Thailand: Computer Crime Act, 2017 Section 12(3) should be stricken. Illegal devices and access codes Section 13 of the Amended Act punishes anyone who sells or disseminates instructions to commit various other offences under the Act. The provision also provides for heightened penalties in conjunction with Section 12 for offences involving certain broadly-defined computer systems. ARTICLE 19 is extremely concerned that Section 13 creates a strict liability offence for disseminating certain technological tools. Like many tools, technologies are dual-use and it is in the nature of technology that it can be used both for legitimate and illegitimate purposes. Most companies would know that the software they manufacture or sell could be used for dual purposes, including for the purposes of unauthorised access to computer data and systems. A disseminated technology be used to commit an offence under the A 13. Otherwise the provision could punish legitimate activities such as security testing. This is the same standard as required under Article 6 of the Cybercrime Convention, which highlights the need for protecting system testing in Article 6(2). In addition, we are concerned that this provision may be used to prosecute individuals or companies producing, distributing, selling or otherwise circulating software used to break Digital Management Rights systems. DRM systems are a type of technology principally used by hardware manufacturers, publishers and copyright holders to control how digital content may be used after sale. DRM systems are controversial from a freedom of expression perspective, as the legitimacy of copyright holders exercising in perpetuity absolute control over the sharing of information is strongly contested. For example, DRM systems prevent individuals from engaging in trivial and non-commercial acts of copyright infringement such as transferring data between their own electronic devices; they can also prevent individuals Recommendations: As written Section 13 can punish the dissemination of legitimate dual-use computer software; an intentionality requirement must be added requiring that dissemination or sale of devices, software, or data be done for the purpose of committing an offence under the Act; The paragraphs of Section 13 that cross-reference Section 12 to impose heightened sanctions for subjectively-defined computer systems should be stricken in accord with The maximum penalty provision provided in the final paragraph of Section 13 should be stricken entirely. Computer forgery and fraud Section 14 and its subsections punish a wide range of conduct: Subsection 1 criminalises the intentional input or alteration of inauthentic computer data Subsection 2 punishes ARTICLE 19 Free Word Centre, 60 Farringdon Rd, London EC1R 3GA Page 18 of 24 www.article19.org +44 20 7324 2500