After the Computer Crime Act was passed Dec. 16 by unanimous vote despite a last-minute petition of more than 300,000 opposing the law and much-hated Single Gateway program, all eyes are now on the Ministry of Digital Economy and Society, or DE Ministry, to see how it exercises its new great powers.
Chulalongkorn University on Friday held a symposium on the next steps at which panelists argued over many of the improvements in the revised act, and how we would simply have to trust the state will not use its most-draconian elements against good people who have done nothing wrong.
But the biggest bombshells came not from the panel but the floor, with claims the single gateway is already in place by one senior regulator turned academic and tales of military harassment and bullying of the broadcasting regulator.
TL;DR Takeaways:
- Telcos and internet providers summoned to install and test eavesdropping equipment
- Junta happy to overrule existing broadcast censorship committee with Article 44
- Article 20 allows DE Ministry to enter and delete information directly in your computer system
- Article 16(2) possession of illegal material will only be used against “bad people” – trust us
- 50,000 people prosecuted under Article 14 may escape punishment but end up with a criminal record nonetheless
- Article 15 to protect ISPs and social media platforms worthless for e-commerce as it only protects those who are not paid directly or indirectly
- Act is only the start of free speech crackdown – soon all journalists will need to be licensed
Opening the event, Assistant Professor Pirongrong Ramasoota, university vice president, said that since the law was passed, the question is what can be done to influence the ministerial regulations and child laws that will follow. She regretted to announce that both Line and True Corp. panelists had canceled at short notice.
The bulk of the day’s proceedings centered around articles 14 (insertion of untrue material into a computer system), 15 (aiding and abetting a computer crime), 16 (the “Photoshop Clause;” which has now been extended to mere possession of doctored images and untrue information) and 20 (setting up a committee with the power to block or delete content).
Article 14 – The Good
Article 14 is by far the most commonly used article in the current Computer Crime Act. It has become an easy way to launch defamation suits by claiming that something said on the internet is simply untrue. Since the original act was passed, more than 50,000 people have been prosecuted under this article, all of which are at heart defamation cases. The good news is that with the new act in force, all those prosecutions should end, as defamation is now explicitly excluded.
The original intent of the law was to prevent phishing sites and impersonation.
One of the people who expects to be released from a nightmare of court entanglement was Prasong Lertratanawisut, director of the Isra News Agency. Prasong noted that even former house speaker and Rangsit University President Arthit Urairat was quickly hit with a Article 14 prosecution and silenced by police after he criticized possible corruption in a police procurement project.
Paiboon Amornpinyokeat, honorary advisor to the subcommittee that drafted the act, has attended every one of the meetings during the bill’s 200-day gestation period. Paiboon said he started off as a staunch critic of the act but came to understand how its compromises were arrived at and said the new act fixes much of what was wrong with the original.
Assistant Professor Pareena Sriwanich from Chulalongkorn’s faculty of Law said there needed to be a balance between protection of people’s rights to express their opinion and safety. Nobody wants the government to intervene in their daily lives, but they also want to be safe.
Article 14 has a clause excusing those without intent from liability. However, under the Penal Code, crimes must have intent to be crimes. Writing a law this way does nothing except give people peace of mind, she said.
Arthit Suriyawongkul from the Thai Netizen Network voiced concern that 14(1) would still be used to silence critics of the state. In the run-up to the constitutional referendum it was widely used against anyone suggesting a view that ran counter to the state narrative. Despite the improvements, the wording that it applies to untrue information is still there and worse, the term “misleading information” is added to what article 14 covers.
“The new law will not change anything,” he said.
Article 15 – The Bad
Article 15 of the act punishes anyone who helps to break the law by abetting a computer crime. This has been interpreted as any service provider or platform that allows people to commit what are usually Article 14 offenses on the internet. But while the new law clearly states what kind of service providers would not be punishable, it only says they would not be punished, leaving the door open to criminal prosecution of ISPs and social media platforms.
The new article 15 explicitly exempts the following categories from punishment:
- An ISP or gateway or medium if the selection of information is automated (like the site which just prompted Facebook to phone in a fake bomb scare)
- Caching with automated selection
- Cloud computing services
- Other sites such as portals, social media as long as the selection of content is automated and they do not receive payment
Paiboon said the old Article 15 would have held ISPs and companies such as Facebook or Google criminally liable for comments or public postings and as such was a major impediment for Facebook investing in Thailand. Under the new 15, the presumption of guilt is changed and those who handle content an automated way are exempt.
Satha Hoonpayon, head of legal at e-commerce platform Lazada said that even after carefully reading the law there was much left unclear.
“We are a service provider, but I’m still not sure which category we fall under, but I have just been told that we are in category 4,” he said, despite the fact Lazda is a commercial enterprise that takes a cut from every sale.
“If something sold is illegal, do I get remuneration from the sale? Yes. But do I get special remuneration because it is illegal? No, I only get the standard percentage as I do for everything else in that category. The law is saying, ‘If you get a cut, you’re guilty’. That is simply not fair,” he said.
Satha said Lazada already receives many takedown requests from vendors trying to disrupt their competitors. He said that law needs more verification of takedown requests to prevent it from descending into chaos.
On 15, Prasong pointed out the law is worded to only say cooperative service providers in the 4-point list need not be punished but says nothing about their guilt.
Arthit said that means from now on, every service provider will have criminal records. Article 15 also places the burden of proof on defendants to prove their innocence, rather than the prosecution proving guilt. He noted that in New Zealand, Google gave evidence to parliament that 57 percent of DMCA (Digital Millennium Copyright Act) takedown requests were maliciously filed by competitors, leading to huge wastes of resources fighting them.
Article 16 – The Ugly
By far the most controversial part of the revised act is Article 16(2), which criminalises possession of defamatory “photoshopped” images. New to this version of the law, this also includes possession of untrue information. The new 16(2) says it is a crime merely to possess material ordered deleted by a court order (the old version only criminalized putting such information into a computer system). But what does that mean? Does it mean everyone who consumes information or reads news has to check with court orders to see if any item has been judicially black-listed?
Paiboon defended the law but said its aim may exceed its reach.
“For 16(2) the intention was to protect national security and the [monarchy]. I told them that it was pointless, as you cannot use this law against foreigners anyway, but they said they’ll deal with that,” he said.
One reporter pressed the point saying, “Khun Paiboon. While I thank you for your clarification on 16(2), that is not what the law says. The law clearly says that possession of information that has been ordered deleted by the courts is a criminal offense. How do we know that the authorities will selectively enforce the law as per your very nice explanation rather than enforce the letter of the law?”
Paiboon only replied that the law was designed to be used against Facebook, which often refuses to take down posts even with a court order.
“They will enforce the law only against those who are guilty,” he said, assuring that normal people have nothing to worry about 16(2) while not quite answering the question.
Pareena said that she did not agree with Paiboon’s interpretation of 16.
The way it is presented means that only the defendant who gets the court order needs to delete it? Or does everyone? As for 16(2) possession, Pareena said the law was too wide and vague. She suggested that it would seem that an officer could even check someone’s phone for possession of banned information.
Another issue she has with 16 is that it does not specify the highest court, only a court. That means blocking or deletion could be enforced even while a case was under appeal. Paiboon said he suggested that the committee use the final court for 16, but the drafters did not listen to his suggestion.
Arthit said that the issue he saw with 16(2) was that it now has been expanded from images to include 14 which includes untrue information that also affects economic security and national security. Besides, why do people have to spend time and money defending themselves against the act like Prasong is doing now, he questioned.
Article 20 – Morality Police Committee
Article 20’s provisions on blocking and deleting content were another very controversial addition.
Paiboon explained it allows for blocking information that is illegal or that runs counter to good morals. What constitutes good morals depends on a nine-member committee that will send recommendations to the Digital Economy Minister to decide upon. If the Minister agrees, then the DE will submit an application to the courts, which will summon the original poster to defend themselves. The court order will be an administrative order which can be appealed in the Central Administrative Court. Article 20 also calls for establishing a center that will serve and follow-up on blocking orders. Paiboon said the ministry has complained the safeguards means nothing can be blocked in Thailand as simply serving a court summons could take a month.
Pareena said she was most worried about Article 20 giving powers to the ministry to block or delete information that is illegal, a threat to national security or breaches intellectual property rights. Her emphasis was on the “or delete” part.
The wording here suggests that this will end up as a full-time committee that will look at every move everyone in the country makes. She said she wanted to see how the drafts came up with the exactly language in Article 20.
Worse is what happens after the committee gets a court order. The law allows ministry officers to block or delete the information. Ordering the service provider to censor or remove content is straightforward and was in the last act, but empowering the ministry to delete the information itself is new and very scary.
“I’m not a technology person but this seems to mean that everyone will need to give the ministry back-door access to their database to delete information,” she said.
The law says the ministry will set up a central organisation to oversee the blocking and censorship and will link to service providers’ database. The law says that the link to the database must not cause undue workloads on the system and must be done with the consent of the service provider. “How will the government negotiate? How do we know that the officers will not access other information?” she asked.
Pareena also noted that there is no mention of compensation if the officer damages anything else or crashes the system by deleting an offending piece of information or if he simply makes a mistake in trying to do so.
She said that the law should have been written in a way that ministry should order the service provider to remove the offending information first and only use direct deletion as a last resort. As it stands, the law says that they can order the deletion or go in and delete themselves.
Arthit added that Article 20’s extension to cover intellectual property issues also might criminalize parody and sarcasm.
So, What Difference Does it Make?
So while academics and the public wrangle over this new reality, Pirongrong took the stage to deliver an unscheduled but important footnote toward the end of the event.
“Why are we even talking about laws when the junta has shown it is ready to overrule everything with Article 44?” she asked rhetorically, referring to the junta’s self-granted absolute power to make anything it wants done “legal.”
Related stories:
Army Denies Buying Web Security Cracking Devices
Army Chief Shrugs Off Cyber Assault; Sites Remain Down
Hackers Batter ThaiGov Online as Anger Over Cyberlaw Boils Over
Computer Crime Act 2.0 Passes Unanimously
