A police officer takes photos of protesters in Yangon, Myanmar on Wednesday, Feb. 24, 2021.  © 2021 AP Photo

(Bangkok) – The Myanmar military junta’s access to a new public camera system equipped with facial recognition and license plate recognition technology poses a serious threat to basic rights in the country, Human Rights Watch said today. Increased surveillance abilities through artificial intelligence technology are a heightened concern after the February 1 military coup, as the junta has increasingly used deadly force against protesters and others expressing opposing views.

On December 14, 2020, Myanmar authorities rolled out the first phase of its “Safe City” initiative and started using a system of 335 surveillance cameras in eight townships in the capital, Naypyidaw. The cameras, from the technology company Huawei, come installed with artificial intelligence technology that automatically scans faces and vehicle license plates in public places and alerts authorities to those on a wanted list. Myanmar’s Safe City plan envisions similar systems in Mandalay by mid-2021, and later, in Yangon, the commercial capital.  

“This powerful surveillance system bolsters the Myanmar junta’s increasingly abusive crackdown on demonstrations,” said Manny Maung, Asia researcher. “The authorities’ ability to identify people on the streets, potentially track their movements and relationships, and intrude into private lives poses a grave risk to anti-coup activists.”

Most of the equipment used in Myanmar’s US$1.2 million project is produced by Huawei, according to a government official cited by Myanmar Now. The same report said that the Naypyidaw-based Linn IT Solutions won the tender to build the control center, and Nang Yoe was selected to install the cameras and communications cables. In a letter to Human Rights Watch dated February 22, Huawei said that as a telecoms supplier, it is providing “standard ICT infrastructure equipment” – referring to information and communications technology – suggesting that the company supplied the CCTV cameras.

Huawei stated that the facial and license plate recognition technology installed on the cameras was not from Huawei: “[T]here are many vendors for different parts of the projects. The application software you paid attention to is not Huawei products. And more important, Huawei is not involved in any actual operation and data storage or processing.” However, Huawei did not clarify whether it sold the government CCTV cameras and associated equipment without these technologies, or had subcontracted the installation of these technologies to other suppliers. 

The Naypidaw and Mandalay Safe City projects have been planned since 2018 and 2019, respectively. In March 2019, the Mandalay Region’s chief minister announced plans for a $1.24 million Safe City project designed in partnership with Huawei, claiming it would heighten security and curb criminal activity.

The proposal for the Safe City project in Mandalay, Myanmar’s second largest city, envisions that Huawei will provide CCTV recording equipment and software, oversee the installation by commissioning third-party contractors, and provide technical support to the Mandalay regional government. In both the Naypyidaw and Mandalay projects, there is little transparency regarding how facial images, vehicle license plate information, and other personal data will be collected, stored, and used. Nor is it clear which officials will be given access to that data and under what circumstances. The replacement of the civilian-elected government by a military junta heightens rights concerns, Human Rights Watch said.

The use of facial recognition technology in public spaces does not merely risk the misidentification of people as criminal suspects, Human Rights Watch said. Even if the technology is accurate, it allows governments to monitor people’s habits and movements, creating potential chilling effects on freedoms of expression, association, and assembly. It can also be used to single out individuals in discriminatory or arbitrary ways, including for their ethnicity or religion.

For example, in China, various technologies including facial recognition and number plate recognition have been used for mass surveillance purposes. Their use is particularly abusive in China’s Xinjiang region, where these systems continually assess the relationships and everyday behavior of Uyghurs, a Turkic Muslim minority. These systems help identify people whom authorities consider “problematic” based on vague criteria following which they are detained, imprisoned, and subjected to political indoctrination.

In Myanmar, the rollout of facial recognition and vehicle license plate recognition technology was approved without public consultation or transparency, making it unclear how the authorities plan to mitigate the technology’s potential impact on human rights, including the right to privacy.  

On February 13, the military junta suspended sections 5, 7, and 8 of the Law Protecting the Privacy and Security of Citizens (2017), removing basic protections, including the right to be free from arbitrary detention and the right to be free of warrantless surveillance, search, and seizure.

Section 5 required the presence of two witnesses whenever the police enter a residence for the purposes of search or seizure “to ensure that there is no damage to the privacy or security of the citizen.” The suspension of that protection significantly raises the risk of abuses during searches and arrests. Section 7 required a court order for any detention of more than 24 hours. Suspension of the provision will facilitate violations of international law, which provides that any person detained on a criminal charge be brought promptly before a judge.

Section 8 provided protections of an individual’s right to privacy by prohibiting search and seizure, surveillance, spying, or any investigation affecting the privacy, security, and dignity of the individual without a court order, protections that the junta has removed.

Neither the privacy law nor other Myanmar law contains any protection for the collection, use and storage of personal data. There is also no specific protection of sensitive personal data, including biometrics, or their processing.

Under international law, government collection or use of personal and sensitive data, including vehicle license plate numbers and biometrics, must comply with international human rights standards, specifically the International Covenant on Civil and Political Rights (ICCPR) in article 17, that “no one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence” and that “everyone has the right to protection of the law against such interference or attacks.” Even though Myanmar has not ratified the ICCPR, these protections are also provided in article 12 of the Universal Declaration of Human Rights, which are considered reflective of customary international law.

Myanmar authorities should ensure that each instance of collection, retention, and use of personal data is comprehensively regulated, narrow in scope, and necessary as well as proportionate to meeting a legitimate security goal. The government should also refrain from deploying facial recognition systems altogether given that the collection and analysis of facial images creates unprecedented risks to privacy and related rights.

Under the United Nations Guiding Principles on Business and Human Rights, technology companies also have a responsibility to ensure that their products and services do not contribute to human rights abuses, including violations of privacy.

“Before the coup, Myanmar’s government tried to justify mass surveillance technologies in the name of fighting crime, but what it is doing is empowering an abusive military junta,” Maung said. “The rollout of these technologies should be suspended given the risks involved and the possibility of further rights abuses.”