Expanding Freedom and Democracy
Freedom on the Net 2022

Sri Lanka

Partly Free
48
100
A Obstacles to Access 9 25
B Limits on Content 22 35
C Violations of User Rights 17 40
Last Year's Score & Status
51 100 Partly Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the research methodology and report acknowledgements.

header1 Overview

Internet freedom in Sri Lanka declined during the coverage period as the government sought to repress historic protests. Prompted by government mismanagement of an economic crisis, Sri Lankans began mobilizing in March 2022, including on social media. The protests coalesced into the Aragalaya (Struggle), a countrywide mobilization calling for reforms to the country’s political culture. In response to the protests, authorities briefly blocked social media platforms, arrested online activists and journalists reporting on the movement, and passed new criminal penalties to bar purportedly false information. Despite these restrictions, Sri Lankans continued to engage in digital activism around a broad range of issues.

Sri Lanka experienced improvements in political rights and civil liberties after the 2015 election of President Maithripala Sirisena, which ended the more repressive rule of Mahinda Rajapaksa when he held the presidency. However, the Sirisena administration was slow to implement transitional justice mechanisms needed to address the aftermath of a 26-year civil war between government forces and ethnic Tamil rebels, who were defeated in 2009. Gotabaya Rajapaksa’s election as president in November 2019 and the Sri Lanka Podujana Peramuna’s (SLPP) victory in the August 2020 parliamentary polls emboldened the Rajapaksa family, which worked to empower the executive, roll back accountability mechanisms for civil war–era rights violations, and further militarize the island, while also entrenching themselves in key positions, including the premiership and finance ministry. Mahinda Rajapaksa resigned as prime minister in May 2022 and Gotabaya Rajapaksa resigned as president in July 2022, as the antigovernment protests continued.

header2 Key Developments, June 1, 2021 - May 31, 2022

  • The country’s economic crisis caused daily rolling blackouts starting in March 2022, some as long as 13 hours, limiting access to the internet (see A1).
  • The government briefly blocked multiple social media and communication platforms in April 2022 to hinder protesters who used the internet to mobilize (see A3, B1, and B8).
  • Then president Gotabaya Rajapaksa brought the telecommunications regulator and the state-owned telecommunications provider under presidential control by placing them under the Ministry of Defence in May 2022, raising concerns about their independence (see A5).
  • Gotabaya Rajapaksa declared two states of emergency in April and May 2022; emergency regulations that sought to curb dissent by barring the spread of purportedly false information, including online, were also imposed (see B8, C1, and C2).
  • Law enforcement officials continued to arrest, detain, and intimidate internet users, including journalists, for online posts related to the Aragalaya (see B8, C3, and C7).
  • Hacktivist groups claimed to have hacked government websites in solidarity with protesters, bringing down the presidential website and breaching some government databases, though the extent of the attacks remained unclear (see C8).

A Obstacles to Access

A1 1.00-6.00 pts0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 2.002 6.006

Score Change: This score declined from 3 to 2 as the economic crisis produced daily rolling blackouts, interrupting connectivity for many Sri Lankans.

Although internet access has increased in recent years, the speed and quality of service is inconsistent. There was a steady rise in the number of mobile broadband subscriptions during the coverage period. According to the Telecommunications Regulatory Commission of Sri Lanka (TRCSL), there were over 19.5 million mobile broadband subscriptions and 2.7 million fixed-line broadband subscriptions as of May 2022.1 According to DataReportal’s Digital 2022 report, in contrast, there were 11.3 million Sri Lankan internet users as of January 2022 and an internet penetration rate of 52.6 percent.2

From March 2022 through the end of the coverage period, people in Sri Lanka experienced daily rolling power cuts, some of which lasted as long as 13 hours, because a shortage of foreign currency limited fuel purchases.3 The power cuts disrupted internet access, interrupting online education and private-sector activities.4 Some Dialog Axiata users saw a decline in connectivity in late March, coinciding with the onset of protests. Some protesters reported they could not connect to mobile services during early-April demonstrations at the presidential secretariat, either due to network congestion or deliberate interference.5

The government is interested in expanding internet access and digital infrastructure projects. In a 2019 manifesto, then president Gotabaya Rajapaksa laid out plans to make Sri Lanka “digitally inclusive” by 2024, including by developing a high-speed optical transmission system and fifth-generation (5G) mobile broadband countrywide.6 As part of this plan, a tech park in Galle will launch by 2023 with 5G facilities.7 In November 2021, then finance minister Basil Rajapaksa said the TRCSL would offer 5G-capable spectrum licenses in an upcoming frequency auction;8 the economic crisis slowed the rollout of the auction. The TRCSL has launched a program aimed at improving 4G connectivity in rural areas in collaboration with major mobile service providers.9

Service provider Dialog Axiata has its own program to expand rural 4G connectivity.10 According to a November 2021 press report, the Sri Lankan government was in preliminary talks with American aerospace company SpaceX to provide Starlink, a satellite-based system, in the country.11 Service providers Dialog Axiata,12 Hutch,13 and Airtel14 conducted 5G trials in 2021 and 2022. State-owned Sri Lanka Telecom (SLT) is also working to establish 5G services, though its rollout may be delayed past 2022.15 SLT has continued to invest in connectivity infrastructure, including fiber-optic and fiber-to-home connections, and had reportedly spent 1.5 billion Sri Lankan rupees ($7.3 million) in 5G-related technologies as of December 2021.16

A2 1.00-3.00 pts0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 1.001 3.003

Mobile internet connectivity is affordable, although gender-based and urban-rural digital divides persist. According to UK-based Cable’s 2022 study of global internet prices, Sri Lanka’s average monthly price for fixed-line broadband was 4,420 rupees ($14.99), compared to a mean household income of 57,292 rupees ($283.01) per the 2019 Household Income and Expenditure Survey.1 Prices for mobile broadband vary.2 Mobile users pay an average rate of 75 rupees ($0.38) for 1 gigabyte (GB) of data, according to Cable, which ranks Sri Lanka the ninth-cheapest country in the world in terms of absolute data-only mobile-broadband plan cost, though prices and the relative cost of mobile internet fluctuated during the country’s economic crisis.3

In April 2022, the TRCSL announced that Airtel would shut down its 3G network by June, compelling subscribers to upgrade to 4G-enabled mobile phones.4 The government increased a telecommunications tax from 11.25 percent to 15 percent in May 2022, reversing a 2019 tax cut as it implemented a package of tax increases to address the economic crisis..5

Urban residents benefit from infrastructural advantages and are better connected to the internet. The province with the highest percentage of households accessing the internet is the Western Province, the country’s most populous,6 where Colombo and other urban areas boast well-developed infrastructure. A September 2020 survey of 87 Sri Lankans, mostly from urban areas, found that half had increased spending on internet connections during the coronavirus pandemic; the proportion of those spending more than $15 per month doubled, from 16 to 37 percent of respondents.7 Government statistics for the first half of 2021 found 47.1 percent of Western Province residents to be computer literate,8 a category that excludes those whose only digital literacy is through smartphones or tablets; the national rate stood at 35 percent. By comparison, the national digital literacy rate, which accounts for more types of devices, is 56.2 percent.9

Though the civil war, which ended in 2009, delayed infrastructure development in the Northern and Eastern provinces, the telecommunications infrastructure in these provinces has recently improved and led to steady growth in internet usage. In 2021, 29.1 percent of Northern Province and 28.9 percent of Eastern Province residents were categorized as computer literate.10 Compared to urban areas, rural and up-country Tamil communities have significantly lower computer and digital literacy rates.11

Only an estimated 34 percent of households with children have an internet connection as of 2019, and 48 percent of households with children have a smartphone or computer, cutting many students off from e-learning initiatives.12 In February 2021, the Education Ministry’s information technology (IT) director warned that only 30 percent of the student population had access to, or could effectively afford, remote learning during the coronavirus pandemic. The government also broadcasts lessons on television and radio.13

A3 1.00-6.00 pts0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 3.003 6.006

Score Change: The score declined from 4 to 3 because authorities imposed a 16-hour block on social media platforms to restrict internet access by protesters.

In April 2022, the government blocked social media and communications platforms for about 16 hours as the Aragalaya intensified. The blocks—which covered social media platforms like Facebook, Twitter, and YouTube and messaging apps like WhatsApp, Viber, and Telegram—were ordered by the Ministry of Defence, according to the TRCSL. They followed then president Rajapaksa’s declaration of a state of emergency. A three-day curfew was also declared, designed to suppress the protests (see B8).1 Some Sri Lankans reported difficulty accessing the internet during protests in April, with some speculating that the government disrupted signals; the connectivity issues may have been related to congestion or infrastructural problems.2

The government had blocked social media platforms repeatedly in April and May 2019 in the wake of the Easter Sunday suicide attacks at churches and hotels.3 For nine days directly following the attacks, Facebook, WhatsApp, YouTube, Instagram, Snapchat, and Viber were all blocked, as was at least one popular virtual private network (VPN).4

Sri Lanka has access to multiple international cables, but most of the landing stations for these cables are controlled by SLT, giving the government control over internet infrastructure.5 SLT is a consortium member for the Singapore–France SEA-ME-WE submarine cable, having reportedly planned to invest $60 million.6 A Maldives–Sri Lanka submarine cable system built by Huawei Marine Networks with Dialog Axiata as a partner was ready for service in February 2021.7

A4 1.00-6.00 pts0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 3.003 6.006

Sri Lanka’s retail tariffs are among the lowest in the world, though the diversity of service providers is limited due to the dominance of some companies, particularly the majority government-owned SLT.

There are three ISPs besides SLT in Sri Lanka.1 SLT remains a key player in the information and communication technologies (ICT) market, and the firm imposes price barriers by forcing competing service providers to lease connectivity from SLT, which charges high rates.2

Dialog Axiata remains the country’s largest mobile service provider, with over 17.6 million subscribers as of March 2022.3 SLT Telecom and Mobitel, a mobile service provider and subsidiary of SLT, reorganized their operations under the SLT-Mobitel brand in January 2021.4 SLT-Mobitel is the second largest mobile service provider, with over 10.2 million subscribers at the end of 2021.5 Hutch had almost 3.9 million active customer accounts reported in 2021,6 while Airtel had 2.9 million subscribers.7

The TRCSL announced that it had ordered service providers to implement number portability, which would allow customers to change their service providers without changing their phone number, by May 2022 in an effort to compel ISPs to provide better service in order to retain customers. Legal approval was granted in October 2021.8

In 2016, SLT announced that it would provide a global connectivity backhauling facility via Sri Lanka, thereby allowing the company to cross-connect to other cable systems and increase capacity.9 In August 2018, the government removed telecommunications floor rates for call charges in hopes of increasing competition among service providers.10 The competitive nature of the market has led to some legal battles. In August 2018, for example, the Commercial High Court rejected Dialog Axiata’s petition against SLT, in which Dialog Axiata accused SLT of violating intellectual property rights.11

Under the Telecommunications Act, ISPs are licensed by the Telecommunications Ministry, but the ministry can follow TRCSL recommendations on granting a license and require providers to address any matter considered “requisite or expedient to achieving” TRCSL objectives.12 In November 2021, the government announced the TRCSL would auction new licenses in 2022, including for fixed-line operators, mobile service providers, ISPs, and satellite broadcasting operators.13

A5 1.00-4.00 pts0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 0.000 4.004

The national regulatory bodies overseeing service providers lack independence, and frequently do not act in a fair manner.

The TRCSL was established under the Sri Lanka Telecommunications (Amendment) Act, No. 27 of 1996. As the national regulatory agency for telecommunications, the TRCSL’s mandate is to ensure the provision of effective telecommunications, protect the interests of the public, and maintain effective competition between service providers.

In May 2022, then president Rajapaksa reorganized the TRCSL, SLT, and the Information and Communication Technology Agency (ICTA) under the Ministry of Defence, leading to concerns about the bodies’ independence.1 The decision reversed a November 2020 move to bring those and other bodies under the Technology Ministry, which is also under presidential purview.2 In June 2022, after the coverage period, the TRCSL, SLT, and ICTA were brought under the Technology Ministry again.3

The TRCSL has been criticized in the past for poor regulatory practices, lack of transparency in recommending whether a telecommunications provider should receive a license, and instances of preferential treatment.4 The agency has sometimes solicited public input on its decisions, as with a call for consultation on number portability in February 2021, during the previous coverage period.5 Analysts have asserted that spectrum allocation and refarming— the more efficient reallocation of spectrum— have been administered in an ad hoc manner, though procedural transparency has improved over time.6

Under Mahinda Rajapaksa’s 2005–15 presidency, many of the TRCSL’s interventions to restrict online content and pronouncements on strengthening internet regulations were partisan and extralegal.7 In 2017, the Colombo High Court sentenced former TRCSL chairperson Anusha Palpital and former presidential secretary Lalith Weeratunga to three years in prison and fined them for misappropriating TRCSL funds for Rajapaksa’s presidential campaign.8 They were acquitted on appeal in November 2020.9

Successive regimes have chosen political allies to head the TRCSL. A former chairman, Jayantha de Silva, served as secretary to the Technology Ministry between June and August 2022.10 A former director general, Oshada Senanayake, publicly advocated for a Gotabaya Rajapaksa presidency when speaking to a convention of academics and professionals.11

B Limits on Content

B1 1.00-6.00 pts0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content, particularly material that is protected by international human rights standards? 4.004 6.006

The government does not systematically block or filter websites and other forms of online content, although a few independent websites and other sites are blocked and authorities briefly blocked social media platforms in April 2022 to limit online mobilization (see A3 and B8).

The Open Observatory of Network Interference has reported signs of HTTP blocking for several websites. For instance, the websites of Al Arabiya,1 LGBT+ rights organization Kaleidoscope Trust,2 and indexing resource Ping-o-matic3 showed signs of HTTP blocking on some networks during the coverage period.

Sankanthi24.com, a Tamil news site, first showed signs of being blocked in June 2020 and continued to show signs as of March 2022 on Dialog Axiata and SLT connections.4 Adult dating site adultfriendfinder.com also showed signs of HTTP blocking on Dialog Axiata connections from September 2020 to February 2022.5 The official website of the US Navy’s Sea, Air, and Land (SEAL) teams showed signs of TCP/IP blocking from June 2020 to May 2022 on both Dialog Axiata and SLT connections.6 US-based news site Jezebel, which appeared to have been affected by domain name system (DNS) tampering on Dialog Axiata connections during the previous coverage period, was accessible as of April 2022.7 News site Lankaenews appeared to be accessible during the coverage period, though it had been inaccessible previously. The website was reportedly blocked for publishing stories critical of then president Sirisena.8

SLT’s unlimited data packages, which became available in April 2021, block torrents, peer-to-peer (P2P) applications, and Telegram under their terms and conditions (see C4).

The government previously blocked social media and communication platforms three times in April and May 2019, in the aftermath of the Easter Sunday attacks, and once for over a week in March 2018 in response to violence in Kandy (see A3). Authorities claimed the restrictions were necessary to stop the spread of disinformation and hateful content, as well as to limit sectarian violence during the politically tense period following the attacks.9 The restrictions prevented access to independent news sources and limited users’ ability to contact those in areas affected by the crisis.10

B2 1.00-4.00 pts0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content, particularly material that is protected by international human rights standards? 3.003 4.004

In recent years, the Sri Lankan government has considered instituting a legal framework to curb online speech it considers discriminatory or defamatory along with speech it considers misleading.1 The government also issued takedown requests during the reporting period.

Between July and December 2021, Facebook only restricted content in Sri Lanka as a part of global restrictions; a review also found that access to 10 items was mistakenly restricted and was then restored.2 In the same period, Google received removal requests for 76 items and removed 7; 26 requests were made for privacy and security reasons, 17 for national security reasons, and 16 for defamation.3 Twitter received no removal requests in that period.4

During the previous coverage period, Facebook restricted access to 1,643 items to adhere to election guidelines related to the August 2020 parliamentary polls, and one piece of content for violating privacy laws.5

In January 2022, the editor of the Tamil Guardian news site alleged that the government played a role in content restrictions on the outlet’s Instagram account. Instagram removed dozens of posts and suspended the Tamil Guardian’s account twice, usually in relation to posts featuring Tamil nationalist protests and notable figures from the Liberation Tigers of Tamil Eelam (LTTE). The group falls under a policy on dangerous individuals and groups enacted by Instagram’s parent company, Meta.6

In November 2021, SLT initiated legal action against parliamentarian Manusha Nanayakkara for defamation, after he repeatedly claimed that SLT was hosting the National Medical Authority database and had intentionally deleted files from it.7 Prior to the suit, SLT demanded that Nanayakkara remove the comments from social media and issue a correction.

B3 1.00-4.00 pts0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 2.002 4.004

There is a lack of transparency around restrictions of online content, but a 2017 right to information (RTI) request revealed that the Mass Media Ministry and Presidential Secretariat can send blocking orders to the TRCSL for reasons including “publishing false information” and “damaging the president’s reputation.” 1 2 The TRCSL then instructs ISPs to block the content. Following the April 2022 social media blocks (see A3 and B1), civil society groups filed RTI requests with the TRCSL for records3 and a fundamental rights petition to the Supreme Court.4 There are no records of ISPs challenging the TRCSL’s blocking orders at the commission itself or through the court.

It is not clear if the TRCSL can impose financial or legal penalties on telecommunications companies that do not comply with blocking orders, since the conditions of such orders are unknown to the public.

There is no independent body regulating content, which leaves few avenues for appeal (see A5). Content providers have filed fundamental rights applications with the Supreme Court to challenge blocking orders,5 but under former president Mahinda Rajapaksa, the lack of public trust in the politicized judiciary and fear of retaliatory measures presented significant obstacles for would-be petitioners.6

After the November 2019 presidential election, the government has sought to introduce a regulatory framework modelled after Singapore’s Protection from Online Falsehoods and Manipulation Act to allow the immediate removal of social media posts that included hate speech or misinformation.7 In October 2021, the Justice Ministry said it was formulating draft legislation aimed at curbing online posts considered false, misleading, and hateful.8

There have been increasing efforts from domestic actors—including government officials, civil society, and fact checkers—to work with international technology companies.9 In March 2020, Facebook committed to removing false coronavirus-related claims or conspiracy theories flagged by global and local health authorities.10 Also in March, it was reported that the Elections Commission (EC) would be working with officials from Facebook, Twitter, and YouTube to monitor content during that August’s polls and to ensure the platforms would not be misused for content like hate speech.11 A report from youth group Hashtag Generation noted that Facebook did remove several instances of election-related hate speech, false news, and targeted harassment reported to them by the EC during the elections.12

In May 2020, Facebook released an impact assessment report which highlighted improvements in its content-removal policies to address previous failures to remove hateful Sinhala-language content that encouraged anti-Muslim violence in March 2018.13 Members of civil society noted shortfalls in the report in terms of guidance in local languages for Sri Lankan users.14 In October 2021, leaked documents revealed that several Sri Lankan people and organizations—including the LTTE, the Sinhala National Force, and anti-Muslim monastic Galagoda Aththe Gnanasara—were listed on Facebook’s Dangerous Individuals and Organizations List, indicating that content related to them is subject to greater enforcement.15

B4 1.00-4.00 pts0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 2.002 4.004

While self-censorship by journalists declined under the Sirisena administration, journalists have since proceeded with caution when reporting on subjects that are considered sensitive. Sri Lankan internet users were vocal in their criticism of the government’s handling of the economic crisis throughout 2022 (see B8).1

Threats against journalists (see C7) and emergency regulations criminalizing false information (see C1) during the coverage period raised concerns about escalating self-censorship.2 People also experienced direct retaliation for supporting the Aragalaya: for example, television presenter Parami Nileptha Ranasinghe was barred from anchoring programs for the state-run television network in March 2022 or entering its offices over Facebook posts criticizing the Rajapaksa government.3

In November 2021, the Ministry of Home Affairs reportedly warned that disciplinary action would be taken against public servants who criticized the government and its policies on social media, citing the Establishments Code, which outlines the duties of government employees working as public servants.4

In February 2021, the Office of the UN High Commissioner for Human Rights raised concerns that the surveillance and harassment reported by over 40 civil society organizations was having a “chilling [effect on] civic and democratic space and leading to self-censorship.”5 Immediately following the November 2019 election of Gotabaya Rajapaksa, journalists and activists reported an increase in self-censorship around political issues. 6

In previous years, journalists have noted a tendency to self-censor when covering the president and the first family.7 Harassment and intimidation leveled against journalists may also contribute to self-censorship (see C7). Members of Tamil and Sinhala media outlets have reportedly faced increased pressure from officials to self-censor in past years.8 Journalists have previously said they were hesitant to criticize the Rajapaksas or write on sensitive topics including rights violations, the army, corruption, missing people, and land appropriation.9 A few prominent anonymous Twitter accounts sharing satirical or other forms of political speech, notably on Tamil issues or focused on the north of the country, closed their accounts after the 2019 elections due to security concerns.10

Under former president Sirisena, self-censorship by journalists online appeared to decrease, in part due to the government’s stated commitment to press freedom. Both traditional and online media outlets expressed a diversity of political viewpoints, including criticism of the government.

B5 1.00-4.00 pts0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 2.002 4.004

The spread of disinformation and misinformation has been a growing concern in recent years. During the protests, researchers found that proxy accounts and Facebook pages associated with or supportive of the Rajapaksa family disseminated content aiming to discredit the protests. For example, Sinhala-language content portrayed the protests as funded by “external” forces.1

Research conducted from July to December 2021 identified politically motivated false information campaigns on Facebook and WhatsApp, predominately targeting activists and left-wing opposition parties.2 During the previous coverage period, disinformation increased in the lead-up to and during the August 2020 parliamentary elections, some of which originated from political parties and candidates. For example, one candidate implied that the elections commissioner was attempting to limit voter turnout in an interview shared on Facebook. Several political candidates also questioned the integrity of the vote-counting process on social media.3

A 2020 report from the Oxford Internet Institute identified the existence of cybertroop teams in Sri Lanka that manipulated information on social media on behalf of politicians and political parties.4 The report found evidence that Sri Lankan teams work to support preferred messaging, attack the opposition, create division, and suppress critical content.

B6 1.00-3.00 pts0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 2.002 3.003

Some government regulations threaten the economic viability of online publishers and start-up platforms.1 Based on guidelines issued in 2019,2 websites were required to register with the Mass Media Ministry starting in 2020 to receive media accreditation, which websites need to cover certain events and engage in field reporting.3 In July 2021, news site MediaLK was reportedly denied accreditation; the Mass Media Ministry claimed that its founder, Tharindu Jayawardhana, had not received clearance from the Ministry of Defence, possibly in retaliation for the outlet’s reporting on senior police officials.4

The government also maintained news site registration requirements introduced by previous administrations. During Mahinda Rajapaksa’s presidency, the Mass Media Ministry directed all news sites to register for a fee of 25,000 rupees ($122), with an annual renewal fee of 10,000 rupees ($49).

B7 1.00-4.00 pts0-4 pts
Does the online information landscape lack diversity and reliability? 3.003 4.004

Diverse content is generally available online. Social media and communication platforms and blogs are popular and widely available, spurring local debate. Sources of information in English, Sinhala, and Tamil are available online, including on socioeconomic and political issues, despite a history of censorship and instances of intimidation targeting online journalists during the reporting period (see C7).

Sri Lankans rely on several online outlets or companion websites for news and information, which are local and regional in scope. Sites such as Roar Media,1 Watchdog,2 Readme.lk,3 Groundviews, Vikalpa, Maatram,4 manthri.lk,5 MediaLK,6 Counterpoint,7 and Anidda8 cover a range of political, social, and economic issues. There have been a number of new initiatives from nonprofits, such as Divide, which examines the gaps between Sinhala– and Tamil-language newspapers in their reporting on gender, minority groups, transitional justice, and political reconciliation.9 Sri Lanka’s online environment also benefits from the virtual Museum of Religious Freedom10 and Historical Dialogue’s memorialization initiatives.11

Misinformation spread by ordinary users is a problem in Sri Lanka. Misinformation about coronavirus cures, vaccines, and mask exemptions circulated during the COVID-19 pandemic.12 For instance, health officials warned that an “organised misinformation campaign” led to unusually high vaccine hesitancy among young people.13 False and manipulated information quickly spread after the 2019 Easter Sunday attacks.14 Inflammatory speech has been amplified and shared on platforms like Facebook.15 Following communal riots in Ampara and Digana, Facebook’s slow response to inflammatory online speech, such as content that implored followers to “kill all Muslims, don’t even save an infant,” became an international concern. The platform has since introduced a misinformation policy in July 2018 (see B3).16 In June 2021, Facebook partnered with the Asia Foundation to launch the Resiliency Initiative, which aims to combat hate and intolerance online; several civil society groups participated in workshops ahead of the initiative’s launch.

B8 1.00-6.00 pts0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 4.004 6.006

Score Change: The score declined from 5 to 4 after government officials arrested online organizers and imposed new criminal penalties to restrict mobilization on social media.

The internet has provided an avenue for robust digital activism and engagement on political issues in Sri Lanka. The 2022 Aragalaya was partly mobilized online.

In early 2022, Sri Lankan internet users criticized the government’s handling of the economic crisis with the #powercutlk and #economiccrisislk hashtags, documenting shortages of vital goods due to the foreign currency shortage.1 In March 2022, Sri Lankan internet users called for Gotabaya Rajapaksa’s resignation through the hashtags #GoHomeGota and #GotaGoHome, mirroring offline protest slogans, along with a range of other anti-Rajapaksa hashtags like #GoHomeRajapaksas and #පන්නමු (“Let’s drive them out”). As the year continued, Sri Lankans mobilized in significant offline protests and actions, including a monthslong occupation of the Galle Face Green, protests outside of the parliament in May, and the storming of the presidential residence in July.2

Authorities deployed a range of restrictions in an attempt to suppress the protests, though Sri Lankans continued to mobilize online. In April 2022, the government blocked social media and communications platforms in an attempt to limit mobilization (see A3 and B1). Then youth and sports minister Namal Rajapaksa posted on Twitter that access to VPNs made such blocks “completely useless” and disclosed that he was using a circumvention tool.3 Police arrested activists who mobilized the protests online, such as an administrator of the #GoHomeGota Facebook page (see C3).4 Then president Rajapaksa declared states of emergency in April and in May, and emergency regulations imposed in May made sharing information considered false or that might “cause public alarm” or “disorder” an offense, threatening social media users who posted about ongoing protests (see C1 and C2).5

In May, after progovernment forces attacked protesters throughout the country, then prime minister and former president Mahinda Rajapaksa resigned. In July 2022, after the coverage period and following months of sustained protests, then president Gotabaya Rajapaksa resigned after fleeing to Singapore. Ranil Wickremesinghe was named president in late July.6 The protests continued after the coverage period; President Wickremesinghe responded by ordering police sweeps, declaring a state of emergency, and passing laws to restrict protests, leading to widespread arrests.7

Previously, most online campaigns registered uneven progress in achieving their goals. Online campaigns have generally been prompted by discrete events, crises, or stalled political processes, and campaigners have been unable to gather the momentum needed to drive meaningful change and long-term citizen participation. People have used hashtags to discuss elections, as well as to share developments following the Easter Sunday attacks.8

Activists and civil society groups have also used hashtags to draw attention to issues including disappearances in the nation’s north and east during the civil war, cases of detention under the controversial Prevention of Terrorism Act (PTA), and the continued marginalization of estate workers and of the Tamil population.9 Women in media also shared experiences of sexual harassment at their workplaces using the #MeToo hashtag.10

C Violations of User Rights

C1 1.00-6.00 pts0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 2.002 6.006

Although internet access is not guaranteed as a fundamental right in legislation, Article 14 (1)(a) of the constitution protects freedom of expression, subject to restrictions related to the protection of national security, public order, racial and religious harmony, and morality. There are no specific constitutional provisions guaranteeing freedom of expression online.

Then president Rajapaksa declared a state of emergency twice during the coverage period, in April and May 2022.1 The second state of emergency was accompanied by emergency regulations that criminalized “communication or spreading of rumors and false information,” including online, in an effort to curb dissent (see B8 and C2).2 After the coverage period, President Wickremesinghe declared a state of emergency in July, lasting into mid-August.3

In January 2021, the cabinet approved a proposal to amend the 1970s-era Press Council Law to regulate new outlets and electronic media in addition to print media.4 Civil society and media rights groups have expressed worries that the amendments would expand the government’s control over online media and online speech.5

After the Easter Sunday attacks, the government declared a state of emergency and passed emergency regulations which created a new authority appointed by the president.6 7 This authority could limit the publication of materials, including online materials, which included content deemed threatening to national security or disruptive to public order or the provision of essential services and require content be reviewed before being published. The regulations also prohibited the spread of false statements that could cause public disorder or alarm. People could appeal decisions made by the authority to new advisory committees. The Easter Sunday–related state of emergency was lifted in August 2019.8

Since the passage of the Right to Information Act in 2017,9 citizens have submitted thousands of RTI applications on issues ranging from legislation on the rights of people with disabilities to the blocking of websites (see B3).10

C2 1.00-4.00 pts0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities, particularly those that are protected under international human rights standards? 1.001 4.004

Several vaguely defined, overly broad laws can be abused to prosecute users and restrict online expression.

The May 2022 emergency regulations (see C1) criminalized the communication of “any rumor or false statement or any information,” including online, deemed likely to cause “public alarm, public disorder, or racial violence,” or otherwise likely to incite a crime. Violators could receive three-month-to-five-year prison terms or fines of 500 ($2.49) to 5,000 rupees ($24).1

Vague amendments to the criminal and penal codes, which criminalize the spread of “false news” affecting “communal harmony” or “state security” and impose fines of more than one million rupees ($4,900) and a maximum five-year prison sentence, were approved by the cabinet in 2019. The amendments were not passed by Parliament as of May 2022.2 The government reportedly approved concept papers for penal code amendments to criminalize false news in March 2021.3 In June 2021, the police cited a number of existing laws which could be used to arrest people for spreading misinformation, including sections of the penal code, the International Covenant on Civil and Political Rights (ICCPR) Act, the Computer Crime Act, the PTA, and sections of the Obscene Publications Act.4

Publishing official secrets, information about Parliament that may undermine its work, or “malicious” content that incites violence or disharmony can result in criminal charges.5 Then government information director general Sudarshana Gunawardana stated in March 2018 that incitement to violence, including on social media, is contrary to Article 28 of the constitution and Section 100 of the penal code, as well as Section 3 of the ICCPR, to which Sri Lanka is a party.6 In January 2022, a senior police official claimed that law enforcement officers were legally able to arrest individuals who insult the president on social media.7

In February 2020, the foreign minister told the United Nations that the government would review and amend the PTA rather than pass the draft Counter Terrorism Act proposed by the previous government.8 The PTA has been used to crack down on critical online content, including speech from journalists, and detain writers, lawyers, and activists (see C3).9 Draft amendments to the PTA proposed in January 202210 retain broad definitions of terrorism and fail to adequately protect freedom of expression and other rights, according to Sri Lankan civil society11 and UN experts.12

Authorities have increasingly manipulated the ICCPR Act, which enshrines the ICCPR in Sri Lankan domestic law, to criminalize online speech (see C2).13 Section 3(1), for example, prohibits national, racial, and religious hatred if it incites discrimination, hostility, and violence. Those charged under the act can only be granted bail by a high court.

In April 2021, the Sunday Morning Business reported that the text of a draft Cybersecurity Act would be settled later that year.14 In October 2021, the cabinet approved the draft Defence Cyber Commands Act15 and a draft bill for cybersecurity concerns outside of defense. The latter bill also called for the establishment of a Cyber Protection Agency.16 Civil society expressed worries that broad definitions in the initially proposed Cybersecurity Act could allow the government to misuse the law against private institutions and impact privacy.17

C3 1.00-6.00 pts0-6 pts
Are individuals penalized for online activities, particularly those that are protected under international human rights standards? 3.003 6.006

During the coverage period, internet users were prosecuted in retaliation for their online activities, including criticism of the government and participation in the Aragalaya.

Several people were arrested in relation to their role in the Aragalaya. In April, activist Anuruddha Bandara, who was the administrator for a #GoHomeGota Facebook group, was arrested and held for questioning over his social media posts. He was granted bail the next day,1 and later filed a fundamental rights petition at the Supreme Court.2 Charges against Bandara were dropped in June.3 In May, a bakery owner was questioned in relation to cyberbullying; she had criticized supporters of the Rajapaksa family on social media.4 Throughout May, internet users were arrested for allegedly inciting violence.5 Journalists also faced repercussions for social media posts about the protests. For example, in April, police interrogated Tamil journalists Selvakumar Nilanthan and Punniyamoorthy Sasikaran, and separately questioned their family members, apparently in relation to their social media posts documenting the protests.6

Authorities also summoned and questioned journalists and others working for online news outlets for other conduct. In August 2021, police arrested Keerthi Ratnayake, a writer for the news site Lankaenews, over a warning he gave about a possible attack on a foreign mission. He was detained under the PTA.7 The court eventually allowed him to post bail in February 2022.8 The editor of Lankaenews alleges that Ratnayake was arrested in retaliation for articles critical of the government.9

In June 2021, an opposition lawmaker alleged that 100 young people had been arrested on PTA charges over Facebook posts. One child tried to create a political party on Facebook and was arrested that month, according to the parliamentarian.10

Several people were arrested for online speech about COVID-19. In August 2021, the Criminal Investigation Department (CID) questioned a doctor for his Facebook post about a hospital that faced a rising number of COVID-19 patients.11 Another individual was arrested that same month for posting a doctored photograph depicting COVID-19 deaths in a Sri Lankan hospital on social media.12 A consumer-rights advocate was arrested in June 2021 in relation to social media posts about the University of Oxford–AstraZeneca vaccine.13

In November 2021, human rights activist Chirantha Amerasinghe filed a fundamental rights petition against his arrest in November 2020. Amerasinghe was charged for criticizing the practice of forced cremation on social media.14 The case remains ongoing as of April 2022.

In November 2020, freelance journalist Murugupillai Kokulathasan was arrested in secrecy in Batticaloa for posting photographs related to the LTTE; however, Reporters Without Borders (RSF) received several reports that he had uploaded a note to Facebook detailing events commemorating those who were killed during the country’s civil war.15 Kokulathasan received bail in March 2022 after being held for 15 months, but still faced PTA-related charges.16

Sri Lankans also face arrest for everyday social media posts. In June 2021, a Galle resident was arrested over a “defamatory” Facebook post referring to the sinking of a vessel and subsequent pollution but was bailed the same day.17 In May 2021, during the previous coverage period, a Kotmale state officer was arrested over Facebook photographs purported to show deforestation; the CID said the photographs actually showed a private land clearing.18

Many young Tamils are being detained over their social media posts.19 In July 2021, a Tamil man was arrested under the PTA for sharing a photo of late LTTE leader Velupillai Prabhakaran on Facebook in 2018.20 In March 2021, during the previous coverage period, the Terrorism Investigations Department (TID) arrested two people in Jaffna for running a website and YouTube channel that allegedly promoted LTTE propaganda. The TID also confiscated computers and other equipment belonging to the individuals.21

Individuals have faced detention for posts related to the Easter Sunday attacks as well as religious content. In April 2021, during the previous coverage period, a 19-year-old from Gampola was arrested under the ICCPR, the penal code, and the Police Ordinance for allegedly posting that the country should “get ready for another easter attack” in response to the government banning the burqa.22

C4 1.00-4.00 pts0-4 pts
Does the government place restrictions on anonymous communication or encryption? 2.002 4.004

Users can freely use encryption tools, though there are some limits to anonymous digital communication. Legal-name registration is required for mobile phone users under a 2008 Defence Ministry program which was bolstered in 2010 after service providers failed to ensure that subscribers registered.1 In October 2020, the TRCSL required all mobile phones to be registered with them and announced that SIM cards on newly purchased unregistered phones would not be activated after a certain date. The TRCSL allegedly instituted this requirement to stop refurbished mobile devices from flooding the market.2 Access to public Wi-Fi hotspots requires a citizen’s national identity card number,3 which could be used to track online activity.

Service providers restrict or limit user access to security tools or certain applications. All but two SLT plans blocked VPNs, torrents, P2P applications, and Telegram as part of their terms and conditions as of April 2022.4 Dialog Axiata also announced it would be offering unlimited data plans which also restrict the speed of torrenting services and Telegram.5

News sites are required to register under a procedure that requires owners, administrators, and editors to enter their personal details, including addresses, along with the domain name and internet protocol (IP) address of the website, with applications reviewed by a panel appointed by the ministry secretary (see B6).6 The form does not refer to a law or indicate the penalty for noncompliance.7

C5 1.00-6.00 pts0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 2.002 6.006

State surveillance of online activities undermines users’ right to privacy. The constitution does not recognize the right to privacy, though the National Action Plan for the Protection and Promotion of Human Rights 2017–21 contained the objective of ensuring it.1

In March 2021, an anonymous Twitter user wrote that the Defence Ministry had activated the Pegasus spyware suite with the cooperation of Dialog Axiata and Mobitel; an opposition parliamentarian also made this claim. Dialog Axiata and the media minister, however, claimed the allegations were false.2 In October 2021, an opposition parliamentarian alleged that the CID had monitored his WhatsApp phone calls in 2018 and 2019, and called for an investigation into whether the CID had access to Pegasus or other spyware tools.3

In February 2022, the Indian government agreed to provide Colombo with a grant to introduce a unitary digital identity system, with the Sri Lankan cabinet prioritizing the envisioned system’s national-level implementation. Digital identification has been proposed by successive governments since 2017.4

The pandemic-related use of mobile apps and tracking tools raised privacy concerns (see C6).5 There was a lack of transparency about how data collected from a government-developed app can be used and stored.6 In an April 2020 interview, the defense minister disclosed that military intelligence was receiving mobile-phone contacts of patients from service providers.7

Following the Easter Sunday attacks, the government indicated its intention to ramp up monitoring and surveillance. During the previous coverage period, while speaking about the arrest of individuals for posts which allegedly referenced or promoted the LTTE propaganda, a government official said that the CID and TID deploy teams that monitor the internet and social media platforms.8

In June 2021, the CID announced the formation of a special team to respond to the spread of false news on social media,9 adding that people could be arrested without a warrant. 10 In March 2021, the Environment Ministry announced it had established a special unit to monitor posts on social media related to environmental destruction.11 In May 2019, the then prime minister announced a plan to implement a Centralized and Integrated Population Information System (CIPIS) to track individuals engaged in terrorism, money laundering, and financial crimes.12

Extrajudicial surveillance of personal communications is prohibited under the Telecommunications Act. However, communications can be intercepted on the order of a minister or a court, or in connection with a criminal investigation.

State agencies reportedly possess some technologies that could facilitate surveillance. In March 2019, then president Sirisena requested approval for the government to purchase 7.11 trillion rupees ($38.9 million) worth of surveillance technology from an unnamed Israeli company. Bypassing the normal procedures for purchasing such technology, Sirisena claimed the request—which was purportedly related to tackling drug trafficking—was urgent and must be kept secret.13

Digital activists in Sri Lanka believe that Chinese companies ZTE and Huawei, which collaborated with Mahinda Rajapaksa’s government in the development and maintenance of the Sri Lankan ICT infrastructure, may have inserted backdoor espionage and surveillance capabilities.14

C6 1.00-6.00 pts0-6 pts
Does monitoring and collection of user data by service providers and other technology companies infringe on users’ right to privacy? 3.003 6.006

There are some legal requirements for telecommunications companies to aid the government in monitoring users, and companies have reportedly provided data to authorities.

In March 2022, the government passed the Personal Data Protection Act (PDPA), which establishes a regulatory framework for personal data processed in Sri Lanka. The law will take effect between 2023 and 2025.1 Civil society and journalists raised serious concerns about the bill before its second reading, including about the independence of the Data Protection Authority (DPA)—which is designated by the government and not independent by statute—and about the lack of exceptions for journalists.2

During the COVID-19 pandemic, the country integrated its defense apparatus into its pandemic response. Military intelligence agencies have obtained personal data from mobile service providers to identify people who have interacted with patients or evaded quarantines (see C5).3

In 2013, Dialog Axiata chief executive Hans Wijesuriya denied the existence of a comprehensive surveillance apparatus in Sri Lanka but agreed that telecommunications companies “have to be compliant with requests from the government.”4 In 2016, however, SLT engineers apparently defied orders from their superiors to install equipment purchased for surveillance.5 The nature and number of government requests for data is unknown, since there is no legal provision that requires officials to notify targets.

From July to December 2021, Facebook received 66 such requests relating to 82 users and accounts; 51 were “legal process requests” and 15 of them emergency disclosure requests. Facebook at least partially complied to 11 percent of the requests.6 Twitter reported two requests relating to 36 accounts during the same period, with which the company did not comply.7

In January 2018, SLT opened a Tier 3 National Data Center,8 which hosts local data and serves as a cloud computing service.9 In June 2021, Dialog Axiata opened a Tier 3 facility near Colombo10 while the Orion Stellar Tier 3 center was opened in the Orion City IT Park in Colombo in November.11

Section 26 of the recently enacted PDPA requires government agencies and other public authorities to process personal data within Sri Lanka, apart from certain categories of data permitted by the government.12 . The bill also limits cross-border data transfers to countries unless the DPA deems the jurisdiction to have an adequate standard of data protection.13 In February 2022, the government signed a joint declaration on privacy and data protection at the Ministerial Forum for Cooperation in the Indo-Pacific.14

C7 1.00-5.00 pts0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? 3.003 5.005

Intimidation against both journalists and ordinary users were reported during the coverage period.

Journalists are frequently the targets of assault, intimidation, and harassment, including during the 2022 protests. Tharindu Jayawardhana, editor of MediaLK, was threatened by the former president’s media team while reporting on protests in early April.1 Jayawardhana also reported being threatened by a police officer on Facebook in July 2021, after Jayawardhana reported critically on the CID.2 In February 2022, Hiru TV reporter and YouTube channel host Chamuditha Samarawickrama said that unidentified assailants shot at his home and threw objects including excrement against its windows.3 He later received police protection.

In March 2021, during the previous coverage period, opposition politicians claimed that online journalist Sujeewa Gamage, a contributor to the Siyarata news site, was abducted and tortured for information on sources and political contacts. A police spokesman later said the journalist had made false claims of being abducted, adding that the Colombo Crimes Division would be questioning him and the two parliamentarians.4

Police often use interrogations to intimidate internet users for their online activities. Activist Manorama Weerasinghe was summoned to the CID in February 2022, likely in relation to his social media posts.5 In September 2021, a teenager was asked to report to CID headquarters in relation to his Facebook activity.6 In January 2022, a woman who had shared a post about Gotabaya Rajapaksa being hooted at was questioned by the CID, saying her phone was taken away and examined.7

Intimidation and harassment also increased around the COVID-19 pandemic. In June 2021, the CID was reportedly forming a team to act against the spread of misinformation on COVID-19 and other “sensitive” issues and take action against those who create and share purportedly false information.8 The Free Media Movement expressed concerns that the government was detaining users who posted pandemic-related social media comments, and noted that the government targeted users living in the north and east of the country.9 Separately, when social media users called to boycott Muslim businesses and spread allegations that Muslims were spreading COVID-19, they were not refuted by the government. Senior government officials also implied that the virus was rife among the Muslim community, drawing condemnation from civil society.10

Women have been subjected to misogynistic and intrusive posts on social media, especially on Facebook. For example, intimate images have been shared in Facebook groups without the subjects’ consent, often with abusive or derogatory captions.11 In 2021, 400 cases of blackmail—including demands for money for sexual favors, sale of intimate videos, the leaking of intimate videos by former partners, sharing of obscene photos and videos, and the posting of edited photos on social media—were reported.12 In March 2022, at least one young woman filed a complaint at the CID over the nonconsensual sharing of intimate images;13 she was countersued for defamation, while she and two other women received court injunctions to stop posting about the case on Instagram.

Female activists, lawyers and politicians have also endured threats and intimidation online that have affected their work.14 A female lawyer who appeared on behalf of families in an enforced-disappearances case was threatened with violence and sexualized abuse on social media.15 During the August 2020 elections, women candidates were also subject to sexualized abuse online.16 17 Members of the LGBT+ community were also the target of hate speech and were “outed” online.

C8 1.00-3.00 pts0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 1.001 3.003

Government and business websites are vulnerable to hacking and other cyberattacks. While the problem is not historically widespread in Sri Lanka, notable attacks on government websites and other websites were recorded during the coverage period. Cyberattacks occasionally targeted government critics, such as the TamilNet news site, under former president Mahinda Rajapaksa.1

Hacktivist groups targeted government websites during the 2022 protests, sometimes sharing messages of solidarity with the protesters. In April, the presidential website was inaccessible, likely due to a distributed denial-of-service (DDoS) attack; a Twitter account identified with Anonymous India claimed responsibility.2 Other accounts claimed to have targeted government websites, including those of the Sri Lanka Police, Parliament, and the Health Ministry.3 It is unclear which of and to what extent these claimed hacks disrupted the functioning of the websites or led to data breaches, though several breached datasets were shared on social media.4

Media sites and journalists have also been targeted. In August 2021, the YouTube channel of news site AdaDerana was hacked, with the channel streaming video about cryptocurrency before the media channel was able to regain access the next day.5 In November 2021, the YouTube channel of the Daily Mirror was also hacked, though it was recovered the same day.6

In April 2022, prominent payment processer PayHere was hacked. Over 1.5 million payment records were later offered for sale online, including physical addresses, phone numbers, and credit card information.7

In April 2021, during the previous coverage period, the Colombo Gazette’s news site was subject to a DDoS attack. The motivations of the attack were unclear.8 In June 2020, several journalists’ WhatsApp accounts were targeted by SIM-swapping attacks, which occur when a hacker convinces a service provider to switch a phone number to a new device that is under their control.9 Those affected included members of the Groundviews WhatsApp group, which was subsequently shut down. In May 2021, the TRCSL issued a notice that SIM-swapping attacks continued to occur on WhatsApp.10

Hackers frequently attacked government and business websites before the 2022 protests. In May 2021, during the previous coverage period, the Health Ministry, Energy Ministry, the Sri Lankan embassy in China, and the Rajarata University websites were hacked by the Tamil Eelam Cyber Force, coinciding with the date of the end of the civil war.11 The prime minister’s website was hacked in June 2021, with the website redirecting to a site dedicated to Bitcoin. 12 In January 2022, security researchers disclosed that Donot Team, a hacker group known for targeting government agencies, used malware against military organizations in Sri Lanka in early 2021.13

The Cybersecurity Act, which would establish a Cyber Protection Agency, is expected to include provisions for protection against hacking (see C2). 14

On Sri Lanka

See all data, scores & information on this country or territory.

See More

Country Facts

  • Global Freedom Score

    54 100 partly free

  • Internet Freedom Score

    48 100 partly free

  • Freedom in the World Status

    Partly Free

  • Networks Restricted

    No

  • Websites Blocked

    Yes

  • Pro-government Commentators

    Yes

  • Users Arrested

    Yes