Thailand: Computer Crime Act, 2017 Extraterritorial application Section 17 punishes computer offences that occur outside Thailand; Section 17(1) makes Thai citizens liable for their conduct outside Thailand, and 17(2) makes non-Thai citizens liable for offences against the Thai government or Thai citizens. Given the number of offences in the Amended Act that punish online speech that offends the government, the provision would appear to criminalise any journalist, human rights organization, or other party that engages in truthful expression viewed as injurious to the reputations of government officials. Recommendation: Section 17 should be stricken. Otherwise, it must be amended to ensure that both Thai and non-Thai citizens who are exercising their fundamental right to freedom of expression abroad do not face criminal penalties in Thai jurisdiction. Arbitrary settlement process Section 17(1) provides for a Settlement Committee appointed by the Minister that has the ability to settle cases that carry sanctions of less than two years imprisonment. ARTICLE 19 finds this provision very problematic on due process grounds. It is up to the sole discretion of the Settlement Committee to settle a case. Section 17(1) provides no guidelines for settlement and no transparency for their decision-making process. There does not appear to be any accountability or appeals process. These characteristics provide for a settlement process highly vulnerable to being subjective and arbitrary. Recommendation: Section 17(1) should be removed or amended to include transparent criteria and guidelines for the settlement process and appeals so it is not vulnerable to abuse. Warrantless Search Power The provisions of Section 18 allow for warrantless digital search powers accompanied by gag orders by default: Subsection 18(1) allows officials to compel the production of data or evidence in an communications. Subsections 18(2) and 18(3) allow officials to compel production of traffic data and userrelated data without built-in privacy safeguards. Subsections 18(4) through 18(6) similarly allow officials to compel inspection of or production of data from individuals controlling computer data or storage equipment. Subsection 18(8) allows for officials to seize or attach computer systems. We note that the judicial and privacy protections in these provisions are non-existent or minimal at best. Subsections 18(1) through 18(3) do not require any court supervision or order and simply allow officials to compel production of an enormous range of personal data, traffic, communications, and activity logs with only seven days to comply. In the cases of investigative measures under Subsections 18(4) through 18(8), Section 19 requires the commission of the offence and adequately describe the alleged offence and desired equipment. Notice must only be given to the owner or possessor of the computer system not the actual user being investigated. Thus, it is possible that individuals may never receive ARTICLE 19 Free Word Centre, 60 Farringdon Rd, London EC1R 3GA Page 21 of 24 www.article19.org +44 20 7324 2500