May 2014

After the coup, the NCPO made dozens of arrests, stepped up digital surveillance, infringed on online privacy, and created a climate of fear where internet users conducted on- and offline “witch hunts” against fellow citizens.

Within a month after seizing control, the NCPO had detained over 500 individuals, including politicians, activists, academics, and journalists. Over 150 of these had exercised freedom of speech in ways that displeased the junta.[86] Some were summoned via public announcements broadcast on every television channel, while others were subject to unofficial arrests made at homes or workplaces. Detainees were brought to designated military camps around Thailand, where personal communications devices were confiscated. Some were blindfolded to conceal the camp’s location. While in custody, individuals were interrogated on their political views. The NCPO said the detentions were carried out under martial law, which authorizes military detentions without legal counsel for up to seven days. Prior to release, the individual in custody would be forced to sign “conditions of release” papers, agreeing not to express political opinion in public, participate in political movements, or travel overseas without NCPO consent, and agreeing they had not been tortured during custody. Many were also ordered to surrender their Facebook account password to the army.[87]

A number of detainees faced criminal charges as soon as the seven day limit was reached. On June 2, NCPO orders stipulated that crimes related to lèse-majesté, national security, or infringing NCPO orders issued after May 25 would be tried by a military court, which lack appellate and higher courts. Three judges conduct military trials, but two are not required to have a law degree if their military ranking is higher than the defendants’.

In this environment, charges of lèse-majesté and computer-related crimes brought by internet users against fellow citizens increased along with political detentions. By June, a civil society group led by a military officer, styling itself the “Rubbish Collection Organization,” had filed charges of lèse-majesté against five internet users with the Technology Crime Suppression Division (TCSD).[88]

In the month after the coup, there were at least five cases of a lèse-majesté charge added when an individual was already in detention. Three notable ones involved digital content:

In May, police arrested a protester identified by the single name Apichat in Bangkok. After seven days in detention, he was charged with violating an NCPO order prohibiting protests. Citing content posted on his Facebook page, a witness separately accused him of lèse-majesté, substantially increasing the possible penalties he faces if convicted.[89]

Another telling case involved Sombat Boonngamanong, a prominent activist who has leveraged new media to address issues of missing persons, post-Tsunami recovery, and the 2011 floods. He also founded the “Red Sunday” meetings after the 2006 coup, which encouraged people to independently associate and mobilize without relying on a political party and initiated the prodemocracy red-shirt movement. Sombat refused to cooperate with an NCPO summons issued after the coup, but set up a “Catch me if you can” campaign on his Facebook page. A joint army and police operation arrested him on June 6, apparently having traced him via his IP address.[90] Although he was initially charged with violating an NCPO order by not responding to the summons, police added the charge of lèse-majesté while he was in custody, based on an earlier complaint against him. This prolonged his detention for three weeks before he was released on bail in July.

Chaturon Chaisang, former minister of education, also refused to answer an NCPO summons. Police arrested Chaturon in the middle of a press conference held at the Foreign Correspondents’ Club of Thailand. Shortly thereafter, he was charged with violating Thailand’s Computer Crimes Act for posting anti-coup statements on Facebook.[91]

Online anonymity is under threat since the coup. In late May, the MICT reportedly proposed to establish a single national gateway to the international internet to expedite monitoring and censorship of online content that is deemed illegal.[92] Reports in June 2014 said MICT officials were consulting with vendors to implement the plan, which would require every Thai citizen to authenticate their identity using a smart ID card before logging onto the internet. [93] At the end of June, there were no confirmed developments.

Officials from the Department of Special Investigation announced in May that they were requesting to join private chat groups on the messaging app Line in order to monitor group conversations for inappropriate content.[94] In early June, a senior police official said police have a duty to check Facebook accounts which share anti-coup messages or invitations to congregate. “Liking” illegal content is also considered a criminal offence, as an act of sharing.[95]

Police also used surveillance methods to capture personal data. In early July 2014, many Thai internet users found that visiting blocked websites prompted a screen with a TCSD logo and a message explaining it had been censored. Attempting to close the message triggered a request for consent to share the user’s personal data, apparently through a Facebook app titled Login. Clicking “Agree” automatically compromised users’ Facebook account details. After the Thai Netizen Network publicized this exposure, the “Close” button which launched the fake app disappeared from TCSD messages, and the TCSD website posted an invitation to “Friend” the division on Facebook in order to help them uncover suspicious activity online.[96]

May 2013—April 2014

As in past years, many Thai journalists, activists, and citizens were sued for defamation and insulting the monarchy in online communication during the coverage period of this report. In an unprecedented case, an internet user known as Kenji was jailed for 13 years for “attempting” to commit lèse-majesté online after police uncovered unpublished anti-royal comments on a device connected to the internet in his home. The sentence was reduced after he confessed to the crime, which has no legal basis. Inadequate technical evidence continues to mar proceedings, and one Prachatai commenter was sentenced to five years in prison for committing lèse-majesté based on misinformation about the computer where the post originated. As rumors of a coup spread online, police tried to persuade international social networks to supply them with user data to assist national security inquiries.

Article 45 of the Constitution of the Kingdom of Thailand 2007 guarantees broad freedom of speech. However, other laws have been used to curtail free expression, including the Internal Security Act of 2007 and the Emergency Decree on Public Administration in Emergency Situations 2005. The 2007 Computer related Crime Act (CCA) groups online speech offenses—such as posting or allowing the dissemination of content considered harmful to national security or public order—with criminal activities like hacking or posting obscene material. Civil society groups and scholars say the CCA can be abused to launch personal or politicized attacks against content providers, webmasters, and other intermediaries.[97]

Many offences in this law already exist in the penal code, but the CCA carries harsher penalties. Article 14(1) provides for prison sentences up to five years, fines up to THB 100,000 (US$ 3,330), or both for anyone who transfers damaging “forged” or “false” computer data,[98] and is often used simultaneously with Articles 326 and 328 of the penal code pertaining to defamation, which carries a maximum sentence of two years in prison or fines up to THB 200,000 ($6,660).[99] Under the penal code, only the victim has the right to sue for defamation, which is considered a personal offence. In contrast, anyone can file criminal charges under the CCA, whether or not they are implicated in the disputed content. Moreover, Article 14(1) refers to the illegal tampering with electronic data, so its application to speech is a misinterpretation, according to Surangkana Wayupab, director of the MICT’s Electronic Transactions Development Agency, who is pushing to amend the CCA.[100]

Police, the attorney general, and the courts continued to pursue such cases during the coverage period of this report. One ongoing investigation dates from February 2013, when the owner of a canned pineapple factory sued researcher Andy Hall for defamation and CCA violations in a report alleging the company had violated labor rights.[101] Hall’s findings, sponsored by the Finnish non-profit organization Finnwatch, were publicized on many websites. A few months later, in an April 2013 speech in Mongolia, Prime Minister Yingluck Shinawatra courted controversy at home when she characterized the 2006 coup d’état, when the military displaced the elected caretaker government headed by her brother Thaksin, as a backward step for the country. [102] In May 2013, she sued a prominent political cartoonist who uses the pseudonym Chai Ratchawatra for defamation and CCA violations, after he posted the response, “a whore sells her body, an evil woman sells her country,” on his personal Facebook page.[103] That investigation is also ongoing. Finally, in December 2013 the Thai Navy sued Alan Morison and Chutima Sidasathian, journalists at the Phuket Wan news website in Phuket province, for defamation and violation of CCA Article 14 (1).[104] The previous July, they had cited a Reuters news agency investigation that accused the Thai military of profiting from the illegal smuggling of Rohingya refugees, a persecuted minority in neighboring Myanmar, into Thailand.[105] Police continue to investigate, though the original article can still be accessed. As of mid-2014, no lawsuit had been brought against Reuters.

Article 14(3) of the CCA prohibits the “import to a computer system of any computer data related with an offence against the Kingdom's security under the Criminal Code,” and carries a penalty of five years’ imprisonment, a fine of up to THB 100,000 ($3,330), or both. It is often used in conjunction with Article 112 of the penal code, which pertains to lèse-majesté. The first case ever tried under the CCA in 2009 followed this pattern,[106] which persists to this day. Since Article 112 carries jail terms from 3 to 15 years, those charged under both laws face a 15-year maximum.

In September 2013, Porntipa Supatanakul, owner of a cable TV program, sued Saran C., a Thammasat University student pseudonymously known as Aum Neko, for committing lèse-majesté and violating the CCA in an interview that was never broadcast, as well as in personal Facebook posts. On March 24, 2014, police summoned the defendant to hear charges, and the investigation is ongoing.[107] In an unrelated case from September, dozens of police in Samut Prakan province raided the residence of a man using the online username Kenji in the online discussion forum “Internet to Freedom” for allegedly posting two lèse-majesté statements online.[108] After his arrest, police found photos with lèse-majesté remarks on a personal device that can connect to the internet and accused him of “attempting” to commit lèse-majesté—a charge with no legal basis. Nevertheless, in December 2013, a criminal court found him guilty of violating both Article 112 of the penal code and CCA Articles 14(2) and 14(3), sentencing him to a total of 13 years and 4 months in prison.[109] The same court reduced the sentence to just under seven years because he confessed.[110] The verdict marked the first time in Thailand that a defendant has been found guilty for attempting to commit lèse-majesté.

Internet users who post controversial content can face harassment outside the legal system, including physical violence. Somsak Jiemteerasakul, an outspoken Thammasat University historian, shares opinions on the monarchy and Thai politics with 80,000 Facebook followers, despite an ongoing lèse-majesté lawsuit the Thai army filed against him in 2011.[111] On February 6, 2014, the army announced that some of his Facebook posts may also violate lèse-majesté laws.[112] On February 12, unknown assailants fired multiple shots and hurled bricks at Somsak’s car and house while he was inside. No one was injured, but the police investigation into the attack appears to have stalled.[113]

CCA Article 15 states that administrators who fail to stop internet users from posting banned content are “supporting or consenting to” the post and face the same penalties as if they had created it themselves.[114] This serves as a discouragement to service providers, since the constant monitoring it demands from website owners is time consuming and inefficient. Moreover, the law fails to establish a time frame for service providers to delete offending content. In 2012, a court sentenced Prachatai’s Chiranuch Premchaiporn to a suspended eight months in jail and a THB 20,000 ($673) fine for failing to delete 10 anti-royal comments, [115] [116] though the site’s administrator had removed them all within 20 days.[117] In April 2013, the ICT Ministry published the draft of an amendment to the CCA, including Article 15.[118] It stipulates that service providers who “know or should know” of computer data on their platforms that violates the law must “remedy the situation,” whether by deleting it or informing the original poster to do so, in order to avoid liability. Like the current law, this puts blame on intermediaries rather than protecting them, and may even lead to more responsibility on grounds that they “should know” of infractions. While the ministry is soliciting public opinions on the draft via an official website, it is not clear if they will be incorporated into the final amendment.

CCA enforcement is inconsistent and lacking in due process. The executive authorities are left to decide what amounts to a violation under its vaguely defined terms, and criminal courts make the final judgments.[119] Many cases are tried without adequate evidence, and defendants who face attorney generals as plaintiffs often decide not to fight their case, because admitting guilt typically leads to reduced penalties and is the fastest way to end the often convoluted proceedings.

On October 2, 2013, an appeals court sentenced a lèse-majesté defendant to five years in prison. In 2011, a court had dismissed the charge against Nopawan T., the 31-year-old manager of a vehicle parts company, based on statements posted to a Prachatai web forum.[120] Police had traced the IP address behind the statements to a factory where many computers connect to the internet, which the court said was insufficient proof of guilt. The appeals court disagreed and reversed the earlier acquittal.

In a separate case in March 2014, an appeals court upheld a ruling that two messages allegedly posted by former stockbroker Kata P. on the Fah Diew Kan (“Same Sky”) bulletin board violated Article 14(2) of the CCA by connecting a crisis of confidence among investors to rumors about the king’s health. The decision was based on testimony from an MICT official citing information received from Microsoft Thailand that supposedly connected the defendant’s email address to the posts. When first presented to the criminal court in June 2013, the Microsoft Thailand information failed to demonstrate that link, but the MICT official presented it again, and said it was supported by unspecified classified information obtained from security and intelligence agencies. Kata P. is now serving a jail term of two years and eight months.[121]

The CCA was passed after the 2006 coup d’état and has been actively used in subsequent national security investigations, when police are known to implement surveillance.[122] The scale and technical capabilities of their activities are unclear, though the CCA requires ISPs and webmasters to retain data logs for up to 90 days and turn data over to investigators upon request.[123] A cabinet directive effective since its publication in the Royal Gazette in May 2012 placed several types of cases, including CCA violations, under the jurisdiction of the Department of Special Investigation (DSI).[124] Under rules regulating DSI operations, intercepting internet communications and collecting personal data in CCA cases no longer needs a court order.[125] Even where court orders are required, Thai judges typically approve requests without serious deliberation—as is the case with censorship decisions. Some internet users and political activists exercise caution when communicating online, and employ additional security and privacy tools to evade surveillance.

In July and August 2013, rumors of a pending government takeover circulated online. The police’s Technology Crime Suppression Division (TCSD) searched social media posts for the word ‘coup,’[126] and summoned four people suspected of initiating the report, including Sermsuk Kasitipradit, editor of politics and national security at the public television station ThaiPBS, who had analyzed the rumors on his personal Facebook page. After the summons made headlines and was widely criticized, the division said the individuals were being sought merely as witnesses.[127] In the wake of the rumors, however, both the government Center for Maintaining Peace and Order and the TCSD independently announced that referring to such rumors or “liking” them on Facebook was tantamount to supporting them, and could be punishable under CCA Section 14(1).[128] Separately, Facebook disclosed that it had received two requests from the Thai government in the first half of 2013, seeking information on five Facebook users, but did not provide more details.[129] TCSD Director Pisit Pao-in also said that his team had requested Japan-based Naver Ltd., the owner and operator of the popular Line chat application, release chat logs and information on users for communication that affect national security.[130] Naver responded that it would only cooperate under a Japanese court order.[131]

Customers at cybercafes must present identification cards, though smaller businesses do not always comply with this rule. Mobile phone users are required to register their real names and national ID with their carrier upon purchasing a SIM card, whether prepaid or subscription. Although the rule is less strictly enforced for prepaid SIM cards, those who do not register are unable to receive certain services.[132]

There have been sporadic reports of hacking attacks on online news outlets in Thailand in the past. None were documented during the coverage period of this report, though hackers did target government sites. In May 2013, a group calling themselves “Unlimited Hack Team!!!” left pejoratives about Yingluck Shinawatra on the Prime Minister’s office website.[133] In February 2014, anonymous hackers disabled the Office of National Economic and Social Development Board website to prevent them from disclosing economic data, forcing them to release the information to the press via e-mail.[134]