An activist group that advocates for information transparency released a stash of documents, revealing the corporate ownership of around 120,000 registered companies in Myanmar on Saturday. The documents, dubbed “Myanmar Financials,” were managed and maintained by two offices under the country’s investment promotion body, the Directorate of Investment and Company Administration (DICA).
The activist group Distributed Denial of Secrets, or DDoSecrets, operates a WikiLeaks-style website that published the 330.5 GB data set. DDoSecrets claims that the DICA documents were handed to them by donk_enby, a hacker who is known for archiving and scraping the data of Parler, an alt-tech social network that is popular among conservatives and conspiracy theorists in the US.
The two DICA websites in question are Myanmar Companies Online (MyCO) and Beneficial Ownership Disclosure, and the documents acquired by DDoSecrets include registry information, incorporation paperwork, and ID scans of officers. There are also more than 3,000 public tenders, as well as beneficial ownership disclosures of the gem and mining industries.
Justice For Myanmar (JFM), an activist group that is critical of Myanmar’s military, combed through the files on Saturday and located details of the structure and operations of the military-owned Myanmar Economic Holdings Limited (MEHL), a conglomerate whose activities finances the country’s military. MEHL’s businesses span many sectors, including mining, beer, tobacco, textiles, and banking, according to Amnesty International.
“We consider that public access to this dataset will allow the public to examine the actions of certain people in Myanmar,” DDoSecrets’s spokesperson told KrASIA.
Founded in 2018, the whistleblower site has hosted files from an array of hacks and leaks, carrying documents and information related to Russian oligarchs, corporate registries in the Bahamas, the US government’s case against Wikileaks founder Julian Assange, Parler, and more. Last year, Twitter banned the group after DDoSecrets released 269 GB of internal data from US law enforcement.
“The Bahamas corporate registry publication was useful for finding tax evaders in Europe. We expect the Myanmar corporate registry to be used in a similar manner, for long-term research and journalism,” the spokesperson of DDoSecrets said to KrASIA.
[Thread] New major release of data by @DDoSecret. Biggest leak in #Myanmar history from DICA. The released docs incl. incorporation docs & shareholder details on every registered company, incl. those controlled by and associated with the Myanmar military ??https://t.co/Q7CcVt2QOQ pic.twitter.com/RUzmfZxMgT
— Justice For Myanmar (@JusticeMyanmar) February 20, 2021
Reacting to the data leak, a cybersecurity expert told KrASIA on the condition of anonymity that the data in Myanmar Financials does not contain any sensitive personal details.
“Data leaks are nothing new as most Myanmar websites do not take security precautions to secure the data. Most data are general personal data, for example data from MyCo concerning company registration. It’s easily extractable as there are no security provisions. It is not an attack, since the data is easily available. Anyone who bothers to look can get it,” the expert said.
In September 2020, a poorly designed web portal for Myanmar citizens to acquire COVID-19 QR passes during lockdowns was easily exploited. Users were able to access and edit information in other people’s accounts by changing the last few digits in the URL.
Internet shut down for eighth night
Now, a group of activists are calling on Google to “crack down” against the coup leaders who are using the company’s services, according to a report published by Business Insider.
On Sunday, Facebook took down the official page of Myanmar’s military, “Tatmadaw True News Information Team Page” saying that it violates community standards that prohibit “incitement of violence and coordinating harm,” Reuters reported.
As of the time of publication, Myanmar has experienced the eighth night of internet blackouts from 1:00 a.m. to 9:00 a.m., according to internet monitoring service NetBlocks. “A week of curfew-style blackouts have silenced reporting as anti-coup protests are met with deadly force,” the service said on Twitter.
