In July 2026, Turkmenistan’s Ministry of Communications issued Order No. 116-iş, introducing updates to the country’s 2021 technical standards for creating and hosting websites. Framed around “cybersecurity compliance,” the rules mandate high-level, complex security measures: two-factor authentication (2FA), encrypted backups, software patching, and detailed administrative activity logging.
On paper, these rules represent standard global cybersecurity best practices. However, in Turkmenistan, where internet access is heavily censored and VPNs are routinely blocked, these technical requirements do not exist in a vacuum. Instead, Order No. 116-iş serves as a powerful mechanism to deepen state surveillance and enforce digital isolation through three structural mechanics.
1. Constructing a Closed “National Intranet”
The Turkmen government has shared its ambition to build a ‘national digital network’ disconnected from the global internet. However, it cannot easily cut off the internet entirely because its modern banking, government offices, and local businesses need basic digital infrastructure to function. Therefore, an alternative is to create a hyper-secure, state-controlled domestic alternative or a “national intranet”. By mandating strict technical requirements under Order 116-iş the government is building a walled internet usage. Once a country has a functioning, secure, domestic-only intranet, where citizens can pay utility bills, check local news, or access state services, it becomes much easier for the government to block, throttle, or shut off access to the global internet without crashing its own domestic economy. By tightening compliance requirements exclusively for websites operating within this domestic jurisdiction, the state ensures that all legal, authorized web traffic remains inside a fenced ecosystem. It doesn’t connect local creators to the global web. Instead, it forces them to build and maintain sites strictly on terms dictated by internal security agencies.
2. Operational Barriers and Legal Pretexts
The order’s complex technical mandates carry steep costs and administrative burdens for Internet users in Turkmenistan. Firstly, for an independent blogger, small business, or non-governmental entity in Turkmenistan, installing mandatory enterprise-level security (e.g., automated 2FA, custom admin URL routing, centralized key lifecycle logging, specialized encrypted backups) requires significant technical expertise and financial resources.
Donate to support Turkmen analysts, researchers and writers to produce factual, constructive and progressive content in their efforts to educate the public of Turkmenistan.
SUPPORT OUR WORKSecondly, in highly regulated environments such as Turkmenistan, these complex technical standards give authorities a convenient legal pretext for selective enforcement. For example, if a website publishes something the state dislikes, the government does not have to publicly admit to political censorship. They can simply audit the site, find that its server logs, authentication key renewals, or patch schedules violate Order No. 116-iş, and legally shut it down or fine the owner.
3. De-Anonymization and Universal Self-Censorship
Order No. 116-iş mandates logging every administrative login attempt, including the webmaster’s exact physical location, IP address, and security key history. Because oversight is jointly enforced by the State Cyber Security Service, the agency responsible for mass IP blocking and internet filtering, webmasters operate under full state visibility. Since website administrators know that their identity and location are logged every time they make an update, they are forced into self-censorship. They voluntarily refrain from linking to external news, hosting open discussion forums, or engaging with global platforms to avoid crossing unseen political boundaries. In theory, the Order No. 116-iş promotes global cybersecurity measures. It does not cut off access to the global Internet, but it achieves similar results through structural design. By introducing expensive and cumbersome requirements, eliminating admin anonymity, and fortifying a state-monitored domestic network, the Turkmen government is methodically trapping its citizens inside a digital bubble.
