Photo courtesy of Sky News
The draft of Sri Lanka’s Online Safety Act, published last week, is draconian, dangerous, and it should come as no surprise, also dumb. I’ve not studied any vocal support of the draft, but this could also be because I don’t follow Sinhala language media to the degree I used when in the country. The draft’s provisions are overbroad by design, and in some parts, indecipherable, which is even more dangerous than sections which are draconian by design. What makes no sense in the draft, makes perfect sense for those who want to use it to stifle critical dissent, given the rich expedient, and parochial interpretive leeway loosely drafted laws allow. Lastly, no proposed legislation to govern online communications in Sri Lanka, including social media, should be appreciated in a vacuum. We are a surveillance state, and despite 2022’s aragalaya, continue to be burdened with a significant, and growing democratic deficit. This foetid firmament, connected to a carceral state which over decades is infamous for extrajudicial killing, abductions, and torture, is essential to understand this draft’s potential application, and actual purpose.
In a broader reading, one finds in Sri Lanka, especially when looking at the post-aragalaya period, an enfilade of terrible drafts of laws, regulations, and proposals targeting a range of issues including countering violent extremism, and terrorism. I believe this is strategic. The architects of these drafts know that in the resulting noise of rebuttal, many also switch off because it is too much to keep pace with. This disengagement is also linked to existential woes, as real today for many, as they were last year at the height of the country’s economic implosion. The metronomic cadence of proposing bad law, after bad law can be read as strategically engineered process to foster fatigue, leading to a disengagement save for a committed few – who by this very fact are exposed to violent reprisals. Linked to this is possibly another strategy, in which a draft act or law is such an egregious, and obvious affront to fundamental rights, that the rejection of it is in fact what’s secretly desired, in order for opposing voices to be singled out as those responsible for a tragedy or calamity in the future. Under attack by an agitated, angry, and anxious constituency, a considerably weakened civil society opposition, and critique can then be more easily dismissed, and even more draconian measures hurriedly passed through parliament, in the guise of national security imperatives.
These concerns aside, the draft Online Safety Act regrettably transforms a vital, and enduringly important conversation around online harms in Sri Lanka – around which significant research already exists – into a partisan, reductive one, dominated by soundbites over substance, and posturing over principle. Without any meaningful consultation, or any other corrective measure to address a context near exclusively defined by impunity, violence, and surveillance, this draft law presents goals which are impossible to realise. Online safety never exists in a vacuum. However, this is what the Sri Lankan government would have us believe, in what’s beguilingly presented as a law to protect children, and victims of online harms. While these are highly desirable goals, the draft law is clearly a Trojan Horse for more expedient, parochial, and repressive measures, especially around electoral moments.
There are fundamental issues around the proposed legislation. For starters, over criminalisation in Sri Lanka is not a hypothetical risk. The weaponisation of ICCPR during, and after the aragalaya, is a stark reminder that legislation originally enacted, and designed to protect fundamental rights is, in Sri Lanka, perversely used to undermine them, incarcerate activists, and scare many more around the possibility of a similar or worse fate. What this draft law will provide is an unprecedented foundation for the state to hunt not just dissidents, but if found to be inconvenient or influential in ways that are problematic to autocratic fiat, cartoonists, satirists, writers, illustrators, digital creators, and anyone who comments on social media. In fact, going after students, pensioners, parents, teachers and those who aren’t associated with NGO networks, which the draft law will allow, helps with chilling effects far stronger than targeting well-known civil society activists. The arbitrary application, and cruelty is the point. While the ambiguity in the draft can be attributed to ignorance, if passed in its current form, it will lead vindictive application, self-serving interpretation, and a licence to silence. Further, the draft has a profoundly misguided, and myopic understanding of enforcement, believing that a country marked by human rights abuses will be taken seriously by companies which are answerable in their own jurisdictions for aiding or abetting violence against users. While there’s understandable cynicism around whether Silicon Valley companies are meaningfully invested in upholding human rights, Sri Lanka was the first country in the world Meta conducted an independent human rights assessment on, after the anti-Muslim violence in early 2018. The company will simply not follow edicts, which aside from incompatibility with corporate responsibilities, and due diligence measures, risk another front page news story in the New York Times like in April 2018, flagging its role in actions to silence, incarcerate, kill, torture, or abduct users of its products. No intermediary will be receptive to what’s proposed in this draft act.
What the draft also risks more fully realising are repressive measures successive Rajapaksa governments introduced. As far back as 2009, media reports captured what the Mahinda Rajapaksa government did to Sarath Fonseka, and “even ministers, officers at the Defence Ministry, and senior Presidential aides who are known to have associated with Fonseka”. In 2010, the first arrests were made “for spreading false rumours by SMS”, and Facebook. In January that same year, the then Defence spokesperson Keheliya Rambukwella noted that “the Government would not hesitate to arrest anyone whose conduct would be detrimental to national security”, and that “anyone who engaged in campaigns against national security and Sri Lanka’s sovereignty by sending false messages via mobile phones would be arrested forthwith and be dealt with according to the law.” I have carefully studied every effort to introduce online regulation or legislation to purportedly address pornography, criminality, or incitement to hate, and harm since 2005. Not one has been in good faith, based on liberal democratic fundamentals, or substantively robust.
The current draft enters the domain of farce when it suggests measures to address bots and coordinated inauthentic behaviours (CIB). I’ve studied, including for doctoral research, CIB to a degree that prefaced what Meta itself established only after the 6 January Capitol Hill insurrection were ways its products, and platforms were instrumentalised for offline violence. In other words, Sri Lanka was a Petrie dish for highly sophisticated strategies deployed later in the West. Identifying these patterns requires a technical expertise that is extremely country, language, content, and context specific, as well as platform dependent. CIB on Facebook Pages is different to CIB on Instagram. CIB on Meta is different to CIB on Twitter. There is no domain or subject matter expertise in the country I know of to service just this horribly drafted aspect of the draft law, which if inappropriately flagged or loosely defined, invariably leads to vast swathes of users being targeted with something they may not be guilty of, or worse, be inadvertently part of, but led by other, state-sponsored actors.
This too is not a hypothetical. Namal Rajapaksa was the first in Sri Lanka to use bots, in co-authored research that as far back as 2018 noted that “the kind of threat social media that’s weaponised to promote a particular political ideology, idea, person, party or process is not something Sri Lanka’s government writ large, and in particular the Elections Department or any independent election violence monitoring body to date has even imagined, leave aside developed the technical capacity to monitor and address.” CIB was studied in March 2018’s riots, in the aftermath of the Easter Sunday bombings, leading up the Presidential election in 2019, and during the aragalaya, to undermine the movement’s messaging, organic nature, and historic significance. In the first half of 2020, coordinated campaigns, generating significant engagement on Facebook, saw an unprecedented production rate. The sustained thrust of this content was to promote the President and undermine the role of Parliament and elections. Repeated posts on Facebook tried to whip up public support for doing away with parliamentary elections, suggesting that military rule (and militarisation), led by the incumbent President, sufficed. The engagement, and virality were significant.
Every instance of CIB studied since 2014, in some fashion, props up the Rajapaksas or SLPP, with leading media platforms, and social media influencers partial to the family, and their respective social media networks, acting as proxies. From baby snakes, to painting public murals, the hyper-partisan agenda-setting power of CIB on social media, serving a Sinhala-Buddhist state’s structural racism, is well established. In fact, my on-going, detailed study of disinformation in New Zealand has yet to surface anything remotely approximating the level of sophistication around CIB present, and studied years ago in Sri Lanka. This is how far advanced architectures to bring about truth decay, and information disorders are in our country, leading to the endemicity of disinformation aiding autocratic capture, even after the aragalaya. To believe the application of the proposed Act will be in a manner that meaningfully addresses this propaganda architecture is frankly farcical.
All this is further complicated by a surveillance apparatus I’ve carefully studied the expansion in Sri Lanka for nearly fifteen years, with the first media reports of alleged Chinese involvement in social media surveillance going back to 2010. In March 2018, Meiya Pico – a Chinese digital forensics company, whose technology has already been used to target Uyghurs – held a workshop in Colombo for 60 military, and police personnel. As noted by the Australian Strategic Policy Institute, “the workshop covered digital forensics and the operation of Meiya Pico’s “smart forensics solution”. Attendees included members of Sri Lanka’s army, navy, air force, CERT and emergency response department.” Why? Why them? Why then? Umbilically connected to this, and much more, are China’s under-appreciated influence operations (IO) in Sri Lanka. Using a combination of authentic, and sock-puppet accounts on social media, connected to ‘wolf warrior diplomacy’, China’s manipulation of social media in the country is vastly more strategic, and sophisticated than any other leading foreign power. The draft law will address none of this.
What I’ve not studied any comment on is how the draft law is in spirit, and form xeroxed from Singapore’s POFMA, which as Human Rights Watch noted “permits a single government minister to declare that information posted online is “false,” and to order the content’s “correction” or removal if deemed to be in the public interest”.
Sri Lanka’s draft law notes “A digital advertising intermediary must take reasonable steps (both in and outside Sri Lanka) to ensure that, after a prescribed period commencing on the date a declaration made under section 32 comes into effect, any paid content that it includes or causes to be included on a declared online location is not communicated in Sri Lanka on the declared online location.” Singapore’s POFMA notes, “A prescribed digital advertising intermediary or prescribed internet intermediary must take reasonable steps (both in and outside Singapore) to ensure that it does not, when acting as a digital advertising intermediary or an internet intermediary, facilitate the communication in Singapore of any paid content that gives publicity to or otherwise promotes an online location that includes the statement or material that is the subject of a Part 3 Direction or Part 4 Direction.”
This isn’t the only example of what is clearly a thinly veiled attempt to simplistically import Singapore’s legislation into Sri Lanka, glossing over vastly different political, technological, geo-strategic, social, historical, demographic, and democratic factors. What’s problematic in Singapore will be catastrophic for human rights in Sri Lanka.
Others have already flagged how the draft law can (and I’d argue, inevitably will) be used to target satirists, and investigative journalists. There are a myriad of other concerns with this proposed legislation, significantly adding to the democratic backsliding in the country, now engineered by an executive president propped up by, and benefits from the inheritance of persuasive influence, and pervasive surveillance infrastructures. Passing this this law will significantly augment risks civil society already face. It will also serve to further weaponise legal frameworks, through the state-sanctioned suppression of dissent at an unprecedented scope, and scale. I can’t imagine anything meaningful resulting from this draft as the basis of conversations around online harms. It has no place in the realisation of Sri Lanka’s democratic potential, and must be firmly rejected.