[Joint Statement] Cambodia Should Scrap Rights-Abusing National Internet Gateway

We, the following 32 human rights organizations, call on the Cambodian authorities to revoke the Sub-Decree on the Establishment of the National Internet Gateway (NIG). Since passage of the sub-decree on February 16, 2021, the government has yet to address the serious human rights concerns raised by civil society groups and tech companies. At the same time, the government has been wholly non-transparent regarding the infrastructure, implementation, financing, and cooperating companies, agencies, and organizations involved in supporting the NIG.

The NIG sub-decree paves the way for the establishment of a digital gateway to manage all internet traffic into and out of Cambodia. Provisions in the sub-decree allow government-appointed NIG operators to block or disconnect any online connections (article 6), retain traffic data for a year and provide other network information as requested by authorities (article 14), and issue overbroad penalties for non-compliant telecommunications operators (article 16).

The sub-decree states that the purpose of the NIG is to facilitate and manage internet connections to strengthen revenue collection, protect national security, and — in terms that are overbroad, ambiguous, and prone to misuse — to “preserve social order, culture, and national tradition” (article 1).

While the exact technical infrastructure and how it will be operated is still unknown, there is little doubt the NIG’s true purpose is to enable the Cambodian government to tighten the noose on what remains of internet freedom in the country.

In April 2021, three independent experts appointed by the UN Human Rights Council expressed concerns that the sub-decree “poses risks to the fundamental freedoms of individuals, namely the freedoms of expression and opinion and the right to privacy and may expose individuals’ personal information without their consent, which would contravene international human rights instruments and Cambodian laws.”  They reiterated this call to the government on February 1 2022, warning that the NIG “will have a serious negative impact on internet freedom, human rights defenders and civil society in the country, further shrinking the already-restrictive civic space in Cambodia.”

Cambodia is a party to the International Covenant on Civil and Political Rights (ICCPR). Article 17 of the ICCPR protects the right of every individual against arbitrary or unlawful interference with his or her privacy. Article 19 of the ICCPR protects the right to freedom of expression. This right includes the “freedom to seek, receive, and impart information and ideas of all kinds.”  Any measures the state takes that would interfere with these rights must be provided for by law, be non-discriminatory, and be strictly necessary and proportionate to protect the rights of others, national security, public order or public health or morals.

The government has repeatedly rejected all human rights concerns about the NIG. The government has also refused to explain how the NIG’s restrictions on freedom of expression and access to information are necessary to achieve any of the legitimate aims, and failed to address the lack of proportionality of the measures. Instead, the internet gateway is poised to restrict these rights in an overly broad manner, without any apparent limits. As UN experts, tech company representatives, and human rights advocates have pointed out, the sub-decree lacks procedural safeguards, independent oversight, and data and privacy protections.

There are grave concerns that the gateway will supercharge the government’s censorship capabilities, allowing it to scale up its website blocking. The gateway is also likely to have a chilling effect on online communications and generate self-censorship online among critical voices and independent media outlets who fear increased surveillance, harassment, and reprisals.

The sub-decree poses risks to data protection and data privacy, requiring government gateway operators to retain and share metadata. In the absence of a data protection law in Cambodia that would protect internet users from misuse of their data and provide certainty about where and how long data is retained, and who has access to it, the NIG will facilitate the authorities’ ability to identify users’ internet activities and habits, ultimately risking identifying the users themselves. Data retention without sufficient protection for data security will increase risks to data security from third-party interference, or hackers. Centralizing internet traffic and data under the NIG also creates a vulnerability for malicious acts, without guaranteeing service providers’ capacity to adequately address the resultant increase in data security needs.

In a press statement issued on February 15, 2022, Cambodia’s Ministry of Foreign Affairs claimed that it had conducted an “extensive study on infrastructure models from different countries around the world and found that most countries have internet gateways.” No information has been provided to back these sweeping assertions, such as which infrastructure models the authorities considered, what their benefits and disadvantages are, and whether the study was done with reference to Cambodia’s human rights obligations under various international human rights treaties.

In Cambodia, the government’s rushed adoption process of the sub-decree establishing the NIG was plagued by a lack of transparency. The authorities failed to hold any consultations, much less wide and inclusive ones, and did not invite inputs by experts, civil society groups, private actors, business groups, and other interested parties prior to the sub-decree’s adoption. The NIG appears designed to function as an authoritarian tool that will facilitate the government’s efforts to curtail free expression, association and privacy online as well as offline, and facilitate targeting of online expression by members of civil society, independent media, and the political opposition.

On February 15, 2022, the government revealed that implementation of the NIG, set to start the next day, would be delayed. No new date for the NIG implementation has been set. A spokesperson for the Ministry of Posts and Telecommunications told the news outlet Nikkei Asia on February 15 that the delay was due to the Covid-19 pandemic. However, another ministry spokesperson told the news outlet VOD that technical difficulties in implementing the NIG was the cause of the delay, stating that “we have to prepare to install and order equipment in order to prepare and create the gateway. And we have to give licenses to any company that the government understands that has the ability to create the gateway.”

Cambodia’s internet gateway greatly risks restricting the free flow of information between Cambodia and the rest of the world while establishing a system that will cast a wide net of surveillance across the country. Foreign governments, technology and telecommunications companies, internet service providers, business groups, UN agencies and others concerned should come together to seek to halt this wholesale attempt at information control.