Dear members,

The seminar organized on 29 October 2008 on the computer crime act was very informative and useful, yet quite scary. Many thanks to Paul Connelly, Partner at International Legal Counsellors Thailand, and Bernard Collin, CEO of Safecoms and member of the ICT Committee of the Joint Foreign Chambers of Commerce Thailand, for clarifying the act to all of us.

The presentation of Paul Connelly can be downloaded and reviewed right here and his accompanying notes can be downloaded by clicking here.

The presentation of Bernard Collin can be downloaded by clicking this link.

This is the short version:

The Computer Crime Act is enacted since a year so all companies and individuals using computers in Thailand have to comply with the law.

Despite the positive intention of the law, it is nearly impossible to comply 100%. However, we do encourage all our companies to comply to the best of their abilities with the new law. In the meantime, we work with the Joint Foreign Chambers of Commerce in Thailand to modify the law in such a way that it keeps the same positive intention but that it will be easier for companies to comply.

The Computer Crime Act, simply said, imposes every single company in Thailand to log the traffic of all their computers for a period of 90 days (rolling). Traffic to be logged includes all internet access, email, web browsing, chat, internet banking, etc. Companies need to log computer ID, user ID, time, host IP etc.

The law also describes spam as criminal if it slows down the operations of the computer or network and if the identity is hidden. To be on the safe side, please always add the "unsubscribe" option to your mass mailing messages.

In order to comply with the law, most companies will have to invest so they can accurately log the information required. Estimates for cost range from 50K to 300K Baht for companies with 20-100 computers/users (amount depending on the number computers/users, type of traffic, quantity of traffic, etc). It is very clear that companies are liable for the behaviour of their employees, so in addition to logging computer usage information, we recommend that companies train their people on what constitutes proper behaviour while on-line.

I hope this helps. Please note that there are member companies specialised in auditing your systems and implementing processes so you can comply with the Computer Crime Act.

Bert