Norwegian police have searched the headquarters of telecom giant Telenor ASA as part of two criminal investigations linked to the company’s former operations in Myanmar, including allegations that its handling of customer data may have contributed to abuses during the military crackdown following the 2021 coup.

Police searched Telenor’s headquarters in Fornebu on September 15. The National Criminal Investigation Service (Kripos) is investigating possible complicity in crimes against humanity, while the Police Security Service (PST) is examining whether the company breached Norway’s sanctions legislation.

According to Reuters, Kripos is investigating Telenor Myanmar’s disclosure of historical customer traffic data to Myanmar’s military authorities after the February 2021 coup, when the military was carrying out widespread abuses against civilians.

Telenor said in a stock-exchange announcement that the company had been charged in both investigations. It said, however, that no individuals had been charged or were under investigation and that it was cooperating with the authorities.

The Kripos investigation covers the period from the military takeover on February 1, 2021, until Telenor completed its withdrawal from Myanmar in March 2022. Investigators are examining whether the company’s conduct in responding to military demands for customer information could amount to complicity in crimes against humanity.

According to DigWatch, the investigations also highlight wider questions over how telecommunications companies should handle customer data and surveillance technology when operating under governments accused of widespread human rights violations.

The second investigation, led by PST, concerns Telenor’s sale of its Myanmar business. Norwegian authorities are examining whether surveillance equipment transferred as part of the transaction was covered by Norway’s sanctions rules and whether the required authorisation had been obtained.

Norwegian parliamentary documents say Telenor informed the Foreign Ministry in December 2020 that its Myanmar subsidiary had installed and tested equipment linked to a lawful intercept gateway. The Foreign Ministry subsequently told the company that it would not authorize the supply of equipment or services connected to communications surveillance under Norway’s sanctions regime.

The Foreign Ministry reported Telenor to police in June 2023 over a possible breach involving communications-surveillance equipment and related technical assistance or services.

Telenor agreed in July 2021 to sell its Myanmar operation to M1 Group and completed its exit from the country in March 2022. The company had previously said that remaining in Myanmar would require the activation of interception equipment for use by authorities.

Telenor said the equipment had not been activated and would not be activated voluntarily. It argued that conflicting local requirements, international law, human rights principles and concerns over employee safety had made continued operations increasingly difficult.

The handling of customer information has also come under scrutiny. Parliamentary documents say Telenor informed the Norwegian Foreign Ministry in February 2022 that it was facing difficulties adequately protecting customer data in Myanmar. Later that month, the company said it had received orders from military authorities to provide historical data.

Telenor has described the information as metadata and said its decisions also had to consider the potential consequences for employees who refused military orders. The company has argued that deleting historical data could have been detected and potentially exposed staff to serious consequences.

The Norwegian parliament has separately scrutinized the government's management of its ownership in Telenor in connection with the company's Myanmar operations. Parliament has also asked the Office of the Auditor General to investigate state ownership management related to Telenor's activities in Myanmar between 2013 and 2022.

The investigations could have broader implications for international telecommunications companies operating in conflict zones and under authoritarian governments. They raise questions about corporate responsibility when companies face demands from security authorities for access to communications data while also being bound by domestic sanctions rules and international human rights standards.

BOB Post