court order before they can mandate the service provider to share any given individual’s data. A copy is diverted to the law enforcement’s monitoring center, where agents in turn listen in on live calls, messages and emails if they are not encrypted.
In addition, algorithms can sift through huge data troves, flagging certain key words or connections.
It’s a tool to solve crime, but in the wrong hands, it can be turned into a powerful and chilling weapon against dissent.
That may soon be the case in Myanmar: an investigation by DW and independent news service Myanmar Now has found that the junta might soon be able to tap into a lawful interception management system created by a German software company.
It’s hard to fathom the potential reach and implications of this move, without first taking a closer look at Myanmar’s telecommunications sector.
Thousands have been detained following the coup.
‘We trusted Telenor’
From 2010 onwards, following decades of brutal military rule characterized by strict censorship, imprisonment of opponents and international isolation, Myanmar slowly transitioned towards democracy. This included foreign investment into key industries, such as its telecommunications sector.
Norwegian operator Telenor, alongside Qatar’s Ooredoo, were both granted 15-year licenses in 2013. The other two operators are state-backed MPT and Mytel. The latter was set up as a joint venture by the militaries of Myanmar and Vietnam.
Telenor, a company partly owned by the Norwegian government, soon developed a reputation as a relatively secure and trustworthy provider, given the other choices.
“We trusted Telenor,” one activist told DW.
John Quinley, a researcher at the human rights organization Fortify Rights, agreed: Telenor, he said, was different to many local operators, in that it had one of the best human rights practices.
To date, 18 million people, roughly a third of Myanmar’s population, are Telenor subscribers, according to the Norwegian company.
Myanmar is a majority share-holder in Telenor’s domestic operations
Did Telenor Myanmar install interception system?
From the outset, Telenor was required to comply with lawful interception demands made by the authorities: DW has acquired a copy of Telenor Myanmar’s operating licence. It clearly states that the “Licensee shall comply with any order to provide or facilitate the lawful interception of any Telecommunications” according to the law.
DW has learnt that in late 2017, Telenor appears to have acquired, via a third party, a lawful interception management system created by German company Utimaco. That is to say, a system that, when actively deployed, could help the authorities wiretap Telenor’s customers.
Sources have told DW that it was subsequently installed and connected to the Burmese government’s monitoring system. DW cannot independently verify these claims.
Telenor declined to comment on individual questions, including ones specifically about Utimaco or whether it had installed a lawful interception management system. But, in a written statement it explained that “a key reason why Telenor is selling Telenor Myanmar is that we cannot activate intercept equipment, which all operators are required to.”
Previously, the company had stressed that an active deployment of the system would be subject to Norwegian and EU sanctions imposed in 2018, which placed restrictions on the export of dual use technology and its use in Myanmar.
Utimaco, in a written response to DW, claimed that it had adhered to all export regulations while doing business “with partners in Asia” prior to 2018.
In a statement to Justice for Myanmar, a covert group of activists, the German tech company said that it “has never conducted direct business with one of the mobile network operators in Mynamar.” And that, with the introduction of the EU’s export restrictions in 2018, “Utimaco informed its international business partners that Utimaco ends all activities regarding partner projects in Myanmar. In accordance with EU export law, Utimaco has also not delivered any products or services nor provided any support via indirect partners since then.”
Utimaco’s statement added that it had “at all times complied and is continuously committed to complying with all applicable export control, customs, economic sanctions, and anti-boycott laws and regulations, rules, and associated executive orders of the United States, the European Union and every other countries’ jurisdictions in which it conducts business.” Thus, the company added, it “requires all of its resellers and customers to strictly adhere to” said laws and regulations.
Telenor’s decision to pull out
Even before the coup in Myanmar, Telenor was under pressure from the then-government under Aung San Suu Kyi, according to the company itself.
It’s sustainability report published in December 2020 tersely states that some requests “have been questioned for their impact on human rights.”
And the report went on to say, Myanmar’s government also intended “to be able to directly access each operator and ISP’s systems without case-by-case approval. Without sufficient legal safeguards, this creates an opportunity for misuse and breach of customers’ human rights.”
The military took over in a coup in February 2021, which quickly turned violent.
After the coup in early February 2021, the pressure on operators intensified. The military’s brutal crackdown on those protesting its takeover, included forcing Telenor and the other operators to shut down mobile data and wireless broadband internet.
In July 2021, Telenor, which has been operating at a loss in Myanmar since the coup, announced its decision to sell off its operations in Myanmar to M1 Group, a Lebanese conglomerate based in Beirut.
For months, the sale stalled as public pressure mounted among widespread concerns about data protection.
At the same time, at least one Norwegian national was prohibited from leaving Myanmar, possibly an attempt by the ruling junta to expedite the sale and force Telenor to adhere to its conditions of retaining customer data and call logs.
Buyer linked to junta?
This was followed by a further revelation: a Reuters investigation from earlier this year disclosed that the sale would include an additional stakeholder: a military-linked conglomerate with interests in mining, petroleum and gems, Shwe Byain Phyu Group (SBPG).
DW has obtained an internal document from the state regulator from December 2021, provided by Justice for Myanmar, that sets out the deal: Accordingly, Telenor Myanmar would be transferred to a new entity, Investcom Pt. Ltd. This would be jointly owned by M1 and SBPG.
Should this sale go ahead, activists fear it would place the lawful interception system in the hands of a business entity with close ties to the ruling military, most likely more amenable to complying with the juntas’ requests.
DW is unable to verify whether Telenor Myanmar’s lawful interception system is indeed part of the sale. Both M1 Group and Telenor declined to comment directly.
But it is plausible given that Telenor in February 2022 said that its “key reason” for leaving the country was the pressure to activate intercept equipment, thereby indicating that it may already be installed: “Telenor has as of today still not activated intercept equipment. It is precisely this conflict – between the requirement to comply with local law on the one hand and the concern about human rights and the risk of violations of Norwegian and European sanctions on the other – that leaves Telenor with no choice but to sell Telenor Myanmar.”
All telecom operators in Myanmar, the statement went on, “are required to store traffic data and as a responsible employer, Telenor cannot make its employees in Myanmar delete it. It can be dangerous for employees to violate local law or the orders given by the military authorities in the country.”
This refers to customers’ historical metadata, including who they called, when and from where. This, activists fear, could retroactively help the junta crack down on them.
Add wiretapping abilities to this, and the junta would have wide-reaching control of communications.
Utimaco did not respond directly to the question whether Telenor Myanmar’s buyer could gain control of its lawful interception system. “In principle, phone tapping can be implemented technically without a LIMS system,” Utimaco said in a written statement to DW.
M1 Group told DW it was “not in a position to disclose details or information with regards to technologies and systems installed by Telenor Myanmar, considering that the sale has yet to be concluded.”
On the ground, activists are preparing for the worst.
His greatest fear, one source in Myanmar told DW, was that “the system will be in the hands of the brutal military that is trying to monitor us 24/7.”
John Quintely from Fortify Rights agrees: the junta is “basically trying to restrict every aspect of human rights defenders and activists’ lives. That includes online space, telecommunication devices and data,” he told DW.
It was, he said, creating an environment to try to silence, track and put away dissenting voices.
At the time of publication, Telenor was still poised to go through with the sale.
Edited by: Lewis Sanders
