The Right to Privacy in Thailand: Privacy International Submission to Human Rights Committee obtain further information than what is publicly available, should be treated as undercover surveillance and addressed with constraints and safeguards similar to those in place for undercover activities. That is, any attempt to infiltrate person-to-person, person-to-group, group-to-group interactions is covert state action that needs to be strictly regulated by law. As it amounts to an interference with someone’s privacy, it should be demonstrably necessary and proportionate to the achievement of a legitimate aim. Further, the privacy’s implications of monitoring ‘publicly available’ information on social networking sites should be addressed. The fact that data is publicly available does not suffice for unregulated and un-checked collection, retention, analysis and other processing. In particular, the authorities’ collection and use of publicly available social media data without informed public awareness and debate, clear and precise statutory framework and robust safeguards fall short of standards of protection of the right to privacy and of personal data protection. This is becoming increasingly concerning in light of the development of technologies that can process and aggregate a vast range of data, including personal data, creating profiles of individuals.17 4. Attempts to circumvent encryption in order to conduct surveillance Beyond social media monitoring mentioned, above, Privacy International is concerned about the expansion of online surveillance methods conducted by the Thai government, in particular its effort to circumvent the encryption of many different online services by secretly undermining their security and directly impacting the privacy of internet users. Research published by Privacy International highlights that the Thai Government’s blocking of Facebook, 6 days after the military coup on 28 May 2014, may have been an attempt to circumvent the platform’s encryption and spy on its users, rather than attempting to censor Facebook users as initially reported. Privacy International could not establish if the Thai Government managed to circumvent encryption.18 In addition, the research illustrates how the Thai military government reportedly conducted downgrade attacks. Downgrade attacks are a way for the attacker to force the user to communicate with their email service provider via an unencrypted channel. This means the security of people’s email communications through mail clients such as Apple Mail, Microsoft Outlook and Thunderbird was likely compromised, and their emails re-routed through insecure channels. This weakened security may have allowed the Thai Government to access the content of the emails. 17 18 Some national oversight bodies have expressed concerns about the privacy implications of the use these technologies. For example, To equal effect, the UK Chief Surveillance Commissioner commented in 2015 that “perhaps more than ever, public authorities now make use of the wide availability of details about individuals, groups or locations that are provided on social networking sites and a myriad of other means of open communication between people using the Internet and their mobile communication devices. I repeat my view that just because this material is out in the open, does not render it fair game” (Office of Surveillance Commissioners Annual Report for 2014-15, paragraph 5.72.) Privacy International (2017) Who’s That Knocking At My Door?: Understanding Surveillance In Thailand 5