9/18/2019 Case | Freedom of Expression Documentation Center | น อ ลกฎหมายและค เส ภาพ The lawyer further asked after the copying, have the police informed the Court about the accomplishment of duty? Mr. Somsak replied that the police did as required by Section   19 Reference to report to the superior officers. But he himself did not write any report, though he was required to make the report to his superior officers, too. As a person authorized by the Court, Mr. Somsak had to ensure that the data copied be kept at the CSD, but no copies were kept at MICT and not with him personally. On 6 March 09, Mr. Somsak was present with the team that had applied for the Court order and had no idea as to how the arresting team performed their duty. No MICT officers went with the police during the raid. The lawyer asked if he was aware as to how many computer systems were copied by the arresting team, and whether or not data of all six desktop computers was copied? Mr. Somsak said he did not know, but thought they would not have done that. The arresting officers did not mention anything to him. As for the copying method, Mr. Somsak said he never used any software. The lawyer then asked that Mr. Somsak mentioned about the serial numbers, it means he did not have knowledge about it? Mr. Somsak replied that from asking the technical team, he only knew that if the data has been altered, the serial numbers will also change. To become a technical officer, one has to have formal training and certification. The lawyer asked during the time the officers were about to store the cloned HDD, did they show the packs to the alleged offender again to verify that they were authentic? Mr. Somsak said no. The lawyer asked Mr. Somsak if he had even turned on the notebook computer containing the original copy of data? He said no. He was standing there as a witness and did not check or count the number of files stored in the computer. The lawyer asked if he has verified if the two sets of data match each other? He said no, no need for comparison. The lawyer asked Mr. Somsak, during the copying of data, if he could confirm that the accused had committed an offence as per Section 14-15 of CCA. He said he could not confirm that. It still needed to be verified. Should there be any offences committed, the incriminating evidence should have been stored in the computer. Prosecutor’s re-examination As described by Mr. Somsak that no instruction has been made by his superior officers to carry out the duty, and no written guidelines have been made, in fact, the process neede to be done promptly invoking power provided for by the CCA and then the officers can inform their superior later. Then, the prosecutor handed over a copy of the guidelines on ho to avoid committing cyber crime which outlines procedure concerning the arrest, holding in custody, searching, inquiry report writing and taking legal action against the offenders o the CCA to Mr. Somsak. The prosecutor pointed to Regulation 5 on page 122 that states that upon receiving a complaint or accusation as per (4), the inquiry officer shall coordinate with the competent officer in order to acquire supporting proof of the offence. And the CCA competent officer is able to coordinate directly with the police. Mr. Somsak said it is correct as said. The prosecutor then asked Mr. Somsak that he said that he had no idea how the computers were related to the commission of the offence. When did he not know about the connection? Mr. Somsak said it was prior to his applying for court orders. He had no idea if the computers had been used to make possible the commission of the offence. Then, he only knew that he was supposed to ask for the court order for cloning data from six computers. Then the prosecutor asked him that he said he had not seen the documents submitted to the Court along with the request, whey did he not get tor read the documents? Mr. Somsak said it was the duty of the inquiry officer to compile all documents. His dut was simply to deliver them to the Court. The police cannot submit the documents directly as they are not authorized to do so. But during the trial, the Court shall ask from the inquiry officers themselves. The prosecutor asked on the day of copying the data, were the inquiry officers and Mr. Somsak present in the room or not? He said he was there, but could only recall detail when the Court order was requested to make the copying of data. (Then he was shown some document by the prosecutor).  Mr. Somsak said further that he was not interested in any detail, but he was listening and was aware that the requesting for court order was related to an offence committed as per Section 14(3) regarding national security and Section 15 and more evidence was needed, and it should have been stored in the HDDs. The prosecutor asked that he said that there have been no written guidelines for operation? Mr. Somsak said they were not necessary. The prosecutor asked that he said police officers can be appointed as CCA competent officers by the order of the PM, have all police officers been appointed so? He replied that only certain police officers. The prosecutor then asked that you said you have not written your report, what did it mean? Mr. Somsak said it was not necessary since the inquiry officers are already required to write up a report as per Section 19.  The prosecutor asked in requesting for a permission to make copy computer data, how did the police forces and Mr. Somsak divide up their duties? Mr. Somsak said he had submitted the request to the Court, and the police themselves have to report to the Court. The prosecutor asked that he said the officers of the arresting team failed to inform him if there were six computers and he did not ask them, and did the accused inform him or no that the copying was made on six computers?  Mr. Somsak said no, she did not tell him and there was no complaint about this matter. The prosecutor asked what did he use to make the copying? He said it was a copying software (sic). The copiers have to be officers with formal training and have to have certificate that meets international standard. That was why Mr. Somsak did not carry out the copying himself, and he had never done it. The prosecutor asked during the course of four hours of copying, did he get to see if the computers were turned on? Mr. Somsak said the process was conducted transparently in small and open room. Whether or not the computers were turned on, he could not remember. He had no idea about it since it required technical knowledge. The prosecutor asked if the HDDs had to be turned on when making the comparison? He said no, it was not necessary. Two copied HDDs were made for analysis at the Royal Thai Police. The prosecutor asked how to verify that the two HDDs match each other. Mr. Somsak said why is there any need to verify them? The prosecutor asked if he had any knowledge about the computer? He said no. The prosecutor asked this morning he said the technician informed him that a photograph was taken as per Exhibit J7, when was the photo taken? Mr. Somsak said he think it was taken at the completion of the copying. The prosecutor asked why could he not confirm that the accused had committed the crime? Mr. Somsak said it is because his duty was simply to copy the data. During the Defence lawyer’s cross examination regarding the document “Regulation Concerning the Arrest, Detention, and Search to Prepare an Inquiry Report and to Prosecute an Offender as per the 2007 Computer Crime Act” enforced since 30 November 2007, on pages 122-123, it only stipulates that cooperation with the inquiry officer has to be made and from no. 4-8, according to Mr. Somsak, the Regulation does not provide for any guidelines. In reality, the work is divided up among the officers and thus far, there have been no new regulations issued. During the prosecutor’s re-examination, Mr. Somsak was asked by the virtue of which law the regulation has been issued?  Mr. Somsak replied that it is issued invoking Section 29 of CCA. The prosecutor asked how to execute all the duties described in the Regulation? Mr. Somsak replied that he could not carry out all duties and cooperation was needed. The police had resources necessary for making the arrest. And the police are authorized by the Regulation to do so. And Mr. Somsak was also part of the complainants, and the arresting had to be executed based on cooperation and division of labour. Witness examination of Mr. Somsak Suppajirawat was adjourned, recess for lunch.   10 February 2011 (Resumption in the afternoon) Examination of prosecution witness no. 4,  Mr. Pairat Yawong, attorney, 38 years, attorney of Law Home 999, Co., Ltd., has been a attorney since 1998 Regarding the case, around March 2009, Mr. Pairat Yawong was having some business with one of his clients at the CSD and he was asked for help by an inquiry officer. He was given some postings in Prachatai website to read and asked to give his opinion as a lawyer if the postings can be deemed an offence as per Section 112. After reading the posts, https://freedom.ilaw.or.th/en/case/112#circumstance_of_arrest 12/26