Just days before Cambodia’s national internet gateway is scheduled to take effect, analysts and civil society organisations say they know scarcely more about its rollout than when the decree was first signed into law last year.
The gateway is slated to route all internet traffic through a state-run portal starting as soon as 16 February. Billed by prime minister Hun Sen’s ruling Cambodian People’s Party as necessary for ‘national security,’ international watchdogs and internet freedom groups decry the project as a potential disaster for internet users.
By regulating traffic through a centralised system, the government has the potential to block websites en masse, monitor activity and even shut off access during critical moments such as elections.
Cambodian Institute for Democracy president Pa Chanroeun called this “unchecked power” across online spaces: “It would undermine internet freedom, affect the flow of information and impact the privacy of the user,” he said.
Yet even the most basic details of the gateway’s deployment, including how the government will manage the technical side and its immediate potential impacts, remain murky. Civil society groups have little reliable information as they prepare for the expansive law to take effect.
Whispers of possible delays abound. One industry professional said local internet service providers (ISPs) were struggling to find affordable means of storing the massive amount of internet traffic data required by the sub-decree. Others have pointed to a recent Ministry of Post and Telecommunications (MPTC) recruitment effort as evidence that the government could be falling behind in its promised rollout.
“The fact that we have no idea what’s going on with the national internet gateway now a week or two before the ostensible implementation date really spells out the process issues with this law that has enormous implications for how Cambodians use the internet,” said Kian Vesteinsson, a technology and democracy research analyst at Freedom House, a political and civil liberties group.
The law, he said, “seemed designed to carry severe consequences for free expression and privacy and access for Cambodians.”
Internet surveillance is not new in Southeast Asia, where arrests, doxxing and threats related to online activity have become routine as authoritarian regimes increasingly see the internet as a crucial means of control.
In Cambodia, citizens have been jailed for alleged offences like publicising garment workers’ plights in the height of the Covid-19 pandemic or insulting the king.
Yet Cambodia’s national internet gateway creates a comprehensive level of surveillance that critics say puts the country on the path toward China’s “Great Firewall.”
Broadly speaking, the internet flows across borders via satellites, land connections and undersea cables, sending ‘packets’ of data to be processed through different servers before their next destinations.
Cambodia’s gateway would route all incoming and outgoing traffic into a centralised set of servers, where government software could block IP addresses, examine data and scan banned URLs, said Michael Caster, the Asia digital program manager with freedom of information organisation Article 19.
The lack of understanding and the lack of knowledge is felt across the board. This opacity is by design”
Michael Caster, Asia digital program manager, Article 19
A second, more intense layer of monitoring called ‘deep packet inspection,’ which is among the tools China uses, could parse internet traffic more granularly and make it easier to block workarounds like virtual private networks.
It’s not clear how much Cambodia’s gateway will follow that general trajectory, experts said, including how many points of entry the system could include, how they will operate and whether deep packet inspection is on the table. The MPTC did not respond to a request for comment.
In interviews with government-aligned media, MPTC minister Chea Vandeth rebutted criticism by saying the government will operate the gateway in several cities including Phnom Penh, Sihanoukville, Poipet and Bavet. A diagram published in the sub-decree also names those cities.
Caster said multiple government checkpoints could potentially help maintain internet speeds and cybersecurity compared to a single entry point, but would not solve the key problem of centralised control.
“The lack of understanding and the lack of knowledge is felt across the board. This opacity is by design,” he said. “It only stands to reason that if the legal instrument that brings some new regime into force is vague, then the new regime will be vague.”
Despite the gateway’s implications, experts have always questioned the government’s capacity to implement it at scale. Those doubts have only increased in recent weeks.
In December, the MPTC advertised on Facebook for more than 100 positions with expertise in cloud technology, data centres, artificial intelligence, cybersecurity and telecommunications infrastructure, a signal that the ministry is “probably still short of the technical capacity to pull this off,” Caster said.
Meanwhile, the sub-decree requires ISPs to maintain records of internet traffic for 12 months to share with the government.
Providers also must cooperate in blocking connections that threaten “national revenue, safety, social order, dignity, culture, traditions, and customs,” categories which Human Rights Watch has panned as “ludicrously broad” and give ISPs a direct role in enforcing surveillance.
One industry professional who spoke with several ISPs, however, said some were struggling to find storage equipment such as hard drives or cloud storage that was not prohibitively expensive to maintain the vast amount of data. There were 43 licenced ISPs as of January, according to the Telecommunication Regulator of Cambodia.
Various providers including Ezecom, Smart, Metfone and MekongNet either declined or did not respond to requests for comment. The Global System for Mobile Communications Association, which represents mobile network operators worldwide, declined to comment.
“Are they ready? Do they have the team? Do they have the equipment? I don’t think so,” said the professional, who was granted anonymity to speak freely about private conversations.
In the final days leading up to the sub-decree’s effective date, civil society groups and human rights organisations calling for clarity have been met with silence.
At a 26 January conference on internet freedom hosted by the Digital Rights Working Group, several MPTC representatives were scheduled to provide gateway updates and answer questions but cancelled last-minute.
Phil Robertson, Human Rights Watch Asia Division deputy director, said the no-show was symbolic of the government’s overall lack of transparency around the gateway’s implementation process, including its structure and operations. There are “many more important and unanswered questions” remaining, he said.
“The three MPTC representatives were supposed to start providing at least some of the answers, but even that was apparently too much for the government,” Robertson said. “Their cancellation naturally begs the question: what is the government trying to hide?”
In comments to Fresh News and the Phnom Penh Post days after the event, MPTC minister Chea publicly disputed claims made during the conference, telling NGOs to “not confuse the public anymore.”
Businesses have remained similarly mum. In late 2020, the Asia Internet Coalition, representing tech giants such as Apple, Facebook, Grab and Google, said the gateway could impede businesses via deteriorated internet speeds and increased cybersecurity risks, but the organisation has issued just one more statement since.
Local civil society organisations said they have heard little from the private sector all year, although some tech companies have spoken privately with government representatives, Robertson said.
In contrast, public uproar from businesses partially caused the Thai government to scrap similar plans for a national gateway in 2015.
The American and European chambers of commerce in Cambodia, along with individual companies including Facebook and Google, declined to comment or did not respond to requests for comment.
“I don’t know if they’re working it out amongst themselves behind closed doors, or they’re afraid to speak out,” Chanroeun said of the private sector.
Absent communication with businesses or officials, internet and human rights experts have continued to air concerns through public statements and independent media.
Three United Nations special rapporteurs including Vitit Muntarbhorn, rapporteur on Cambodian human rights, wrote on 1 February that the “repressive” gateway would violate the International Covenant on Civil and Political Rights, a treaty to which the Kingdom is party.
“To legally justify such a sweeping infringement on personal freedoms requires compliance with strict tests of legality, necessity and proportionality, including for matters of national security or public morality,” their statement said. “It is exceedingly hard to imagine how any such legal justification may apply in this case.”
The Cambodia Mission in Geneva emphatically dismissed the statement as “radically one-sided, politicised, imaginary and misleading.”
Civil society leaders also have warned repeatedly of the gateway’s impact on the ability of Cambodians to speak freely, which has been stifled since the Supreme Court in 2017 dissolved the main political opposition group, the Cambodia National Rescue Party, and cracked down on independent media.
“They have not listened to us, and they keep going on with the sub-decree,” said Nop Vy, executive director of the Cambodian Journalists Association.
With the government showing no interest in substantively explaining or reconsidering the sub-decree, possible delays have provided critics little comfort.
Even if the gateway began operating later than anticipated, there is no clarity whether everyday internet users would know when the changes had taken effect.
“The only upside of a delay,” Robertson said, “would be it’s another day in which the government will not yet have its new tool to increase internet control and facilitate the crackdown on online dissidents.”
