The Washington PostDemocracy Dies in Darkness

Security-tech companies once flocked to Myanmar. One firm’s tools were used against two journalists.  

Detained Myanmar journalist Wa Lone speaks to reporters in July as he is escorted from a court hearing by police in Yangon. (Myo Kyaw Soe/AFP/Getty Images)

YANGON, Myanmar — Myanmar police had two Reuters journalists behind bars, but they wanted more.

The reporters, Wa Lone and Kyaw Soe Oo, were lured into a meeting with police in December 2017 and arrested on claims of violating state secrecy laws as they reported on atrocities against the country’s Rohingya Muslim minority.

The journalists’ detention was quickly condemned by media-freedom groups and rights activists around the world. Myanmar authorities, meanwhile, were not swayed by international pressure. As a next step, they wanted to comb the reporters’ cellphones, according to court documents and an attorney for the journalists.

Authorities turned to a cellphone-breaching technology from an Israeli company, Cellebrite, according to the documents and a defense lawyer’s account.

Cellebrite — which has since left the Myanmar market — was one of numerous technology companies that rushed into Myanmar as the country opened to greater foreign investment in recent years.

The deals made at the time did not bring any complaints of violations of international laws.

But the case against the journalists laid bare the potential risks of making deals with governments that could use the foreign forensic and surveillance technology in hard-line crackdowns and prosecutions.

In the case of the journalists, the files pulled from the phones later became a core element of Myanmar’s accusations.

Wa Lone and Kyaw Soe Oo — awarded the Pulitzer Prize for international reporting last month — were found guilty in September of possessing state secrets and intending to share them and were sentenced to seven years in prison.

The two journalists were left out of a mass prisoner amnesty held annually during Myanmar’s traditional new year celebrations in April. Of the thousands of people freed, just a handful were political prisoners, rights groups said.

Later that month, Myanmar’s Supreme Court rejected an appeal by the two journalists, effectively ending their bids to overturn their sentences through the legal system.

Reuters journalists give up on courts after latest appeal denied

Last year, Cellebrite halted new sales in the country and stopped servicing equipment that was already sold, its Myanmar distributor said in an interview.

Cellebrite does not comment on “specific incidents, customers or territories,” the company said in a statement.

“Cellebrite continually reviews its policies to enforce compliance with our user agreements,” the statement added. “We require that agencies and governments that use our technology uphold the standards of international human rights law. In the extremely rare case when our technology is used in a manner that does not meet international law or does not comply with Cellebrite’s values, we take swift and appropriate action, including terminating agreements.”

Myanmar has received substantial third-party assistance to train and equip its police in recent years. Activists say that companies and donor countries are providing advanced tools to help police further repress perceived dissent. Proponents argue the work is needed to help professionalize the police force. 

The police worked alongside the armed forces during its August 2017 crackdown on Rohingya Muslims in Rakhine state, according to U.N. investigators who say the minority group was targeted by security forces with “genocidal intent.”

The Myanmar military and the civilian government lead by Aung San Suu Kyi have dismissed evidence of abuses as biased and unfounded.

In addition to journalists, the police continue to detain peaceful protesters and critics, including a prominent filmmaker, Min Htin Ko Ko Gyi, who was recently arrested for criticizing the military on Facebook.

Myanmar’s Nobel laureate could free 2 jailed journalists. She has not.

Cellebrite’s technology is widely used by law enforcement around the world. The company began selling its products in Myanmar in 2016 through MySpace International, a Yangon-based cybersecurity and digital forensics firm, MySpace officials said. The company has no relation to the U.S. social media website Myspace.

Kyaw Kyaw Htun, MySpace’s chief executive, said Cellebrite stopped its dealings with the country late last year.

Police in Myanmar, however, still have the technology at their disposal, the MySpace CEO said.

In a July motion to dismiss charges against the two Reuters journalists, attorneys for Wa Lone and Kyaw Soe Oo noted that the police officer who carried out the search of the reporters’ phones had an expired training certification from Cellebrite. 

“They said that he was a technical expert, that he is well trained by Cellebrite, but his Cellebrite certificate was out of date,” said Than Zaw Aung, an attorney for the journalists.

Thandar Moe, an officer in the commercial and information section of Israel’s embassy in Yangon, said the embassy was unaware of Cellebrite’s business in the country and declined to comment further.

Cellebrite equipment pulled documents from the reporters’ phones including itineraries for Pope Francis’s visit to the country and the vice president’s travels, as well as details of the military’s campaign in Rakhine, according to the court documents and the defense lawyer.

A judge deemed the information to be secret. Defense lawyers argued that the information was already widely available to the public and that the reporters were set up by police.

Kyaw Kyaw Htun, who served in the military, said the Ministry of Home Affairs, the military-controlled ministry overseeing the police, is a major customer.

The company had a “very close” relationship with Cellebrite but was informed four or five months ago by the company that it would stop business in Myanmar, he said.

In a statement, Interpol, the international police organization, said it also provided digital forensic equipment manufactured by Cellebrite and three other unnamed companies to the police. The software licenses for the tools provided by Interpol ended in early 2018.

Myanmar’s Buddhists block Rohingya from blood supplies, report says

Two PowerPoint presentations by the Myanmar Police Force showing crime data from 2016 and 2017, reviewed by The Washington Post last month, said authorities acquired a range of Cellebrite’s Universal Forensic Extraction Device (UFED) equipment used to hack smartphones. This included the UFED Chinex Kit, used to extract data from Chinese mobile phones, and UFED 4PC, a software system that Cellebrite promotes as “flexible and convenient.”

A spokesperson for the police did not respond to requests for comment.

Reseda, Calif.-based MediaClone, which produces data collection and cellphone extraction tools, confirmed that it did a deal with MySpace in 2016. Company CEO Ezra Kohavi said that he did not know which ministry received its equipment, but Kyaw Kyaw Htun said it was being used by the police.

Business, however, has slowed considerably in recent months because of “the Rakhine state situation,” Kyaw Kyaw Htun said, a reference to the Myanmar military’s August 2017 campaign against the Rohingya, which sent some 730, 000 people fleeing to neighboring Bangladesh after militants claiming to represent the minority attacked police posts.

“It’s very tough for us, you know,” he said.

Aung Naing Soe in Yangon and Shibani Mahtani in Hong Kong contributed to this report.

Facebook blocks accounts of Myanmar’s top general

U.N. rights investigators comb new conflict zone: Internet hate speech

Myanmar fires general who led campaign against Rohingya

Today’s coverage from Post correspondents around the world

Like Washington Post World on Facebook and stay updated on foreign news