Thailand: Computer Crime Act, 2017 containing access prevention measures does not carry any intentionality requirement. Hence the offence appears to be a strict liability crime. While intentional access to a computer system without right can be a legitimate offense when it is properly defined, the vagueness of this provision fall short of international standards. there be intent to obtain computer data. Further, Section 5 should require the infringement of security measures. ARTICLE 19 also notes that Section 7 nearly duplicates the language of Section 5, with the from a comparative perspective, we observe that the Cybercrime Convention does not provide these as separate offences, and thus the punishment of accessing computer data can be Recommendations: The phrase Amended Act should be replaced with the infrin Section 7 should be omitted for being redundant. Computer data can be addressed by Section 5. Disclosure of security measures is nowhere defined and provides for no intentionality requirement, in effect making the provision a strict liability offence. The measure as written could punish those who are carrying out legitimate activities, e.g. academic and digital security research. For instance, researchers will often test software and computer systems for vulnerabilities and bugs and post their results publicly so that flaws can be addressed. Companies often hire security consultants to test systems and publish their findings. The public dissemination of such flaws, particularly in the case of open-source software, serves to improve security and usability. Recommendation: Section 6 should be stricken in its entirety. Unauthorised interception and interference Section 8 of the Amended ARTICLE 19 Free Word Centre, 60 Farringdon Rd, London EC1R 3GA Page 15 of 24 www.article19.org +44 20 7324 2500