• Society

Cambodia’s Online Freedoms under Threat from Draft Cybercrime Law

• Gerald Flynn and Phuong Vantha
• October 22, 2020 3:53 AM

After a decade of drafting, the latest copy of the law from August 2020 is—according to analysts—overly vague, could stifle the digital economy and be used as a tool to silence online dissent.

PHNOM PENH--Consisting of nine chapters and 50 articles, the leaked copy of Cambodia’s draft Cybercrime Law is believed to be the latest incarnation of legislation that has been a decade in the making. However, after 10 years of drafting, the most recent version of the law—dated Aug. 4, 2020—remains vague and concerning, according to experts.

The first article of the draft law sets out its purpose: “to ensure the integrity of the use and the management of computer systems and computer data, to maintain security and public order, and to protect rights and freedom of any person by specifying measures to prevent and combat cybercrime.”

While terms like “security,” “public order” and “national security” feature heavily as elements of online activity that would—under the draft law—constitute a crime, there is no definition of such terms.

Even the terms that are defined are granted very loose definitions in the draft law, with a service provider defined in Article 3 as “[a]ny natural person or legal person providing any user the possibility to communicate through computer or telecommunication system.”

This is of particular importance given the restrictions and responsibilities that the draft law would apply to service providers, which can range from storing traffic data for at least 180 days to providing that data to the authorities if they deemed it necessary. Failure to comply with some of the more stringent regulations that apply to service providers could result in a prison sentence of up to five years and a fine of up to 50 million Riels—roughly $12,200—but the broad terminology in the law makes it difficult to know who exactly would be responsible for these duties or liable for the punishments.

However, the Minister of Interior would ultimately be responsible for enforcing the law and the current draft appears to grant them the power to jail, fine and surveil internet users and service providers. The revocation of business licenses, certificates and permits—as well as the access to personal data—are among the additional punitive measures the authorities can apply under the law.

While illegal data sharing, hacking, unlicensed digital currency trading, accessing or disseminating pornography, intellectual property rights violations, identity theft and fraud all fall under this law, beyond this the law uses broad strokes to outlaw the spread of false information.

Vague Words Used to Silence Critics

For many who have seen the draft copy of the law, questions remain as to what safeguards will be put in place to prevent the abuse of this law on behalf of a government who has—just over the course of this year—demonstrated a propensity for silencing critics both online and off.

“Time and time again we've seen this government use vaguely worded laws to lock people up for expressing their political opinions,” said Naly Pilorge, director of the human rights group LICADHO. “Article 45 of this law appears to give the ruling party absolute and arbitrary authority to criminalize any and all free speech on the internet that it dislikes.”

Article 45 is of particular concern to human rights defenders, many of whom have already faced jail or harassment for their private online communications.

“Any person who knowingly and intentionally makes a false statement or material misrepresentation through information technology,” Article 45 states, before listing an array of vague concepts through which Cambodian internet users could be prosecuted for being “prejudicial,” although no definition is offered as to what would be considered prejudicial under the law.

This includes being “prejudicial” to national security, public health, public safety, public finances and friendly relations of Cambodia and other countries. Further still, publishing misleading information aimed at influencing the outcome of a national election or inciting feelings of enmity, hatred, racial discrimination or ill-will between groups of people are also punishable under Article 45.

Moreover, Article 45 will allow the Ministry of Interior to determine whether online content diminishes public confidence in the government or state institutions, with between one month and three years’ imprisonment for those found guilty of doing so—on top of fines of up to 10 million Riels, roughly $2,500.

Another Tool in a Broad Arsenal

“The Cambodian government has undermined internet freedom by blocking websites, revoking news outlets’ licenses after critical reporting, and arresting and prosecuting people for their online speech,” said Allie Funk, senior research analyst for technology and democracy at the US-based NGO Freedom House.

“If passed, the Cybercrime Law will add to the already broad arsenal of tools the government has at its disposal to go after critical expression online,” Funk added.

In their 2020 Freedom on the Net report, Freedom House gave Cambodia a score of 43 out of 100—with 100 being the most free. It is worth noting that the Cybercrime Law was not included in this calculation as Freedom House collated data from June 1, 2019 to May 31, 2020, some two months before the August 2020 draft of the law was written.

While Freedom House’s research found that access to the internet is increasing—with some 15.2 million internet subscribers and 20.7 million smartphone users in April 2020—it also found that poor infrastructure and inequality created vast differences in the quality of access available nationwide. The variation in the quality of services was most stark in comparing internet access between rural and urban communities, but also men and women were found to have different levels of access and level of education was also found to be a factor in accessing the internet or digital services.

The report also noted that the proposed National Internet Gateway—an as-of-yet unsigned sub-decree—would grant broad powers to the government and allow them to centralize internet traffic, which academics, business leaders and civil society groups have warned will negatively impact Cambodia’s growth.

This, Freedom House reported, was compounded by the lack of independence of the Telecommunications Regulator—the ineffectiveness of which would be deepened by the introduction of the National Internet Gateway.

“The amount of online content removed at the behest of state or non-state actors remains difficult to assess, as the process is unofficial and nontransparent,” the report read. “However, content was removed following government pressure or user complaints during the coverage period, and users were forced to sign statements promising to stop posting some content online while they were held in detention.”

In March 2020, online news outlet TVFB’s Sovann Rithy was detained for accurately quoting Prime Minister Hun Sen and was accused of spreading fake news. Although he was released on Oct. 5 with a suspended sentence, it is unlikely the ban will be lifted on his media organization.

“Freedom House's research consistently shows how laws criminalizing ‘fake’ information are weaponized to suppress dissent and used as a pretext to go after journalists, activists, and other members of the public,” continued Funk.

Data from LICADHO shows that at least 24 people were detained between January and April 2020 for posting what the government deemed fake news online, with five of them imprisoned.

“The draft law's provision on false information is worrisomely broad and lacks a clear definition, allowing it to easily be deployed to curtail free expression,” Funk said, adding that the penalties for distributing what the authorities deem fake news are disproportionate and prone to arbitrary abuse.

Funk also noted that the draft law would grant the authorities more power to access people’s personal data due to the data retention requirements set out by the Cybercrime Law.

“Such access raises serious privacy concerns, notably in an environment that lacks strong legal protections ensuring personal data is safeguarded from abuse,” she warned.

Still Time to Change the Draft Law

The Ministry of Interior’s Anti-Cybercrime Department Director Chea Pov said that the ministry is still discussing the draft Cybercrime Law and could not confirm how many chapters or articles the latest draft consists of, although he did confirm certain contents of the draft law.

“It still is in draft form, so I can’t say much, maybe we will add more or cut some chapters in the future. We’re still meeting about it,” he said in a telephone interview.

Responding to the concerns raised by civil society organizations, he said that the draft Cybercrime Law is based on international standards, and so drafting the law requires consultation, which takes time.

“Any NGOs who want to join during the draft, they can draft their version of the law and send it to me,” he said, adding that now was not the time to involve NGOs in the drafting process.

Pov went on to say that the Anti-Cybercrime Department would have a much easier time preventing cybercrimes when the law is passed and complained that currently his department has to rely on a number of laws to guarantee a conviction.

Meanwhile, Undersecretary of State at the Interior Ministry Bun Honn said that the ministry has met to discuss the draft law 68 times since 2016 and that its aim is to ensure security and social order in an era of modern technology.

“The making of law must study the social interests, human rights and individual freedoms,” Honn said. “For those who don’t understand the law, they think it’s taking too long, but even now I cannot determine when it ends.

“The government wants us to finish it quickly, but [we] have to think about it from all angles,” he said, adding that the draft law had received input from US Justice Department officials, as well as representatives from Facebook, Google and Amazon.

International Input

Chad Roedemeier, spokesperson for the US Embassy in Cambodia, confirmed that in June 2020 the embassy had facilitated a workshop to provide feedback on the latest draft of the law and that leading US tech giants were present for this, but he stressed that the Ministry of Interior is responsible for drafting the law.

“We encourage the government to pass a law that protects fundamental freedoms online and maintains the integrity of Cambodia’s IT networks,” said Roedemeier.

Established in 2010, the Asia Internet Coalition (AIC) serves as an industry association comprised of some of the biggest tech companies worldwide, including Google, Facebook, Amazon and Twitter. Collectively, the AIC serves as a platform for internet companies to promote best practices and policies throughout Asia and the Pacific.

Jeff Paine, the AIC’s managing director, commended the Cambodian government’s efforts to adopt new legal tools to counter emerging threats posed by cybercrime, but warned against introducing legislation that could harm Cambodia’s digital economy.

“[T]o ensure that any regulation supports the growth of Cambodia’s nascent digital economy, it is imperative that the government adopts a collaborative approach and works closely with industry stakeholders to design a regulatory framework that will not inadvertently stifle innovation, harm freedom of expression, and raise concerns about user privacy,” he said.

Paine went on to echo the sentiments of other analysts, saying that there were many vague elements to the draft law that could be subject to broad interpretation.

“We are concerned that this grants excessive power to local authorities to access information such as personal data and business trade secrets that are protected under Cambodia’s Law on Electronics Commerce and Copyrights Act,” he noted, warning that user confidence would be affected by excessive powers of surveillance in Cambodia.

“This cannot bode well for the growth of the country’s digital economy,” Paine added.

While Cambodia’s digital economy has long been touted as an area where the country could leap-frog—bypassing legacy technology and techniques—and capitalize on a young, digital-savvy population, it has also been regarded as a viable move away from traditional models of growth such as manufacturing, agriculture and construction.

Indeed, the National Bank of Cambodia has often been praised for its innovative approach to a blockchain digital payments system, while a number of digital payments services such as Wing, Pi Pay, Clik and TrueMoney already thrive in Cambodia.

“We reiterate the critical need for the Cambodian government to consider policy approaches that will allow its citizens to capture the immense opportunities from e-commerce and the digital economy—GDP growth, innovation, foreign investment and jobs,” concluded Paine.