A recent draft of the cybercrime law obtained by VOA Khmer has drawn concerns from NGOs and rights groups over clauses that could help the government intensify its crackdown on freedom of expression, while also raising privacy and data collection concerns.
The draft law, the formulation of which was first announced in 2010, was intended to regulate Cambodia’s cyberspace and related crimes, giving judicial police and courts access to investigate these infractions. However, articles in an August draft of the law reveals that it could be used to further curtail freedom of expression while relying on vaguely-defined scenarios to justify its implementation.
VOA Khmer provided Interior Ministry Secretary of State Bun Honn a copy of the leaked draft, but the official refused to confirm the authenticity of the text, but did not reject its contents. Bun Honn is in charge of drafting the long-delayed legislation.
“The discussions are not yet completed and we haven’t asked approval from the government about the draft law,” he said. “Who gave the draft [to VOA Khmer]?”
Bun Honn said the draft was still being discussed and attempted to dissuade reporters from reporting its contents.
The draft law requires service providers to “preserve traffic data for at least 180 days” to facilitate requests from “competent authorities.” However, the draft does not clearly outline the kinds of service providers that come under the ambit of this law.
The draft states that any natural or legal person storing data on behalf of others or providing users the possibility of communicating through telecommunications systems are considered as service providers. It is unclear if this would be limited to internet and mobile service providers or also include cyber cafes and internet access provided by organizations to their staff.
Article 45 of the draft would allow authorities to fine or imprison people who “knowingly or intentionally” make false statements using information technology that could be detrimental to “public safety,” “national security” and “friendly relations of Cambodia and other countries.”
If convicted, a person could face a maximum of three years in prison and up to $2,500 in fines, according to the draft law.
Similarly, Article 40 can be used to punish people for causing “interruptions, fear, threats, abuses, intimidation” through the use of computers. Maximum imprisonment under this article is six months in prison, the draft says.
Soeung Saroeun, executive director at Cooperation Committee for Cambodia, which represents a coalition of local and international NGOs, said stakeholder consultations should be conducted before passing the draft law because it involves private sector service providers and the general public, who mainly use Facebook.
“At first glance, our concern is about the consumer’s privacy because service providers have the legal right to record and store for at least 180 days,’’ Soeung Saroeun said. ‘’It is not right. How can privacy be protected?”
He also expressed concern about the draft article related to the sharing of alleged fake news, which carries potential prison sentences.
“How do you define and protect from fake news?” Soeung Saroeun said, adding that people could share information that only later is shown to be untrue.
Soeung Saroeun said his organization had requested a copy of the draft law from the Interior Ministry on two occasions but had heard no response.
The government has detained individuals, mostly linked to the dissolved Cambodia National Recuse Party, for posting social media messages in support of the party over the last three years, most recently when opposition leader Sam Rainsy unsuccessfully attempted to return to Cambodia last November.
The government has arrested a number of Cambodians, a majority from the CNRP, during the COVID-19 pandemic for allegedly posting fake news, which human rights groups have classified as an attempt to curb dissent over the administration’s handling of the viral outbreak and its economic impact.
The draft law does contain provisions on other cybercrimes, such as identity theft, computer-related forgery and theft, intellectual property infractions, and crimes related to pornography.
In June, a U.S. Justice Department expert conducted a workshop with Interior Ministry officials to discuss the draft legislation, according to the U.S. Embassy in Phnom Penh. Leading U.S. technology companies were also present to provide feedback and best practices related to the protection of fundamental rights and Cambodia’s information technology systems.
Chad Roedemeier, a U.S. embassy spokesperson, said the diplomatic mission was aware of the draft law and had engaged with the government to emphasize the importance of the draft legislation protecting freedoms enjoyed by Cambodians and of taking into account the needs of users, citizens, and businesses.
“A law that fails to balance Cambodia’s security needs with the needs of businesses and end-users could negatively impact foreign investment and reduce opportunities for Cambodia’s small-to-medium-sized technology companies – both within and outside Cambodia,” Roedemeier said in an email.
“The human rights and fundamental freedoms that individuals have offline must also be protected online,” he said.
Chak Sopheap, executive director at the Cambodian Center for Human Rights, said other contentious clauses in the leaked draft law were problematic. She said her concerns relate to the use of terms such as “public order” and “security,” which, she noted, were vague and open to interpretation by authorities.
“There is no clear definition when stating about public order and security and the [national] interest,” she said.
Rights advocates have said that the lack of legislation to regulate the online space has not stopped the government from arresting and charging individuals for online expression. The government has also attempted to put into place infrastructure and frameworks to monitor online activity.
In a July document, the Cambodian government had proposed the establishment of a national internet gateway to control and monitor online traffic, drawing concerns from rights groups and businesses.
The proposal was detailed in a sub-decree titled the “Establishment of the National Internet Gateway (NIG)”, obtained by VOA Khmer, and states that once the NIG is established it will control all internet operations in the country.
In a May 2018 government notice, the Ministries of Telecommunications, Information, and Interior formed a working group to monitor the accuracy of news on online media platforms and social media, with each ministry tasked with different roles in the online monitoring mechanism.
The government also instructed internet service providers to block 17 websites days before the 2018 national election because they were likely to “obstruct the election.” Ministries and sub-national officials have also been asked to monitor the content posted by citizens, including in private messaging groups.
