Virtual Private Network Usage in South East Asia

Info: 9467 words (38 pages) Report
Last Edited: 20th May 2026 by Stephen Hagan

Tagged: Information TechnologyVirtual Private Networks

A Comparative Analysis of Regulatory Drivers, Technical Circumvention and State Counter-Measures across the Philippines, Thailand, Vietnam, Malaysia, Singapore and Hong Kong

1. Introduction

The South East Asian (SEA) region represents one of the most dynamic and contested arenas for the use of Virtual Private Networks (VPNs) anywhere in the world. Driven by an unusual confluence of high digital adoption, rapidly evolving state controls and rich appetite for cross-border digital consumption, the six jurisdictions examined in this report (the Philippines, Thailand, Vietnam, Malaysia, Singapore and Hong Kong) collectively account for one of the densest concentrations of VPN downloads on Earth. According to Atlas VPN's adoption index for the first half of 2023, Singapore led the world with an adoption rate of 19.32 per cent of its 5.85 million population, while a 2023 NordVPN Global Usage Survey reported that 50.2 per cent of Hong Kong residents aged 18 to 54 were active VPN users, the highest rate of any of the twenty jurisdictions surveyed (Atlas VPN, 2023; NordVPN, 2023). GlobalWebIndex (GWI) reported Malaysia at approximately 43 per cent, Thailand at 38 per cent and the Philippines at 41 per cent of internet users, while estimates for Vietnam centre on roughly 27 to 28 per cent (Top10VPN, 2020; Windscribe, 2024).

The motivations driving this elevated adoption are heterogeneous but structurally consistent. Freedom House's 2024 Freedom on the Net report ranked Vietnam at 22/100, Thailand at 39/100 and Singapore at 53/100, all in the "Partly Free" or "Not Free" category, while Malaysia and the Philippines each scored 60/100, declining by one point from the previous year (Freedom House, 2024a). Hong Kong, although not separately scored within the Asia-Pacific Freedom on the Net tabulation, has been the subject of a dramatic erosion of digital freedoms following the imposition of the 2020 National Security Law and the 2024 Safeguarding National Security Ordinance (United States Department of State, 2025). In broad terms, the regional VPN economy reflects four overlapping drivers: (i) the consumption of geo-blocked entertainment, particularly Netflix, Disney+ and live sports; (ii) circumvention of state content controls on pornography, gambling, political opposition material and certain social media platforms; (iii) increased privacy concern in jurisdictions with intrusive cyber-surveillance laws; and (iv) the routine use of corporate VPNs to interconnect distributed teams across the region.

This report is structured at masters level for an information-security and computer-science readership. It proceeds from the regulatory environment in each country, through the niches that drive consumer VPN demand, the underlying tunnelling and obfuscation technologies, and the enforcement countermeasures deployed by the state. Comparative tables synthesise quantitative indicators across jurisdictions, and the conclusion draws together the regional trajectory and outlook.

2. Regulatory Landscape by Country

2.1 Thailand

Thailand operates one of the region's most expansive content-blocking regimes, anchored by the Computer-Related Crime Act B.E. 2550 (2007), as amended by Act No. 2 B.E. 2560 (2017) (hereafter "the CCA"). Section 14 criminalises the entry into a computer system of "false data" causing damage to the public, the economy or national security, while Sections 18 and 20 grant the Ministry of Digital Economy and Society (MDES) authority, via court order, to demand removal of and to block access to "computer data" deemed unlawful (ARTICLE 19, 2017; Asia Centre, 2022). The 2017 amendments retained much of the original act's controversial breadth, including a five-person committee empowered to seek court orders blocking content judged offensive to public morality (ARTICLE 19, 2017).

The CCA is reinforced by Section 112 of the Criminal Code, the country's lèse-majesté provision, which carries a sentence of three to fifteen years' imprisonment per count for defaming, insulting or threatening the King, Queen, Heir-Apparent or Regent. Section 112 has been used aggressively against online speech: on 18 January 2024 the Chiang Rai Court of Appeal increased the sentence handed to online clothes vendor Mongkhon Thirakot from 28 years to 50 years' imprisonment for 27 Facebook posts about the monarchy, in what is believed to be the longest lèse-majesté sentence ever recorded (CNN, 2024; The Guardian, 2024). The human rights lawyer Arnon Nampa was sentenced to a further four years under Section 112 on 17 January 2024, adding to the four-year term imposed on 26 September 2023 (United Nations Office of the High Commissioner for Human Rights [OHCHR], 2024).

Thailand's content blocking is performed at scale. The Ministry of Digital Economy and Society reported the blocking of 220,486 illegal URLs between 1 October 2025 and 11 January 2026, rising to 437,473 by 28 February 2026, of which 362,482 were online gambling links (Gambling Talk, 2026; Thailand Business News, 2026). The MDES "WebD" platform, operated under Deputy Prime Minister Prasert Jantararuangtong, applies AI and Robotic Process Automation to process more than 100,000 illegal URLs annually (Nation Thailand, 2025). The 2020 court-ordered block of Pornhub and 190 other adult sites is a paradigmatic case: it precipitated a 644 per cent surge in VPN installations in Thailand within a single week, with Atlas VPN noting that before the surge "only 1 out of every 85 citizens use a VPN service in Thailand" and "1.17 per cent of Thailand's population downloaded a VPN service in the first half of 2020" (Prachatai English, 2020; South China Morning Post, 2020).

2.2 Vietnam

Vietnam's regulatory architecture is among the most comprehensive in the region. The Law on Cybersecurity No. 24/2018/QH14 (the "2018 Cybersecurity Law"), in force since 1 January 2019, requires foreign service providers to store data of Vietnamese users locally, establish in-country representative offices and remove "illegal content" within 24 hours of state notification. Decree 53/2022/ND-CP, effective 1 October 2022, supplies implementation detail for data localisation, while Decree 13/2023/ND-CP (effective 1 July 2023) constituted Vietnam's first comprehensive personal-data protection instrument (DLA Piper, 2023; Vnetwork, 2022). The 2023 Decree was, in turn, superseded by the Personal Data Protection Law No. 91/2025/QH15, in force from 1 January 2026, alongside Decree 356/2025/ND-CP (DLA Piper, 2026).

Most consequential for VPN demand has been Decree 147/2024/ND-CP, in force from 25 December 2024, which: (i) requires social-media platforms with monthly traffic exceeding 100,000 visits to verify user identities via Vietnamese phone numbers or national ID; (ii) compels removal of "illegal" content within 24 hours; and (iii) restricts live-streaming to verified accounts (Voice of America, 2024; Information Technology and Innovation Foundation [ITIF], 2025). On 21 May 2025 the Ministry of Information and Communications ordered domestic Internet Service Providers (ISPs) to block Telegram by 2 June 2025, citing alleged use of the platform by "reactionary forces", affecting 11.8 million Vietnamese Telegram users as of 2024, per data extraction company SOAX (Al Jazeera, 2025; The Diplomat, 2025).

The blunt force of these provisions is manifest in prosecutions: Human Rights Watch documented in 2024 that "government-controlled Vietnamese courts convicted and sentenced at least 36 critics to long prison terms because of posts or livestreams" under Article 117 of the Penal Code ("conducting propaganda against the state") or Article 331 ("abusing freedom and democracy") (Human Rights Watch, 2024). Video-blogger Thái Văn Đường was sentenced to 12 years' imprisonment in October 2024 after his alleged abduction from Thailand in April 2023 (Freedom House, 2025). VPN use itself is not explicitly criminalised, but the substantive content offences are sufficiently broad to capture VPN-mediated speech.

2.3 Malaysia

Malaysia's principal statute is the Communications and Multimedia Act 1998 (CMA). Notably, Section 3(3) of the CMA states that "nothing in this Act shall be construed as permitting the censorship of the Internet", a guarantee that helped attract international technology firms to the Multimedia Super Corridor in the late 1990s (Malaysia Communications and Multimedia Commission [MCMC], 2024; MSC Malaysia, n.d.). In practice, however, Sections 211 and 233 of the CMA, which criminalise the provision of content that is "obscene, indecent, false, menacing or offensive in character with intent to annoy, abuse, threaten or harass", together with Section 263(2), have been used to block thousands of websites.

The Communications and Multimedia (Amendment) Act 2024, passed on 9 December 2024 by a vote of 59 to 40, increased penalties under Sections 211 and 233 to fines of up to MYR 1,000,000 and imprisonment of up to 10 years, granted MCMC search-and-seizure powers without warrant, and introduced an Application Service Provider (Class C) licensing regime requiring social-media services with over eight million Malaysian users to obtain a licence from 1 January 2026 (ARTICLE 19, 2024). From January 2022 to August 2024 MCMC reported blocking 10,423 websites, of which 4,484 were online-gambling sites, 3,271 pornography sites and 1,654 copyright-infringing sites (Malaysian Communications and Multimedia Commission, 2024; The Star, 2024).

2.4 Philippines

The Philippines is governed primarily by Republic Act No. 10175, the Cybercrime Prevention Act of 2012, signed by President Aquino on 12 September 2012. The Act criminalises cyber-libel under Section 4(c)(4), cyber-squatting, identity theft, child pornography (Section 4(c)(2), in conjunction with Republic Act No. 9775, the Anti-Child Pornography Act of 2009), cybersex and offences against the confidentiality, integrity and availability of computer data. The Supreme Court's 2014 decision in Disini v. Secretary of Justice struck down Section 19, which had purported to grant the Department of Justice authority to block computer data ex parte, on the grounds that it violated due process and the prohibition against prior restraint (Respicio, 2025).

Cyber-libel under Section 4(c)(4) has nonetheless been weaponised against journalists. On 15 June 2020, the Manila Regional Trial Court Branch 46 (Judge Rainelda Estacio-Montesa) in Criminal Case No. R-MNL-19-01141-CR found Rappler chief executive Maria Ressa and former researcher Reynaldo Santos Jr. guilty of cyber-libel and sentenced them to an indeterminate term of six months and one day to six years' imprisonment, plus PHP 400,000 in damages. On 7 July 2022 the Court of Appeals affirmed the conviction but increased the maximum sentence to six years, eight months and twenty days of prisión mayor in its minimum period (Columbia Global Freedom of Expression, 2022; Rappler, 2022). The case has been widely interpreted as a chilling instrument against press freedom and a primary driver of VPN-mediated anonymity among Filipino journalists.

Content blocking in the Philippines is performed via memoranda of the National Telecommunications Commission (NTC). NTC Memorandum 2017 directed ISPs to block pornographic websites under Republic Acts 9775 and 7610. On 27 March 2024 the NTC instructed major telecommunications companies to block Binance's website following a Securities and Exchange Commission notice the previous day (Wikipedia, 2024). The Philippine Amusement and Gaming Corporation (PAGCOR) regulates legal gambling, while illegal sites are blocked under Presidential Decree 1602 and the Cybercrime Prevention Act (Respicio, 2025).

2.5 Singapore

Singapore combines a high-trust regulatory state with sophisticated content control. The Broadcasting Act 1994 (Cap 28) and its Class Licence Notification automatically licence Internet Content Providers and ISPs, empowering the Info-communications Media Development Authority (IMDA) to direct ISPs to disable access to specified websites that breach the Internet Code of Practice. As Freedom House (2022) summarises, the IMDA "blocks a list of 100 websites as a means of signaling societal values. This floating list has never been made public. Other than a few overseas sites run by religious extremists, the list is known to mainly consist of pornographic sites." The list includes Pornhub, YouPorn, RedTube and Ashley Madison, supplemented by a small number of extremist and inauthentic-news domains.

The Protection from Online Falsehoods and Manipulation Act 2019 (POFMA), in force from 2 October 2019, prohibits the communication in Singapore of false statements of fact and empowers ministers to issue Correction Directions, Stop Communication Directions, Targeted Correction Directions, Disabling Directions and Account Restriction Directions through the POFMA Office within IMDA (Allen & Gledhill, 2019; Wikipedia, 2024b). Penalties under Section 7 include fines of up to SGD 50,000 and imprisonment for up to five years for individuals. The Online Criminal Harms Act 2023 (Act 24 of 2023), in force from 1 February 2024, empowers police to issue Stop Communication, Disabling, Account Restriction, App Removal and Service Restriction Directions for online criminal harms, with subsidiary Codes of Practice for Facebook, WhatsApp, Instagram, Telegram, WeChat, Carousell and Facebook Marketplace effective 26 June 2024 (Singapore Statutes Online, 2024; Reed Smith, 2024). The Broadcasting (Amendment) Act 2022 introduced a Code of Practice for Online Safety, in force from 18 July 2023, exposing designated social-media services to fines of up to SGD 1,000,000 for non-compliance (Bird & Bird, 2024).

2.6 Hong Kong

Hong Kong's digital regulatory landscape was transformed by the imposition on 30 June 2020 of the Law of the People's Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region (the "NSL"). Article 43, implemented by detailed Rules gazetted on 6 July 2020, empowers the police to order online platforms, publishers and service providers to take down "electronic messages" deemed likely to constitute an offence endangering national security, with fines of HKD 100,000 and six months' imprisonment for non-compliance (Proton, 2020; Wikipedia, 2024c). Following non-compliance, police may obtain a warrant to seize devices and compel decryption.

On 23 March 2024 the Hong Kong Legislative Council unanimously enacted the Safeguarding National Security Ordinance (the "SNSO" or "Article 23"), creating new offences of treason, insurrection, theft of state secrets, espionage, sabotage endangering national security and external interference, including a specific offence of "doing an act in relation to a computer or electronic system without lawful authority and endangering national security" (Henry M. Jackson School, 2024). Implementation Rules amended in 2025 empower police to compel suspects to disclose device passwords, with non-compliance punishable by fines of up to HKD 100,000 and one year's imprisonment (The Standard, 2025).

The Open Observatory of Network Interference (OONI) measurements between July 2023 and June 2024 confirmed DNS tampering, TLS interference and TCP blocks on sites including the Tiananmen Square memorial 8964museum.com and Hong Kong Watch (Grokipedia, 2024). VPN use itself remains legal in Hong Kong, as there is no equivalent of mainland China's Cyberspace Administration approval requirement, but the National Security Law's reach extends to online activities regardless of the technical means used (Cybersecurity Campaign Hong Kong, 2026).

3. VPN Usage by Niche

3.1 Sports Streaming

The fragmentation of regional broadcasting rights for the English Premier League, the UEFA Champions League and the UFC drives extensive VPN-mediated access. Premier League rights in the Philippines, Singapore and Thailand have historically been held by Astro, beIN Sports, Premier Football and similar pay-television operators, while in Vietnam and Hong Kong concurrent or competing licensees impose price discrimination and exclusivity. Geolocation enforcement on streaming services such as DAZN, Sky Sports and ESPN+ is conducted primarily by IP-address geolocation databases such as MaxMind and IP2Location, with secondary checks against payment-method country and, on mobile devices, GPS data (ExpressVPN, 2026). VPN users in SEA routinely tunnel into UK, US and Australian endpoints to access matches at favourable kick-off times and lower subscription tiers.

3.2 Entertainment Streaming

Bypassing Netflix and Disney+ regional catalogues remains one of the most cited VPN use cases. According to Variety (2015), GlobalWebIndex's Q3 and Q4 2014 survey of 83,806 adults aged 16 to 64 across 32 countries, within a sample of 16,889 identified Netflix users, found that "some 54 million people use VPNs to watch Netflix on a monthly basis", including 21.6 million in mainland China; the same survey methodology indicated that only 34 per cent of self-identified Netflix users actually paid for the service. For Hong Kong residents, NordVPN data indicates the most common use case is accessing the regional Cantonese libraries of Disney+ via Singapore servers when Hong Kong endpoints are detected and blocked (Top10VPN, 2024). In Singapore, NordVPN's 2023 survey found that 87.2 per cent of residents are aware of VPNs, and that streaming sits second only to work-related use among self-reported reasons.

3.3 Online Gambling

Gambling is the single largest target of state blocking in Malaysia, Thailand and the Philippines. Malaysia's MCMC reported that 4,484 of 10,423 sites blocked between January 2022 and August 2024, representing 43 per cent of all blocked sites, were online gambling sites (The Star, 2024). Thailand's MDES blocked 362,482 gambling URLs between 1 October 2025 and 28 February 2026, dwarfing all other categories (Thailand Business News, 2026). In the Philippines, Republic Act No. 12312 of 2025 banned and declared illegal Philippine Offshore Gaming Operations (POGOs), and PAGCOR-coordinated blocking by the NTC has expanded under House Bill 5812's proposed Online Gambling Crimes Task Force framework (Republic of the Philippines, 2025; House of Representatives of the Philippines, 2024). Singapore's Gambling Control Act 2022 directs ISPs to block unlicensed remote gambling sites administered by the Gambling Regulatory Authority. VPN-mediated access to international books such as Bet365, Betfair and Pinnacle is widespread but constitutes a contravention of local gambling laws in each of these jurisdictions.

3.4 Academic Access

Researchers in Vietnam, the Philippines, Thailand and Malaysia routinely use VPNs to bypass institutional IP-range restrictions on JSTOR, ScienceDirect, IEEE Xplore and SpringerLink, particularly when affiliated with under-funded universities. While quantitative penetration data are not published, the practice is documented in studies of academic information-seeking behaviour and contributes to the diffuse but persistent demand for residential-class VPN endpoints in the US, UK and Germany.

3.5 Social Media and Communication

Vietnam's blocking of Telegram on 2 June 2025, affecting 11.8 million users, prompted a measurable surge in VPN downloads, although precise figures remain unpublished (The Diplomat, 2025). Malaysia experienced VPN-demand surges during the 2018 election following blocks of Sarawak Report and The Malaysian Insider, while Thailand recorded a 644 per cent surge in VPN installations within the week following the November 2020 Pornhub block (Prachatai English, 2020). Hong Kong recorded a 50 per cent surge in VPN demand on 22 June 2021 alone, the day before the closure of Apple Daily, while VPN demand had also risen 245 per cent on 11 March 2021 when the National People's Congress approved a resolution tightening control over Hong Kong's electoral system (Top10VPN, 2024). The arrest of 286 individuals and conviction of 68 under the NSL in Hong Kong by January 2024 has been accompanied by significant adoption of Signal, Telegram with proxies and Proton VPN among local activists and journalists (Henry M. Jackson School, 2024).

3.6 Political and Government Information

Vietnam, Thailand and Hong Kong present the clearest cases of politically motivated VPN usage. Vietnamese citizens use VPNs to access Radio Free Asia, the BBC Vietnamese service and Voice of America; Thai citizens use them to read material on the monarchy banned under Section 112; Hong Kong residents use them to read Apple Daily archives, Hong Kong Watch and exiled diaspora media such as Flow HK, which was the subject of a Hong Kong police take-down demand to WordPress hosting company Automattic in October 2024 (Hong Kong Free Press, 2024).

3.7 Adult Content

Pornography is blocked outright in Thailand, Malaysia, the Philippines, Singapore and Vietnam, although the technical thoroughness of blocks varies considerably. The blocking of Pornhub and 190 other sites in Thailand in November 2020 was implemented under the CCA and the Gambling Act B.E. 2478 (1935), and triggered the "#SavePornhub" protest movement (The Diplomat, 2020). Singapore's IMDA list remains predominantly pornography-focused. In Hong Kong, by contrast, adult content is not routinely blocked, reflecting the territory's continued "One Country, Two Systems" framework.

3.8 Financial Services and Cryptocurrency

The Philippine NTC's March 2024 blocking of Binance, the regional restrictions on cryptocurrency exchanges and bank-level requirements that VPN traffic be flagged for fraud monitoring have all created a demand for residential-IP VPN services. Vietnam's Decree 53/2022 also requires foreign payment-services providers to localise data, indirectly increasing demand for VPNs among small businesses transacting with offshore counterparties.

4. Methods Used: Technical Foundations of VPN Circumvention

4.1 Tunnelling Protocols

The contemporary VPN ecosystem rests on three principal tunnelling protocols: OpenVPN, WireGuard and IPSec/IKEv2. OpenVPN, an open-source TLS-based protocol, uses either TCP or UDP transport (commonly on ports 1194, 443 or 53) and provides AES-256-GCM or ChaCha20-Poly1305 encryption with HMAC-SHA-256 authentication. WireGuard, released as a Linux kernel module in 2020 and now ubiquitous, uses ChaCha20-Poly1305 with Curve25519 elliptic-curve Diffie-Hellman over a single UDP port, providing markedly higher performance at the cost of static-IP allocation and a small but identifiable handshake fingerprint (Tegant, 2025). IKEv2/IPSec, common in mobile contexts due to its MOBIKE support across network transitions, remains widely deployed but is increasingly fingerprintable.

4.2 Deep Packet Inspection and Protocol Fingerprinting

Modern Deep Packet Inspection (DPI) systems do not rely solely on port-based filtering; they inspect packet structure, handshake signatures and statistical timing patterns. OpenVPN, WireGuard and IKEv2 all expose distinctive handshake patterns visible to ML-trained DPI classifiers. As Top10VPN (2026) notes, "standard Shadowsocks, even with modern AEAD cipher encryption, is now detected with over 90% accuracy by the Great Firewall." Within SEA, only Vietnam approaches this level of sophistication on a routine basis; Thailand, Malaysia and Hong Kong rely primarily on DNS-level and IP-level blocking.

4.3 Obfuscation Techniques

To defeat DPI, VPN providers and circumvention tool developers deploy obfuscation. Shadowsocks, originally designed to circumvent China's Great Firewall, wraps SOCKS5 proxy traffic in stream ciphers (now AEAD ciphers such as ChaCha20-IETF-Poly1305) that produce output statistically indistinguishable from random data (VPNMentor, 2026). Obfsproxy implements pluggable transports, including obfs2, obfs3, obfs4, meek and ScrambleSuit, that wrap the underlying protocol in a layer designed to evade pattern matching. OpenVPN with XOR scrambling, OpenVPN Scramble and Stunnel-wrapped OpenVPN are widely deployed. More recent protocols include V2Ray/VMess, XRay and the REALITY protocol, the last of which borrows the TLS identity of a legitimate trusted website to defeat active probing without collateral damage to genuine traffic (Top10VPN, 2026).

4.4 DNS over HTTPS and DNS over TLS

DNS-level interference is the most common form of state blocking in SEA. The Sinar Project documented in August 2024 that Malaysian ISPs Maxis and Time dotCom had implemented transparent DNS proxies that silently redirect queries directed at Google's 8.8.8.8 or Cloudflare's 1.1.1.1 through ISP-controlled resolvers, defeating ordinary client-side DNS reconfiguration (Sinar Project, 2024). DNS over HTTPS (DoH) per RFC 8484 and DNS over TLS (DoT) per RFC 7858 encrypt the DNS query within a TLS tunnel to port 443, rendering it indistinguishable from ordinary HTTPS traffic and effective against transparent proxying, at least until the ISP can block the DoH resolver's IP address. Modern VPN clients increasingly default to DoH for resolver queries, even before tunnel establishment.

4.5 Multi-Hop and Split Tunnelling

Multi-hop VPN routes (NordVPN's Double VPN, ProtonVPN's Secure Core, Mullvad's bridge nodes) chain encrypted connections through two or more servers in distinct jurisdictions to defeat single-server compromise. Split tunnelling allows selected applications or destinations to bypass the tunnel, which is useful for accessing local banking services that themselves block VPN traffic, while maintaining tunnel coverage for general browsing. These features are particularly valued in Hong Kong, where ProtonVPN's Switzerland-based jurisdiction protects users from local subpoena power.

5. Enforcement and Countermeasures

5.1 Thailand

The MDES uses the WebD AI platform to identify and process illegal URLs at scale. Blocking is implemented at the ISP level via DNS interference and IP blackholing. The 2017 amendments to the CCA empower MDES to compel ISP cooperation, and Articles 18(2) and 18(3) permit access to user and traffic data without a court order under "probable cause" (Wikipedia, 2024a). VPN use is not explicitly prohibited; however, the use of a VPN to access pornography or gambling sites remains an offence in itself under the CCA and Gambling Act, and surveillance methods are extensive. Thailand has not deployed Chinese-style DPI against VPN protocols.

5.2 Vietnam

Vietnam exhibits the most aggressive enforcement posture of the six jurisdictions. Decree 53/2022 imposes data-localisation duties on foreign providers; Decree 147/2024 imposes identity-verification duties on social-media platforms; and Decrees 13/2023 and PDPL 91/2025 impose data-protection obligations administered by the Department of Cybersecurity and High-tech Crime Prevention within the Ministry of Public Security. The state has historically used network slowdowns to coerce Facebook compliance with content-removal requests. In February 2023 all five of Vietnam's submarine cables malfunctioned simultaneously, causing approximately a 75 per cent loss of the country's international data flow over the Lunar New Year period; in June 2024 a second incident brought down three of the five cables, specifically the Intra Asia (IA), Asia Pacific Gateway (APG) and Asia-Africa-Europe-1 (AAE-1) systems (Carnegie Endowment for International Peace, 2024; The Register, 2024). Article 117 of the Penal Code has been used to imprison at least 36 critics in 2024 alone (Human Rights Watch, 2024). Significant DPI capability exists, though it appears focused on protocol identification rather than uniform VPN blocking; standard commercial VPNs operate in Vietnam without systematic blocking, though slowdowns are reported.

5.3 Malaysia

The MCMC issues blocking directives to all licensed ISPs under Sections 233 and 263(2) of the CMA. Between January 2020 and August 2024, more than 20,000 sites were blocked, with the bulk concerning gambling, pornography and copyright. The MCMC has begun cooperating with the Royal Malaysian Police on prosecutions of social-media influencers promoting illegal gambling: on 13 June 2024 police arrested 27 social-media influencers, comprising 23 women and four men aged 21 to 35, apprehended across seven states, for promoting illegal online gambling sites. Those individuals were investigated under the Open Gaming House Act and Section 233 of the MCMC Act, per Bukit Aman CID Director Comm Mohd Shuhaily Mohd Zain (The Star, 2024). Transparent DNS proxying, confirmed in August 2024, defeats client-side DNS workarounds. The 2024 Communications and Multimedia (Amendment) Act expands MCMC powers to compel disclosure of user data without judicial oversight.

5.4 Philippines

Following Disini v. Secretary of Justice (2014), the Department of Justice cannot block computer data ex parte. The Cybercrime Investigation and Coordinating Center (CICC), the National Bureau of Investigation Cybercrime Division and the Philippine National Police Anti-Cybercrime Group conduct enforcement. Real-time collection of traffic data is permitted under Section 12 of RA 10175 with "due cause", as modified by the Disini ruling, which limited the provision to non-content data. The NTC issues binding directives to ISPs for category-based blocking covering pornography, illegal gambling, child sexual abuse material and terrorism. The Philippines has not deployed DPI infrastructure at scale; blocking is overwhelmingly DNS-based.

5.5 Singapore

Singapore's POFMA Office, IMDA and Singapore Police Force coordinate enforcement. The POFMA Office maintains a public Declared Online Locations register; the IMDA maintains the symbolic Class Licence blocklist. The Online Criminal Harms Act 2023's Codes of Practice impose mandatory cooperation duties on designated providers (Facebook, WhatsApp, Instagram, Telegram, WeChat and Carousell). Singapore does not deploy DPI against VPN protocols and VPN use is legal; however, the use of a VPN to access blocked content such as unlicensed gambling or pornography does not relieve the user of liability under the underlying substantive offence. Mondaq (2024) notes that "apart from the Broadcasting Class Licence framework, which generally empowers the IMDA to issue blocking directions, there are no specific regulations relating to the blocking of consumer virtual private network (VPN) services" (Mondaq, 2024).

5.6 Hong Kong

Article 43 implementation rules empower the police to compel takedowns by ISPs, platforms and individuals. The 2025 amendments empower police to compel disclosure of device passwords on pain of a HKD 100,000 fine and one year's imprisonment (The Standard, 2025). Meta actioned 4,004 Hong Kong government restrictions in the first half of 2023 alone, compared with 199 in the comparable pre-NSL period (Grokipedia, 2024). VPN providers have responded variably: Private Internet Access (PIA) decommissioned its Hong Kong servers in 2020 citing the new warrantless-seizure powers; IPVanish followed suit before redeploying in 2022. ProtonVPN explicitly stated that "without a Swiss court order, we will not assist or comply with any Chinese demands over Article 43, and we remain committed to protecting Proton Mail and Proton VPN users in Hong Kong" (Proton, 2020). Some 53 VPN apps were reportedly unavailable in Hong Kong as of 2024 (Grokipedia, 2024).

6. Comparative Data Tables

Table 1: Internet Freedom and Adoption Indicators

Jurisdiction	Freedom on the Net 2024 score (out of 100)	Internet penetration (Jan 2024)	Freedom House category
Singapore	53	~96%	Partly Free
Malaysia	60	97.4%	Partly Free
Philippines	60	~73%	Partly Free
Thailand	39	~88%	Not Free
Vietnam	22	79.1%	Not Free
Hong Kong	Not separately scored in Asia-Pacific tabulation; status declining	~93%	Partly Free (declining)

Sources: Freedom House (2024a, 2024b, 2025); DataReportal (2024).

Table 2: VPN Adoption Indicators

Jurisdiction	Reported VPN usage rate	Source / methodology
Hong Kong	50.2% (population 18 to 54); 87.2% awareness	NordVPN Global Usage Survey 2023, 54,625 respondents across 20 countries
Singapore	19.3% adoption index H1 2023 (1.1m downloads); 43% NordVPN survey	Atlas VPN H1 2023; NordVPN 2023
Malaysia	43% (NordVPN 2023); 38% (GWI legacy)	NordVPN 2023; GlobalWebIndex
Philippines	~41% of internet users (GWI legacy)	GlobalWebIndex 2018 to 2020 reports
Thailand	~38% of internet users (GWI legacy); 644% surge following Pornhub block November 2020	GlobalWebIndex; Atlas VPN
Vietnam	~27.6% of internet users (commonly cited)	Aggregated tech sources; figure unverified by primary survey

Table 3: Blocked Content Categories by Country

Jurisdiction	Pornography	Gambling	Political	Social media platforms	Cryptocurrency
Thailand	Blocked (190+ sites November 2020, including Pornhub)	Blocked (362,482 URLs October 2025 to February 2026)	Blocked under lèse-majesté	Selective takedowns	Selective restrictions
Vietnam	Blocked	Blocked	Heavily blocked under Article 117	Telegram blocked June 2025; Facebook throttled	Restricted
Malaysia	3,271 sites blocked January 2022 to August 2024	4,484 sites blocked in same period	Selective blocks of opposition media	ASP(C) licensing from 1 January 2026	Restricted
Philippines	Blocked under RA 9775	Illegal sites blocked; POGOs banned RA 12312 (2025)	Limited (anti-terrorism law used to block news sites under Duterte)	No platform blocked	Binance blocked March 2024
Singapore	~100 sites including Pornhub blocked (IMDA list)	Unlicensed sites blocked under Gambling Control Act 2022	POFMA Correction and Disabling Directions	No platform blocked	Restricted
Hong Kong	Not blocked	Not blocked	Hong Kong Watch, 8964museum.com, HKChronicles and Flow HK blocked under NSL	TikTok ceased operations July 2020	Limited

Table 4: Enforcement Mechanisms by Country

Jurisdiction	Primary blocking technique	DPI deployed against VPN?	ISP cooperation	VPN legal status
Thailand	DNS and IP blocking; WebD AI platform	Limited	Mandatory via CCA	Legal, but content offences apply
Vietnam	DNS, IP, throttling, undersea cable maintenance	Emerging	Mandatory via Cybersecurity Law 24/2018	Legal; content offences extensive
Malaysia	DNS and transparent DNS proxy (Maxis, Time, TM)	Limited	Mandatory via CMA 1998 ss.233, 263(2)	Legal
Philippines	DNS blocking via NTC memoranda	No	Mandatory via NTC	Legal
Singapore	DNS blocking via IMDA Class Licence	No	Mandatory via Broadcasting Act, POFMA, OCHA 2023	Legal
Hong Kong	DNS, TLS interference and TCP RST (OONI-confirmed)	No	Article 43 NSL takedowns	Legal, but warrantless seizure powers under NSL

Table 5: Notable Prosecutions and Enforcement Actions

Jurisdiction	Case / action	Date	Outcome
Philippines	Maria Ressa and Reynaldo Santos Jr. (RA 10175 s.4(c)(4))	Convicted 15 June 2020 (Crim. Case No. R-MNL-19-01141-CR); Court of Appeals affirmed 7 July 2022	6 months and 1 day to 6 years 8 months 20 days imprisonment
Thailand	Mongkhon Thirakot (Section 112)	Court of Appeal, 18 January 2024	Sentence increased from 28 to 50 years for 27 Facebook posts
Thailand	Arnon Nampa (Section 112)	26 September 2023; further conviction 17 January 2024	Cumulative 8 years' imprisonment
Vietnam	Thái Văn Đường / Duong Van Thai	Sentenced October 2024	12 years' imprisonment for YouTube criticism
Vietnam	At least 36 critics convicted under Articles 117 and 331	2024 (HRW documentation)	Long prison terms
Malaysia	Mohamad Azlan Ibrahim (insulting Sultan of Selangor)	September 2023	6 months' imprisonment, MYR 10,000 fine
Malaysia	27 influencers arrested for promoting illegal gambling	13 June 2024	Investigated under MCMC Act s.233 and Open Gaming House Act
Hong Kong	NSL arrests cumulative	By January 2024	286 arrested, 68 convicted
Hong Kong	Flow HK take-down notice to Automattic/WordPress	October 2024	Automattic refused, notified site owner
Singapore	East Asia Forum POFMA Direction and Access Blocking Order	13 September 2023	Access blocked after non-compliance

7. Conclusion

The six jurisdictions surveyed share a structural pattern in which the demand for VPNs is shaped by the cumulative weight of state content controls and the simultaneous attraction of global digital services. Hong Kong, with 50.2 per cent of its 18-to-54 population using VPNs, and Singapore, with the world's highest H1 2023 VPN adoption index of 19.3 per cent, represent two distinct paths to the same outcome: citizens in technically sophisticated, internationally connected economies using VPNs both for legitimate privacy concerns and for circumvention of distinct varieties of content restriction. Vietnam, by contrast, presents a tightening regulatory architecture under Decree 147/2024 and the new Personal Data Protection Law of 2025 that pushes VPN use into a defensive posture for activists, while leaving routine commercial VPN traffic substantially unimpeded. Thailand and Malaysia occupy a middle position: prolific content blocking on gambling, pornography and copyright grounds drives consumer demand for VPNs, but the state does not yet deploy China-style DPI against the VPN protocols themselves.

From a computer-science perspective, the technical contest is converging on the obfuscation layer. Standard tunnelling protocols, including OpenVPN, WireGuard and IKEv2/IPSec, are identifiable to even moderately capable DPI systems through handshake fingerprinting and traffic-analysis methods. The future of VPN circumvention in SEA lies in the deployment of obfuscated protocols such as Shadowsocks with AEAD ciphers, V2Ray/VMess, XRay and the REALITY protocol, together with DoH-protected DNS resolution and multi-hop routing across jurisdictions outside the regional regulatory reach. The Malaysian deployment of transparent DNS proxies in 2024 confirms that the contest extends down to layer-three infrastructure, and the Hong Kong Article 43 password-disclosure powers extend it to the endpoint. For the foreseeable future, the regional VPN economy will continue to grow, sustained by the structural mismatch between national content regulation and the inherently borderless nature of the internet itself.

References

Al Jazeera (2025) 'Vietnam orders blocking of Telegram messaging app', 24 May.

Allen & Gledhill (2019) Protection from Online Falsehoods and Manipulation Act 2019 effective from 2 October 2019. Available at: https://www.allenandgledhill.com/sg/publication/articles/13509/ (Accessed: 18 May 2026).

ARTICLE 19 (2017) Thailand: Computer Crime Act: Legal Analysis, January 2017. London: ARTICLE 19.

ARTICLE 19 (2024) 'Malaysia: CMA Amendments are a step backwards for freedom of expression', 9 December. Available at: https://www.article19.org/resources/malaysia-the-passing-of-the-cma-amendments-is-another-step-backwards/ (Accessed: 18 May 2026).

Asia Centre (2022) Thailand Computer Crime Act: Restricting Digital Rights, Silencing Online Critics. Bangkok: Asia Centre.

Atlas VPN (2023) 'Global VPN adoption trends in H1 2023', via Global Security Mag.

Bird & Bird (2024) Singapore: Content Regulation: Harmful Online Content.

BrightSideOfNews (2026) 'Malaysia Anti-Online Gambling Reform 2026: Betting Act and MCMC Blocks'.

Carnegie Endowment for International Peace (2024) Subsea Communication Cables in Southeast Asia: A Comprehensive Approach Is Needed. Washington, DC: Carnegie Endowment for International Peace.

CNN (2024) 'Thailand: Man sentenced to record 50 years for lese-majeste', 19 January.

Columbia Global Freedom of Expression (2022) People of the Philippines v. Santos, Ressa and Rappler. Available at: https://globalfreedomofexpression.columbia.edu/cases/ (Accessed: 18 May 2026).

Cybersecurity Campaign Hong Kong (2026) Is Using a VPN Legal in Hong Kong?

DataReportal (2024) Digital 2024 reports. Available at: https://datareportal.com (Accessed: 18 May 2026).

DLA Piper (2023) Vietnam: Decree 13 and the new regulations on personal data protection. Available at: https://www.dlapiper.com/en-us/insights/publications/crossroads-icr-insights/2023/vietnam-decree-13-and-the-new-regulations-on-personal-data-protection (Accessed: 18 May 2026).

DLA Piper (2026) Data protection laws of the world: Vietnam. Available at: https://www.dlapiperdataprotection.com/?t=law&c=VN (Accessed: 18 May 2026).

ExpressVPN (2026) What is geoblocking? Understanding online access limits.

Freedom House (2022) Singapore: Freedom on the Net 2022 Country Report. Available at: https://freedomhouse.org/country/singapore/freedom-net/2022 (Accessed: 12 May 2026).

Freedom House (2024a) 'Internet Freedom in the Asia-Pacific Region Declined in 2024'. Available at: https://freedomhouse.org/article/fotn-2024-asia-pacific-release (Accessed: 12 May 2026).

Freedom House (2024b) Vietnam: Freedom on the Net 2024 Country Report.

Freedom House (2025) Vietnam: Freedom on the Net 2025 Country Report.

Gambling Talk (2026) 'Thailand blocks nearly 184,000 online gambling URLs in three-month cyber crackdown'. Available at: https://gamblingtalk.net/news/thailand-blocks-nearly-184000-online-gambling-urls-in-three-month-cyber-crackdown (Accessed: 18 May 2026).

Grokipedia (2024) Internet censorship in Hong Kong. Available at: https://grokipedia.com/page/Internet_censorship_in_Hong_Kong (Accessed: 18 May 2026).

Henry M. Jackson School (2024) 'Internet Censorship and Digital Surveillance Under Hong Kong's National Security Law'. Henry M. Jackson School of International Studies, University of Washington. Available at: https://jsis.washington.edu/news/internet-censorship-and-digital-surveillance-under-hong-kongs-national-security-law/ (Accessed: 18 May 2026).

Hong Kong Free Press (2024) 'US tech firm issued notice by Hong Kong police to take down diaspora media site Flow HK on national security grounds', 8 October. Available at: https://hongkongfp.com/2024/10/08/ (Accessed: 18 May 2026).

House of Representatives of the Philippines (2024) House Bill 5812: Online Gambling Crimes Task Force.

Human Rights Watch (2024) 'Vietnam: Repeal harmful internet laws', 11 December. Available at: https://www.hrw.org/news/2024/12/11/vietnam-repeal-harmful-internet-laws (Accessed: 18 May 2026).

Info-communications Media Development Authority (IMDA) (n.d.) Internet content standards and classification. Available at: https://www.imda.gov.sg (Accessed: 15 May 2026).

Information Technology and Innovation Foundation (ITIF) (2025) 'Vietnam's Content Moderation Regulation', 2 June.

Malaysian Communications and Multimedia Commission (MCMC) (2024) Statement on websites blocked January 2022 to August 2024.

Mondaq (2024) TMT Comparative Guide: Singapore. Available at: https://www.mondaq.com/media-telecoms-it-entertainment/1330912/tmt-comparative-guide (Accessed: 18 May 2026).

MSC Malaysia (n.d.) Communications and Multimedia Act 1998 (CMA): Malaysia Cyber Law Reference. Available at: https://www.msc.com.my/cyberlaws/communications-and-multimedia-act.html (Accessed: 18 May 2026).

Nation Thailand (2025) 'Thailand launches AI-powered "WebD" platform to tackle illegal websites and boost efficiency'. Available at: https://www.nationthailand.com/news/general/40052180 (Accessed: 18 May 2026).

NordVPN (2023) Global Usage Survey 2023. Available at: https://nordvpn.com/blog/nordvpn-usage-survey-us/ (Accessed: 11 May 2026).

OHCHR (2024) 'Thailand: UN experts alarmed at sentences handed down to human rights lawyer Arnon Nampa', press release, 25 March. Available at: https://www.ohchr.org/en/press-releases/2024/03/thailand-un-experts-alarmed-sentences-handed-down-human-rights-lawyer-arnon (Accessed: 18 May 2026).

Prachatai English (2020) 'VPN installs surge 644% in Thailand after Pornhub ban'. Available at: https://prachataienglish.com/node/8906 (Accessed: 18 May 2026).

Proton (2020) 'Chinese government pushes censorship and surveillance on Hong Kong'. Available at: https://proton.me/blog/china-censorship-hong-kong (Accessed: 18 May 2026).

Radio Free Asia (2025) 'Vietnam to block messaging app Telegram over anti-state contents', 23 May.

Rappler (2022) 'Court of Appeals affirms Maria Ressa, Reynaldo Santos Jr cyber libel conviction with modification'.

Reed Smith (2024) Singapore introduces codes of practice under the Online Criminal Harms Act 2023. Available at: https://www.reedsmith.com/articles/singapore-introduces-codes-of-practice-under-the-online-criminal-harms/ (Accessed: 13 May 2026).

Republic of the Philippines (2012) Republic Act No. 10175, the Cybercrime Prevention Act of 2012.

Republic of the Philippines (2025) Republic Act No. 12312 banning POGOs.

Respicio (2025) Cybercrime Prevention Act of 2012 [R.A. No. 10175]: Special Penal Laws. Available at: https://www.respicio.ph/bar/2025/criminal-law/special-penal-laws/cybercrime-prevention-act-of-2012-ra-no-10175 (Accessed: 11 May 2026).

Singapore Statutes Online (2024) Online Criminal Harms Act 2023 (No. 24 of 2023). Available at: https://sso.agc.gov.sg/Act/OCHA2023 (Accessed: 18 May 2026).

Sinar Project (2024) 'Internet Censorship Update: Transparent DNS Proxy Implemented by Malaysian ISPs on Cloudflare and Google Public DNS Servers', 6 August.

South China Morning Post (2020) '#SavePornhub: Thailand bans porn and gambling sites'.

Tegant (2025) Choosing the Best VPN Protocol for Speed and Security.

Thailand Business News (2026) 'Thai government shuts down more than 437,000 illegal websites in major crackdown'. Available at: https://www.thailand-business-news.com/crime/294555-thai-government-shuts-down-more-than-437000-illegal-websites-in-major-crackdown (Accessed: 18 May 2026).

The Diplomat (2020) 'Thailand Blocks Access to Porn Sites, Prompting Protests'.

The Diplomat (2025) 'Why Is Vietnam Blocking Access to Telegram?' Available at: https://thediplomat.com/2025/06/why-is-vietnam-blocking-access-to-telegram/ (Accessed: 17 May 2026).

The Guardian (2024) 'Man jailed for record 50 years for criticising Thai monarchy', 18 January.

The Register (2024) Coverage of Vietnam submarine cable failures, 18 June.

The Standard (2025) 'Hong Kong enacts National Security Law Amendments allowing police to demand device passwords'. Available at: https://www.thestandard.com.hk/politics/article/327446/ (Accessed: 17 May 2026).

The Star (2024) 'Over 10,000 websites blocked by MCMC since 2022', 8 August. Available at: https://www.thestar.com.my/news/nation/2024/08/08/online-gambling-porn-top-category-of-websites-blocked-by-mcmc-as-of-aug-1 (Accessed: 14 May 2026).

Top10VPN (2020) GWI Global VPN Usage Report 2020.

Top10VPN (2024) The Best Free and Paid Hong Kong VPN Servers; VPN Demand Statistics. Available at: https://www.top10vpn.com/research/vpn-demand-statistics/ (Accessed: 17 May 2026).

Top10VPN (2026) What Is VPN Obfuscation and Do I Need It? Available at: https://www.top10vpn.com/guides/vpn-obfuscation/ (Accessed: 18 May 2026).

United States Department of State (2025) 2025 Hong Kong Policy Act Report.

Variety (2015) 'Does Netflix Really Have 20 Million-Plus Users in China? Research Firm Projects Massive VPN Base'. Available at: https://variety.com/2015/digital/asia/does-netflix-really-have-20-plus-million-users-in-china-research-firm-projects-massive-vpn-base-1201401061/ (Accessed: 18 May 2026).

Vnetwork (2022) Decree 53/2022/ND-CP: When Cybersecurity and Data Protection become a competitive advantage for Vietnamese Enterprises. Available at: https://www.vnetwork.vn/en-US/news/nghi-dinh-53-2022-nd-cp/ (Accessed: 18 May 2026).

Voice of America (2024) 'Sweeping Vietnam internet law comes into force', 25 December. Available at: https://www.voanews.com/a/sweeping-vietnam-internet-law-comes-into-force/7913333.html (Accessed: 18 May 2026).

VPNMentor (2026) What is VPN Obfuscation? Best Way to Hide VPN Traffic in 2026. Available at: https://www.vpnmentor.com/blog/vpn-guides/what-is-vpn-obfuscation/ (Accessed: 10 May 2026).

Wikipedia (2024a) Internet censorship in Thailand.

Wikipedia (2024b) Protection from Online Falsehoods and Manipulation Act 2019. Available at: https://en.wikipedia.org/wiki/Protection_from_Online_Falsehoods_and_Manipulation_Act_2019 (Accessed: 03 May 2026).

Wikipedia (2024c) Internet censorship in Hong Kong. Available at: https://en.wikipedia.org/wiki/Internet_censorship_in_Hong_Kong (Accessed: 11 May 2026).

Windscribe (2024) 55 VPN Statistics and Industry Trends (2023 to 2025). Available at: https://windscribe.com/blog/vpn-statistics-trends/ (Accessed: 14 May 2026).