VPNs with servers in Cambodia

Telecommunications operators connecting to the gateway must require their users to apply and provide clear identification (art. 12). A gateway operator that fails its duties can face a restricted, suspended or revoked licence, a frozen account or fines (art. 16).

As LICADHO quotes it, art. 6 of the 2015 Law on Telecommunications requires all operators and persons involved in the sector to give the Ministry the telecommunications service data. Cambodia’s entry in the UNODC electronic-evidence fiche states that no specific legal provision sets a mandatory retention period for electronic data. Whether either instrument reaches a VPN operator is not established.

The sub-decree directs gateway operators to cooperate with the authorities to “block and disconnect all network connections that adversely affect national revenue, safety, social order, dignity, culture, traditions, and customs”. According to LICADHO’s analysis, article 66 of the Law on Telecommunications prohibits telecommunications activity that may affect public order or national security, and article 80 sets seven to fifteen years’ imprisonment for establishing, installing or using equipment where this leads to national insecurity.

According to submissions to the UN Human Rights Committee by the ICJ and by ARTICLE 19, the Criminal Code punishes insulting the King (art. 437 bis) with one to five years’ imprisonment, a fine of two to ten million riel, or both; direct incitement to commit a felony or to disturb social security (arts. 494–495) with six months to two years and a fine of one to four million riel.

The same submissions list defamation and insult (arts. 305–310), including insult of a public official (art. 502). The ICJ records that the authorities have used articles 494 and 495 extensively to arrest, prosecute and convict journalists, human rights defenders and political opponents for their online expression.

According to a 2016 LICADHO analysis, the Law on Telecommunications permits secret surveillance on the approval of a “legitimate authority” that it does not define (art. 97); the same analysis reads article 6 as letting the Ministry demand user data without a warrant or other safeguard. The Code of Criminal Procedure (art. 172) requires an investigating judge’s order, stating the type of communication and the duration, for recording telephone conversations and other telecommunications.

The order of the rows is the security score, and a server’s location is not a recommendation.