Junta patrols by soldiers, Pyu Saw Htee militia and traffic police have started checking the phones of pedestrians and motorists in Mandalay, Myanmar’s second largest city, after junta boss Min Aung Hlaing signed the Cybersecurity Law into effect on July 30.
According to locals, these checks go beyond routine vehicle and driving license verification and now include invasive searches of mobile phones for social media usage and Virtual Private Network (VPN) software.
“I thought it was just a regular license check, so I stopped my motorbike. Once they saw everything was in order, they inspected my phone. After failing to find VPN software or Facebook on my phone, they accused me of deleting them,” said a 25-year-old man from Maha Aungmyay Township.
“Then they started digging through my photos and videos. They wore militia uniforms and were around the same age as me.”
The junta passed its repressive Cybersecurity Law on Jan. 1, criminalizing the use of VPNs and penalizing users who access banned sites or share information from them. The law grants the regime unlimited power to access user data, arrest online critics and conduct online surveillance. It also criminalizes online gambling and other banned cyber activities.
A digital rights advocate said the law violates fundamental human rights, including freedom of expression, the right to access information, and cyber freedoms, while granting the junta legal cover for its suppression.
Since the 2021 coup, the junta has consistently targeted online platforms and social media channels by imposing internet shutdowns and blocking sites like Facebook and independent news websites. To get around this, internet users have turned to VPNs, applications that can bypass such blocks.
The junta banned the use of VPNs in May 2024.
The Cybersecurity Law extends beyond Myanmar’s borders to vessels or aircraft registered under its laws, and even Myanmar citizens using the internet abroad.
Under the law, establishing or providing VPN services without authorization is punishable by up to six months in jail and/or a fine up to 10 million kyats (around US$ 4,750).
It also imposes jail terms and fines for offering unauthorized digital platforms and online gambling services.
The regime has also begun verifying identities with the Person Scrutinization and Monitoring System (PSMS)—a digital surveillance tool developed with Chinese technical support.
The system enables authorities to cross-check national registration numbers against criminal records at checkpoints, hotels, and ticketing counters.
On Saturday, a woman in her 20s was reportedly arrested after her hotel registration was processed through the PSMS.
“We heard she had previously joined anti-regime protests,” said a Mandalay resident. “She was staying at a hotel in Chanmyathazi Township. Hotels are required to submit lists of their guests to authorities. Her guest registration was flagged by the PSMS and she was detained at an interrogation center. We heard she’s being charged under Article 50(j) of the Counter-Terrorism Law.”
Security checkpoints across Mandalay are now routinely using PSMS to screen travelers, according to residents. The regime has also deployed Pyu Saw Htee militias and plainclothes soldiers as part of mass surveillance in Mandalay, while installing CCTV cameras in key locations across the city.
