9/18/2019 Case | Freedom of Expression Documentation Center | น อ ลกฎหมายและค เส ภาพ The lawyer asked if he could see that there was a system for removing certain postings in the accused’s website.  Mr. Aree said yes, but during that time, there was not such a   Reference system. And though a link was put there for users to click for removal of a posting, but after you click it, the posting would not be removed right away. It was simply a method of notifying the webmasters. There were about 40 people in the Courtroom. Toward the end of the session, the defence lawyer spotted that a driver of a prosecution witness for tomorrow was seated in the room. He informed the Court so, and the Court told the prosecutor not to let any persons close to the next prosecution witness to be present during the witness examination. 9 February 2011 Examination of prosecution witness no. 2, Mr. Thanit Prabhatnan, Legal Officer, MICT - No trial observation note taken 10 February 2011 Examination of prosecution witness no. 3, Mr. Somsak Suppajirawat, Legal Officer, MIC and CCA competent officer since 2007 until present Mr. Somsak stated that he was asked by the inquiry officers at the Crime Suppression Division to make a copy of computer data.  Mr. Somsak Suppajirawat’s help was sought since he was a CCA competent officer. Mr. Somsak said he sought a warrant from the Criminal Court to make a copy of the data with complaint prepared by the inquiry officer. The request was sent to the Court at 14.30 For detail of the issuance of the warrants, it would be better that the Court asked from the inquiry officers since he had not been involved since the beginning. In the complaint, he was aware that 409 was the no. of address at which Prachatai’s office was located with the accused as webmaster. He was aware that there were six desktop computers and the accused’s notebook computer, and they were part of the evidence in the commission of the offence. The Court granted the permission for the copying of data. Since the postings were done from a computer system, it was assumed that they might have been saved in one of the computers and the data needs to be verified technically. During the arrest, the officers were split into two teams. The first team stood by at the CSD including Mr. Somsak, and another group went to invite the accused to the CSD. Thus, he had no idea how the arrest was conducted. At the CSD, he met with accused and about 20 other people from her team and Fujitsu notebook, serial no. YK8 C032771. The cloning of HDD was conducted by officers from the Hi-tech Related Crime Inspection and Analysis Division, Royal Thai Police with their equipment and team. It was done in the presence of the accused, inquiry officers and Mr. Somsak. It took place for around four hours, and the whole process was videotaped. After The cloning of HDD is done, the cloning device shall generate a serial number (called MD5, as explained later by Freedom of Expression Documentation Center) of the original HDD and the serial number of the cloned HDD has to match the number. The identical serial numbers help to verify that contents in both HDDs are identical. Should the serial no. of any of the two HDDs got changed; it means some alteration has been made to data of either one of the HDDs. The MICT officers also took photo of the serial nos. on the HDDs to ensure that both serial nos. match. After the cloning was done, five witnesses were asked to sign to certify that the process of cloning had been done transparently and accurately. Then the police officers shall write a report about the case and the case prepared by CSD in which Mr. Somsak signed to certify.  The cloned HDD was well packed and wrapped, and signed by both Mr. Somsak and the accused, and kept at CSD and then transferred to the Royal Thai Police. To whom the inquiry officers may transfer the evidence is up to them. No cloned HDD was given to the accused. Two copies were made and verify that they matched each other. Mr. Somsak further testified that his duty was then completed. He had not been involved with the case before and had not known the accused, though he recognized her. He could not remember the name of the expert (the accused said he was not present in the room). Answering questions during the Defence lawyer’s cross examination According to Mr. Somsak, his regular duty is not involved with inspecting webboards. Evidence in the case includes messages in various URLs that he had not seen before. Mr. Somsak was aware that as part of the prosecution, search and arrest warrants had been requested, and a court order for blocking the website had been requested, but was not part of those requesting team. In applying for the court order to copy the data, the police contacted Mr. Somsak personally with no written letters or assignments from their superior officers. In submitting his request, Mr. Somsak did not submit to the Court any documents from his office. Mr. Somsak was not aware if how many computer desktops or notebooks were there in the accused’s office. He was not aware of the six desktop and one notebook computers had been used to run web services regularly. It was the inquiry officer’s duty to find out. The lawyer further asked Mr. Somsak to view Exhibits J23-32, evidence supporting the alleged violation of Section 14(3) and asked him if it was the document he submitted to the Court the day he sought an order to copy the HDDs. Mr. Somsak said he did not look into it. It was the police’s duty. Mr. Somsak further testified that he failed to bring an electronic copy to compare with the documentary evidence during the trial. But he was sure that his office had in possession incriminating information against the accused. The lawyer further asked why he failed to bring with him the incriminating evidence, was that because he was requested to do so by his office? Mr. Somsak replied that once an offence was identified and website blocked, he referred the matter to the Royal Thai Police. And according to the regulation, the inquiry officers are obliged to coordinate with CCA competent officer as per Section 18 when an attempt to copy information or to seize any equipment. The lawyer further asked Mr. Somsak that MICT still had no working procedure concerning (1) the copying of computer data from service providers, (2) guidelines on how to verify the copies, (3) how to store electronic evidence, (4) how to compile documents to supply to the Court and ask for blockade, (5) guidelines concerning necessary documents to be submitted to the Court to ask for copying computer data. Was it true that MICT had no such guidelines? Mr. Somsak said no, and explained that since there were no expert on the matter and the MICT still rely on officers from the Royal Thai Police and the copying has to be done with the presence of various witnesses. Some regulations are so trivial and no necessary. Mr. Somsak also said that apart from appointing MICT officers as CCA competent officers, police officers, officers from DSI and CSD are also appointed as competent officers as well. But in this case and according to the Court’s order, it was Mr. Somsak alone who was authorized to copy data in the six desktop and one notebook computers. But during the actual operation, he had to coordinate with stakeholders. In executing the Court order, and as a competent officer, he did not write up any report and did not write any letter to authorize by other police officers to carry out the copying of the computer data. https://freedom.ilaw.or.th/en/case/112#circumstance_of_arrest 11/26