Myanmar Military Junta’s Increasingly Powerful Surveillance Ecosystem Over Four Years

The military junta (State Administration Council) has started using a suite of technologies to effectively identify, track and locate dissidents in Myanmar starting from March 2025. The digital repression tactics by the junta have escalated significantly 4 years after the coup. Myanmar Internet Project(MIP) has documented 357 instances of internet shutdowns since the coup until the end of March 2025. Conflict affected and contested areas are frequently subjected to a form of internet shutdown and Sagaing Region and Kachin State are regarded as areas facing most instances of the internet shutdown situation in Myanmar. Internet shutdowns are often observed in contested/liberated areas while areas and the populace under military control are heavily subjected to the junta’s surveillance mechanisms

Evolution of Surveillance Ecosystem in Myanmar

Throughout this 4 year period, the military junta have undertaken steps to build up on the remnant and existing surveillance mechanisms that were implemented during the civilian government’s tenure. Additionally, we have observed their strategy to transform Myanmar’s cyber space into a surveillance assemblage and an ecosystem. The mechanisms are discussed below.

Assembly of National Database

The military junta has been building up a National Database as a surveillance assembly, composed of NRIC(National Registration Identity/Identification Card), SIM registration as well as information from other services.

We regard recently emerged and widely discussed technologies such as Guest List Management System(GLMS) - implemented in accommodation facilities; Person Scrutinizing and Monitoring System(PSMS), Myanmar Advanced Passenger Processing System(MAPPS) - implemented at Airports, and National Service Information Management System(NSIMS) - for identifying conscription eligible travellers, as one of the functional apparatuses of an assembly of a centralized database containing identification information of citizens.

This surveillance assembly’s inception was initiated with Sim Registration in Myanmar as part of the e-Government project, first in 2016-17 and the second time in 2019-2020 under the civilian government’s leadership. The junta continued strict enforcement of sim registration after the coup. Telenor’s exit from Myanmar was cited due to their inability to comply with the junta’s requests. Additionally, as Telenor’s operations were sold to become Atom, its users were forced and coerced to register their sim cards.

2022 September’s announcement from the Junta’s Ministry of Transport and Communications revealed not only the completion of digitization and registration of 52 million populace by the Ministry of Immigration and Population with ‘e-ID Biographic Registration Software’ technology as ‘National Database’, but also their plan to conduct cross check verification of the digitized database with the Sim Registration information. This marked the first instance of the ‘National Database’ and its presence being made publicly known. Soon after, at the end of October 2022, the Ministry of Transport and Communications called for tender to establish ‘SIM Registration Management System’ and allocated Universal Service Fund(USF) for the project. The tender was awarded to Naung Yoe Company for 6,991,701,000 MMK (six billion, nine hundred ninety-one million, seven hundred one thousand Myanmar Kyats, which is roughly equivalent to 2.3 million USD in November 2022 per black market pricing) throughout the 4 years project period in April 2023.

The Ministry of Transport and Communications later announced termination of Sim cards failing to comply with the sim registration requirements with the 2023 January 31st deadline for registration. Sim registration is (still) strictly enforced later on. In 2023 May, Atom went as far as to triangulate and notify incorrectly registered sims with SMS that contained the location of the nearest Atom Digital Store to the user. Currently, new sim cards are reportedly barred from receiving OTP codes for registration with VoIP communication and instant apps such as Telegram and Signal.

SMS notification for Sim Registration with the address of the nearest Atom Digital Store

The ‘e-ID’ project activities and implementations gained further momentum in 2023. On April 3, 2023 SAC made an announcement regarding plans for the collection of Biometric data in SAC headquartered Naypyidaw, issuing Unique ID (UID) cards designed with 10 digit numbers which will serve as a prelude before issuance of National ID (NID)(the latter is yet to be implemented by the time of this writing) with the slogans that roughly translate to “Lets collect Biometric for Development”.

Biometric and Biographic data collection differ. Whereas Biographic data refers to biographic data such as name, age, DOB and addresses, etc, Biometric relates to biometric data of fingerprint, iris scan and facial structure.

This indicated a next phase in terms of data collection and we assess that Naypyidaw was piloted to smooth out the procedures, data points, and general modus operandi.

Afterwards in 2023 June, training and field exercises were provided for biometric data collection in Shan and Bego states while collecting biometric data from SAC’s personnel.

Opening ceremony for the biometric enroll and UID Management System training featured in Global New Lights of Myanmar

Also in June 2023, an announcement was made claiming that the Ministry of Immigration and Population have digitized 13 million (66/6) household record documents along with 52 million (N-4) personal records into the database. By July, the processes have been presumably ironed out with the UID card containing 10 digit numbers that also featured a QR code and SAC began scaling out the collection process. By August 2023, the junta announced completion of collection of biometric data and issuance of UID cards to 7 million people.

Unique Identification Number (Source -BNI)

China has been supporting the junta with the process. Junta’s personnel requested help for “census collection and electronic analysis system” and its personnel acquired capacity building in China.

Global New Light of Myanmar’s feature on e-ID related process

Soon the junta turned to coercion tactics. These tactics started with the requirement of UID for local travel in some of Yangon’s townships; travellers without UID had to acquire written approval from the Ministry of Immigration and Population as well as written approval and verification from ward administration office in 2023. The junta started making UID (or smart card - as it came to be addressed) a requirement for passport application process in some regions in early 2024. After 2023 Conscription Law’s legislation, the junta “requested” through national news paper for passport applicants to bring along with them their UID, “if” they have already acquired it. Starting from April 5, 2024, the UID have become a mandatory requirement for TBP (Temporary Border Pass). By 2024 May 14, UID was officially announced as a mandatory requirement for all passport applications. This forced mass biometric data collection through UID application.

We started observing the use of these collected data points and the systems to identify, track and arrest dissents starting from the later part of 2024. A November 5th 2024 meeting, held at Yangon International Airport, included a directive to prioritize screening out blacklisted and wanted personnel from leaving the country through the airport. Soon, 23 accomplices were arrested relating to forgery of UID card for passport application, the junta announced in national newspapers on November 27, 2024. This indicates a new set of capabilities of the junta in terms of digitized repression and making digitally facilitated arrests.

2024 Nationwide Census

The nationwide census collection, of which talks, preparations and initiatives began in May 2023, started on October 1, 2024. The Junta employed Computer-Assisted Personal Interviewing (CAPI) methodology and over 42,000 enumerators (data collectors) were equipped with mobile tablet devices for census data collection. The census questionnaire included 68 question items and contained 9 sectors around biographical information, travel status, education, profession, birth details, disability status, migration status, household relations and mortality and maternal mortality.

Through digitized data collection, individual responses were synchronized with the central database allowing for easy filtering of conscription eligible youths, students and personnel in Civil Disobedience Movements (CDM), migrated personnel and revolutionary groups.

The nationwide census was conducted in preparation for the upcoming General Election and the initial census collection deadline of October 15 was extended to October 31. The Ministry of Immigration and Population’s 2024 December census report accounted for 32,191,407 personnel and estimated 19,125,349 persons from areas where the census was unable to be carried out. This indicates that 32 million people have had their household registration data digitized and collected by the SAC.

Table indicating distribution of population by Ministry of Immigration and Population

What is PSMS technology?

PSMS(Person Scrutinization and Monitoring System) is assessed to be a combination of Facial Recognition technology and centralized CCTV network, enhanced by Artificial technology working along with the information collection in the National Database for blanked surveillance. Whereas PSMS is not a standardly regarded terminology or technology, (we have also observed mentions of NSIMS or National Service Information Management System that operates similarly for different purposes of screening out serviceable and conscripted eligible personnel) - these systems are monitoring, tracking and oppressive apparatuses of surveillance on civilians.

The PSMS technology suite is reportedly and allegedly supported by Huawei. Huawei also has a proven history of conducting sales of surveillance equipment in conflict-prone countries to monitor dissents. In addition to blanked passive surveillance, we assess that this capability may also allow better ground for junta’s personnel to conduct deeper analysis to profile, identify, track, arrest dissents.

CCTV Camera Network

CCTV (closed circuit television) networks were implemented in major cities such as Mandalay, Yangon and Naypyidaw as part of “Safe City, Smart City” initiatives under civilian government’s leadership. Facilities such as Yangon Traffic Control Center were also established and later served as a foundation for Junta’s surveillance capabilities.

In 2022, news emerged about the junta’s rapid and continuous expansion of CCTV networks in additional cities and regions such as Mawlamyaing, Dawei, Taungyi, Hpa-an and Myitkyina. These systems included facial and VIN (Vehicle Identification Number) recognition capabilities.

The CCTV network is presumed to be embedded in to the PSMS technology or system, and is able to detect targeted personnel once they are in the vicinity of the network that is regularly synchronized with a centralized database.

The suite of technology was provided by Chinese (Zhejiang Dahua Technology, Huawei and Hikvision.

Firewall Technology

The junta imposed additional censorship of independent media websites, social media platforms and communication apps significantly. Due to the block of Facebook platform, the public have been resorting to the use of VPN to circumvent the censorship. Technology to block the use of VPNs was implemented by the Junta in 2024, May 29.

The escalation in censorship technologies, namely the installation of IANGOU secure gateway (TSG) firewall and its network intelligence counterpart - (Cyber Narrator), was investigated to be supported by izhi (Hainan) Technology Company Limited (a.k.a.) Geedge Network, headquartered in China.

In terms of technical capabilities, TSG Firewall system is advertised to have next generation “Deep Packet Inspection” technology to block over 1000 applications based on their traffic behavior. The technology facilitated censorship backbone. The DPI technology is capable of decrypting the network traffic packets. Unless the decryption is possible, the system is also advertised to be able to collect traffic metadata such as file size, time stamps and IP addresses of senders and receivers.

This technology facilitated a situation of “between a rock and a hard place” for Myanmar netizens. Users are now having to rely on a handful of reliable and private VPN’s, amidst the rampant circulation of insecure VPN, for using services such as Facebook, Signal and even Netflix. Whereas users without VPN are heavily monitored by the junta, the users resorting to unreliable are also frequently subjected to the privacy breach risks. Secure and private self-hosting and self-managed solutions are also criminalized under the Cyber Security Law legislated on January 1st, 2025.

Network Monitoring

The accompanying Cyber Narrator is a network intelligence platform that works in conjunction with the Firewall technology and can produce actionable intelligence for network monitoring. The technology can provide in-depth analysis of users’ traffic patterns: “Over The Top (OTT) Service Tracking” to identify popular applications; and profile users based on their application use patterns, IP address connections, DNS records and services they use. Combination of these data and the intelligence can help profile groups and dissents. Cyber Narrator works alongside the TSG firewall system. We assume that the junta now has access to comprehensive and context rich network intelligence through these suites of technologies.

Interception

The junta heavily monitors and scrutinizes the public’s communications. Even before the coup, interception technologies were present in Myanmar: Justice for Myanmar investigated installation of LIG (Lawful Interception Gateways) on Telenor’s infrastructure in February 2018. The junta’s 2021 amendment of the Law Protecting Privacy and Security of the Citizens also provided paveway for the junta for interception of communications legally in addition to installing interception tools on local internet service providers.

An anonymous source from the Myanmar Police Force revealed to the media about the formation of Cyber Security Team under the directive of the Ministry of Transport and Communications for monitoring and scrutinizing of cellular calls and SMS messages. The interview indicated the use of Artificial Intelligence-like technology for keyword recognition and automatic flagging for SMS and phone calls containing words such as “Revolution” and “Protest”. Additionally, due to the inherent way of cellular communication protocol, the users may be able to be triangulated to their approximate locations during and after making these communications.

Telenor cited these concerns during their exit from the Myanmar market. We assume that in this post telecom exodus era, all mobile operators may have been equipped with interception technologies.

While the above address the technical framework and capabilities, the junta have also undertaken significant legislative changes and enactments to systematically streamline the interception process. 2023 March promulgation of Lawful Interception Framework as Chapter 14 addendum to the Counter-Terrorism Law provided, framework, roles, responsibilities, and modus operandi for (un)lawful interception requests. The law is deliberately designed to have no multi-stakeholder oversight whatsoever: as the Central Committee, exclusively appointed by the Junta’s Ministry of Home Affairs, holds all the decision making power.

Additionally the Counter-terrorism law in Myanmar mandated formation of the Central Committee chaired by the Union Minister of the Ministry of home affairs with sweeping power for arbitrary interception, blocking and restriction of communications of users.

Digital Forensic Lab

“National Digital Forensic Lab” was described as a chapter in the 2025 January legislated Cyber Security Law. Whereas the process and the status regarding the “National Digital Forensic Lab” is in muddy waters, reports, historical incidents and investigations indicate significant digital forensic capability is present in the Junta’s arsenal.

In 2017, Myanmar authorities lured and arrested 2 Reuters journalists - they were charged and imprisoned under Official Secrets Act. The authorities used Israeli cellebrite technology to conduct forensic analysis of the devices of two journalists and the data obtained from the devices was submitted as criminal evidence. The Washington Post’s investigation revealed that Cellebrite provided Universal Forensic Extraction Device (UFED) with capability to crack Smartphones and Laptops. Although Cellebrite claimed to have stopped their service license to Myanmar after the incident, the two lawyers interviewed by the New York Times indicated that the police continue to use the technology and the tools.

Cellebrite’s UFED devices (Source)

The New York Times article also indicated that Sweden based MSAB also exported similar Cellebrite and MSAB forensic technology and devices starting from 2019. Tender winner announcements in the 2020-2021 budget year also claimed MySpace International facilitated the importing of MSAB’s tools and technology. MSAB also stopped supporting service licenses and updates after the 2021 military coup.

MSAB Field Forensic Units (Source)

We assess that although Cellebrite and MSAB may have stopped further support and updates, older devices and older operating systems may still be vulnerable to the tools.

On legal grounds, the amendment of the Law Protecting Privacy and Security of the Citizens, namely the suspension of clause 5, 7 & 8 allows the authorities with unbridled access to conduct surveillance, enter and search properties, seize properties and devices and conduct extrajudicial detention of suspects. Additionally, Section 12 “Seizure of evidence and submission of expert testimony” of the Cyber Security Law described groundwork for processing digital forensic evidence.

Even before the legislation of the Cyber Law, we have observed ground reports indicating that the junta’s checkpoints are equipped with capabilities and tools to inspect electronic devices and recover and obtain deleted data from the devices. Justice for Myanmar’s April 16 investigation revealed that another forensic technology provider, Compelson s.r.o, provided MOBILedit Forensic Pro Software to the Myanmar Police Force. The technology is able to acquire call logs, phone numbers, SMS’s, multi-media files and contents from VoIP applications such as Skype, Facebook, Viber and Signal according to their website. Although Compelson s.r.o claimed that the sale was conducted prior to the 2021 coup, Justice for Myanmar uncovered that the company sent a series of sales emails urging the authorities to subscribe for license renewal after the coup.

Scrutinizing Mobile Money and Transactions

The junta have also been keeping a close scrutiny on the mobile transactions and the money trails toward the resistance and revolution forces. Monitoring and suspension of mobile banking wallets such as KBZ Pay and Wave Pay are widely reported.

Although the incidents of suspension and termination of banking accounts and mobile wallets started emerging in April 2021, media reported that banks have started submitting daily transaction records to the Junta starting from mid/early February 2021.

The junta also enforced strict compliance with the banking KYC(Know Your Customer) information for the users and announced permanent termination of the accounts failing to comply with the requirements on 2022 September. A directive also required wallet representatives to acquire KYC information and phone numbers from the wallet customers and were also required to install CCTV cameras in their shop as record. Whereas the banks and relevant institutions have yet to produce figures and information regarding this, a leaked meeting minutes from presumably 2022 December indicated that over 18,000 wallet accounts and bank accounts were terminated during the unspecified 18 months period.

Banks in Myanmar are heavily controlled by the Junta and are required to comply with their request. Alternative resolutions such as the use of Cryptocurrency were outlawed since before the coup on 2020 May 15 under article 171. A research also observed heavy prosecution with lengthy imprisonment and seizure of physical assets which were spearheaded by termination of banking assets.

Social Media Monitoring

In Facebook dominant Myanmar, the junta and its apparatus not only block and censor access to Facebook, they also heavily dissenting opinions and users on social media. This kind of social monitoring activity echoes the establishment of the Social Media Monitoring Team (SMMT) that was established under the civilian government leadership with a budget of 6 million US dollars in 2018. There was no transparency nor report around the activities, roles and responsibilities of the team.

Social media activities around dissenting opinions such as posts, shares and comments usually end up in having the user’s identity, physical addresses and photos being shared and circulated and doxxed on an alternative platform - which is Telegram - among many of the junta’s lobbyist and propaganda channels. This has put many behind bars or worse. These channels also wage unbridled harassment campaigns especially targeting women activists with sexual harassment, circulation of NCII(Non-consensual intimate imagery) contents, videos and death threats.

Arrests of users for participation in the Flower Strike, online protests, and due surprise checks, netizens have started to refrain themselves from online activities such as sharing, commenting and interacting with revolution related contents. Data for Myanmar have documented the arrest of 1691 personnel due to their online expression on social media or online communications opposing the Myanmar military and supporting pro-democracy movements and resistance groups within February 2022 to February 2024. In 2024 alone, Myanmar Internet Project has also tracked the arrest of at least 373 personnel who were arrested based on their expression on Facebook, TikTok and Telegram. This campaign of terror is one of the many mechanisms of digital oppression in Myanmar.

Surveillance is Everywhere

Blurring lines between physical and digital life; internet activity, CCTV records, biographic and biometric data - have made it possible to profile potential threats based on these data. The junta have been utilizing this comprehensive suite of technologies to profile, track, identify and monitor CDM personnel, conscription eligible youths, and activists. Everyone is under the ever watchful eyes whenever we travel, communicate, connect to the internet and interact on social media. This seriously erodes basic human rights and freedom of expression.

Sensitive personnel will have to navigate with great care in this environment, especially if they have their biographic data documented by the Junta, while being left out of this assembly may also single them out for easy filtering. Additionally, UID becoming a mandatory requirement for passport applications has populated the National Database servers with the required data.

Wearing a mask when going out, encrypting data during travel, permanent and secure deletion of data, use of end to end encrypted communication and access to reliable and private VPN are becoming essential survival tips in Myanmar. Only then there may be a level of mitigation and resilience against this ever increasing surveillant.

This comprehensive suite of tools and oppression apparatus have made Myanmar a comprehensive ubiquitous surveillance state that has no regard for individual freedom.Freedom of expression, freedom of assembly, freedom against arbitrary detention, freedom of movement and rights to life have eroded fundamentally in Myanmar. Myanmar people will have to be extra vigilant and resilient to navigate against this surveillance that often leads to detention or worse.

<Ø>

Recommended Citation Style - SRS/Myanmar Internet Project (2025, April 26). Myanmar Military Junta’s Increasingly Powerful Surveillance Ecosystem Over Four Years, https://www.myanmarinternet.info/post/surveillance_ecosystem_over_four_years-1