Matthias Monroy

With the withdrawal of the Norwegian telephone service provider Telenor from Myanmar, German surveillance technology threatens to end up in the hands of the military regime. This could violate EU sanctions and the General Data Protection Regulation.

The Norwegian company Telenor, which specialises in telecommunications, is selling its business in Myanmar. As has now become known, a surveillance system made by the IT company Utimaco from Aachen could also end up in the hands of the military junta. The Myanmar Now news agency, based in the’s capital of the country, warns of this. Through the back door, EU sanctions would be circumvented and 18 million customers would be put at risk – that is about one third of the population.

On 1 February 2021, the military couped against the democratically elected government under Aung San Suu Kyi, dissolved parliament and declared a state of emergency. The subsequent protests were violently put down, hundreds of people were killed, thousands arrested. Because of „atrocities and serious human rights violations“ against the Rohingya population group, the EU has even extended its sanctions regime.

Utimaco praises itself as market leader in eavesdropping technology

The generals had ordered, among other things, the shutdown of the internet and telephony and called on telecommunication providers such as Telenor to cooperate. The technology used for this is, among other things, a so-called „Lawful Interception System“ (LIMS), with which authorities can monitor all packet-based telecommunications in real time.

For the LIMS, providers are required to set up a technical interface. Police forces and secret services can feed specific persons or connections into the system for interception. Via this, either historical traffic data or, in the case of a real-time interception, content data can be fed out to the authorities within the framework of a data retention.

Utimaco claims to be one of the market leaders for LIMS and sells them as a complete package. The company regularly participates in or even sponsors relevant sales fairs for interception technology.

Authorities demand permanent access

The two journalists Naomi Conrad and Julia Bayer picked up the reports from Myanmar Now and did further research for Deutsche Welle. Their work is based on leaked documents and statements by Telenor employees. According to these, the Norwegian company is withdrawing from Myanmar because the government is increasing pressure on telecom operators to conduct wiretaps.

As is common in most countries around the world, the Myanmar government has ordered all telecom operators to install LIMS. Deutsche Welle quotes from a licence that also requires Telenor to comply with orders „to provide or facilitate the lawful interception of any Telecommunications“. The technology comes from Utimaco and was supplied through a third party in 2017, Deutsche Welle reports.

So far, however, Telenor claims not to have given the authorities access via the LIMS, and in a statement the company calls this a „dilemma“. Even before the coup, the company said it was „under pressure“ from the government of Aung San Suu Kyi. Myanmar’s authorities also demanded direct access to the systems without case-by-case authorisation from police or judicial authorities. „Without sufficient legal safeguards, this creates an opportunity for misuse and breach of customers‘ human rights“, Telenor is quoted by Deutsche Welle.

Ban on supply of communications surveillance equipment

Speaking to Conrad and Bayer, a staff member of Fortify Rights, a non-governmental organisation working in Myanmar, confirmed this, saying Telenor has one of the best human rights practices unlike the other operators. The Norwegian company did not respond to journalists‘ questions about German interception technology, but reiterated that the withdrawal from Myanmar is because of the wiretapping order.

However, Telenor could still favour the persecution of opposition members. This is because selling its own equipment would also transfer Utimaco’s existing surveillance technology into other hands. But this would break EU sanctions, which since 2018 have prohibited direct sales of „equipment for monitoring communications that might be used for internal repression“. The LIMS is such a dual-use technology.

Utimaco allegedly prohibits resales by customers

The Aachen-based surveillance manufacturer claimed to Deutsche Welle that it had complied with all export regulations when doing business „with partners in Asia“ before 2018. Utimaco had told the human rights group Justice for Myanmar that it „has never conducted direct business with one of the mobile network operators in Mynamar“. In 2018, the company had informed its international business partners that all activities related to Myanmar had ended.

Utimaco’s statements leave open the question of whether the transfer now intended by Telenor constitutes a breach of the 2018 EU sanctions by the back door. After all, Utimaco had also told Justice for Myanmar „that it requires strict compliance with the aforementioned laws and regulations from all its resellers and customers“, Conrad and Bayer write. This should also apply to Telenor.

New owners with good contacts to the military

As far as is known, the sale of Telenor Myanmar is to the Beirut-based M1 Group. According to research by Reuters, the conglomerate also includes the Shwe Byain Phyu Group (SBPG), which specialises in the mining of precious metals and diamonds. For the takeover, the two shareholders have founded the new company Investcom Pt. Ltd.

M1 Group would not disclose details of the technologies and systems installed by Telenor Myanmar to Deutsche Welle journalists  „as the sale has yet to be concluded“. However, now that this has been done, the military government’s ability to prosecute dissent will be significantly strengthened, activists fear.

It is hardly likely that the SBPG from Myanmar or the M1 Group from Lebanon would have moral qualms about this, like their predecessor Telenor. Both companies are said to have good contacts with the military, and the M1 Group also exports to Sudan and Yemen, warns an association of Myanmar civil rights groups. One of the CEOs is said to have relations with the regime in Syria.

Complaint to the Norwegian Data Protection Authority

The Deutsche Welle research appeared the day before yesterday, at which time Telenor was said to still be willing to complete the sale. However, a few weeks ago, the Norwegian law firm Sands filed a complaint against Telenor with the Norwegian Data Protection Authority on behalf of an anonymous Myanmar national. The company is asked to ensure that no sensitive data of its users is passed on in the sale.

This would violate the privacy of those concerned and contravene the European Union’s General Data Protection Regulation, to which Norway is also bound as a non-EU member. Justice for Myanmar is therefore demanding that the Norwegian government investigate the sale for a breach of international conventions. It is not yet known whether there will also be a complaint or investigation in Germany because of the transfer of Utimaco technology to the military junta or its loyal companies.

Image: Kyal Sin was shot dead on 3 March 2021 during an anti-coup demonstration. The slogan „Everything will be ok“ on her T-shirt became a symbol of resistance against the regime (Fortify Rights).