Myanmar requested data from a Norwegian telecoms firm. Months later, an activist was dead

The email landed in the inbox of the Norwegian telecommunications giant’s head office in Myanmar at 1.51pm on 31 October 2021. Myanmar’s ministry of communications was requesting the call logs of six of Telenor’s customers on grounds of national security. 

Ten months after ousting the country’s civilian government, the ruling junta was hunting down its opponents as it sought to smother resistance against the coup.

Phyo Zeya Thaw, a hip-hop artist and one of the most recognisable figures in Myanmar’s pro-democracy movement, had been on the run for months, moving from one safe house to another and changing SIM cards to cover his tracks. 

Some three weeks after the email, in a safe house on the outskirts of Yangon, the 40 year-old paused for lunch. He had been up since dawn, coordinating with fellow members of the resistance to the junta. Meanwhile, Thazin Nyunt Aung had prepared one of his favourite meals: pork ribs and rice.

It was 18 November 2021 — Full Moon Day at the end of the rainy season. Typically, families across Myanmar would celebrate by sharing meals, lighting lanterns and visiting pagodas. But that year, festivities were muted by martial law.

As he sat down to eat, Zeya Thaw said they would have to move again soon. “He just told me that we need to move to a new place,” Thazin recalled. “[He said] we’ll talk about that after lunch”.

They never got the chance. 

A military convoy was already en route to the Dagon Seikkan township where they were hiding.

By the time they realised what was happening, the complex was surrounded. From the window of the 10th floor apartment, Thazin could see the military vehicles below. “If we had known they were coming to arrest us, we would have found a way to escape,” said Thazin.

Within minutes, armed men smashed down the door and swarmed the apartment. Zeya Thaw was seized and taken away.

How had they been found? Had someone betrayed them? Alone in the ransacked apartment, Thazin’s mind raced with theories.

What she didn’t know then was that Zeya Thaw’s call records had been shared with the junta by a telecommunications company majority-owned by the Norwegian state.

The company, Telenor, had entered Myanmar seven years earlier as the ruling generals opened up the economy and implemented a “seven-step roadmap to a discipline-­flourishing multiparty democracy”. Five decades of military dictatorship had turned Myanmar into one of the poorest and most isolated countries in the world.

The three blue petals of the Telenor logo soon became an emblem of the country’s liberalisation. But the company’s foray into Myanmar was fraught with risk.

When the generals reversed course in 2021, detaining state counsellor Aung San Suu Kyi and imposing a state of emergency, Telenor was caught between corporate responsibility and the demands of an authoritarian junta that wanted control over its customers.

Five years on, the company is being sued by customers who accuse it of helping the junta to persecute its opponents.

“What happened in Myanmar is tragic,” Telenor said in response to questions from The Observer. “It is terrible if data from Telenor Myanmar has been misused by the authorities. However, it is solely the military authorities in Myanmar who are responsible for how they treat their own population. Neither Telenor Myanmar, Telenor nor any other civilian organisation has that responsibility.”

The king and queen of Norway stood clapping vigorously as the birdlike woman walked up to the rostrum in Oslo City Hall in June 2012. Aung San Suu Kyi had won the Nobel peace prize more than two decades earlier, but only now was she free to deliver her lecture. The military had released her from house arrest and allowed her to travel as it engineered a transition to a quasi civilian government.

“It is because of recent changes in my country that I am with you today,” Suu Kyi said when the applause died down. “The endeavours of those who believe in democracy and human rights are beginning to bear fruit in Burma.”

Off stage, she was accompanied by Zeya Thaw on the European tour. He too had been released from prison the previous year after serving four years for holding a small amount of foreign currency and forming an illegal organisation. As part of the four-piece hip-hop group Acid, he had founded a collective of rappers, street artists and activists who used music, graffiti, and clandestine campaigns to mobilise young people against military rule.

“While I was in prison, I reconsidered some of my past actions and I felt very uneasy,” he said in an interview several months after his release. “I don’t feel that I’ve used my full capabilities to help the country.”

Then 30, Zeya Thaw traded his streetwear for traditional Burmese attire and threw himself into politics, winning a seat in the 2012 byelections for Suu Kyi’s National League of Democracy (NLD) party.

Things were changing. Musicians were no longer required to submit songs to the Lyrics Scrutiny and Registration Committee. A 25-year ban on public gatherings of more than five people was lifted. The US and EU rewarded the junta with sanctions relief, opening the door to foreign investment.

Telecommunications firms vied for the opportunity to enter one of the world’s last untapped mobile phone markets. Out of a population of almost 60 million, fewer than one in 10 people in Myanmar had access to a phone. Telenor won one of two licences in what it described as the world’s toughest licensing competition.

“We thought it was someone we could trust,” said Thazin, who got her first mobile phone in 2012 when she was 30 years old.

“This is the start of an exciting journey in Myanmar’s development,” said Jon Fredrik Baksaas, president and CEO of Telenor Group.

Until then, state-owned MPT had been the only operator in Myanmar. The assumption was that authorities were listening in on calls, and activists avoided discussing sensitive topics over the phone. Now they began to speak more openly. “It was really an incredible moment of freedom,” said Thazin. “Those were the golden days.”

On a state visit to Myanmar in December 2014, the king and queen of Norway visited Telenor House, the company’s 13-storey headquarters in Yangon. “We are aware that you will encounter difficulties in your process of transition,” King Harald told officials, diplomats and students in a speech at Yangon University, vowing to be “a true and honest friend” of Myanmar.

While reforms lifted Yangon and other cities, ethnic conflicts festered in the country’s borderlands. In 2017, the military attacked hundreds of villages in Rakhine state, killing thousands of Rohingya Muslims and driving 700,000 into neighbouring Bangladesh in “clearance operations” that led to Myanmar being accused of genocide before the International Court of Justice.

In 2019, as violence escalated, Myanmar’s ministry of telecommunications ordered mobile phone operators to shut down the internet in Rakhine and Chin states “to maintain law and stability”. Telenor complied, while expressing “grave concern”. Yet, business was good. Telenor’s revenue from Myanmar topped $800m (£605m) in 2020. By then the company had more than 16 million customers across the country.

The NLD won an even bigger landslide that year. Zeya Thaw helped with the campaign but didn’t run; the transition to democracy appeared to be on track, and he wanted to get back to music, Thazin said. “He decided to take a break from politics.”

Their relationship began around that time, though they had known each other for years from the hip-hop scene. Thazin worked as a sound engineer in the studio where Zeya Thaw recorded, and was a rapper in her own right. As one half of Myanmar’s first female rap duo, YAK, she challenged traditional gender norms and promoted freedom of expression.

Zeya Thaw began planning a comeback concert with the three remaining members of Acid; they planned to perform some of their old hits and were working on a new track. Preparations went ahead even as the military disputed the results of the election, alleging fraud. “He was already choosing what to wear and he even had his hair cut,” Thazin said. The gig would be sponsored by Telenor.

At around 5am, five days before the concert, Zeya Thaw woke Thazin. A coup was underway. In a dawn raid, the military detained Suu Kyi and other senior NLD officials, declaring a state of emergency. It was 1 February 2021.

Hundreds of thousands of people took to the streets in protest. In a photograph, Zeya Thaw appears holding a megaphone in one hand and making a three-finger salute with the other – a gesture adopted by pro-democracy protesters across Asia from The Hunger Games films as a symbol of revolt against oppressive rule.

“If we are all united, the regime will be gone soon,” Zeya Thaw said. “Our cause must prevail.”

As protests swelled, the military ordered Telenor and other operators to shut down the internet and block Facebook, Twitter and Instagram. Telenor challenged the decision, saying it contradicted international human rights law, but complied.

“We are facing many dilemmas,” then-chief executive Sigve Brekke told Reuters in May. Armed soldiers raided company offices. Base stations were mined.

In July, the company announced plans to sell its Myanmar subsidiary to the Lebanese company M1 Group. A spokesman for Telenor said all options had been assessed, including sabotaging equipment, immediately shutting down operations and continuing under junta control. “It became clear early on that an exit was the least detrimental solution.”

To Thazin, it felt “like a stab in the back”. She had gone underground with Zeya Thaw as the military cracked down, killing hundreds of people. “We felt like we are being betrayed by our friends.”

Other opponents of the junta were also alarmed. Ko Ye, the former national coordinator for the Myanmar Alliance for Transparency and Accountability, had gone into hiding with his wife and two children following the coup. He still trusted Telenor, but not M1. If the sale went ahead, all his data – physical addresses, bank accounts, e-wallets, ID numbers, location data, and call logs – would be handed over to a company that had done business in war-torn jurisdictions such as Sudan, Yemen and Syria with little apparent regard for human rights.

After reaching safety in Thailand, Ko Ye appealed to the king of Norway in an open letter signed by 464 civil society organisations. “We see this sale as not only the disposal of Telenor’s business in our country. It is also the disposal of our lives,” read the letter dated 12 July 2021. “Telenor and the Norwegian government are not being a friend of Myanmar, as King Harald promised.”

The letter was forwarded to Norway’s Ministry of Trade, Industry and Fisheries, which manages the state’s stake in Telenor. “As a shareholder, we expect that the companies with a state ownership share act responsibly in their business conduct,” then-minister Iselin Nybø responded. Company operations, however, were for the board of directors and management: “Questions related to the investment should therefore be raised with Telenor.”

Ko Ye sent an email to Telenor days later with the subject line: Urgent request for erasure of personal data. It took the customer care team two weeks to respond: “The current requirement in Myanmar is that an operator needs to store call data records for a minimum of five years,” read the email. Customers in Myanmar – unlike those in Europe and the UK – did not enjoy the “right to be forgotten” under the General Data Protection Regulation (GDPR).

“We hope this clarifies your request and that Telenor Myanmar will have your continued support going forward.”

The bruised and dishevelled man in the photograph published by Myanmar’s interior ministry was barely recognisable as Zeya Thaw.

Dressed in a striped top, he kneeled – hands on head – with two pistols, an M16, phones, laptops, wads of cash and bullets laid out neatly on the floor in front of him. The junta accused him of plotting to assassinate members of the military-linked USDP party.

Among the other items the military said it had seized from the safe house were “women’s accessories” belonging to Thazin, who had “helped in writing party victory songs and short films for the NLD party”.

She fled to Thailand about one month after Zeya Thaw’s arrest.

For Telenor, getting out of Myanmar was proving difficult. The military authorities confiscated several executives’ passports and blocked the sale to M1 until the Lebanese company agreed to partner with the junta-linked conglomerate Shwe Byain Phyu Group. Meanwhile, pressure was mounting on Telenor to activate intercept equipment in violation of Norwegian and EU sanctions.

“There are no solutions without negative consequences,” Telenor said in a statement as the sale was finalised in early 2022. Deleting customer data would involve its employees breaking the law, putting them “at considerable risk”, it added.

Having invested 5.3bn Norwegian krona (about $535.5m) in Myanmar, Telenor sold its business for just $105m.

Around the time Telenor left, a military tribunal sentenced Zeya Thaw to death. In Insein prison, built to a panopticon design by British colonial authorities in the 19th century, he appealed the sentence. It was rejected.

In a Zoom call with his mother, he asked for reading glasses, a dictionary and some money, she told the BBC’s Burmese service. When she went to take them to deliver them days later, Zeya Thaw and three other pro-democracy activists were already dead.

“The punishment has been carried out according to prison procedures,” read a report in state media on 25 July 2022. Western countries condemned the “reprehensible acts of violence” in a statement signed by more than half a dozen foreign ministers including Norway’s.

Three years on, in 2025, Ko Ye was still struggling for accountability. A data protection case in Norway appeared to be going nowhere. A mediation process with Telenor had broken down the previous year.

Then a whistleblower came forward with documents that cast a new and damning light on Telenor’s conduct. In internal memos seen by The Observer, the company assessed each of the Myanmar authorities’ requests to share specific customers’ data: should Telenor comply?

“Disclosure of such information… will likely lead to arrest,” the local sustainability team repeatedly assessed, recommending that Telenor decline the request. If compelled, however, the company should notify the customer to mitigate risk.  

The local legal department took a different view. Section 77 of Myanmar’s Telecommunications Law granted the government broad powers to suspend services, intercept communications, and control equipment in an “emergency situation”; Telenor was bound to comply.

The request was sent up to company headquarters in Norway, given the “extremely high impact” of the decision. Time after time, senior executives approved.

One of the requests was for all ingoing and outgoing calls to the number 09794063471 for the month of October 2021. Like all the assessments, it was marked “secret”. The CEO of Telenor Myanmar Jon Omund Revhaug was copied in. With the approval of Telenor in Oslo, Zeya Thaw’s call data was shared with the junta.

In the nine months before Telenor quit Myanmar, the junta requested the data of 1,253 numbers. Not once did the company refuse. Customers received no warning. “In Myanmar, refusing requests from the military authorities could, in the worst case, have led to imprisonment, torture or the death penalty,” a company spokesman said. Martial law made it illegal to notify customers, and doing so could have resulted in “serious consequences” for employees.

The call logs Telenor shared contained the location of both caller and recipient to the nearest cell tower, effectively providing the junta with a map of dissent. As many as 100,000 people may have been exposed, said Joseph Wilde-Ramsing, advocacy director at the Center for Research on Multinational Corporations (Somo), which has been at the forefront of efforts to hold Telenor accountable.

Among the call logs requested by the junta were two corresponding to close associates of Suu Kyi. The data would probably be used to support the military’s efforts to prosecute her for corruption, the company assessed. It shared the records anyway.

The next year, a military court sentenced Suu Kyi to an additional seven years on corruption charges, taking her overall jail time to more than three decades. Rights groups and western governments dismissed the trial as a sham.

At least one of the individuals whose data was shared with the military worked for Telenor, Wilde-Ramsing said. Other employees were targeted by opponents of the military because the company was perceived to be collaborating with the authorities, he added.

An independent expert body responsible for promoting responsible business conduct found that Telenor’s decision to prioritise the safety of its 734 Myanmar-based employees over that of customers was not in line with OECD guidelines. The company did not carry out sufficient due diligence in relation to its exit from Myanmar, the National Contact Point in Norway concluded last year. If the risk of a coup had been taken into consideration, Telenor would have been better prepared to deal with the fallout.

The revelations, first made public by Norway’s public broadcaster NRK, began to ruffle politicians. “We have to find out if the government is to blame for accepting or in any way contributing to human rights violations,” the head of the Control and Constitutional Affairs Committee in the Norwegian parliament, Per-Willy Amundsen told The Observer.

The Ministry of Trade, Fisheries and Industry refused to share communications with the committee. A parliamentary session was postponed until after the summer because of another scandal involving Norway’s Crown Princess Mette-Marit and her relationship with the late convicted sex offender Jeffrey Epstein.

Meanwhile, lawyers were building a case against Telenor, backed by dozens of civil society groups. In April they filed a civil class-action lawsuit in Norway, seeking damages for customers whose data was shared. Most of the plaintiffs are too fearful of the junta to be identified.

“It is highly likely that the junta located Thazin and Zeya Thaw’s safe house with the help of customer data,” read the writ of summons submitted to the Asker and Baerum District court in April.

Telenor disputes that its actions directly led to arrests, torture or killings.

“It really makes me so angry,” said Thazin.

In Thailand, she avoids listening to Zeya Thaw’s music and tries not to think about what happened. She still remembers her old Telenor number by heart.

Photographs by Ye Aung Thu/AFP/Getty Images; Soe Than WIN/AFP/Getty Images; Aung Shine Oo/AP; Thierry Falise/Getty Images