Cyber security or cyber snooping?
Under an autocratic regime, no one can hurt the ruler except itself. A recent move by the coup-installed National Reform Steering Assembly (NRSA) seems to prove that saying.
The NRSA’s media reform committee has proposed a fresh cybersecurity bill that would effectively take broad control of online activity in the country.
The bill is an amendment to the original version drafted by the Ministry of Digital Economy and Society (DE) and endorsed last year by the cabinet.
The amended version has sparked public concerns because it proposes the establishment of a national cybersecurity committee that will have authority to gain access to the computer systems of both state and private entities vulnerable to cyber threats. Put simply, the committee can hack any computer system in this country.
The committee will be powerful with department-equivalent status. It will be directly supervised and chaired by the prime minister. Even though the bill says that gaining access to computer systems requires a court order, it allows the committee to do so without prior court approval in cases of emergency or urgency.
The definition of what constitutes exceptions in these cases is too vague and gives room for authorities to use their own judgement to define what an “emergency” or “urgent incident” is to hack public computer systems or demand access from the systems’ owners.
While the Ministry of Digital Economy’s bill only proposed disciplinary penalties on state officials, the revised version extends the punishments to be imposed on private individuals, who could face criminal charges if found to have violated the committee’s order.
There has also been concern over the bill’s broad definition of “cybersecurity”, which covers “measures and operations to protect against, respond to and address threats that will disrupt all types of networks — computers, communications, telecommunications and the internet, as well as satellite, public utility and public services including transport systems”.
This means the committee has the authority to carry out not only computer hacking but also wiretapping. This cybersecurity bill merely makes another bill, previously proposed by the police, to amend the Criminal Code to allow wiretapping, redundant.
The police bill requires a court order in every case without exception and limits wiretapping to only four criminal cases — terrorism, transnational crimes, crimes with a statute of limitations of 10 years and above, and national security.
Like it or not, the cybersecurity bill, if enshrined into law, could be more easily exploited by anyone as a weapon against political opponents. It can allow abuses of privacy.
Ridiculously, the NRSA committee cited the current world-wide attacks in which the malicious software — WannaCry ransomware — was used to justify the necessity and priority of its controversial bill.
Pol Maj Gen Phisit Pao-in, vice chairman of the NRSA’s committee on media reform, has asked Prime Minister Prayut Chan-o-cha to exercise his special power under Section 44 of the former interim charter to set up the cybersecurity committee in advance, despite the fact the bill has not been passed by the cabinet and has not yet been promulgated.
Pol Maj Gen Phisit cited the ministry’s support for this bill.
I have no idea how the cybersecurity committee would be able to respond to such cases as the WannaCry ransomware attack. Would it block all internet gateways to Thailand? or would it hack all internet networks to examine the malware infection?
The cybersecurity bill is one of two controversial bills proposed by the NRSA’s panel in the past few months. The first one is the media reform bill which has been heavily criticised, particularly by media and human rights advocates who expressed concerns it would pave the way for state interference in reportage.
What’s worse is a recent move by the NRSA requesting the prime minister invoke Section 44 to promulgate its proposed bills concerning reforms in various areas, including media reform.
NRSA president Tinnapan Nakata reportedly sent a letter to Gen Prayut asking him to exercise his special power to bypass the enactment process of its 39 proposed reform bills and make them into law.
Capt Tinnapan claimed the enactment of these bills would not be completed by this year under the normal lawmaking process and would hinder the government’s reform efforts.
The cybersecurity bill and the media reform bill are among the 39 bills. Other bills include those concerning justice affairs, democracy promotion, education development, budget procedures improvement, state agencies reform, and digital economic development.
Under Section 77 of the constitution, public hearings are mandatory prior to passing any bill in order to gauge views from stakeholders on the potential impacts. The NRSA’s request to bypass the enactment process obviously violates the charter’s spirit even though the prime minister’s special power could be used to overrule the charter’s clauses.
Deputy Prime Minister Wissanu Kreangam’s cool reaction to the request of the NRSA president is a good sign despite his not objecting outright.
Mr Wissanu commented the NRSA’s request was not in harmony with the government which tried to limit the use of Section 44.
Several Section 44 orders also include a provision which states that normal law should be issued to replace the orders as soon as possible.
The deputy prime minister said the NRSA’s request, however, would be put for consideration before a national reform committee which will be set up in the next few months.
Ahead of its third anniversary in power, despite criticism that the army has failed to tackle economic problems and the rebuke it has incurred over freedom of expression, the status of the military regime is still promising.
Things that can shake up the regime’s stability come not from critics but from its own mechanisms, particularly the NRSA.
Soonruth Bunyamanee is deputy editor, Bangkok Post.