Computer Act changes 'threaten user privacy'

Computer Act changes 'threaten user privacy'

Leaked docs raise data security concerns

Activists have voiced concerns about the draft revision to the Computer Crime Act, saying it could lead to government intrusion of internet users' private, encrypted data.

The bill, which passed its first hearing at the National Legislative Assembly (NLA) and is currently being considered by a special committee ahead of the two remaining readings, could permit the Information and Communications Technology Ministry (ICT) to gain access to encrypted information online, said Arthit Suriyawongkul, coordinator of the Thai Netizen Network, an internet freedom advocacy group.

The network recently uncovered a series of proposals the ICT presented to the NLA's special committee, asking for additional amendments to be made to the draft.

The leaked document from the ministry states: "To stop dissemination of, or to block computer data... The ICT minister may set criteria, periods and guidelines to do so in line with changing technology."

"In order to effectively screen and block online content, special methods and tools are required to achieve the goal," the document says.

It refers later to SSL (Secure Sockets Layer) technology, the standard security technology for encrypting links.

If the proposal is included in the final draft of the law, a severe violation of user rights to privacy would result, said Mr Arthit. Social media sites use encryption to protect their members' personal information or messages, as do online banking and transaction platforms, he added.

In this case, most users are less concerned about their civil rights than their online safety, he said. Since the Thai Netizen Network publicised the leaked document, individuals and businesses have expressed concerns about security breaches.

"It's like going back in time," Mr Arthit argued. In the first days of the internet, there was little or no data encryption.

Internet service providers and platforms have since improved their security levels. However, the ICT ministry's proposals are going to tear these achievements down, he added.

He said state security agencies could gain access to internet users' personal information at any time.

Since the 2014 military coup, state agencies have persistently taken steps to intrude on users' privacy, Mr Arthit said. In December 2014, ICT ministerial Order No.163/2557 asked experts to come up with ways to intercept encrypted information.

Last year, Wikileaks revealed the government had purchased equipment from Hacking Team, an Italian firm providing means to collect private data.

The current political situation is "special", argued Mr Arthit.

The National Council for Peace and Order's sweeping authority allows it to lawfully breach online privacy through temporary orders.

"However, laws that are passed by the NLA will stay on for good -- even after an election takes place," he said. Proposals to amend the bill will turn a temporary rights violation into a permanent one, he added.

But some legal experts find Thai Netizen's interpretation of the act goes "too far and is an overly-legal interpretation".

"The new draft doesn't authorise the government to gain access to encrypted data by forcing service providers to disclose such data," said Dhiraphol Suwanprateep, partner of the Information Technology & Communications Practice Group at Baker & McKenzie Ltd.

He explained the computer data filtering committee under the bill is only authorised to remove illegal content with court approval.

Paiboon Amornpinyokiat, adviser to the parliament commissioner appointed to analyse the Computer Crime Act, also agreed the draft won't allow access to encrypted data.

He said the only worrying point in the draft is Section 18 which would allow authorities to decrypt data without requiring court approval.

Poramate Minsiri, founder of Kapook, a leading local content provider, supported the Thai Netizen Network's interpretation.

He voiced concern over the computer data filtering commission which will be appointed under the bill and automatically act as a censorship board able to block any content.

The committee will have the power to hand down sentences of up to two years and/or a fine of up to 100,000 baht.

The committee shouldn't be allowed to act like a court, he said.

If the government wishes to decrease the burden on courts, it can do so by clearly defining what the bill covers.

Do you like the content of this article?
COMMENT (6)