Score Change: This score improved from 2 to 3 because internet penetration rates in Sri Lanka increased, according to some measurements.

Although internet access has increased in recent years, the speed and quality of service is inconsistent. There was an increase in the number of mobile broadband subscriptions and internet penetration during the coverage period. According to the Telecommunications Regulatory Commission of Sri Lanka (TRCSL), there were over 19.2 million mobile broadband subscriptions and 2.6 million fixed-line broadband subscriptions as of March 2023.1 According to DataReportal’s Digital 2023 report, there were 14.58 million Sri Lankan internet users as of January 2023 and an internet penetration rate of 66.7 percent, compared to 52.6 percent in January 2022.2

Between June 2022 and February 2023, people in Sri Lanka experienced daily rolling power cuts, varying between one hour and twenty minutes and three hours due to the country’s ongoing economic crisis.3 Rolling power cuts began during the previous coverage period, and lasted as long as 13 hours in March 2022.4 The power cuts have disrupted internet access, interrupting students examinations, online education, and private-sector activities.5 In February 2023, the Power and Energy Minister announced there would be no more power cuts after an electricity tariff hike was approved by the regulator.6

The government is interested in expanding the use of fifth-generation (5G) technology for mobile networks, including through improved connectivity and digital infrastructure projects. In December 2022, the TRCSL announced preparations for the implementation of commercial 5G services in 2023.7 There were no updates regarding implementation as of the end of the coverage period. Service provider Sri Lanka Telecom (SLT),8 Dialog Axiata,9 Hutch,10 and Airtel11 conducted 5G trials in 2022. However, the chief executives of both Hutch and Airtel said the economic crisis had impacted their 5G rollouts,12 with Hutch’s rollout likely being delayed by at least a year.13 State-owned SLT has also said its 5G rollout may be delayed past 2022.14

In 2021, the TRCSL launched a program aimed at improving the connectivity of fourth-generation (4G) technology in mobile networks in rural areas in collaboration with major mobile service providers.15 Service provider Dialog Axiata has its own program to expand rural 4G connectivity, and announced a $152.4 million investment in July 2022.16 Starlink, a satellite-based network system, said it expects to expand service to Sri Lanka by 2023, but added that availability would be subject to regulatory approval.17 SLT has continued to invest in connectivity infrastructure, including fiber-optic and fiber-to-the-home connections, with a total of 475,000 connections reported as of the end of September 2022.18

Mobile internet connectivity is affordable, although gender-based and urban-rural digital divides persist. According to UK-based Cable’s 2023 study of global internet prices, Sri Lanka’s average monthly price for fixed-line broadband was 3,471 rupees ($11.95), compared to a real mean household income of 57,292 rupees ($283) per the 2019 Household Income and Expenditure Survey.19 Prices for mobile broadband vary.20 Mobile users pay an average rate of 91 rupees ($0.27) for 1 gigabyte (GB) of data, according to Cable, which ranks Sri Lanka the eleventh-cheapest country in the world for data-only mobile-broadband plans, though prices and the relative cost of mobile internet fluctuated during the country’s economic crisis.21

In April 2022, the TRCSL granted permission to Airtel to shut down its third-generation (3G) mobile network effective June 2022, compelling subscribers to upgrade to 4G-enabled mobile phones. 22 Airtel was granted until September 2023 to complete the transition to avoid service disruptions. In December 2022, Dialog Axiata also announced it would shut down its 3G network in 2023 to support better 4G services.23

The government has imposed additional taxes on telecommunications services during the economic crisis. In September 2022, the TRCSL approved a 20 percent tariff hike for mobile, fixed, and broadband services. 24 In May 2022, authorities increased a telecommunications tax from 11.25 percent to 15 percent, reversing a 2019 tax cut as they implemented a package of tax increases to address the economic crisis.25

Urban residents benefit from infrastructural advantages and are better connected to the internet. The province with the highest percentage of households accessing the internet is the Western Province, the country’s most populous,26 where Colombo and other urban areas boast well-developed infrastructure. A September 2020 survey of 87 Sri Lankans, mostly from urban areas, found that half had increased their spending on internet connections during the COVID-19 pandemic; the proportion of those spending more than $15 per month doubled, from 16 to 37 percent of respondents.27 Government statistics for the first six months of 2022 found that 47.1 percent of Western Province residents were computer literate,28 excluding those who were only digitally literate with smartphones or tablets; the national rate stood at 35.7 percent. By comparison, the national digital literacy rate, which accounts for more types of devices, is 59.8 percent.29

Post–civil war infrastructure development in the Northern and Eastern provinces was delayed.30 However, the development of telecommunications infrastructure in these provinces has improved and led to increased internet usage. Nonetheless, compared to urban areas, rural and up-country Tamil communities have significantly lower computer and digital literacy rates.31 Some 34.2 percent of the population in rural areas and 11.5 percent in estate areas were categorized as computer literate, compared to 49.1 percent in urban areas, while 58 percent in rural areas and 43 percent in estate areas were categorized as digitally literate compared to 72.4 percent in urban areas. In February 2021, the Education Ministry’s information technology (IT) director warned that only 30 percent of the student population had access to, or could afford, remote learning during the COVID-19 pandemic. The government also broadcasted lessons on television and radio.32

Score Change: This score improved from 3 to 5 because social media and communications platforms were not blocked during the coverage period, in contrast to recent years.

There was no blocking of social media and communications platforms during the coverage period.

During the previous coverage, in April 2022, the government blocked social media and communications platforms for about 16 hours as the Aragalaya protests intensified. The blocks—which covered social media platforms like Facebook, Twitter, and YouTube and messaging apps like WhatsApp, Viber, and Telegram—were ordered by the Ministry of Defence, according to the TRCSL. They followed then-president Rajapaksa’s declaration of a state of emergency. A three-day curfew was also declared, designed to suppress the protests (see B8).33 Some Sri Lankans reported difficulty accessing the internet during protests in March and April 2022, with some speculating that the government disrupted signals; the connectivity issues may have been related to congestion or infrastructural problems.34

The government also blocked social media platforms repeatedly in April and May 2019 in the wake of the Easter Sunday bombings at churches and hotels.35 For nine days directly following the attacks, Facebook, WhatsApp, YouTube, Instagram, Snapchat, and Viber were all blocked, as was at least one popular virtual private network (VPN).36

Sri Lanka has access to multiple international cables, but most of the landing stations for these cables are controlled by SLT, giving the government control over internet infrastructure.37 SLT is a consortium member of the Singapore–France SEA-ME-WE submarine cable, and reportedly plans to invest $60 million.38 The project hit a roadblock in February 2023 when two of China’s largest mobile operators pulled out of the project due to tensions over infrastructure control.39 A submarine cable system between the Maldives and Sri Lanka, built by Huawei Marine Networks in partnership with Dialog Axiata, was ready for service in February 2021.40 In November 2022, the Indian conglomerate Reliance Industries reportedly received approval to build a submarine cable from Singapore to Mumbai which would also connect to Sri Lanka.41

Sri Lanka’s retail tariffs are among the lowest in the world, though the diversity of service providers is limited due to the dominance of some companies, particularly SLT.

There are three fixed-line providers in Sri Lanka.42 SLT remains a key player, and the firm imposes price barriers by forcing competing service providers to lease connectivity from SLT, which charges high rates.43 As of 2022, the government owned a 49.5 percent stake in SLT and Global Telecommunications Holdings NV, a Dutch company, held a 44.98 percent stake.44

In March 2023, the Cabinet of Ministers approved the sale of the government’s major shareholding in SLT to improve its foreign reserves.45 The decision has been met with protests against privatization from employees and a sectoral oversight committee.46 The secretary to the treasury stated that divestment will be complete no earlier than June 2023.47

Dialog Axiata remains the country’s largest mobile service provider, with over 17.37 million subscribers as of December 2022.48 SLT and Mobitel, a mobile service provider and subsidiary of SLT, reorganized their operations under the SLT-Mobitel brand in January 2021.49 SLT-Mobitel is the second largest mobile service provider, reporting over 9.3 million subscribers at the end of 2022.50 Hutch reported 4 million active customer accounts in 2022,51 while Airtel reported 2.93 million subscribers.52

In May 2023, Dialog and Airtel agreed to combine operations in Sri Lanka, and discussions on the transaction are ongoing.53

In an effort to compel internet service providers (ISPs) to provide better service to retain customers, the TRCSL ordered providers to implement number portability, which would allow customers to change their service providers without changing their phone number, by May 2022.54 As of November 2022, ISPs were reportedly in the early stages of implementation, though delays of up to a year are anticipated.55

In August 2018, the government removed telecommunications floor rates for call charges in hopes of increasing competition among service providers.56 The competitive nature of the market has led to some legal battles.57

Under the Telecommunications Act, ISPs are licensed by the Telecommunications Ministry, but the ministry can follow TRCSL recommendations on granting a license and require providers to address any matter considered “requisite or expedient to achieving” TRCSL objectives.58 In November 2021, the government announced the TRCSL would auction new licenses, including for fixed-line operators, mobile service providers, ISPs, and satellite broadcasting operators.59 Some operators, including Dialog Axiata, have reportedly been given spectrum rights to provide 5G services ahead of the issue for commercial, fixed, mobile, ISP and satellite broadcast licenses.60 CEOs of some mobile service providers raised concerns about the feasibility of expanding into 5G in 2023 given the significant investment needed and the ongoing economic crisis in the country.

The national regulatory bodies overseeing service providers lack independence, and frequently do not act in a fair manner. In May 2023, authorities proposed the formation of a broadcasting regulatory commission, which would likely implicate electronic media.

In May 2023, a cabinet-appointed subcommittee completed a proposal to establish the Broadcasting Regulatory Commission (BRC) through a broadcasting regulatory act.61 The presidentially appointed, five-member commission would oversee licensing for broadcasting services, including electronic media. The proposed commission, tasked with ensuring “national security, national economy, and public order” in broadcasting, would also be empowered to seize and detain the records of broadcasting services (see C6). The proposal has been strongly criticized by opposition parties for its potential violations of free expression, which is enshrined in Article 14 of the constitution (see C1).62 As of June 2023, the proposal was reportedly under review by media institutions.63

The TRCSL was established under the Sri Lanka Telecommunications (Amendment) Act, No. 27 of 1996. As the national regulatory agency for telecommunications, the TRCSL’s mandate is to ensure the provision of effective telecommunications, protect the interests of the public, and maintain effective competition between service providers.

In May 2022, then president Rajapaksa reorganized the TRCSL, SLT, and the Information and Communication Technology Agency (ICTA) under the Ministry of Defence, leading to concerns about the bodies’ independence.64 The decision reversed a November 2020 move to bring those and other bodies under the Technology Ministry, which is also under presidential control.65 In June 2022, the TRCSL, SLT, and ICTA were returned to the purview of a newly created Ministry of Technology and Investment Promotion.66 In October 2022, President Wickremesinghe brought the TRCSL and all allied institutions under the control of the Ministry of Technology.67

The TRCSL has been criticized in the past for poor regulatory practices, instances of preferential treatment, and a lack of transparency in recommending whether a telecommunications provider should receive a license.68 The agency has sometimes solicited public input on its decisions, and it called for consultation on number portability in February 2021.69 Analysts have asserted that spectrum allocation and refarming— the more efficient reallocation of spectrum— have been administered in an ad hoc manner, though procedural transparency has improved over time.70

Under Mahinda Rajapaksa’s 2005–15 presidency, many of the TRCSL’s interventions to restrict online content and pronouncements on strengthening internet regulations were partisan and extralegal.71 Successive regimes have chosen political allies to head the TRCSL. A former chairman, Jayantha de Silva, served as secretary to the Technology Ministry between June and August 2022.72 The current chairman, Niranjan D. Gunawardena, is also the secretary to the Technology Ministry.73 A former director general, Oshada Senanayake, publicly advocated for a Gotabaya Rajapaksa presidency when speaking to a convention of academics and professionals.74

The government does not systematically block or filter websites and other forms of online content, although a few independent websites and other sites are blocked, and authorities have briefly blocked social media platforms during previous coverage periods (see A3 and B8).

During the coverage period, the Open Observatory of Network Interference (OONI) has reported signs of transmission control protocol and internet protocol (TCP/IP) blocking on several websites. For instance, the websites of Al Arabiya,75 the official website of the US Navy Sea, Air, and Land (SEAL) teams,76 and the LGBT+ rights organization Kaleidoscope Trust77 showed signs of TCP/IP blocking on some networks during this and the previous coverage period. Sankathi24, a Tamil news site, showed signs of being blocked from June 2020 to February 2023 on SLT connections. The site also showed signs of blocking on Dialog connections, including in May 2023.78 Adult dating site adultfriendfinder.com showed signs of HTTP blocking on Dialog Axiata connections during the coverage period.79 News site Lankaenews appeared to have been impacted by domain name system (DNS) tampering on SLT connections during the coverage period,80 though it had previously been periodically accessible. The website was previously reportedly blocked for publishing stories critical of then president Sirisena.81

The government previously blocked social media and communication platforms in April 2022 and three times in April and May 2019, in the aftermath of the Easter Sunday attacks, and once for over a week in March 2018 in response to violence in Kandy (see A3). Authorities claimed the restrictions were necessary to stop the spread of disinformation and hateful content, as well as to limit sectarian violence during the politically tense period following the attacks.82 The restrictions prevented access to independent news sources and limited users’ ability to contact those in areas affected by the crisis.83

SLT’s unlimited data packages, which became available in April 2021, block torrents, peer-to-peer (P2P) applications, and the messaging app Telegram under their terms and conditions (see C4).

In recent years, the Sri Lankan government has considered instituting a legal framework to curb online speech it considers discriminatory, defamatory, or misleading.84 The government also issued takedown requests during the reporting period.

During the coverage period, individuals were summoned by authorities and ordered to make public apologies for content they posted online. In May 2023, comedian Jayani Nathasha Edirisooriya was arrested for comments “defaming Buddhism” in a viral standup routine (see C3). In June 2023, after the coverage period, Edirisooriya posted a public apology video and the YouTube video of the routine was removed.85 In October 2022, a Facebook user was called before the parliamentary committee on ethics and privileges for posting a video that was allegedly defamatory towards member of parliament R. Sampanthan on his Facebook page. The user was given a warning and directed to publish an apology in a prominent newspaper and on his Facebook page.86 The committee also summoned two journalists from a daily Sinhala-language newspaper for publishing allegedly false information which “damaged the honor” of the entire Parliament. They were directed to publish a statement of regret in the newspaper and the editor in chief was instructed to “take care” of the matter.87

During the previous coverage period, in January 2022, the editor of the Tamil Guardian, a news site, alleged that the government played a role in content restrictions on the outlet’s Instagram account. Instagram removed dozens of posts and suspended the Tamil Guardian’s account twice, usually in relation to posts featuring Tamil nationalist protests and notable figures from the Liberation Tigers of Tamil Eelam (LTTE). The group falls under a policy on dangerous individuals and groups enacted by Instagram’s parent company, Meta.88

Between January and June 2022, Facebook restricted two items within Sri Lanka; a review also found that access to one item was mistakenly restricted and subsequently restored.89 Between July and December 2022, Google received content removal requests for 99 items and removed 7; 10 requests were made for privacy and security reasons, 3 for being critical of the government, 4 for obscenity or nudity, and 15 for defamation.90 Twitter received two removal requests between July and December 2021.91 In 2020, Facebook restricted access to 1,643 items to adhere to election guidelines related to the August 2020 parliamentary polls.92

There is a lack of transparency around restrictions on online content, but a 2017 right to information (RTI) request revealed that the Mass Media Ministry and Presidential Secretariat can send blocking orders to the TRCSL for reasons including “publishing false information” and “damaging the president’s reputation.”93 The TRCSL then instructs ISPs to block the content.

Following April 2022 social media blocks (see A3 and B1), civil society groups filed freedom of information requests with the TRCSL asking for related records94 and sent a fundamental rights petition to the Supreme Court.95 There are no records of ISPs challenging the TRCSL’s blocking orders at the commission itself or through the court.

It is not clear if the TRCSL can impose financial or legal penalties on telecommunications companies that do not comply with blocking orders, since the conditions of such orders are unknown to the public.

There is no independent body regulating content, which leaves few avenues for appeal (see A5). Content providers have filed fundamental rights petitions with the Supreme Court to challenge blocking orders,96 but under former president Mahinda Rajapaksa, a lack of public trust in the politicized judiciary and fear of retaliatory measures presented significant obstacles for would-be petitioners.97

During a January 2023 meeting, President Wickremesinghe again emphasized that the government was working to introduce legislation to regulate social media platforms that would be modeled after Singapore’s laws.98 In October 2021, the Justice Ministry said it was formulating draft legislation aimed at curbing online posts deemed false, misleading, or hateful.99

There have been efforts by domestic actors—including government officials, civil society members, and fact checkers—to work with international technology companies.100 In March 2020, Facebook committed to removing false COVID-19-related claims or conspiracy theories flagged by global and local health authorities.101 Also in March, it was reported that the Elections Commission of Sri Lanka (ECSL) would work with officials from Facebook, Twitter, and YouTube to monitor content during that August’s polls and to ensure the platforms would not be misused for content like hate speech.102 A report from youth group Hashtag Generation noted that Facebook did remove several instances of election-related hate speech, false news, and targeted harassment reported to them by the ECSL during the elections.103

Social media platforms, including Facebook, have faced scrutiny for flawed content moderation in Sri Lanka. A January 2022 report by the Intercept, an American news organization, indicated that Facebook has repeatedly failed to distinguish violence-instigating content from journalistic and cultural expression, impacting news publications including the Tamil Guardian.104 In October 2021, leaked documents revealed that several Sri Lankan people and organizations—including the LTTE, the Sinhala National Force, and anti-Muslim monk Galagoda Aththe Gnanasara—were listed on Facebook’s Dangerous Individuals and Organizations List, indicating that content related to them is subject to stricter enforcement.105 In May 2020, Facebook released an impact assessment report which highlighted improvements in its content-removal policies to address previous failures to remove hateful Sinhala-language content that encouraged anti-Muslim violence in March 2018.106 Members of civil society noted shortfalls in the report in terms of guidance in local languages for Sri Lankan users.107

While self-censorship by journalists declined under the Sirisena administration, journalists proceed with caution when reporting on subjects that are considered sensitive. However, Sri Lankan internet users were vocal in their criticism of the government’s handling of the economic crisis in 2022 (see B8).108

Threats against journalists and social media activists (see C7) and emergency regulations criminalizing false information (see C1) during the coverage period raised concerns about escalating self-censorship. People also experienced direct retaliation for supporting the Aragalaya protest movement. For example, an activist was arrested by Sri Lanka’s Computer Crimes Division for posting a comment that criticized Independence Day celebrations on Facebook.109

The government also threatens public servants with disciplinary action for expressing ideas in alleged violation of the Establishment Code. The Establishment Code outlines the duties of government employees working as public servants. In September 2022, the Ministry of Public Administration announced that public officers expressing ideas on social media without following the Establishment Code could face disciplinary action, allegedly after public officials spoke to the media about school children fainting due to hunger in classrooms. 110 In November 2021, the Ministry of Home Affairs reportedly warned that disciplinary action would be taken against public servants who criticized the government and its policies on social media, also citing the Establishment Code.111

The Office of the UN High Commissioner for Human Rights raised concerns in 2021 that the surveillance and harassment reported by over 40 civil society organizations was having a “chilling [effect on] civic and democratic space and leading to self-censorship.”112 Immediately following the November 2019 election of Gotabaya Rajapaksa, journalists and activists reported an increase in self-censorship around political issues.113

In previous years, journalists have noted a tendency to self-censor when covering the president and the first family.114 Members of Tamil and Sinhala media outlets have reportedly faced increased pressure from officials to self-censor in past years.115 Journalists have previously said they were hesitant to criticize the Rajapaksas or write on sensitive topics including rights violations, the army, corruption, missing people, and land appropriation.116

The spread of disinformation and misinformation has been a growing concern in recent years.

During the 2022 protests, researchers found that proxy accounts and Facebook pages associated with or supportive of the Rajapaksa family disseminated content that aimed to discredit the demonstrations.117 For example, Sinhala-language content portrayed the protests as funded by “external” forces.118

Research conducted from July to December 2021 identified politically motivated false information campaigns on Facebook and WhatsApp, predominately targeting activists and left-wing opposition parties119 during the August 2020 parliamentary elections, some of which originated from political parties and candidates. For example, one candidate implied that the ECSL was attempting to limit voter turnout in an interview shared on Facebook. Several political candidates also questioned the integrity of the vote-counting process on social media.120

Deliberate misinformation about candidates, electoral campaigns, and government decision-making spread on social media ahead of the planned, and later postponed, 2023 local government elections.121 Posts circulated claiming that K.D. Lalkantha, a member of parliament from the People’s Liberation Front (JVP) party, had stated that “the JVP was built by true Buddhists and other main parties were built by non-Buddhists.” Medical misinformation attributed to former JVP member of parliament Nalinda Jayatissa was also circulated online alongside photos of him.122

A 2020 report from the Oxford Internet Institute identified the existence of cybertroop teams in Sri Lanka that manipulated information on social media on behalf of politicians and political parties.123 The report found evidence that Sri Lankan teams worked to support their causes’ preferred messaging, attack their opposition, create division, and suppress critical content.

Some government regulations threaten the economic viability of online publishers and start-up platforms.124 Based on guidelines issued in 2019,125 websites were required to register with the Mass Media Ministry starting in 2020 to receive media accreditation, which websites need to cover certain events and engage in field reporting.126

In July 2021, news site MediaLK was reportedly denied accreditation; the Mass Media Ministry claimed that its founder, Tharindu Jayawardhana, had not received clearance from the Ministry of Defence, possibly in retaliation for the outlet’s reporting on senior police officials.127 In February 2023, the Human Rights Commission ruled that the Media Ministry had violated the right to freedom of expression including publication by denying MediaLK media accreditation. The Ministry of Defence identified MediaLK as a “risk to national security.128 As of the end of the coverage period, MediaLK had not received media accreditation.

The government has also maintained news site registration requirements introduced by previous administrations. During Mahinda Rajapaksa’s presidency, the Mass Media Ministry directed all news sites to register for a fee of 25,000 rupees ($122), with an annual renewal fee of 10,000 rupees ($49).

Diverse content is generally available online in Sri Lanka, despite a history of censorship, concerted efforts to spread misinformation about protests, and instances of intimidation targeting online journalists during the reporting period. 129 Social media and communication platforms and blogs are popular and widely available, providing a platform for local debate. Sources of information in English, Sinhala, and Tamil are available online, including on socioeconomic and political issues.

Sri Lankans rely on several online outlets or companion websites that provide local and regional news and information. Sites such as Roar Media,130 Watchdog,131 Readme.lk,132 Groundviews, Vikalpa, Maatram,133 Manthri.lk,134 MediaLK,135 Himal Southasian,136 Counterpoint,137 and Anidda138 cover a range of political, social, and economic issues. There have been a number of media literacy initiatives from nonprofits, such as Divide, which examines the gaps between Sinhala- and Tamil-language newspapers in their reporting on gender, minority groups, transitional justice, and political reconciliation.139 Sri Lanka’s online environment also benefits from the virtual Museum of Religious Freedom140 and the digital platform Historical Dialogue’s memorialization initiatives.141

Misinformation spread by ordinary users is a problem in Sri Lanka. Misinformation about the 2022 protests proliferated during the coverage period, with reports that people at a rally were detained for clapping and that protesters broke into Sri Lanka’s central bank.142 Homemade heart disease remedies and cancer cures also circulated as Sri Lanka faced medicine shortages due to the economic crisis.143 Misinformation about cures, vaccines, and mask exemptions circulated during the COVID-19 pandemic, labeling ethnic and religious minorities as COVID-19 carriers and reportedly contributing to vaccine hesitancy among young people.144 Similarly, false and manipulated information quickly spread after the 2019 Easter Sunday attacks.145

Inflammatory speech has been amplified and shared on platforms like Facebook.146 Following anti-Muslim riots in Ampara and Digana in 2018, Facebook’s slow response to inflammatory online speech, such as content that implored followers to “kill all Muslims, don’t even save an infant,” became an international concern. The platform introduced a misinformation policy in July 2018 (see B3).147 In June 2021, Facebook partnered with the Asia Foundation to launch the Resiliency Initiative, which aims to combat hate and intolerance online; several civil society groups participated in workshops ahead of the initiative’s launch.

The internet has provided an avenue for robust digital activism and engagement on political issues in Sri Lanka. The 2022 Aragalaya protest movement was partly mobilized online.

Throughout the coverage period, protesters mobilized online around the hashtag #GoHomeRanil in response to issues including then president Wickremesinghe’s crackdown on the protests, delayed local elections, and the economic crisis. 148 Aragalaya protesters in Batticaloa employed the hashtag #Battiwalk4justice149 to amplify their protests. In May 2023, protesters and internet users mobilized around hashtags like #Mullivaikkal and #Justice4Tamilgenocide to mark 14 years since the end of the civil war.150 Activists also used #Malaiyaha200 to mark the 200th anniversary of the arrival of the Malaiyaha Tamils in Sri Lanka and raise awareness of the injustices faced by their community.151

Sri Lankans mobilized in significant offline protests and actions, including the storming of the presidential residence in July 2022, the monthslong occupation of the Galle Face Green, and protests outside of the parliament in May 2022.152 In March 2022, during the previous coverage period, Sri Lankan internet users called for Gotabaya Rajapaksa’s resignation through the hashtags #GoHomeGota and #GotaGoHome, mirroring offline protest slogans.

In July 2022, following months of sustained protests, then president Gotabaya Rajapaksa resigned after fleeing to Singapore and Ranil Wickremesinghe was appointed president.153 President Wickremesinghe deployed a range of restrictions in an attempt to continue to suppress the ongoing protests, though Sri Lankans continued to mobilize online. Wickremesinghe declared a state of emergency (see C1), passed laws to restrict protests, and continued arrests (see C3).154 Protesters received reprisals for posting footage from the protests and for posting in support of the Aragalaya.155 Amnesty International also raised concerns of surveillance of protesters' social media accounts (see C5).

Most online campaigns registered uneven progress in achieving their goals. Online campaigns have generally been prompted by discrete events, crises, or stalled political processes, and campaigners have typically been unable to gather the momentum needed to drive meaningful change and long-term citizen participation. The 2022 online and offline protests, however, led to the resignation of then President Gotabaya Rajapaksa and mobilized diverse groups including civil society, families of the disappeared, artists, and students and all ethnic and religious groups and ages, for the first time in Sri Lanka’s history of social movements.

Activists and civil society groups have also used hashtags to draw attention to issues including disappearances in the nation’s north and east during the civil war, cases of detention under the controversial Prevention of Terrorism Act (PTA), and the continued marginalization of estate workers and the Tamil population.156 Women in media also shared experiences of sexual harassment at their workplaces using the #MeToo hashtag.157

Although internet access is not guaranteed as a fundamental right in legislation, Article 14 (1)(a) of the constitution protects freedom of expression, subject to restrictions related to the protection of national security, public order, racial and religious harmony, and morality. There are no specific constitutional provisions guaranteeing freedom of expression online.

In July 2022, acting president Wickremesinghe announced a state of emergency that granted sweeping powers of arrest and detention to the police and armed forces, lasting through August 2022.158 The regulations included clauses prohibiting the spread of rumors, false information, or information likely to cause public alarm, including online (see B8 and C2).159 During the previous coverage period, in April and May 2022, then president Gotabaya Rajapaksa declared states of emergency with similar provisions in an effort to curb dissent (see B8 and C2).160

In January 2021, the cabinet approved a proposal to amend the 1970s-era Press Council Law to regulate new outlets and electronic media in addition to print media, though the amendments have yet to become law as of the end of coverage period.161 Civil society and media rights groups have expressed concern that the amendments would expand the government’s control over online media and online speech.162

Since the passage of the Right to Information Act in 2017,163 citizens have submitted thousands of RTI applications on issues ranging from legislation on the rights of people with disabilities to the blocking of websites (see B3).164

Several vaguely defined, overly broad laws can be abused to prosecute users and restrict online expression. In March 2023, the government introduced the widely criticized Anti-Terrorism Act, which contains a broad definition of terrorist activity and criminalizes speech that is “likely to be understood” as encouraging or inciting terrorism.165

The bill, designed to replace the widely scrutinized PTA, places broad restrictions on free expression, reintroduces the death penalty, encroaches on data privacy, and targets the use of encryption (see C4 and C6).166 Seen as a repackaging of the PTA, the legislation has faced strong criticism from Sri Lankan civil society and international rights bodies.167 The PTA has been used to crack down on critical online content, including speech from journalists, and to detain writers, lawyers, and activists (see C3).168 Draft amendments to the PTA proposed in January 2022169 similarly retained broad definitions of terrorism and failed to adequately protect freedom of expression and other rights.170

The July 2022 emergency regulations (see C1) criminalized the communication of “any rumor or false statement or any information or image or message,” including online, deemed likely to cause “public alarm, public disorder, or racial violence” or otherwise incite a crime. Violators could receive prison sentences ranging from three months to five years or fines of 500 ($2.49) to 5000 rupees ($24). The regulations also extended the detention period for a suspect before being produced under a Magistrate from 24 to 72 hours.171 The May 2022 regulations passed by then president Gotabhaya in May 2022 included similar provisions and penalties.

Vague amendments to the criminal and penal codes, which criminalize the spread of “false news” affecting “communal harmony” or “state security” and impose fines of more than one million rupees ($4,900) and a maximum five-year prison sentence, were approved by the cabinet in 2019. The amendments had not been passed by Parliament as of May 2023.172 The government reportedly approved concept papers for penal-code amendments that would criminalize false news in March 2021.173 In June 2021, the police stated that a number of existing laws could be used to arrest people for spreading misinformation, including sections of the penal code, the International Covenant on Civil and Political Rights (ICCPR) Act, the Computer Crime Act, the PTA, and sections of the Obscene Publications Ordinance.174

Publishing official secrets, information about parliament that may undermine its work, or “malicious” content that incites violence or disharmony can result in criminal charges.175 The then director general of government information, Sudarshana Gunawardana, stated in March 2018 that incitement to violence, including on social media, is contrary to Article 28 of the constitution and Section 100 of the penal code, as well as Section 3 of the ICCPR, to which Sri Lanka is a party.176 In January 2022, a senior police official claimed that law enforcement officers were legally able to arrest individuals who insult the president on social media.177

Authorities have increasingly manipulated the ICCPR Act, which enshrines the ICCPR in Sri Lankan domestic law, to criminalize online speech (see C3).178 Section 3(1), for example, prohibits national, racial, and religious hatred if it incites discrimination, hostility, and violence. Those charged under the act can only be granted bail by a high court.

In May 2023, Minister of Buddhashasana, Religious, and Cultural Affairs Vidura Wickramanayaka announced that Sri Lanka would pass legislation to curb “religious slander” on social media, after comedian Jayani Nathasha Edirisooriya was detained for her satirical remarks regarding the Buddha (see C3).179

In February 2023, the state minister for technology said plans were underway to present the Cyber Security Bill in Parliament during the year.180 In October 2021, the cabinet approved the draft Defence Cyber Commands Act181 and a draft bill for cybersecurity concerns outside of defense. The latter bill also called for the establishment of a cyber protection agency.182 Civil society expressed worries that broad definitions in the initially proposed Cybersecurity Act could allow the government to misuse the law against private institutions and impact privacy.183

During the coverage period, internet users were prosecuted in retaliation for their online activities, including criticism of the government and participation in the Aragalaya protest movement.

Several people were arrested in relation to protests. In June 2023, after the end of the coverage period, social media activist Piyath Nikeshala was arrested for live streaming protesters setting fire to the president’s private residence in July 2022 and was granted bail the next day.184 In February 2023, social media activist and YouTuber Darshana Handunugoda was arrested for posting a live video near the prime minister’s official residence around the time when protesters took over the premises, and was granted bail the same day.185 In August 2022, British national Kayleigh Fraser’s passport was seized for an alleged visa violation after she posted footage of the protests on her Instagram account.186 She was later given a deportation order.187 In July 2022, an unnamed 28-year-old Muslim individual was arrested for criticizing the army on social media and expressing support for the Galle Face protests.188 Also in July 2022, social media activist Pathum Kerner was arrested after he posted a live video on Facebook where he could be heard urging protesters to gather and breach the barriers outside Parliament. He was released on bail in August.189

Authorities have summoned and questioned journalists and others working for online news outlets for other conduct related to their work (see C7). In November 2022, journalist and activist Tharindu Uduwaragedara was questioned by officials for three hours after he made a Facebook post asking people to identify police officers who were using disproportionate force on protesters.190 During the previous coverage period, in August 2021, Keerthi Ratnayake, a writer for Lankaenews, was arrested over a warning he gave about a possible attack on an embassy. Ratnayake was detained under the PTA, alleged retaliation for articles he wrote that criticized the government.191 The court allowed Ratnakaye to post bail in February 2022.192

Authorities also arrested users for offending Buddhist religious sentiments. In May 2023, comedian Jayani Nathasha Edirisooriya was arrested and questioned by the police force’s Cyber Crime Unit for “defaming Buddhism” in a viral performance she uploaded to YouTube.193 In June 2023, after the coverage period, YouTuber Bruno Divakara was arrested for “aiding and abetting” Edirisooriya by reposting her performance to his YouTube channel.194 Both were released on bail in July 2023.195 In May 2023, a Buddhist monk, Venerable Rajangane Saddharathana Thera, was arrested after he posted a video on social media insulting President Wickremesinghe.196 He was also remanded until late June 2023.197 In January 2023 social media activist and YouTuber Sepal Amarasinghe was arrested under the ICCPR Act for making defamatory comments about the Sacred Tooth relic, venerated by Buddhists, in a video. He was released in late February.198 In November 2021, during the previous coverage period, human rights activist Chirantha Amerasinghe filed a fundamental rights petition related to his arrest in November 2020. Amerasinghe was charged for criticizing the practice of forced cremation on social media.199 The case remained ongoing as of March 2023.200

Many young Tamils have been detained over their social media posts, often for memorializing relatives who died during the civil war.201 In July 2021, a Tamil man was arrested under the PTA for sharing a photo of late LTTE leader Velupillai Prabhakaran on Facebook in 2018.202 In March 2021, the Terrorism Investigations Department (TID) arrested two people in Jaffna for running a website and YouTube channel that allegedly promoted LTTE propaganda. The TID also confiscated computers and other equipment belonging to the individuals.203

Users can freely use encryption tools, though there are some limits to anonymous digital communication. Anticorruption and antiterrorism legislation proposed during the coverage period would further undermine encryption.

In April 2023, the government introduced the Anti-Corruption Bill which would empower magistrates to direct any person providing encryption services to help decrypt information.204 In July 2023, after the coverage period, Sri Lanka’s parliament approved an amended version of the bill without a vote.205 Article 66 of the draft Anti-Terrorism Act (see C2) would similarly require encryption service providers to unencrypt information if ordered to so by a magistrate.206

Legal-name registration is required for mobile phone users under a 2008 Defence Ministry program, which was strengthened in 2010 after service providers failed to ensure that subscribers registered.207 In October 2020, the TRCSL required that all mobile phones be registered with them and announced that SIM cards inserted in newly purchased unregistered phones would not be activated after a certain date. The TRCSL allegedly instituted this requirement to stop refurbished mobile devices from flooding the market.208 Access to public Wi-Fi hotspots requires a citizen’s national identity card number,209 which could be used to track online activity.

Service providers restrict or limit user access to security tools or certain applications. All but two SLT unlimited data plans blocked VPNs, torrents, peer-to-peer (P2P) applications, and Telegram as part of their terms and conditions as of May 2023.210 Dialog Axiata announced it would offer unlimited data plans that restrict the speed of torrenting services and Telegram.211

News sites are required to register under a procedure that requires owners, administrators, and editors to enter their personal details, including addresses, along with the domain name and internet protocol (IP) address of the website, with applications reviewed by a panel appointed by the secretary of the Mass Media Ministry (see B6).212 The form does not refer to a law or indicate the penalty for noncompliance.

In November 2022, an official from the Technology Ministry said citizens’ data would be added to Sri Lanka’s digital biometric identification system by 2024.213 In February 2022, the Indian government agreed to provide Colombo with a grant to introduce the system. Digital identification has been proposed by successive governments since 2017.214

State surveillance of online activities undermines users’ right to privacy, specifically activists and human rights defenders. The constitution does not recognize the right to privacy, though the National Action Plan for the Protection and Promotion of Human Rights 2017–21 contained the objective of ensuring it.215

Authorities have faced allegations of monitoring telephone conversations and social media platforms. In April 2023, claims that the Defence Ministry monitored telephone conversations and information shared on social media platforms such as WhatsApp, Facebook, and Twitter proliferated online.216 The ministry issued a statement calling the allegations “completely false.” In October 2021, an opposition parliamentarian alleged that the Criminal Investigation Department (CID) monitored his WhatsApp phone calls in 2018 and 2019 and called for an investigation into whether the CID had access to Pegasus or other spyware tools.217 In October 2022 the director of the CID was summoned before the parliamentary Committee on Ethics and Privileges to discuss how the CID was able to obtain the opposition member’s WhatsApp call data, but there were no public updates released after his testimony.218

State agencies may possess technologies that facilitate surveillance. In February 2023, Haaretz reported that the digital-services firm S2T had a Sri Lanka office and potentially Sri Lankan clients. S2T offers its clients tracking services, the ability to penetrate closed social media groups, and the means to remotely turn on phone cameras and secretly create recordings.219 In March 2021, an anonymous Twitter user wrote that the Defence Ministry had begun using Pegasus spyware with the cooperation of Dialog Axiata and Mobitel; an opposition parliamentarian also made this claim. Dialog Axiata and the media minister claimed the allegations were false.220 In March 2019, then president Sirisena requested approval for the government to purchase 7.11 trillion rupees ($38.9 million) worth of surveillance technology from an unnamed Israeli company. Bypassing the normal procedures for purchasing such technology, Sirisena claimed the request—which was purportedly related to tackling drug trafficking—was urgent and must be kept secret.221

Digital activists in Sri Lanka believe that Chinese companies ZTE and Huawei, which collaborated with Mahinda Rajapaksa’s government in the development and maintenance of the Sri Lankan information and communication technology (ICT) infrastructure, may have inserted backdoor espionage and surveillance capabilities into these systems.222

The CID and TID reportedly monitor the online space. During the previous coverage period, while discussing the arrests of Tamil youth for posts that allegedly referenced or promoted the LTTE, a government official said that the CID and TID deploy teams that monitor the internet and social media platforms.223 In June 2021, the CID announced the formation of a special team to respond to users spreading false news on social media,224 adding that those users could be arrested without a warrant.225 In March 2021, the Environment Ministry announced it had established a special unit to monitor posts on social media related to environmental destruction.226 In May 2019, the then prime minister announced a plan to implement a Centralized and Integrated Population Information System (CIPIS) to track individuals engaged in terrorism, money laundering, and financial crimes.227 Following the Easter Sunday attacks in 2019, the government indicated its intention to intensify monitoring and surveillance.

Extrajudicial surveillance of personal communications is prohibited under the Telecommunications Act. However, communications can be intercepted on the order of a minister or a court, or in connection with a criminal investigation.

There are some legal requirements for telecommunications companies to aid the government in monitoring users, and companies have reportedly provided data to authorities. Proposals for a Broadcasting Regulatory Commission and the Anti-Terrorism Act would further undermine privacy if implemented.

The proposed Broadcasting Regulatory Commission (see A5), would empower authorities to enter and search the premises of broadcasting services, including electronic media, and seize and detain their records for investigations. 228 Article 63 of the draft Anti-Terrorism Act (see C2) would require service providers to turn over user data to the authorities for investigations related to an overly broad definition of terrorism.229

In March 2022, the government passed the Personal Data Protection Act (PDPA), which establishes a regulatory framework for personal data processed in Sri Lanka. The law will take effect between 2023 and 2025. In February 2023, the state minister of technology said a Data Protection Authority (DPA) would be established by March 2023, but there were no further developments as of May 2023.230 The PDPA limits cross-border data transfers unless the DPA finds that the receiving country has an adequate standard of data protection.231 Civil society and journalists raised serious concerns about the bill, including about the independence of the Data Protection Authority (DPA)—which would not be statutorily independent—and about the lack of exceptions for journalists.232

Section 26 of the PDPA requires government agencies and other public authorities to process personal data within Sri Lanka, with exceptions for certain categories of data.233 In January 2018, SLT opened a tier 3 national data center,234 which hosts local data and serves as a cloud-computing service.235 In June 2021, Dialog Axiata opened a tier 3 facility near Colombo236 while the Orion Stellar Tier 3 center was opened in the Orion City IT Park in Colombo in November.237

In 2013, Dialog Axiata chief executive Hans Wijesuriya denied the existence of a comprehensive surveillance apparatus in Sri Lanka but agreed that telecommunications companies “have to be compliant with requests from the government.”238 In 2016, however, SLT engineers apparently defied orders from their superiors to install equipment purchased for surveillance.239 The nature and number of government requests for data is unknown, since there is no legal provision that requires officials to notify targets.

From July to December 2022, Facebook received 162 requests for data related to 477 users and accounts; 148 were “legal process requests” and 14 were emergency disclosure requests. Facebook at least partially complied with 9.26 percent of the requests.240 Twitter reported 2 requests relating to 36 accounts from July to December 2021, with which the company did not comply.241

Intimidation against both journalists and ordinary users was reported during the coverage period.

Journalists have frequently been the targets of assault, intimidation, and harassment, including during the Aragalaya protests. In July 2022, security forces assaulted a team from the broadcaster Newsfirst, including one journalist from its digital team, Janitha Mendis, as he and his colleagues covered a protest outside then prime minister Wickremesinghe’s residence.242 Also in July 2022, journalist and protester Veranga Pushpika was seized by unidentified men in civilian clothes in Colombo; police later acknowledged that Pushpika had been arrested.243 In June 2022, journalist and activist Tharindu Uduwaragedara was interrogated for four hours by the CID over his YouTube channel, which contained content critical of the government.244 In May 2022 and April 2023, journalist and rights activist Sasikaran Punniyamoorthy, who freelanced for Tamil newspapers and websites, was harassed online, and photos of his family were circulated on Facebook.245

Activists were also intimidated and assaulted in connection with protests. In May 2023, social media activist and Aragayala protester Piyath Nikeshala was pulled out of his car and physically attacked by a group led by Chandika Abeyratne, a former deputy mayor and current member of the SLPP.246 Both Nikeshala and Abeyratne were subsequently hospitalized. Nikeshala alleged the attack was retaliation for a video he posted of Abeyratne.247 In August 2022, YouTuber and activist Rathidu Senaratne was questioned by the Colombo Crime Division for approximately three hours about his role in the Aragalaya. He was eventually arrested for violating a court order during a protest.248 In December 2022, social media activist Dilan Senanayake was stabbed by masked assailants. Police claimed the attack was motivated by misogynistic comments Senanayake had leveled at a female protester during the Aragalaya, which he denied.249

Police often use interrogations to intimidate internet users for their online activities. In May 2023, social media activist Darshana Handungoda was questioned by the CID for eight hours in connection with comments he made in a YouTube video about compensation for the XPress Pearl environmental disaster.250 In September 2022, Selvakumar Nilanthan, a reporter for Tamil Guardian and frequent target of intimidation attempts, was summoned for questioning about alleged links to the LTTE.251

Women are targeted by misogynistic and intrusive posts on social media, especially on Facebook. When stand-up comedian Natasha Edirisooriya faced arrest for uploading a joke deemed derogatory to Buddhism to YouTube (see C3), a flood of misogynistic comments were leveled against her on social media, including calls by Sinhala extremists for her to face severe punishment.252 Intimate images have been shared in Facebook groups without the subjects’ consent, often with abusive or derogatory captions.253 In March 2022, during the previous coverage period, at least one young woman filed a complaint with the CID over the nonconsensual sharing of intimate images.254 She was countersued for defamation, and she and two other women received court injunctions to stop posting about the case on Instagram.

Female activists, lawyers and politicians have also experienced threats and intimidation online that have affected their work.255 A female lawyer who appeared on behalf of families in an enforced-disappearances case was threatened with violence and sexualized abuse on social media.256 During the August 2020 elections, women candidates were also subject to sexualized abuse online.257 LGBT+ individuals were also the target of hate speech and were identified as gay online.

Score Change: The score improved from 1 to 2 because there were no reported attacks against civil society organizations, human rights defenders, or the media.

Government and business websites are vulnerable to hacking and other cyberattacks. Cyberattacks have occasionally targeted government critics, civil society, and the media.258

In May 2023, the official Facebook account of the head of Sri Lanka’s Ministry of Labour and Foreign Employment was temporarily hacked during a live broadcast on labor law amendments, instead linking to pornographic content.259 The Sampath Bank Twitter account was similarly targeted in October 2022.

Hacktivist groups targeted government websites during the 2022 protests, sometimes sharing messages of solidarity with the protesters. In April 2022, during the previous coverage period, the presidential website was inaccessible, likely due to a distributed denial-of-service (DDoS) attack; a Twitter account identified with the Anonymous India hacker group claimed responsibility.260 Other accounts claimed to have targeted government websites, including those of the Sri Lankan police, parliament, and health ministry.261 It is unclear if these claimed hacks disrupted the functioning of the websites they targeted or led to data breaches, but several breached datasets were shared on social media.262

Media sites and journalists have also been targeted during previous coverage periods. In August 2021, news site AdaDerana’s YouTube channel was hacked and streamed videos about cryptocurrency until the media channel regained access the next day.263 In November 2021, the Daily Mirror’s YouTube channel was also hacked, though it was recovered the same day.264

In April 2021, the Colombo Gazette’s news site was subject to a DDoS attack. The motivations of the attack were unclear.265

The Cybersecurity Act, which would establish a Cyber Protection Agency, is expected to include provisions for protection against hacking. The state ministry for technology said they were planning to present it in parliament in 2023 (see C2).266