A draft cybercrime law in Cambodia threatens increased surveillance of internet users, privacy rights, and free speech online, Human Rights Watch said this week.
The rights group said the United States, other concerned governments, and international technology and communications companies operating in Cambodia should call for the bill to be dropped.
Human Rights Watch said it obtained the third known draft, dated August 4, 2020. The government has received private advice from the United States, but the government has not shared the draft with the public or consulted with civil society organizations or experts.
“Prime Minister Hun Sen has long bragged about listening in on phone calls and intercepting emails, and the proposed cybercrime law would give him further legal cover to do so,” said Brad Adams, Asia director at Human Rights Watch. “The draft cybercrime law’s terms are incredibly broad and vague, and would give an already authoritarian government even more power to arbitrarily prosecute critics and political opponents,” Adams said.
The draft states that its purpose is “to ensure probity in the use and the management of computer systems and computer data and to protect security and public order.” Article 45 calls for up to three years in prison for intentional false statements that have an “adverse effect” on national security; public health, public safety, or public finances; relations with other countries; the results of a national election; that incite racial hostility, hatred or discrimination; or cause a loss of public confidence in the government or state institutions. Article 40 prohibits acts that vaguely constitute “disturbing, frightening, threatening, violating, persecuting or verbally abusing others by means of computer.”
The bill does not define any of these terms, such as “adverse effect,” “national security,” “public safety,” or “loss of confidence.” It also does not specify which authority would decide when the terms of the law have been violated.
Articles 32 and 33 on “unauthorized access” to a computer system, or transferring data from a system without authorization, face up to 10 years in prison. The provisions could be used to prosecute whistleblowers and investigative journalists who use leaked materials in their work.
Chapter 3 of the draft law mentions the obligations of “service providers,” but fails to clarify whether its application is limited to internet and mobile service providers, or also includes internet cafes or other places, including company offices, that provide internet access to staff. Articles 8 and 12 require service providers to store internet traffic data for at least 180 days upon request by the authorities. Failure to preserve data or to cooperate with the authorities are punishable by fines and prison sentences.
The most recent draft follows earlier versions in 2014 and 2015 that were sharply criticized by civil society and media groups for restricting the rights to privacy and free expression. The groups expressed concerns that the drafting process lacked inclusivity, transparency, and public participation.
The Cambodian government has already enacted several repressive laws that allow for increased governmental control over information and communications technologies. The 2015 Telecommunications Law permits undeclared monitoring by the authorities of any private speech via telecommunications without any procedural safeguards and judicial oversight. The law established an enforcement body of “telecommunications inspection officials” to investigate alleged offenses under the Telecommunications Law, with the authority to call in support from the armed forces “to join in cracking down on alleged crimes.”
In May 2018, the Cambodian government adopted the Inter-Ministerial Proclamation on Website and Social Media Control, which requires all internet service providers to install surveillance software to monitor content circulated on the internet. The proclamation grants the Ministry of Posts and Telecommunications the authority to “block or close” web and social media pages containing “illegal [content] … considered as incitement, breaking solidarity, discrimination, create turmoil by will, leading to undermine national security, and public interests and social order.”
In July 2020, the Posts and Telecommunications Ministry proposed a sub-decree on a National Internet Gateway, which seeks to route all internet traffic through a regulatory body monitoring online activity. The sub-decree would allow for the “blocking and disconnecting [of] all network connections that affect safety, national revenue, social order, dignity, culture, tradition and customs.”
The US-based Freedom House’s “2020 Freedom of the Net” report documented incidents between June 2019 and 2020 in which online content ranging from Facebook accounts to online news sites and songs released on YouTube and Facebook critical of the government, “was removed following government pressure or user complaints during the coverage period, and users were forced to sign statements promising to stop posting some content online while they were held in detention.”
The Cambodian government has a long record of targeting critics of the government. Cambodia now has more than 50 political prisoners. The authorities also have arrested 30 people for peacefully expressing their views on social media related to Covid-19. Among those detained is the online journalist Sovann Rithy, whom the authorities charged with incitement after he quoted a speech by Hun Sen. The authorities also revoked two broadcasting licenses of Rithy’s news and radio site, TVFB, allegedly because Rithy broadcast information “which was to generate an adverse effect on the security, public order and safety of society.”
“Cambodia lacks a data protection law with safeguards to ensure that official requests for data are necessary and proportionate,” said Adams. “But this bill grants the authorities the power to conduct fishing expeditions for data without independent oversight. Governments should call for the Cambodian government to start over and draft a law that ensures protection for online speech and privacy rights.”
