Surapak Puchaisaeng is a computer programmer who was arrested on lese majeste and Computer-related Crime Act charges on 1 September 2011. He was aged 40 at the time. Lawyer Lomrak Meemeuan says police arrested him for allegedly insulting the king on a Facebook page.
A later statement says that Surapak was arrested by about 10 plain clothes Department of Special Investigation officers at his apartment in Bangkok. Surapak states that the police accused him of creating an offending Facebook page. He denied all knowledge of this, of the username Dork Or (“ดอกอ้อ”) and involvement with the website Nor Por Chor USA. He is quoted: “I denied all knowledge, but they tried to force me to sign a confession. I went to telephone a lawyer, but they took the mobile phone from me.” He said that he then signed the confession and gave his password as he was afraid. He was only able to contact a lawyer when taken to DSI HQ. He sought bail but eventually spent 13 months in jail before he was acvquitted.
Surapak’s case carried the dubious distinction of being the first lese majeste arrest under the Yingluck Shinawatra government, although investigations began under the Abhisit Vejjajiva government.
A later Prachatai account provides different details of the case. It says the software developer arrested by Technology Crime Suppression Division police on 1 September 2011 and accused of being the owner of a Facebook page entitled ‘I shall reign with … [censored]’ which allegedly contained messages offensive to the monarchy. Suraphak denied all charges.
Surapak said the police seized his mobile phone, two computers and a laptop, and refused him access to friends, witnesses and lawyers until he was taken to the TCSD office for further interrogation. He claimed the police did not produce any evidence to substantiate the allegations, and simply told him that a student had filed a complaint about the Facebook page and a witness had identified him.
Surapak was indicted on 25 November 2011, with no bail and two previous requests for bail have been refused.
Freedom House issued a Freedom Alert on this case on 8 September 2011 (see below).
His trial began on 18 September 2012 and concluded after just 4 days.
The gist of the proceedings seems to be an accusation rather than evidence, with a police colonel from the Technology Crime Suppression Division stating that Surapak “admitted after his arrest and during an initial probe that he was the owner of the email address and Facebook page” that were said to be involved with lese majeste content. As noted above, Surapak “denied all knowledge, but they tried to force me to sign a confession. I went to telephone a lawyer, but they took the mobile phone from me.” He was denied access to a lawyer for some time.
The policeman, presumably one of those involved in denying Surapak he legal and constitutional rights, stated that it was only when “the defendant learned that he could be charged under Section 112, the so-called lese majeste law, he pleaded not guilty…”.
Surapak’s own evidence appears in line with that noted above. He denied “an association with the email and Facebook page alleged by the police as being used to display messages deemed insulting to the monarchy.” He stated that he was denied a lawyer and that the policeman cited above, “Pisit Paoin, deputy commander from the Technology Crime Suppression Division, told him to write down the suspected email address and Facebook page on a piece of paper…”, and had him sign it. He “denied the document proved his authorship of the email and ownership of the Facebook page. He also denied all charges.” In addition, Surapak pointed to the “temporary files which the police entered as evidence proving an association between the email and Facebook page and his two computers were not credible.” Finally, he “pointed to a Microsoft report entered as evidence by the prosecutor which showed an attempted link to his computer through Wifi on Sept 7, five days after he was arrested.”
On this technical matter, Surapak was supported by a “defence witness, Kittipong Piyawanno, a lecturer at the Royal Thai Navy Academy’s Engineering Department, [who] argued that police evidence supposedly showing log files of the suspected Facebook page appeared incomplete and irregular.” He stated that “if a Facebook use is to appear in the cache file, it must be in the form of PHP, not HTML as shown in the evidence. He said the source post provided by the police looked like it was created manually.” He added that “the police evidence also showed that the computer was activated twice while it was not in the possession of the defendant.”
Kittipong concluded that as “the computer forensic police did not appear to follow the appropriate protocol in its handling of the exhibit computers, the resulting evidence is not credible…“. Kittipong added: “The reliability [of the claimed evidence] is almost nil…”. He went on to say that “if an innocent person were sentenced under the lese majeste law or the Computer Crimes Act, not only would the person develop a negative impression about the monarchy, but the monarchy would be negatively affected as well.” And, to finish, he is said to have “criticised the activities of the so-called cyber-scouts and ultra-royalists, saying that going on a witch-hunt was not the right way of expressing love for the monarch.”
The Nation newspaper had a story headlined: I’ve been framed: Lese majeste man. That seems an appropriate description.
While the accounts of the evidence are incomplete in the newspaper reporting, there certainly appears to be little substantial evidence in this case. Surapak may well be one of those in the tiny 4-5% who get off lese majeste and computer crimes charges, but the recent behavior of the courts suggest that acquittal is unlikely. We hope we are wrong. At the very least, Surapak should be bailed immediately.
The court delivered its verdict on 31 October 2012, and agreed that Surapak deserved the “benefit of the doubt.” The “doubt” was that the HTML files on his computer were not cached when browsing Facebook but were pasted into Mr Surapak’s computer. This suggests that the computer used as evidence was tampered with, probably by the police. PPT is overjoyed that Surapak joins the 5% who have been acquitted and that the court appears to have taken evidence seriously in a lese majeste case. That is a significant change.
Prachatai published a translation of the verdict, which PPT reproduces here, in full:
The prosecutor accused the defendant of creating a personal e-mail account, firstname.lastname@example.org, and using it in the capacity as the owner to create a Facebook profile titled, ‘I shall reign by staging coups’. The defendant wrote messages deemed insulting, defaming and threatening to His Majesty the King, and imported those messages, or false computer data, into a computer system. The prosecutor asked [the court] to punish [the defendant] according to Sections 33, 91, and 112 of the Criminal Code and Sections 3, 14, and 17 of the 2007 Computer-related Crimes Act, and confiscate all evidence.
The defendant pleaded not guilty.
[The court] considers that, according to evidence shown to the court by the prosecutor, it does not appear that the defendant has the e-mail account email@example.com or the password for the Facebook account ‘I shall reign by staging coups’ which was registered in the system. It was learned that the password which the defendant wrote for police officers was merely the password to open the defendant’s notebook computer, and was the same one for the defendant’s e-mail account firstname.lastname@example.org and Facebook account. Normally, an account user would keep secret his passwords for e-mail or Facebook accounts to prevent access by other people. But after the defendant was arrested and detained, the e-mail account email@example.com continued to be active.
According to the prosecutor, the fact that the password for an e-mail address is found in the computer of an individual and that the e-mail address is used to log in to a Facebook account is evidence that that individual owns that Facebook account. This is merely the understanding of prosecution witnesses, without other corroborating evidence being presented. On examination, the computer files InboxLight.htm, which logs the use of the email account firstname.lastname@example.org, and home.htm, which refers to the Facebook profile ‘I shall reign by staging coups’, were [allegedly] found in the defendant’s notebook computer which has been seized as evidence, and it was found that the email and Facebook accounts were accessed on 2 and 8 January 2011, respectively, which predated the postings of the messages as charged by the prosecutor by several months. If the notebook computer was really used to post the messages, logs of computer use should have been found to match the time of the postings, but nothing has been found, and no connection has been found between the email address email@example.com and the Facebook account ‘I shall reign by staging coups.’
Furthermore, such computer files can be copied from other computers in less than a second, and the defence argued that the computer files could never be found in the computer’s normal data storage, were not created during internet use, but were produced and imported into on the seized computer. The properties of the files are found to be irregular in terms of time. During the trial, defence witnesses showed the court how the copying of such files could in fact be done. Considering in detail the forensic report on the seized computer, the court found many irregularities as had been attested by the defence
The court has to take into account the credibility of how the original data was preserved, because each start-up of the computer results in certain automatic changes and data can be easily altered or modified. It appears that after the defendant was detained and his notebook computer was seized by the police, the computer was started up on 2 September 2011 at 20.13.44 hrs and on 7 September 2011 at 21.12.07 hrs, before the computer was sent to the forensic police officer for examination, and this could allow modifications of the data of the seized computer. Therefore, the results of the examination of the computer are flawed and unreliable, and it cannot be clearly concluded that the data pertaining to the use of the email account firstname.lastname@example.org and Facebook account ‘I shall reign by staging coups’ results from the use of the defendant’s notebook computer
The evidence attested by the prosecutor contains reasonable doubt as to whether the defendant committed the alleged offences. The court decides to give the defendant the benefit of the doubt according to Section 227, Paragraph 2, of the Criminal Procedure Code.
Remarkably, prosecutors appealed. After more than a year, on 26 March 2014, the Appeals Court upheld the dismissal. Again, the prosecution appealed, and on 13 August 2015, the Supreme Court upheld the Appeals Court’s verdict.
The Bangkok Post had a long analysis of the case in late August 2015. Because Post stories disappear after a few months from free access, we reproduce the whole story below:
Cracking the code to freedom
Surapak Phuchaisaeng’s ability to fight and win a landmark lese majeste case came from the very evidence that was used against him.
Published: 30/08/2015 at 01:41 AM
Newspaper section: Spectrum
About three months after his arrest on lese majeste charges, Surapak Phuchaisaeng was certain the evidence against him had been doctored.
As a red shirt supporter whose ideals lie in “equality, freedom, democracy and capitalism”, he would often engage in Facebook conversations with those who disagree with his political standpoint.
But still, he never expected to be whisked away from his apartment on Lat Phrao Road on Sept 2, 2011.
A computer programmer by training, the 44-year-old quickly realised forged temporary internet files were being used, among other evidence, to allege he posted five Facebook messages deemed defamatory to the royal family.
It would be the start of Mr Surapak’s four-year battle to prove his innocence: that the cache files did not exist in the first place, and that someone was out to frame him.
“I have the mind of a red shirt, but I am innocent,” he told Spectrum at his residence after the Supreme Court acquitted him of lese majeste charges on Aug 13.
Mr Surapak was indicted on Nov 25, 2011, for posting the defamatory messages. The Criminal Court dismissed the charges on the grounds the evidence was weak. The prosecutor later appealed, but the Appeal Court affirmed the earlier ruling in March 2014. After a second appeal, the case ended this month with an acquittal from the country’s highest court.
It was a rare victory involving a charge carrying up to 15 years in jail, especially given the technicality involved.
It was also the first time in history a lese majeste defendant had ever made it to Thailand’s Supreme Court and won.
THE FIGHT BEHIND BARS
With few lawyers willing to take on a lese majeste case and no tools in hand, Mr Surapak was growing desperate in the first months after his arrest. None of his IT friends would visit him in prison, and he had already changed three lawyers.
long fight: The Supreme Court upheld Surapak Phuchaisaeng’s acquittal this month.
“Attempting to teach computer skills to a lawyer is like teaching A to Z,” said Mr Surapak, who has bachelor’s degrees in economics and law from Ramkhamhaeng University.
His time at the Bangkok Remand Prison involved pushing carts full of animal feed that would later be transported to pig farms. He read the historical Chinese novel Xun Qin Ji (The Chronicles of Finding Qin) until late at night under dim light, which he said caused him to become long-sighted.
Mr Surapak recalled how he made friends with several other prisoners facing lese majeste charges: Somyos Prueksakasemsuk, Joe Wichaicommart Gordon, Surachai “Sae Dan” Danwattananusorn, Sathian Rattanawong, Thanthawut Taweewarodomkul (Num Nor Por Chor) and Yuthapoom Martnok.
“I tried to convince them to fight,” Mr Surapak said. “After all, what employer would want to hire a lese majeste convict?”
Mr Surapak was especially close to Mr Gordon, a Thai-born US citizen accused of creating a blog with a link to download Paul Handley’s The King Never Smiles, as well as translating parts of the book and posting them online. Like Mr Surapak, Mr Gordon claims authorities fabricated the evidence, including the blog itself.
Speaking on behalf of other prisoners, Mr Gordon, who is now living in exile, said most were losing hope because lawyers were reluctant to help and lese majeste suspects tended to be denied bail.
“We had lawyers approaching us who wanted money but weren’t willing to fight the case, with some even asking for the money upfront,” Mr Gordon said.
Citing communication issues and his lawyer’s heavy workload, Mr Gordon decided to plead guilty, which resulted in his prison term being halved from the original sentence of five years. He received a royal pardon after 14 months in prison.
“How could we fight? No one has ever won a lese majeste case before, and I do not believe in the Thai court system. There is no justice,” Mr Gordon said. “Surapak’s case was rare. He was lucky for hitting the jackpot. Nobody else does.”
In prison, Mr Surapak was provided printed documents containing two source codes for Facebook and Hotmail that were allegedly contained in the temporary internet files (cache) folder on his laptop. It was an attempt to prove that he was the owner of both accounts.
A Facebook user had filed a complaint to the Technology Crime Suppression Division alleging Mr Surapak had used the email email@example.com to sign in to a Facebook account under the name “We will rule the country by staging a coup”.
Mr Surapak’s hard drive was split into several partitions and the Facebook file was stored in the D drive, which he thought at the time was peculiar. After he was released and could access his computer, he learned Windows prevented files from being copied into the cache folder of drive C.
He also noticed his machine had been tampered with: he had no access to his Sony laptop or Acer PC after they were seized along with an aircard, three sim cards, 52 CDs, a modem and an electronic circuit during his arrest.
But documents from computer forensics, presented as evidence in court and seen by Spectrum, showed his laptop was switched on at 8pm the night he was arrested and on Sept 7, before the forensics team received it on Sept 8.
Documents from Microsoft provided consistent information, showing that the email firstname.lastname@example.org was accessed on Sept 5, 6 and 7. However, in its appeal, the prosecution alleged Mr Surapak could have provided the password for “any other person” to access the email address after his arrest.
The 2012 trial, spread over four days, lasted a little over 20 hours. It would be one of the few trials in Thai history where the court allowed the use of an electronic device to support a case.
Using a Windows XP laptop, a projector and the lawyer’s mobile hotspot, the defence team demonstrated, among other things, how it was possible to forge a cache file. They also satisfied the court that Facebook does not generate cache files, and that any file claiming to be such must be false. Facebook did not respond to Spectrum’s requests for comment.
The Criminal Court dismissed the charges under the Criminal Code and the Computer Crime Act on Oct 31, 2012, on the grounds the evidence was weak, and that the digital evidence provided by the prosecution was “unreliable” and “could have been tampered with”.
“The [Facebook cache file titled] home.htm cannot be generated from using the internet but was generated on purpose, with the intention to serve as evidence of Facebook usage,” the court said in its ruling.
According to court records, the prosecution did not raise any argument after the defence team’s demonstration. However, in appeal documents the prosecution contended the demonstration was an “attempt to create confusion and diversion from the facts”.
Pol Maj Gen Pisit Paoin from the Technology Crime Suppression Division, who was leading the investigation at the time, said in his testimony he had used Mr Surapak’s password to open his laptop after he was arrested.
A LANDMARK CASE
There are others who face a similar predicament to Mr Surapak. According to Yingcheep Atchanont, a project manager at the Internet Dialogue on Law Reform (iLaw), several lese majeste cases in the past have relied on electronic evidence to identify suspects.
Only five, including Mr Surapak, have so far pleaded not guilty and fought their cases on technical grounds.
The other four were Ampon Tangnoppakhun (Uncle SMS), Katha Pajariyapong (Katha Wet Dream), Noppawan Tang-udomsuk (Bento) and Mr Thanthawut.
“However, from what I’ve witnessed from studying all these cases, the evidence is all distorted,” Mr Yingcheep said. “Since there are many ways for the suspects to avoid being detected, authorities try to come up with other types of evidence.”
Sawatree Suksri, an assistant professor of law at Thammasat University, hailed the Supreme Court ruling as a significant milestone in the history of lese majeste cases, but cautioned the problems associated with Article 112 — such as its vagueness and broad interpretation — still exist.
Ms Sawatree, also a core member of Thammasat University’s Enlightened Jurists Group, known as Nitirat, wrote a 20-page critique of Mr Surapat’s case soon after the Criminal Court delivered its judgement in 2012. The paper was posted on Nitirat’s website, which is blocked by the government. The group faced heavy criticism over its 2012 campaign to amend the lese majeste law.
“The case may provide hope for those defending computer-related criminal charges and give them reason to think they may win their case if it is proven that the evidence is unclear,” Ms Sawatree said.
“But since Mr Surapak was acquitted due to technical reasons as opposed to the content of the [Facebook] messages itself, the outcome of the judgement does not directly address the problems of Article 112.”
That the electronic evidence used in Mr Surapak’s trial had been tampered with was not only key to his acquittal, but also highlights the lack of rules governing digital investigations.
Although Thailand does not have specific rules for the collection and handling of such evidence, the Electronic Transactions Development Agency is in the process of drafting a best-practice guideline. It will be based loosely on the UK guideline, which prohibits data being tampered with, requires a third-party audit of the examination and puts the onus on the person in charge of the investigation to ensure those principles are followed. The ETDA declined to comment on the matter.
Andrew Smith, director of computer forensics at Orion Investigations Co, stressed the importance of the defence team having access to the same data or forensic images as the prosecution for the sake of transparency.
In the UK, he said, the defence team would request a copy of the forensic image and undertake their own examination.
“If a file had been modified or was not present on the forensic image this would be detected very quickly,” said Mr Smith, who has been involved in computer forensics for nearly 10 years in the UK.
Investigators are meant to conduct the examination on a forensic image of the hard drive — commonly referred to as a bit-for-bit copy, in which all sectors of the drive are replicated without any changes — as opposed to the original machine. Digital fingerprints known as hashes are embedded when the forensic images are created and can be used to verify their integrity.
Although the prosecution team claimed to have created a forensic image of Mr Surapak’s laptop, according to the testimony seen by Spectrum they failed to provide evidence of it.
After the verdict was read out at the Supreme Court on Aug 13, Mr Surapak told reporters he would consider suing those he believes framed him.
Although work was hard to find in the early days of his release, due to the stigma associated with the lese majeste charge, Mr Surapak now receives a steady income from freelance IT work.
He has yet to receive compensation for the 13 months spent on remand, calculated at 200 baht per day.
Speaking to Spectrum after his yearly visit to see his mother in the northeastern province of Bung Kan, Mr Surapak attributes his success to many factors: fate, moral support from red shirt sympathisers, his IT expertise, his mother meeting his lawyer by coincidence at a TV show and having an experienced witness to take the stand during his trial.
Mr Surapak’s lawyer, who asked not to be named to avoid becoming a target for lese majeste crusaders, found an IT specialist with extensive experience in computer programming to give evidence.
“The process of finding an expert witness was hard but what was even more depressing is the negative mindset of the investigators: they gave no respect to the victim, who was not even granted bail,” the lawyer said.
“As soon as you are accused of lese majeste, you are condemned by society, and lawyers who help these suspects are branded tanai lom jao [lawyers plotting to overthrow the monarchy]. It disturbs me from time to time, but I try not to think about it.”
The lawyer’s closing argument consisted of a question he asked the expert witness, a navy officer who has also requested anonymity. He was asked why he had chosen to take part in the case. Mr Surapak recalled the witness’s response as “strong words that gave me goosebumps and left me speechless”.
According to court transcripts, the witness said, “For me, loyalty to the monarchy comes in many forms, but I do not agree with loyalty in the form of causing people trouble, such as the witch hunts.
“Meanwhile, the problems caused to the defendant are immediate, resulting in dissatisfaction towards the monarchy … My role this time is to help seek the truth in order to provide justice to all sides, especially the defendant, which I consider to be one form of protecting the monarchy.”
On his way out: Surapak Phuchaisaeng was released from detention after being acquitted of lese majeste in October 2012, then faced almost three years fighting appeals from prosecutors.
Writer: Nanchanok Wongsamuth
Media accounts of Surapak’s case:
Bangkok Post, 30 August 2015: “Cracking the code to freedom”
Prachatai, 13 August 2015: “Supreme Court finds programmer not guilty of lese majeste”
Prachatai, 26 March 2014: “Appeal Court dismisses lèse majesté case related to Facebook page”
Red Shirts blog, 2 December 2012: “The Remarkable 112 Community”
Reporters Without Borders, 2 November 2012: “Netizen freed for lack of evidence in lèse-majesté case”
Prachatai, 2 November 2012: “An interview with the lawyer for a victim of the lèse majesté law and the Computer-related Crime Act”
Prachatai, 2 November 2012: “Official summary of court verdict on Suraphak’s case”
AP, 31 October 2012: “Thai man acquitted of insulting king on Facebook”
Bangkok Post, 31 October 2012: “Surapak acquitted of lese majeste”
The Nation, 23 September 2012: “I’ve been framed: Lese majeste man”
Bangkok Post, 22 September 2012: “Criminal Court to rule on Surapak case on Oct 31”
Bangkok Post, 21 September 2012: “No trace of Facebook entry found in seized computers”
The Nation, 20 Septermber 2012: “Protesters rally for release of lese majeste prisoners”
Bangkok Post, 18 September 2012: “Programmer on trial for lese majeste”
Bangkok Post, 18 September 2012: “Rich get bail, while poor go to jail”
Bangkok Post, 6 August 2012: “LM convict’s mum wants him bailed”
Prachatai, 29 November 2011: “Facebook user indicted for lèse majesté”
Prachatai, 15 October 2011: “Singaporean gets 15 years for lèse majesté”
Phuket News, 9 September 2011: “Man held for lese majeste”
Freedom House, 8 September 2011: “Thai Computer Programmer Detained After Criticizing Monarchy on Facebook”
Bangkok Pundit, 7 September 2011: “Thai arrested for Facebook comment”
ZDNet, 6 September 2011: “Man arrested for allegedly insulting Thailand’s king on Facebook”
The Examiner, 6 September 2011: “Felonious: Man could serve 15 years for ‘defaming’ Thailand’s king”
Washington Post, 5 September 2011: “Thai computer programmer charged with insulting Thailand’s revered king on Facebook“