Thailand: Computer Crime Act, 2017 the UDHR and the ICCPR.39 Legislation and regulations protecting human rights defenders and journalists should include provisions that enable access to and provide support for using technologies that would secure their communications; Restrictions on encryption and anonymity must meet the three-part test of limitations to the right to freedom of expression under international law.40 Laws and policies providing for restrictions to encryption or anonymity should be subject to public comment and only be adopted following a regular rather than fast-track legislative process. Strong procedural and judicial safeguards should be applied to guarantee the right to due process of any individual whose use of encryption or anonymity is subject to restriction.41 The Special Rapporteur's report also addressed compelled 'key disclosure' or 'decryption' 42 creating serious challenges that implicate individual The report stipulated that such orders should be based on publicly accessible law; clearly limited in scope focused on a specific target; implemented under independent and impartial judicial authority, in particular to preserve the due process rights of targets; and only adopted when necessary and when less intrusive means of investigation are not available.43 Cybercrime No international standard on cybercrime exists in the area. From the regional standards, the 2001 Council of Europe Convention on Cybercrime (the Cybercrime Convention) has been the most relevant standard.44 Although Thailand is not a signatory to the Convention, it provides a helpful model for states seeking to develop cybercrime legislation. The Cybercrime Convention provides definitions for relevant terms, including definitions for: computer data, computer systems, traffic data and service providers. It requires State parties to create offences against the confidentiality, integrity and availability of computer systems and computer data; computer-related offences including forgery and fraud; and contentrelated offences such as the criminalisation of child pornography. The Cybercrime Convention then sets out a number of procedural requirements for the investigation and prosecution of cybercrimes, including preservation orders, production orders and the search and seizure of computer data. Finally, and importantly, the Cybercrime Convention makes clear that the above measures must respect the conditions and safeguards for the protection of human rights and liberties, consistent with the ICCPR and other applicable international human rights instruments. 39 Ibid, para 53. Ibid, para 56. 41 Ibid, paras 31-35. 42 Ibid, para 45. 43 Ibid. 40 44 The Council of Europe Convention on Cybercrime, CETS No. 185, in force since July 2004. As of May 2015, 46 states have ratified the Convention and a further eight states have signed the Convention but have not ratified it. ARTICLE 19 Free Word Centre, 60 Farringdon Rd, London EC1R 3GA Page 12 of 24 www.article19.org +44 20 7324 2500