A new cybersecurity law came into force in Myanmar on 1 January 2025, with VPN usage and digital freedoms under threat.
Introduced by the country’s military junta, the law aims to address cyberattacks that pose a threat to Myanmar. It sets out a penalty of six months in prison and fines of up to $4,750 for “unauthorized VPN installation.”
Myanmar has been under military control since the elected government was deposed in 2021. Internet freedoms have been suppressed and the media is under direct control of military leaders.
As a result, many in Myanmar rely on the best VPNs to bypass this censorship and get independent information in and out of the country.
The military regime activated the Cybersecurity Law on Wednesday, imposing up to six months in jail or 1-10 million kyats (US$475-4,750) in fines for establishing virtual private network (VPN) connections or providing VPN services without permission. #WhatsHappeningInMyanmar pic.twitter.com/4Wo6s2aOIHJanuary 2, 2025
The law consists of 16 chapters and 88 articles, and also includes penalties for online fraud, illegal gambling, and unauthorized financial transactions.
Non-profit group the Human Rights Foundation of Monland (HURFOM) reported that the junta has claimed the law aims to “protect national stability and authority by preventing cyberattacks and ensuring control over digital spaces.”
However, a legal expert from the city of Mawlamyine told the group “the VPN law is being misused to control public narratives. The Junta is more interested in restricting independent information flow rather than focusing solely on legitimate cybersecurity concerns.”
A draft of the bill was seen back in 2022 by digital rights advocacy group Access Now. The group, and other stakeholders, had been successful in halting a previous incarnation of the law, but this was not the case this time round.
Access Now discussed how the law gives the junta the power to censor online expression, and undermine data protection. They also said how the law would be “throttling any remaining rights of the people of Myanmar to freedom of expression, association, information, privacy, and security.”
In 2022, the group labelled the law to commandeer control of cybersecurity and VPNs as “illegitimate” and “practically impossible.”
Myanmar’s digital history
Myanmar has experienced suppression like this before. In May 2024, the country experienced a VPN ban, with many providers failing to work, and unable to connect to social media apps and popular websites.
It was also reported that people’s phones were inspected, with fines issued and arrests being made if VPNs were found to be installed.
Social media sites including Facebook, WhatsApp, X, and Instagram are all blocked, along with many independent news sites. This all exists at the same time as ongoing conflict between rebels and the military government, documented human rights abuses, and war crimes.
A report by Top10VPN into the cost of government internet shutdowns found that in 2024 Myanmar experienced the joint longest shutdown – 8,784 hours. This cost Myanmar $1.58 billion, and only Pakistan totalled more ($1.62 billion).
Citizens of a number of countries, including Pakistan, Russia, and Mozambique, joined those in Myanmar in experiencing suppression of their online freedoms in 2024. This worrying trend is expected to continue in 2025, and maintaining the digital rights of people worldwide is more important than ever before.
