WARNING: GRAPHIC - This report contains graphic content. While efforts have been made to blur details, the report contains information which some readers may find distressing.

Key Event Details

• Incident Location: Pa Zi Gyi village (ပဇီကြီးရွာ), Kanbalu township (ကန့်ဘလူမြို့နယ်), Sagaing region (စစ်ကိုင်းတိုင်းဒေသကြီး) [23.004859, 95.920608].

• Date/Time of Incident:

  • Airstrikes on 11 April 2023

  • Fires and reported airstrike on 20 April 2023

  • Multiple doxxing incidents and subsequent arrests between 12 - 30 April 2023

• Alleged Perpetrator(s) and/or Involvement:

  • Myanmar Air Force (MAF)

  • State Administration Council (SAC)

  • Pro-SAC Telegram Channels

• Summary of Investigation

  • Myanmar Witness has investigated and geolocated various incidents in Pa Zi Gyi village, and concluded that an airstrike took place on 11 April 2023, and fires occurred on 20 April 2023.

  • Pro-SAC Telegram channels have doxxed social media users who showed support for the victims of the attack (support was shown largely through the ‘black profile’ campaign, whereby users posted and shared content on social media showing sympathy for the airstrike victims).

  • Between 13 and 30 April 2023, 68 arrests were announced in the state-owned Myanma Alinn newspaper, and one by the BBC. Myanmar Witness has confirmed that 11 of these individuals were previously doxxed by pro-SAC Telegram channels.

  • This analysis revealed that pro-SAC Telegram channels’ intelligence gathering is extensive both online and on-the-ground. The findings indicate a notable coordination between the two domains, particularly regarding the utilisation of on-the-ground intelligence within online doxxing activity. 

  • The information collected and analysed during this investigation supports the hypothesis that pro-SAC channels are not operating individually and instead are engaged in coordinated doxxing activities. 

UPDATE: Since the investigation took place, Myanmar Witness continued to monitor events related to the doxxing of these individuals and the Kanbalu airstrike. Five individuals were released from detention in July. The report has been updated to include these developments.

Executive Summary

On 11 April 2023, airstrikes hit Pa Zi Gyi village (ပဇီကြီးရွာ), Kanbalu township (ကန့်ဘလူမြို့နယ်), Sagaing region (စစ်ကိုင်းတိုင်းဒေသကြီး) causing loss of life, damage and destruction to buildings and vehicles. The location has been geolocated and verified by Myanmar Witness. CNN reported that at least 165 people were killed due to the airstrike; other sources reported the exact number of casualties between 50 and 171. An additional airstrike and fire in Pa Zi Gyi on 20 April 2023 was reported by multiple sources, including Khit Thit, Radio Free Asia and Voice of America. The date of the fires was confirmed by Myanmar Witness using Nasa’s Fire Information Resource Management System (FIRMS).

The attack spurred an emotional response from Myanmar social media users. Individuals expressed sympathy for the victims through the ‘black profile’ campaign, and by posting and sharing content condemning the attack. The ‘black profile’ campaign is a spontaneous response observed by Myanmar Witness, where social media users, particularly on Facebook, changed their profile pictures to black, and wrote and shared posts showing support for the victims of the airstrikes. 

Following the airstrikes and public outcry online, Myanmar Witness witnessed a spike in doxxing (sharing a person’s private information without their consent) by pro-SAC Telegram channels. The channels called for the torture and arrest of social media users who had expressed sympathy for the airstrike victims, labelling these users with various derogatory phrases, and accusing them of supporting terrorism. Examples of these posts are included within this report. Myanmar Witness’ monitoring and research show that there were at least 20 people doxxed for this reason.

Subsequently, as announced in the state-owned Myanma Alinn newspaper, the SAC confirmed the arrest of 68 people and BBC reported the arrest of an additional local celebrity between 13 and 30 April 2023. Of the 69, Myanmar Witness found that 11 people had been previously doxxed at least once by pro-SAC channels in relation to the airstrikes in Kanbalu.

Myanmar Witness’ quantitative and qualitative analyses reveal:

1. A systematic doxxing response by pro-SAC Telegram channels against the Facebook users who participated in the ‘black profile’ campaign following the Kanbalu airstrikes.

2. A crackdown by the SAC through the arrest and charging of civilians for showing support for the pro-democratic movement on Facebook, Telegram and Tik Tok.

3. 11 occasions where an individual was doxxed preceding their arrest.

4. Persistent and organised monitoring by pro-SAC channels of pro-democracy supporters online activity. This was reinforced by continued reporting on doxxed individuals following SAC action.

5. Evidence of coordinated behaviour between the pro-SAC channels which engaged in online doxxing and on-the-ground surveillance. This signals that the pro-SAC Telegram channels obtain information from individuals who are physically on-the-ground.

The context: airstrikes in Kanbalu

On 11 and 20 April 2023, multiple airstrikes were carried out by the Myanmar Air Force (MAF) targeting Pa Zi Gyi village, Kanbalu township, Sagaing region. The target of the airstrike was a civilian building, where an opening event of a people’s administration office — which is in alignment with National Unity Government of Myanmar (NUG) — was reportedly taking place, according to an interview with a local. The same interview states that the event was attended by 150-200 people from Pa Zi Gyi and nearby villages. CNN reported the number of casualties was at least 165, while the exact number of casualties varies between 50 and 171 across reports. The attack on 11 April was also confirmed by SAC spokesperson General Zaw Min Tun.

Following this attack, Myanmar social media users expressed their sympathy for the victims of the airstrike through the ‘black profile’ campaign: social media users changed their profile pictures to black, and shared posts showing support for the victims and condemning the attack. Since, Myanmar Witness has observed a spike in doxxing activities (sharing a person’s private information without their consent) against those who engaged in the ‘black profile’ campaign by pro-SAC Telegram channels, as this report details.

Verification of the airstrikes on 11 April 2023

Multiple airstrikes were carried out targeting Pa Zi Gyi village on 11 April 2023. Myanmar Witness has verified the occurrence of this attack through in-depth analysis of footage showing the damage (including figure 1, top). Sentinel Hub imagery also confirms changes in the area (figure 2).

Figure 1: Geolocation of the damaged area in Pa Zi Gyi [23.002921, 95.919442] (Sources have been redacted due to privacy concerns). 

Figure 2: Sentinel satellite image taken on 10 April shows the building's blue roof (left), while a satellite image taken on 20 April shows that the blue roof has disappeared (right). The two satellite images are consistent with the claim that airstrikes took place on 11 April 2023.

Myanmar Witness also verified that there was a fire in Pa Zi Gyi village on 20 April 2023, and that there was fire damage to the area (figure 3).

Figure 3: (Top) Geolocation of the damage after the fires in Pa Zi Gyi [23.004800, 95.921814]. (Source has been redacted due to privacy concerns.) (Bottom) FIRMS imagery shows high heat signatures in Pa Zi Gyi on 20 April 2023.

Doxxing and arrests following the airstrike

Shortly after the airstrike, 18 Telegram channels that regularly post pro-SAC content and narratives began doxxing a number of social media profiles, mostly from Facebook. The number of doxxing posts from the 18 channels spiked on 12 April 2023, one day after the Kanbalu airstrikes on 11 April 2023.

Doxxing Spike on Pro-SAC Channels

Figure 4 shows the average number of doxxing posts per day, per channel, for the pro-SAC Telegram channels monitored by Myanmar Witness. The value stayed around one post per day per channel until 10 April, after which it spiked to four posts per channel on 14 April. 

Myanmar Witness analysed the doxxing posts on 12 April 2023, and found that the reasons for the spike was three-fold: 

1. For showing sympathy towards the victims of the airstrike through Facebook posts and the black profile campaign; 

2. For displaying negative public sentiment regarding the SAC-sponsored Thingyan festival events (as will be discussed later in the report); and 

3. For showing general support to the pro-democratic movement.

Figure 4: Average number of documented doxxing posts per day per channel between 1 and 30 April 2023. Data was calculated by dividing the number of documented doxxing posts on each day by the number of channels that posted the doxxing content. This formulation is chosen for a meaningful comparison across dates when the total number of channels being monitored has increased over time. See the quantitative methodology section for more details.

Figure 5: Total number of documented doxxing posts related to the Kanbalu event.

When the Kanbalu-related doxxing posts are isolated, the total number of posts shows a significant number starting on 12 April 2023 (figure 5). Myanmar Witness’ monitoring shows that there are at least 59 Kanbalu-related doxxing posts between 11 April 2023 (the date of the incident) and 30 April 2023 targeting 20 individuals. The collected data reveals the significant doxxing by pro-SAC Telegram channels against Facebook users who showed support for the victims of the airstrikes in Kanbalu. 

Rationale behind doxxing and arrests

Pro-SAC Telegram channels consistently provide the reason for doxxing in their post: that the individual is participating in the black profile campaign, and posting and sharing content that shows sympathy towards the victims of the airstrike (figure 6, top). The texts frequently refer to the individuals as terrorists or terrorist supporters.

Figure 6: Top image shows a doxxing post from a Telegram channel against a Facebook user. Bottom image shows the arrest announcement of the victim. The doxxing post contains two screenshots of the victim’s Facebook that show sympathy towards the reported airstrike victims. The text of the doxxing post refers to the victim as a terrorist supporter from Mandalay who needs to be arrested in a timely manner and mentions the victim’s address. The victim was doxxed on 12 April 2023 and was arrested on 23 April 2023.

The arrest announcements in the Myanma Alinn newspaper follow a particular template (marked in yellow in figure 6). For all arrests dated between 12 and 30 April 2023 the offence is not publicly announced by the SAC; however, the newspaper states that the individuals were cooperating with the NUG, Committee Representing Pyidaungsu Hluttaw (CRPH), and affiliated organisations, in acts of public disturbance, spreading propaganda or providing assistance to said organisations through audio, action or any other manner. The charges fall under Section 52 (A) of the Counter Terrorism Law, Section 124 (A) of the Penal Code, Section 505 (A) of the Penal Code, and Section 33 (A) of the Electronic Transactions Law. It also states that the properties associated with the charges may be confiscated by the SAC. The arrest articles mention that the public was warned not to associate with said organisations on 25 January 2022. Myanmar Witness verified that this warning was published in the 26 January 2022 issue of Myanma Alinn with the article date-stamped 25 January 2022.

All of the arrests refer to the online social media profile of the detained individuals, but without pointing to any specific content. For example, out of the reported 69 people arrested, the announcements mention the Facebook profile of the arrested 66 times, Tik Tok once, and Telegram once as the reason for their arrest. The arrest of a local celebrity was only reported by BBC Burmese and there was no official announcement from the state-owned media.

Additionally, the dates of doxxing precede the arrest announcement dates by on average 6.5 days, with all doxxing posts appearing at least one day before the arrest announcement. This is an additional indication that the arrests may have been triggered by the doxxing. Figure 7 shows the distribution of the number of days that the doxxing precedes the arrest announcement.

Figure 7: Number of days doxxing precedes arrest. On average, doxxing precedes the arrest announcement by 6.5 days.

The alignment between the reasons for the arrests and doxxing, and the fact that the doxxing consistently occurred before the arrests took place, suggests that the arrests are highly likely linked to the doxxing activity.

Breakdown of Arrests and Victims of Doxxing

The state-owned Myanma Alinn newspaper announced 68 arrests and BBC one arrest between 13 and 30 April 2023. Myanmar Witness found that at least 20 people were doxxed for supporting Kanbalu victims. Of these 20 individuals, 11 were arrested later.

There was a concentration of arrests in Yangon, Mandalay and Bago, all areas which have historically been sites of anti-SAC movement and protest. However, arrests also took place in six other regions, indicating that the crackdown on those using social media to criticise the SAC goes beyond the key urban centres (figure 8).

Figure 8: Most arrest victims are from Yangon, Mandalay, and Bago.

Figure 9 shows that the number of people arrested peaked on 21 April and stayed relatively high for four more days. Myanmar Witness identified 20 victims of Kanbalu-related doxxing on pro-SAC channels. Of the 20, at least 11 people have been arrested. These 20 victims were doxxed at least 59 times. Most victims were doxxed by multiple channels, and sometimes multiple times by the same channels (figure 10).

Figure 9: Number of people arrested by date. All victims are charged with cooperating and assisting NUG, CRPH and affiliated organisations.

Figure 10: Distribution of number of times a victim was targeted. One victim was targeted at least 9 separate times.

The high volume of arrests may also be attributed to an open boycott on Facebook, which overlapped with the Kanbalu event, against the Myanmar New Year Thingyan festival that took place between 12 and 16 April 2023. During the monitoring, Myanmar Witness documented at least eight doxxing posts related to the Thingyan boycotts. 

Surveillance by Pro-SAC Telegram Channels

A detailed analysis of the doxxing posts shows that as well as conducting monitoring and surveillance online, the pro-SAC Telegram channels are accessing information from on-the-ground sources. For example, the channels recount information about the individuals movements, including that they have been seen fleeing their homes or places of work.

During this investigation, Myanmar Witness has not found this information online in any other location, reinforcing the view that the pro-SAC Telegram channels are accessing this information directly from individuals on the ground. 

Online surveillance

The pro-SAC channels are able to find and capture the online activities of pro-democratic Facebook users almost immediately; for example, some screenshots are taken as quickly as one minute after the user has posted it (figure 11). The prompt reaction from pro-SAC channels implies a close surveillance of pro-democratic Facebook users. This makes them a useful source of information on individuals who are deemed anti-SAC and could potentially lead to the SAC utilising the channels for making arrests.

Figure 11: The screenshots used by a Pro-SAC Telegram channel were taken only one and five minutes after the posting. Links available on request.

Offline surveillance

The pro-SAC channels also show evidence that they have sources on the ground who engage in surveillance and reporting. For example,  a shop-owner was targeted at least nine times, seven of which were on 12 April 2023 by seven different pro-SAC channels (figure 12). The victim allegedly had to flee their house and shop. The news that this individual had fled his properties was picked up by two of the seven aforementioned pro-SAC channels. The two channels called for the individual’s arrest and foreclosure of the house two days later on 14 April 2023, with the note saying that the channel will monitor and report developments (figure 13).

The swift response by the pro-SAC channels after the victim's evacuation from their home and shop strongly suggests that the pro-SAC Telegram team is likely receiving information directly from individuals on the ground or conducting active on-the-ground surveillance operations.

Figure 12: A victim was doxxed at least nine times by seven different channels on two different dates. Each dot represents a doxxing post against the victim. Telegram channels available on request.

Figure 13: The victim was doxxed again on 14 April. The post also requested foreclosure of the victim’s house and stated the situation will be monitored further.

The information analysed in this investigation suggests that 1) pro-SAC channels may have multiple people monitoring the activities of pro-democratic Facebook users, 2) certain pro-SAC Telegram channels have the resources to gather intelligence and monitor on-the-ground developments, and 3) the intelligence gathered on-the-ground is used by pro-SAC Telegram channels for doxxing. As a result, the Telegram channel’s which engage in doxxing activity may be coordinated by multiple people across both the physical and online domain. This is consistent with a post on another well known Pro-SAC Telegram channel (name witheld due to privacy concerns) that claims that the channel is run by between 20 and 33 people (figure 14).

Figure 14: A post on a well-known Pro-SAC Telegram channel, first claiming the number of admins is “14 times 2 plus 5” and then directly stating that “the channel is run by more than 20 people.” The post also threatens to eliminate all NLD supporters.

Doxxing Channels and Coordinated Behaviour

Myanmar Witness statistical and network analysis of the pro-SAC Telegram channels’ behaviour and doxxing patterns found that there is strong coordination among the channels.

The identification of pro-SAC Telegram channels primarily occurred as the channels often use derogatory language against the people who support the pro-democratic movement. Myanmar Witness has been monitoring 1 pro-SAC channels that participate in doxxing, one of which has been taken down at the time of reporting (table 1).

Table 1: The 18 pro-SAC channels that participated in the doxxing and the number of Kanbalu-related doxxing posts in April 2023. Channels available on request. Removed from publication due to privacy concerns.

An analysis of the patterns of doxxing across the 18 channels shows signs of coordinated behaviour. Based on the number of common victims that each pair of channels doxxed, two types of statistical analysis were performed, Pearson correlation and Cramer’s V. There are seven pairs of channels with statistically significant, moderately to highly correlated behaviour in both approaches (table 2). The network mapping of the Pearson correlation of the doxxing behaviour reveals two sub-communities of channels (figure 15). Both sub-communities form a fully connected network.

Table 2: Pearson correlation and Cramer’s V analyses show seven statistically significant and moderate to highly correlated pairs of channels. The analyses are based on who the channels are doxxing and frequency of doxxing. Channel names blurred due to privacy concerns. Available on request.

Figure 15: Network of highly coordinated pro-SAC Telegram channels. Each node represents a channel, and each edge represents a statistically significant, moderate-to-high correlation between connected channels, labelled with the correlation coefficients.

The information collected and analysed during this investigation supports the hypothesis that  pro-SAC channels are not operating individually and instead are engaged in coordinated doxxing activities. For example, the results of statistical and network analyses, the evidence of vigilant online and on-the-ground monitoring, as well as the coordination between on-the-ground intelligence and online doxxing efforts support this hypothesis.

Update: The release of detained individuals 

Nearly four months after the Pa Zi Gyi airstrikes and subsequent arrests, five of the detained individuals — including a former journalist and four celebrities — were released after their cases were reportedly closed on 7 July 2023, according to several sources including The Irrawaddy, DVB, MyanmaPlatform, Yangon Media Group, and three pro-SAC Telegram channels. AAPP’s release database has also been updated to show that the five individuals have been released. They were originally charged under Section 505 (A) of the Penal Code.

Further research by Myanmar Witness investigators confirms that between 8 July and 3 August 2023, the Facebook accounts of four of the five released individuals, have become active again; all of which were inactive as early as 10 April 2023.

The release news also showed a potential coordination among the pro-SAC Telegram channels. One well-known Pro-SAC Telegram channel posted the earliest among the four channels at 2050 hours on 7 July. The post did not share any specifics, but hinted that there would be good news for these individuals soon (Figure 16). The earliest post that is not from a pro-SAC channel was created on the morning of 8 July.

Figure 16: The earliest post regarding the release hinted at good news for the artists without specifying any details. This post was from one of the many channels affiliated with a well-known Pro-SAC channel that Myanmar Witness has been monitoring. Information is available on request.

Three other identical posts by pro-SAC channels were posted within 28 minutes of each other. The message spoke of the SAC in a good light, and also expressed hope that the artists could continue their work. The language used could be interpreted as a warning to the artists, implying that they should not interfere with politics in the future (Figure 17).

Figure 17: The common message shared by three pro-SAC Telegram channels containing specifics about the released individuals.

Conclusion and Future Monitoring

It has been reported that pro-SAC groups have been taking the fight to digital platforms against the pro-democratic movement. This report has identified a significant increase in doxxing activities by pro-SAC channels following the Kanbalu airstrikes. 11 individuals who protested against the airstrikes on social media have been doxxed and subsequently arrested. This forms part of a crackdown by the SAC on those they claim support anti-SAC groups on social media. Continued monitoring has revealed that four months after the airstrike, five individuals have now been released from detention.

Through statistical quantitative analysis, this research has identified specific Telegram Channels involved in doxxing activities, signs that these channels coordinate with one another, and that they have the ability to gain information from people on the ground. Myanmar Witness will continue to monitor the status of those detained, the potential coordinated behaviour of the doxxing channels, and how they react after significant events on the ground.

Abbreviations and Definitions

• SAC - State Administration Council

• BBC - British Broadcasting Corporation

• NUG - National Unity Government of Myanmar

• CRPH - Committee Representing Pyidaungsu Hluttaw

• Doxxing - The act of sharing private information about a person without their consent - data such as their address, contact details,personal photos may be shared and used as a form of intimidation or social punishment.

• Pearson correlation - Measure of the strength of a linear association between two continuous variables

• Cramer’s V - Measure of the strength of association between two categorical variables.

Methodology

Quantitative Methodology

The quantitative research methodology contained three stages: 1) the collection of Pro-SAC Telegram channels and posts from those channels; 2) the detection of potential doxxing posts; and 3) the identification of arrest victims in the collected data.

The full methodology can be found in the PDF.