At 1.51pm on 31 October 2021, an email arrived at the Myanmar head office of Telenor, the Norwegian state-backed telecoms company, requesting the call logs of six customers on national security grounds, The Observer reports. Ten months after seizing power in a coup, Myanmar’s military junta was hunting down opponents of the regime, among them Phyo Zeya Thaw, a hip-hop artist and prominent pro-democracy figure who had spent months moving between safe houses and switching SIM cards to avoid detection.
Three weeks after that email, on 18 November 2021, Zeya Thaw sat down for lunch in a safe house on the outskirts of Yangon with his partner, Thazin Nyunt Aung, who had prepared his favourite meal. He mentioned they would need to move again soon. They never got the chance. A military convoy was already approaching the building. Within minutes, Thazin told the paper, armed men broke down the door and took Zeya Thaw away. From the tenth-floor window, she had watched the vehicles surround the complex below, certain that had they known the raid was coming, they would have fled.
What Thazin did not know at the time, according to The Observer’s investigation, was that Zeya Thaw’s call records had already been handed to the junta by Telenor, a company majority-owned by the Norwegian state. Telenor had entered Myanmar seven years earlier, during a period of liberalisation under the military’s so-called roadmap toward multiparty democracy, becoming one of two operators awarded a licence in what it described as the world’s toughest competitive bidding process. At the time, fewer than one in ten of Myanmar’s nearly 60 million people had access to a phone. Telenor’s logo became, in the paper’s account, a symbol of the country’s opening to the world.
The paper traces Zeya Thaw’s own path through that liberalisation. Released from prison in 2011 after serving four years for possessing foreign currency and forming an illegal organisation, he had been part of the hip-hop group Acid, using music and street art to mobilise young people against military rule. He later entered politics, winning a parliamentary seat in 2012 for Aung San Suu Kyi’s National League for Democracy, and toured Europe with Suu Kyi when she finally delivered her long-delayed Nobel lecture in Oslo. Thazin, a sound engineer and rapper in her own right as one half of Myanmar’s first female rap duo, had known him for years through the music scene before their relationship began.
By 2020, with elections approaching, Zeya Thaw had stepped back from politics to focus on a musical comeback with Acid, sponsored by Telenor. Those plans collapsed on 1 February 2021, when the military detained Suu Kyi and declared a state of emergency. Zeya Thaw became a visible face of the protest movement that followed, photographed with a megaphone and the three-finger salute adopted by pro-democracy demonstrators. As protests grew, the junta ordered Telenor and other operators to cut internet access and block social media platforms. Telenor objected on human rights grounds but complied, and by July 2021 had announced plans to sell its Myanmar operations to Lebanon’s M1 Group, a move the company later described as the least damaging of the options it had considered, including sabotaging its own equipment.
According to the report, that decision alarmed other junta opponents in hiding, including Ko Ye, a civil society figure who feared that a sale to M1 would place sensitive customer data in the hands of a company with a history of operating in conflict zones with little regard for human rights. Ko Ye organised an open letter to Norway’s king, signed by hundreds of civil society organisations, warning that the sale amounted to the disposal of their lives, not just Telenor’s business. Norway’s trade ministry responded that operational questions were matters for Telenor’s board, not the state. When Ko Ye separately asked Telenor to erase his personal data, the company told him Myanmar law required retention of call records for five years, and that customers there, unlike those in Europe, had no right to be forgotten under GDPR.
Zeya Thaw was arrested weeks later. State media published images of him kneeling with weapons and cash the junta said had been seized from the safe house, accusing him of plotting an assassination. He was tried by a military tribunal, sentenced to death, and executed in July 2022 alongside three other pro-democracy activists, prompting condemnation from Western governments, including Norway. Telenor had by then completed its exit from Myanmar, selling a business it had invested more than half a billion dollars in for just $105 million, after junta authorities confiscated executive passports and forced the deal to include a junta-linked local partner.
The Observer’s investigation, drawing on internal documents brought forward by a whistleblower, found that Telenor’s own sustainability team in Myanmar repeatedly warned that handing over specific customers’ data was likely to lead to arrest and recommended refusal, while the legal department maintained the company was bound to comply under Myanmar’s telecommunications law. Senior executives in Norway approved each request regardless, including the one covering Zeya Thaw’s number, copied to Telenor Myanmar’s chief executive. Over nine months, the junta requested data on 1,253 numbers, and Telenor never refused, including requests tied to close associates of Suu Kyi that the company itself assessed could support corruption charges against her. The location data attached to these call logs, accurate to the nearest cell tower, may have exposed as many as 100,000 people, according to Joseph Wilde-Ramsing of the Centre for Research on Multinational Corporations, cited in the report.
Norway’s National Contact Point, an independent body overseeing corporate conduct, concluded last year that Telenor’s choice to prioritise the safety of its own staff over its customers fell short of OECD guidelines, and that the company failed to carry out adequate due diligence ahead of its exit. Parliamentary scrutiny has stalled, with the trade ministry declining to share related communications and a session postponed due to an unrelated political scandal. Telenor disputes that its conduct directly led to arrests, torture or killings, telling The Observer that responsibility for how Myanmar’s military treats its own population lies solely with the authorities there. A civil class-action lawsuit, filed in Norway in April on behalf of customers whose data was shared, argues it is highly likely the junta located Zeya Thaw and Thazin’s safe house with the help of that data. Most plaintiffs remain too afraid of the junta to be publicly identified. Thazin, now in Thailand, told the paper she avoids listening to Zeya Thaw’s music, though she still remembers her old Telenor number by heart.
