German expert's statement on SMS sender identification in Amphon's case | prachatai.com

German expert's statement on SMS sender identification in Amphon's case | prachatai.com
prachatai.com, August 25, 2012

Poonsuk Poonsukcharoen, lawyer for Amphon Tangnoppakul, has published a letter from an expert on telecommunication technology in Germany on her Facebook page.  The letter was intended to be used in the Appeals Court before the appeal was withdrawn.

000

SR Security Research Labs GmbH   Veteranenstr 25   10119 Berlin

Cross Cultural Foundation (CrCF)
111 Soi Sitthichon Samsennork Huaykhwang
Bangkok 10310
Thailand
Dr. Karsten Nohl
Chief Scientist
nohl@srlabs.de
+49-3089392996

Berlin, January 30th 2012

Expert statement on SMS sender identification

To whom it may concern:

Security Research Labs is a risk management think tank in Berlin, Germany that advises European telecommunication network operators and governments in mitigating risks arising from cell phone technology.

We were asked to provide a subject matter expert opinion on the reliability of mobile phones identifiers used in determining the sender of an SMS message.

The attached statement was prepared based on extensive knowledge of GSM standard, the operation of GSM networks in general, and measurements of the GSM networks in Bangkok, Thailand in particular. The statement reflects the current state of GSM security research and was prepared to the best of our knowledge.

Best Regards,

Dr. Karsten Nohl

-------------

Expert statement on SMS sender identification

This statement discusses the question of whether a mobile phone sending a text message can be identified reliably based on data records in the phone network. This question is to be investigated for the dtac GSM network in Bangkok, Thailand.

Question 1: Does an SMS identify a phone (IMEI)?

An SMS transaction contains multiple small data packets exchanged between a phone and the radio network. These packets negotiate encryption, establish the transaction type, and exchange data. One example SMS transition on the dtac network included 107 packets.
Phones are identified by their IMEI numbers, which act as serial numbers.
One packet, called the “Cipher Mode Command”, can ask the phone to send its IMEI number in the next packet. However, the dtac network does not use this option in SMS transactions as shown in Figure 1. This was verified at multiple locations in Thailand.
No other message in an SMS transaction can include the IMEI number.

Answer 1: An SMS transaction on the dtac network does not identify a phone (IMEI).
[See images below]

Figure 1. Partial trace of an SMS transaction on the dtac network in Bangkok, Thailand. The “Ciphering Mode Command” message does not ask the phone to send its IMEI number.


Question 2: How does the dtac network assign an IMEI to an SMS transaction?
The mobile network and phones execute different types of transactions including SMS messages and voice calls. The only type of transaction on the dtac network that include the IMEI number are “Location Update” transactions. These transactions are done when the phone is switched on, when it changes location significantly (ie, to a different part of a city), and also periodically.
The phone identity included in a dtac SMS record most likely is copied from the most recent “Location Update” the network observed for a given subscriber account.

Answer 2: The IMEI is most likely copied from an older transaction into the dtac SMS record.

Question 3: How does the dtac network assign a location to an SMS transaction?

Answer 3: The possibility exists that the location is copied from an older transaction into the dtac SMS record. Further information from dtac is needed for a conclusive answer.

Question 4:  Can an SMS message be sent without a phone?

Answer 4: SMS messages can be sent from the Internet with arbitrary spoofed sender numbers. If the dtac network creates delivery records for such transactions, it would likely include the IMEI number of the most recent “Location Update” message from the spoofed phone number. Further information from dtac is needed for a conclusive answer.


Question 5: Can individuals observe IMEI numbers on the GSM network?
“Location Update” transactions that include a phone’s IMEI number are sent encrypted over the air. The GSM standard uses outdated security that can be broken within seconds.
Software that has been available on the Internet since 2008 can be used to break the encryption of a “Location Update” message in less than one minute on a standard computer.
Since the release of the software, it has been installed in hundreds of locations around the world. Engineering students take less than one week to create a functioning intercept and decryption setup.

Answer 5: Technologically-savy individuals can extract IMEI numbers from GSM messages.


Question 6: Can SMS be sent from a phone using somebody else’s identify?
The IMEI number on almost all phones can be changed using widely available software.
Answer 6: An individual can easily change the IMEI of his/her phone to the IMEI of somebody else’s phone.


Conclusion

The dtac SMS transaction records are not reliable in identifying a phone as the emitter of an SMS message. At least two possibilities exits where the data diverts from reality:

• SMS injected into the phone network from the Internet or SS7 network may be falsely linked to a “Location Update” message of somebody else’s phone
• Phone identities can be changed to the phone of somebody else in the same part of a city after observing a transaction of the other phone with the GSM network which requires only readily available hardware and software

Former Judge’s Views on the Case of Ah Kong | prachatai.com

Former Judge’s Views on the Case of Ah Kong | prachatai.com
prachatai.com,  August 24, 2012

Originally published on the Facebook page of Poonsuk Poonsukcharoen, lawyer for Amphon (Ah Kong); Republished on Prachatai


The below is from a lecture given by Professor Satit Phairoh, a former judge, during the 65th session of the Thai Bar Association. A senior colleague sent me a recording of the lecture and I have transcribed it so that other people can read it. Doing this case, I learned a lot of lessons. These included the difficulties with temporary release, detention, the demonstration of evidence, and the admissibility of evidence. I do not want to make excuses for myself as a lawyer, but what I want is for the judicial process to progress in a noble fashion.

The cremation of Ah Kong will be on 26 August at Wat Lad Phrao. All are invited to come bid Ah Kong farewell.

------------------------------------------------------
A question was raised about Ah Kong’s case:

Article 39 of the Constitution says that everyone is presumed innocent. It is a general principle that when a person is innocent, bail must be granted. This is simple, there is nothing profound about it. According to this principle, at the time one is charged, the court has not yet delivered a verdict of whether or not the law has been broken, and so bail must be granted. If bail is denied, a rationale for why not must be provided. And, the rationale must be a logical one. When I was assigned to dispose of case dossiers, I encountered illogical rationales.  When you dispose of dossiers, you have to read every one of them. I found many quite odd cases.  In one case, the defendant was charged with stealing an elephant. The Court ruled that “This is major theft. Bail can’t be granted.” This rationale is not in line with the Criminal Procedure Code. This is not how it is written in the law.  In another case, the defendant was accused of stealing a needle and thread. A minor theft from a house. The court ruled that, “Bail is not granted for petty theft.” It is not written in the law that bail is not granted for petty theft. There is no basis for this. 

In the case of Ah Kong, on the issue of bail, the court ruled that, “The facts concerning the offence as described in the plaint gravely impact public sentiment and national security.” They wrote in this fashion before there had been any investigation, at all. This indicates that the Court already believed that the accusation was true. If you already believe the charges when you read them, how can you be a judge? You have to listen to evidence before you can write that, “The facts of the alleged offence gravely impact public sentiment and national security.” Having only read the charges, without having heard evidence in the case, how can the judge talk about the impact? You have to investigate first. Making a decision without listening to the evidence is a definitive characteristic of how a judge should not act. No matter how terrible the indictment sounds, it is an allegation only. The facts have not yet shown whether it is true or false.

They guessed further that, “If the examination of evidence results in solid proof, the defendant may flee.”  The Court began by surmising that if the proof advanced was solid, then the defendant might flee. And if they surmised incorrectly, then who would be held responsible? Would they be jailed (instead of the defendant)? No. This decision was based on a guess. How do you know if the proof will be solid or not? By guessing. This conjecture had a disastrous effect for their defendant. An order like this is not characteristic of a Court that is supposed to be impartial.  The order violated the Constitution. The Constitution is procedural law, if you ask me.

The Court made another incorrect conjecture. Why is this? It is written in the judgment itself that, “Although the plaintiff is unable to present indisputable proof that the defendant is the person who sent the messages as charged.”  This indicates that the Court acknowledged that the plaintiff’s adduction of evidence was not indisputable.  This indicates that the ruling about bail was incorrect. But the Court committed a double fault by convicting the defendant. If the evidence is not indisputable, how can you convict a defendant?  This is a breach to Section 227 of the Criminal Procedure Code which clearly stipulates that in weighing the evidence, the Court must not render a judgment to convict until it is certain that the offence was committed and the defendant was the perpetrator. The word “certain” means indisputable.  When you say it is not indisputable, how are you able to render a conviction?

At the end of the judgment, they wrote even more incorrectly: “But it was difficult for the plaintiff to find eyewitness evidence.” Where in the law does it say that if it is difficult, then you can convict on speculation? There is only one principle here: the plaintiff must have evidence that the defendant committed the offence beyond doubt, whether it is eyewitness or circumstantial evidence. It cannot be that there is circumstantial evidence and so you can then convict on speculation.  This judgment will eternally stand and cannot be subjected to correction since Ah Kong is dead. This judgment will be eternally criticized because the Appeal Court and the Supreme Court have no chance to amend it.  I presume if this case went to a higher court, the higher court would not allow the decision to stand because it was unlawful. This decision contradicts Section 227 completely. It is a contradiction on the order of saying that the sun rises in the west. Jurists must have principles, and must not write arbitrarily. If you are a judge, do not do this. Don’t think you are powerful and can do anything at will. We are not the only ones who read the law. Professor Nidhi Eoseewong has written that the Court acts arbitrarily. He is correct.

-- Professor Satit Phairoh, lecture on criminal law, 65th session of the Thai Bar Association, 8 June 2012.

Translated by Tyrell Haberkorn and Pipob Udomittipong.

THAILAND: Freedom of expression under attack

THAILAND: Freedom of expression under attack
Asian Legal Resource Centre, JUne 12, 2012

he Asian Legal Resource Centre (ALRC) wishes to bring the crisis of freedom of expression in Thailand to the attention of the Human Rights Council. This statement is the third on this topic that the ALRC has submitted to the Council since May 2011. During the seventeenth session of the Council in May 2011, the ALRC highlighted the rise in the legal and unofficial use of section 112 of the Criminal Code and the 2007 Computer Crimes Act (CCA) to constrict freedom of expression and intimidate citizens critical of the monarchy (A/HRC/17/NGO/27). In February 2012, the ALRC detailed some of the threats faced both by those who have expressed critical views of the monarchy, both legal and extralegal, as well as those who have expressed concern about these threats (A/HRC/19/NGO/55).

The ALRC is again raising the freedom of expression to stress the persistence of the threat present, foreground the intensification of the dangers to human rights in Thailand broadly, and to acknowledge the continued courageous actions by citizens to revise or revoke section 112 and the CCA, despite these threats and dangers. As the ALRC has continually stressed, within the context of the political crisis that began with the 19 September 2006 coup and greatly increased with the violence of April-May 2010, the protection of fundamental human rights, including freedom of expression, is essential if there is to be the possibility of successful democratization and widespread access to justice in Thailand.

Section 112 criminalizes criticism of the monarchy and mandates that, “Whoever defames, insults or threatens the King, Queen, the Heir-apparent or the Regent, shall be punished with imprisonment of three to fifteen years." Statistics provided by the Office of the Judiciary indicate a sharp rise in lese-majesty charges filed since the 19 September 2006 coup, with 33 charges filed in 2005, 30 filed in 2006, 126 filed in 2007, 77 filed in 2008, 164 filed in 2009, and an extraordinary 478 charges filed in 2010. While statistics released for the first five months of 2011 indicate a reduction in the number of charges filed, information for the second half of 2011 and 2012 to date has not been made available publicly. The failure of the Government of Thailand to provide information itself raises many unanswered questions about the use of the law to diminish space for freedom of expression through the use of secrecy and generating of uncertainty.

Court judgments in cases of individuals charged and prosecuted under a combination of section 112 and the CCA are similarly resistant to scrutiny and ready comprehension. Section 14 of the CCA notes that anyone can be jailed for five years if found to have imported to a computer "false computer data in a manner that it is likely to damage the country's security or cause a public panic… any computer data related with an offence against the Kingdom's security under the Criminal Code." As section 112 also is classed as a crime related to national security, it can be powerfully combined with the CCA to punish dissent, or perceived dissent, carried out via electronic means. Two recent cases, of Mr. Amphon Tangnoppakul and Ms. Chiranuch Premchaiporn, illustrate the dangers to freedom of expression posed by categorizing criticism of the monarchy as a crime against national security and the lacunae in the CCA, which makes it a ready vehicle for enhancing these dangers.

On 8 May 2012, Mr. Amphon Tangnoppakul, a 61-year-old man, was found dead in prison custody. At the time of his death, Amphon was serving a 20-year sentence received upon being convicted of four violations under section 112 and the CCA on 23 November 2011. Amphon was convicted for allegedly sending four SMS messages defaming the Thai queen and insulting the honor of the monarchy. In this submission, we concentrate on the legal ambiguities and lacunae in the case that go to the criminalizing of free speech through the use of section 112 and the CCA in Thailand:

a. Similar to other court decisions in cases of alleged violations under section 112 and the CCA, the judges in this case had to infer the meaning of the four SMS messages in question (which was imprecise), the alleged intention of the defendant, and speculate on any potential damage caused to the monarchy and national security. At best, the court’s interpretation could be described as legally inexact. At worst, it can be described as complete fiction.

b. The court’s logic in finding the four SMS messages in question criminal rested on an argument about the validity of the information contained within them and on what this might cause readers of the messages to believe. More specifically, the judgment reads that the messages were

“… the import to a computer system of false computer data, that was defamatory, insulting, and threating to the king, queen, heir-apparent, and regent. would cause those who saw it to believe that the content of the messages was the truth, which would damage the nation’s security. As a result, some of the aforementioned actions of the defendant are likely to damage the honor and reputation of the king, queen, heir-apparent, and regent and to cause them to be insulted and despised. With an intention to cause the people to dishonor, fail to venerate, and threaten the king, queen, heir-apparent, and regent.”

Throughout the decision the adjective “likely” is used; in other words, damage was not caused by the SMS messages, but was probable in the opinion of the court. The ruling was not one that found the defendant guilty beyond doubt, but rested on a highly uncertain balance of probability.

c. In addition, to interpret under the CCA the sending of a rude SMS message as “the import to a computer system of false computer data” is to stretch the category of “false computer data” beyond the already broad ambit provided by the law. Several pages later in the court decision, “false” is elaborated in political, rather than scientific or legal terms. The judges write that the four SMS messages in question

“… are entirely false because the truth reflected for the people around the country is the king and the queen are full of compassion. They are concerned for every person in the land and perform their royal duties for the benefit and happiness of the Thai citizenry.”

While this may be the judges’ opinion of the monarchy, to categorize it as truth is an ideological stance inappropriate for an ostensibly independent judiciary to take, and does not constitute any form of grounds for conviction under law. Further, given the increased frequency with which section 112 is being enforced, this statement is difficult to appeal against, either in law or in public debate, without also risking being charged under the law.

d. Finally, even if the accused in this case had committed the offences as alleged, the 20-year sentence raises significant concerns about the proportionality of punishment for crimes of defamation in Thailand and speaks manifestly to an imbalance in the law of Thailand as written and as currently enforced between protecting the sovereign and protecting the human rights of people residing in the country.

On 30 May 2012, Ms. Chiranuch Premchaiporn, a 44-year-old human rights defender and webmaster of Prachatai, an independent online news site, was found guilty of one count out of ten alleged charges of violating the CCA. The charges against her in this case stemmed from her alleged failure to remove comments deemed offensive to the monarchy from the Prachatai webboard quickly enough. The prosecution alleged that this indicated her support of and consent to the comments, which constituted a violation under the CCA. She was sentenced to one year in prison and a 30,000 baht fine, which was reduced to a suspended sentence of eight months and a 20,000 baht fine.

a. In the decision, the judges responded with an assessment of the appropriate length of time. The decision notes that in nine of the ten comments in question, they were removed within one to eleven days, and that this indicates that Chiranuch did not intentionally support or consent to them. In the instance of the tenth comment, which remained online for twenty days before she removed it, however, the court concluded that this duration indicated “implied consent.”

b. Of particular concern to the ALRC was a statement in the ruling that while apparently endorsing freedom of expression in fact does precisely the opposite by imposing on the public the obligation to self-censor or be subject to criminal actions:

“The court acknowledges that freedom of expression is a basic right of citizens that is guaranteed and protected in every Thai Constitution. This is because freedom of thought and expression reflects good governance and the democratization of a given entity or nation. Criticism from the people, both positive and negative, provides an opportunity to improve the nation, given entity, and individuals for the better. But when the defendant opened a channel for the expression of opinions within a computer system, she was the service provider and it was within her control. The defendant had a duty to review the opinions and information that may have impacted the country’s security as well as the liberty of others which deserves similar respect. the defendant cannot cite freedom of expression in order to be released from liability.”

This statement, far from being an endorsement of free expression, is a direct attempt of the Court to disavow the right to freedom of expression found both in the Constitution of Thailand and in the ICCPR. The role of the Court and the judiciary in a broad sense should be to aid the development of justice and the rule of law, not aid in its dismemberment.

The ALRC is concerned that the cases of both Amphon Tangnoppakul and Chiranuch Premchaiporn are both indicative of how the judiciary in Thailand is marshaling spare evidence to convict persons of offences under political laws, and in so doing, of its role in eroding institutions and structures that are supposed to guarantee human rights and protect freedom of expression.

The ALRC also wishes to draw the Council’s attention to the courage of human rights activists, media advocates, and citizens in Thailand who continue to call for reform of section 112 despite the growing legal and extrajudicial threats they face. Under the 2007 Constitution, if at least 10,000 citizens sign in support of a proposed amendment to law, then it must be examined by the parliament. On 28 May 2012, the Campaign Committee for the Amendment of Section 112, a coalition of human rights and media activists, writers, artists, and citizens, presented 26,968 signatures in support of an amendment to section 112 limiting its use and reducing the punishment for violations. It is essential that in the coming months, the 26,968 citizens who signed in support of the draft amendment do not experience harassment or other repercussions for doing so.

The Asian Legal Resource Centre expresses solidarity with those persons in Thailand working to have laws aimed at narrowing the freedom of expression revoked or amended, and calls upon the Human Rights Council and also Special Procedures of the Commissioner for Human Rights to contribute to their efforts by urging the Government of Thailand to make the necessary changes to protect this fundamental human right. In this regard, the ALRC calls on the Special Rapporteur on Freedom of Expression to continue to monitor the situation on the ground in Thailand and to request the government to make an official visit to the country at the nearest possible opportunity to meet with concerned persons and produce a report with recommendations to the Government of Thailand for legal and institutional changes to the same end.

A written statement submitted by the Asian Legal Resource Centre (ALRC), a non-governmental organisation with general consultative status
HUMAN RIGHTS COUNCIL
Twentieth session, Agenda Item 3, Interactive Dialogue with the Special Rapporteur on freedom of expression