Katha: Wet dream (Stock falling case)

The plaintiff’s defense

1. The messages as complained were false and have caused panic and compromised national security. The first message was false and has caused panic and prompted the sell-off in stock exchange exchange.
   The second message was false and affected national security since it intended to claim that the monarchy was politically partial. 
2. The defendant confessed to the charges three times at the inquiry level. 
3. The defendant posted the messages. 

• To identify the poster, MICT and security agencies have acquired confidential intelligence indicating that the poster used the email [email protected] to post the messages and based on the IP address, they were posted from KT Zmico Securities. The officer did a recheck by sending an e-mail to this e-mail account and acquired the same IP address when the defendant clicked on a link in the e-mail. 
• Based on the monitoring of bank accounts, the inquiry officer found online transactions of the accounts were made using the email address as well. 
• Based on traffic data of the email [email protected] obtained from Microsoft Corp, operator of Hotmail, MICT found the email was used the last time at the office of KT Zmico Securities.  
• The computer seized from the defendant’s office was found to contain the name ‘wet dream’ and ‘sameskybooks’ in several instances and access to sameskybooks website was also made using user name ‘[email protected](1.txt)’.  

The defendant’s defence

1. The statement as complained was not false data that had been inputted into computer system. It was simply a paraphrase of existing rumour, but was not an attempt to create rumour. 
2. The defendant confessed to being the person issued with the warrant and owner of the email [email protected], but has never admitted to being the poster of the messages. In addition, during the interrogations, no lawyer or confidante of the defendant was present. 
3. The plaintiff failed to acquire evidence to confirm data of the user ‘wet dream’ from Fah Deaw Kan webboard to present to the Court. 
4. The defendant did not post the messages. 

• No links could have been established between ‘wet dream’ as the poster and Mr. Katha P.
• Access to the computer seized from the defendant’s office was not protected with password, and therefore, it could have been accessed by any persons at the office. 
• The computer seized from the defendant’s home contained no traces of access to Fah Deaw Kan webboard.
• The defendant’s email address used to be hacked by other people. 

That the terms ‘wet dream’ and ‘sameskybooks’ were found did not suffice to prove that the name ‘wet dream’ was used when accessing the website. By simply checking out the webpage, the traces could have been recorded.

Crucial evidence in the case

1. The secret investigations carried out by the National Intelligence Agency and National Security Council confirm that the user ‘wet dream’ in Fah Deaw Kan webboard was the owner of the email [email protected] (the information did not appear in written form and was not included in the case file, and no witnesses from either of the two intelligence agencies gave any oral evidence supporting it).
2. A letter from Microsoft Corp indicates the IP address from which the email [email protected] was accessed and a letter from CS Loxinfo indicates that the IP address was used from internet connection available at the company where the defendant was working (Exhibit J11).
3. A letter from the Krung Thai Bank replying that Mr. Katha P. using the email [email protected] for online transactions (Exhibit J17)
4. The report of forensic examination of the hard drive found in the computer seized from the defendant’s officer in which the terms were found and the computer was named ‘kathap’, and when the keyword ‘wet dream’ was filled in the search engine, 241 instances of the term were found, and 29,475 instances of the term ‘sameskybooks’ (Exhibit J23).

Summary of prosecution witness examination

Examination of prosecution witness no. 1, Mr. Nut Payongsri, computer expert, Ministry of Information and Communication Technology (MICT) who discovered the messages as complained  

          Mr. Nut testified that it began around middle of October 2009 when people called in at MICT to complain about inappropriate websites. It was then found that a user using ‘wet dream’ as login name posted messages regarding the stock market and the monarchy in Fah Deaw Kan webboard. On 14 October 2009, around 15.00, a message was posted about the situation of stock exchange with phrases including "the blind man" and on 15 October 2009, another message was posted as  "Live report from the stock market…(cont.)". He then conducted further investigation and found ’wet dream’ also posted another message on 22 April 2009 that “when the gunshot was heard” with the picture of HRH Princess Maha Chakri Sirindhorn.

          Mr. Nut stated that when any persons read such messages and in conjunction with the sell-off in stock exchange in October, the readers might become panic thinking that news about HM The King’s health was true. Also, in the posted messages, titles such as “Phra” and “Sadej Poh” were used and thus it made a reader to think of the monarchy. The term “Phra Mep” used simply made people think of HRH Princess Maha Chakri Sirindhorn. The sentence “no hope for help from the divinity” and the false statement “alas, it was ended with emptiness again”, when read, could be interpreted as the King had no concern about his people, or that he cared for the yellow shirts more than the red shirts, even though it has been known generally that the King is politically neutral. Mr. Nut insisted that the messages as complained compromised national security and when read shall motivate the readers to split. But he himself read the messages and was not convinced by them. 

          Then Mr. Nut corroborated evidence from Fah Deaw Kan webboard and handed it over to his superior officers to apply for the Court warrants to seize the computer. Based on the examination of computer set seized from Mr. Katha P.’s house, it was found to be connected with internet, but it was not examined if the computer was used for broadcasting signal to other users. Based on log files obtained from Fah Deaw Kan webboard, neither IP address nor email of the poster was included. He did not make further inquiry about this matter from the webboard administrator. As to which information confirmed that the user ‘wet dream’ was the defendant, Mr. Nut had no idea about this since it was worked out by the inquiry officer.  

Examination of prosecution witness no. 2 Mr. Aree Jiworarak, former Director of Information Technology Supervision Office, MICT, the accuser

          Mr. Aree stated that it was not MICT’s duty to find out the person who used ‘wet dream’ as his alias. All the data acquired had been submitted to the Technology Crime Suppression Division (TCSD), and later TCSD wrote to MICT asking for help to track down internet traffic during the time the incidence took place. 

          Mr. Aree thus consulted with the National Intelligence Agency to track down the identity of the poster since the NIA had its means to track down the IP address of the computer used for posting the messages. But he had no idea how the NIA could verify the computer’s IP address. However, based on intelligence received from NIA, Mr. Aree learned that the poster of the messages was Mr. Katha P. and acquired both the email plus the IP address. Then, Mr. Aree sent an email to the email address, and when the receiver in the other end click to accept the email, he instantly knew the IP address which was found to match the IP address identified by the NIA. He thus became confident with the information and later found that the email address was also used by the defendant to open a savings account, too. 

          Mr. Aree submitted the IP address to CS Loxinfo, the ISP, and obtained name of the internet user which was the company at which the defendant was working. The IP address found was used in the private network or leased line, but he failed to ask for IP addresses internally used in the defendant’s company. 

          Toward the end of his testimony, Mr. Aree gave new information that in fact he had obtained information about the email and IP address prior to intelligence received from the NIA. The information was given to him as he was collaborating with the National Security Council (NSC), but he had no idea how they had obtained it. 

          Mr. Aree stated that the postings were made on a working day of the defendant, and the computer used for financial transactions should have been protected by password. He had no idea though from which place the messages as complained were posted.

          Mr. Aree testified that the messages as complained with the term “the blind man", "nearly ascending the heaven”, “terminally ill” remind any readers of HM the King since he was then receiving treatment at Siriraj Hospital. When people got to read the messages, they would become panic of felt troubled. Mr. Aree stated that as far as he knew, HM the King had been ill since 2008 until now, but he was terminally ill or not, he had no idea and had never submitted a letter to inquire the medical doctor who was treating the King. It was inappropriate to get to read messages indicating that he was terminally ill. He believed that the posting was made, a notification was made by the Royal Household Bureau indicating that his health was improving. Therefore, the statements claiming that he was terminally ill, was about to die, etc., were not true. Then the public prosecutor asked Mr. Aree if HM the King was blind, Mr. Aree said that from the outset, he did not look like a blind person. 

          Mr. Aree testified that the sentence in which the term "Phra Mep" is mentioned makes it easy for readers to assume that it refers to HRH Princess Maha Chakri Sirindhorn. Similarly, when the term “Somchai” is mentioned, it refers to a particular person. The offensive statement goes that “Phra Mep does not love people equally. She only sent ambulances for the People Alliance for Democracy (PAD)” and according to Mr. Aree, it incurs misunderstanding among readers that HRH Princess Maha Chakri Sirindhorn was politically partial. Another satirical phrase used was “The apple doesn't fall far from the tree”, which could damage the reputation of HM the King. 

          In response to the defense lawyer, Mr. Aree said he had no idea if the statements would cause panic among average people, or whether it would cause a sell-off in the stock exchange. However, he reiterated that the statements were not appropriate as the monarchy was highly revered among people. Though after reading the statements, Mr. Aree still found his belief and reverence of the monarchy unshaken, but the statements are more or less like an advertisement. And the more they get advertised, the more likely that they become credible to people. 

          In response to the defense lawyer regarding panic among the public, Mr. Aree said it started with people complaining with MICT about the statements. That he claimed that there had been many complaints about the statements, he could not remember if he had said so when giving testimony to the inquiry officer. Panic is a natural response to the statements since people love HM the King. “If they know that he was…..”, at this moment before Mr. Aree was about to explain further, he was interrupted by the judge who said he needed not say it. The judge further told the defense lawyer that it is the plaintiff’s duty to present to the Court if the statements had caused panic among the public. Since the plaintiff had not presented this point to the Court, the defendant lawyer should not ask this kind of question. 

Examination of prosecution witness no. 3 Ms. Siwatcha Baiya, an officer of MICT

          Ms. Siwatcha conducted forensic examination of the two hard disk drives seized the day the defendant was arrested. They were submitted to her by TCSD to find out if there were traces of access to www.sameskybooks.com. Ms. Siwatcha testified that the process was started with cloning the hard disk drives and then using Encase as a search engine to find words or phrases that she wanted based on the documents submitted to him by the police including the words such as wet dream, sameskybooks.

          According to the examination of the second hard disk drive, it was found to have been used by user’s name “KathaP” since 13 May 2009, and phrase ‘wet dream’ was found in the hdd altogether 241 instances, ‘sameskybooks’ 29,475 instances. Access to the website has sometimes been made using the name ‘[email protected]’ (1.txt). The access could have been made by other users, but it could not be verified. Nevertheless, in this examination, no postings as complained on the specific times and dates have been found in the hdd.

          Ms. Siwatcha stated that the texts found to contain the term ‘wet dream’ were neither complete nor legible possibly due to the data being rewritten by other data. As for the hdd that was found to contain records of access to Fah Deaw Kan webboard, the identity of the user could not be verified since the data recovered was illegible. 

          Ms. Siwatcha explained that though the phrase ‘sameskybooks’ was found in 20,000 instances, it did not mean the hdd was used for accessing the website for 20,000 times. She was not sure If the phrase ‘sameskybooks’ was generated once or several times when an access was made. She could not confirm how the user name ‘KathaP’ was related to ‘wet dream’ either. But since the phrase ‘sameskybooks’ was found in more than 20,000 instances, and the hdd was used by user name ‘KathaP’, it is possible that KathaP was related to ‘sameskybooks’ for the whole 20,000 instances. 

          In the report of computer examination, a sentence was included with the term ‘format’ and a corresponding date, Ms. Siwatcha explained that ‘format’ refers to the system formation of the hdd, did not mean that the hdd had been formatted. Ms. Siwatcha had no idea if any attempt had been made to erase or alter data in the computer, and had no idea if the phrases found had been generated before the formatting of the hdd. 

Examination of prosecution witness no. 4 Pol Lt Col Theeraphat Kaen-in, inquiry officer who made the arrest of the defendant, while he was an officer of TCSD, but at present, he is a police officer of Muang Surin Police Station

          Pol Lt Col Theeraphat testified that on 1 November 2009, he and his commanding officers raided and arrested the defendant. It was known to them that Mr. Katha was to join a seminar at Liberty Building in Silom Rd. and the officers were thus standing by at the Building’s parking lot. Upon seeing the defendant walking toward his car, the police established the warrant and the defendant admitted to being the person under the warrant. Searching his vehicle, the officers found 40 pages of printout from Fah Deaw Kan webboard with content related to the King. The arresting team went further to search his office on the 16^th floor of Sindhorn Building, but Pol Lt Col Theeraphat did not participate during the search. 

          Pol Lt Col Theerapha stated that while informing the defendant that he was charged for violating Computer Crime Act’s article 14 (2), he failed to describe detail of the offence to the defendant, and during the time, neither the defendant’s lawyer nor his confidante was present. 

Examination of prosecution witness no. 5 Pol Sen Sgt Maj Sirachut Pinsiri, TCSD officer who made the search and seizure of computer from the defendant’s residence

          Pol Sen Sgt Maj Sirachut made the search and seizure of computer from the defendant’s residence on 1 November 2009, during which time, the defendant was not home. Among the objects seized were one Nokia phone, Asus computer, CD Rom, and some printouts, but he could recall more detail. 

Examination of prosecution witness no. 6 Pol Lt Col Olarn Sukkasem, TCSD officer who interviewed the defendant

          Pol Lt Col Olarn testified that the person who reported the case was Mr. Aree Jiworarak while he was Director of Information Technology Supervision Office, MICT and Mr. Nut Payongsri, also a MICT officer.  

          Mr. Aree claimed that someone posted a message in Fah Deaw Kan webboard. While reporting the case, he did not mention the defendant’s name, but the login name used for accessing the website. The investigation of the case has been carried out by a team and it was agreed collectively that a warrant should be sought to arrest Mr. Katha P. As to how the team knew that the person who used alias as ‘wet dream’ was Mr. Katha P., the witness said the investigation team was informed by the inquiry officer. But he had no idea how they have come up with that information. 

Examination of prosecution witness no. 7 Pol Col Chanachai Limprasert, Commander of TCSD, the case’s inquiry officer

          Pol Col Chanachai testified that during the investigation, the mobile phone seized was sent for examination and a request was made to the KT Zmico Securities to acquire more background information about the defendant. Similar requests were also submitted to the Krung Thai Bank and Siam Commercial Bank for detail of the defendant’s transactions and the information used for opening the accounts. 

          In addition, Pol Col Chanachai asked MICT to track down internet traffic of the poster (as then Pol Col Chanachai was not appointed as competent officer as per the Computer Crime Act and had to seek cooperation from Mr. Aree). Three written requests were submitted to MICT with no response. Eventually, Mr. Aree failed altogether to send information on the internet traffic. He only sent the witness a letter explaining that the user of email [email protected] was the person using the login name ‘wet dream’.

          Pol Col Chanachai testified that during the investigation, no attempt was made to interview neither the administrator of Fah Deaw Kan webboard nor Mr. Aree, and no attempt was made to acquire internet traffic from the website owner. 

Examination of prosecution witness no. 8 Pol Lt Col Phiraphat Siriworachaikun the case’s inquiry officer (who was then an inquiry officer under TCSD, but is serving the Highway Police Division)

          Pol Lt Col Phiraphat testified that he received a lead to the identity of the poster from MICT which confidentially investigated until they got the email used by the poster in Fah Deaw Kan webboard and the email had been used to apply for membership of the Fah Deaw Kan webboard and used for opening an account with the Krrung Thai Bank.

          Pol Lt Col Phiraphat conducted three interviews of the defendant. In each interview, he informed the defendant of his rights, but the defendant refused to use his right to have a lawyer and simply confessed to the charge and admitted that he was ‘wet dream’. When showing the messages as in the complaint to the defendant, the defendant simply admitted to being the person who posted them in Fah Deaw Kan webboard. He explained that the postings were done at his office, KT Zmico Securities, and that he used [email protected] as the email to apply for membership at the Fah Deaw Kan webboard.

          In response to a question from the public prosecutor, Pol Lt Col Phiraphat stated that he loved the King and knew that his eyesight was healthy. He knew that once the King had an injury in one of his eyes due to accidence, but he was not aware which eye was injured. He knew though that both of his eyes were healthy. When the incidence in this case happened, HM the King was receiving treatment at the Siriraj Hospital. Though h

e was ill, he was normal. He knew all these from reading statements issued regularly by the Royal Household Bureau.

          Pol Lt Col Phiraphat testified that to his understanding the messages as complained that went “the blind man was terminally ill….” referred to HM the King. He knew this since the phrase “ascending the heaven” was used. The phrase “the blind man” was unfounded since HM the King’s eyes were normal. Similarly, the phrase that went “nearly ascending the heaven”, which meant nearly dead was false because in fact the King was not terminally ill. He was healthy. But people who have access to computer would be upset, panic and worried upon reading the statements. He was asked by the defense lawyer that he testified that the King’s eyes were normal, how could he know that? The Court suddenly interrupted and asked the defense lawyer if he could present any oral evidence to ascertain that the King was blind. If the defense lawyer could not produce such evidence, he should not have asked the question, since it would have given him leverage. Pol Lt Col Phiraphat replied that the statements from the Royal Household Bureau failed to mention the point. And he used to write to ask for information from the Siriraj Hospital, but was told to ask for it from the Royal Household Bureau. 

          The Judge then asked the defense lawyer to come close to the bench and explained that it should suffice it for the defendant to defend that he had not committed the offence. It was too difficult to debate the meaning of the phrases since it would be very difficult to obtain any supporting evidence. An emphasis should be placed on some other issues. If the defense lawyer insisted on examining the issue, the Judge shall hinge on the civil procedure which prevented the defense lawyer from posing the questions to the prosecution witnesses, should he not pose the same questions to the defence witnesses, too. But whether the King was blind or not was not the essential point of the case since the term sounds impolite. And it did not convey any meaning. 

          Pol Lt Col Phiraphat further testified that the phrase as complained that “when the first gunshot was heard” made him think of an imminent coup d'état and a massive number of people were going to get killed. The defense lawyer asked him to elaborate as to which particular event he referred to. Pol Lt Col Phiraphat replied that it sounded like HM the King was in favour of the yellow shirts, and so was HRH Princess Maha Chakri Sirindhorn.

          The Judge did not allow the defense lawyer to pursue the same issue. Then, the Judge asked the witness himself as to what were his opinions in general when reading the phrases. Pol Lt Col Phiraphat replied that it could be surmised as the King was in favour of the yellow shirts, and so was HRH Princess Maha Chakri Sirindhorn. But in fact, both of them supported neither of the groups. The defense lawyer asked if the phrases could have been made out of the feeling of being upset. Pol Lt Col Phiraphat said he could not answer the question. But he did not feel that the posters were being upset. The phrases were mentioned simply to indicate that the King was in favour of one group against another or was partial. The defense lawyer then asked if the King had made any gesture showing his support for the red shirts. The Judge then asked the defense lawyer to rephrase his question. The defense lawyer then asked if it was true that neither the King nor HRH Princess Maha Chakri Sirindhorn presided over any funeral service of a red shirt protester. The Judge said the question was irrelevant to the case and did not allow the question to be asked since it was known that both had never done such a thing. The defense lawyer asked a new question that it was reported that HM the Queen, HRH Princess Maha Chakri Sirindhorn and Princess Chulabhorn attended a funeral rite of a yellow shirt protester, was that correct? Pol Lt Col Phiraphat replied that as far as he knew only the Queen was there by herself. He then asked more questions from the defense lawyer that he was not aware that HM the King and HRH Princess Maha Chakri Sirindhorn admitted any injured persons under their royal patronage. The Judge then sternly told the lawyer that he knew that both also accepted (to give treatment) to the red shirt protesters as well. Thus, such a question was not allowed. The Judge shall not record it since it was irrelevant to the trial. If the defense lawyer found the messages as complained was an expression of being upset, he had to come forward with supporting evidence, since the witness already answered that he had not idea about it. 

A summary of the defendant’s examination

Examination of defence witness no. 1 Mr. Katha P., the defendant

          Mr. Katha testified that prior to being charged, he was a stock broker employed by KT Zmico Securities with its branch at Sindhorn Building, Wireless Rd. His job was to advise clients on stock exchange and he had been doing it for over ten years. 

          His office was an open and un-partitioned room, and some employees had to computers to use. While one computer was used for monitoring stock exchange and protected by password, another computer was simply used for monitoring news with internet connection, and any person could access it since it was not protected by password. Several other computers at his officer were equipped with internet connection and the one with internet connection that he used had been in use since May 2009.

          Mr. Katha stated that the arrest of him was made on Sunday 1 November 2009, when he was attending a training course necessary for him to extend his broker permit and held at Liberty Building, Silom. He admitted to own the email [email protected] and from the evidence of the prosecutor including internet traffic information provided by Microsoft Corp, the email was accessed on 1 November 2012 with an IP address located in USA. The evidence showed the time the email address was accessed in PDT or Pacific Day Time, and when converted into Thai time, it would be from around 8.00am, 8.45am and 9.14am, during which time, he was already in his seminar room and in the room, there was no internet connection and his mobile phone also had no internet connection. 

          Then around 14.00, Katha felt sick and walked to his car to get his medicine. At his car, he was shown the court warrant by the officers and when asked if he was the person in the picture of the warrant, he said yes. Then, he was informed that he was under arrest by the warrant issued invoking the Computer Crime Act and was asked to sign his name to certify that he was the same person as per the picture in the warrant. When signing the paper, he made no written confession. Then, he was asked to sign the record of search and arrest and he did so and admitted to owning the papers found in the back of his car. Mr. Katha testified that he never confessed to the charge. He had no idea when the written confession was written. But when he signed the paper, the word “confession” written in handwriting was not there. 

          After being arrested at the parking lot of Liberty Building, Mr. Katha and the police officers went to Sindhorn Building on Wireless Rd. to the officer where he worked. There, a lot of reporters were waiting. Then, they went on and arrived at TCSD around 18.00. His mobile phone was seized since he was first arrested. Though he asked to use his phone to contact his relatives or his lawyers, the police simply disallowed it. 

          The interrogations were conducted by different teams of inquiry officer. During the initial interrogations, Mr. Katha always denied that charge. Then, he was informed by an inquiry officer that his case could land him in jail for five years, and if he confessed to the charge, he would be granted bail and then could defend himself in the Court. Around midnight, he decided to confess to the charge and was temporarily released. While he signed the confession, neither his lawyer nor his confidante was present. 

          The inquiry officer asked him to report himself the day after. When he went there, he was subjected to an interview by officers from the Department of Special Investigation (DSI). He did not deny anything since he was simply asked about the stock market. Then, the next interrogation took place on 7 September 2010, and again he did not deny anything since he was simply asked about the stock market and general information. In other word, in the three reports of interview, he made no denial to the information. But at the trial level, on 15 August 2011, he for the first time denied the charge.

          Mr. Katha testified that he did not commit the office and was not the person who used ‘wet dream’ as his alias and he was not a member of Fah Deaw Kan webboard. However, he admitted to reading the webboard.  

          The papers seized from his car were related to his work. When asked by the Judge if they were documents printed on used papers, Mr. Katha testified that they were documents about his work. Some were in English, some contained stock exchange graphs and some were stock analysis related to the Chakri Dynasty. 

          The public prosecutor asked him to describe his opinion upon reading the phrase ‘Phra Mep’, and would it refer to HRH Princess Maha Chakri Sirindhorn? He said he was not sure. And if other phrases might refer to HM the King or not, he had no idea about that since the information sounded unfounded. The public prosecutor asked him further that supposing that ‘the blind man’ in the plaint referred to HM the King, was the King really terminally ill as claimed?  Mr. Katha said no. The public prosecutor asked again if he though the statement was untrue. But the Judge denied him permission to ask any question beginning with the term “supposing”. 

Examination of defence witness no. 2 Asst Prof Dr. Chitthat Fakcharoenphon, a lecturer from Faculty of Engineering, Kasetsart University, as an expert witness on computer

           Asst Prof Dr. Chitthat testified that in order to identify a cyber identity, it could be done by tracing from the other end. The website administrator could be asked if any computer had accessed the system since the IP address of each poster should be recorded. 

          But the written evidence in this case with the printouts from Fah Deaw Kan webboard contained neither the URL nor the IP address of the computer in which the postings were made. In order to get a lead, an attempt should be made to contact the administrator of the website to inquire if at the particular time and date, which messages were posted from which IP addresses. Once the IP addresses had been obtained, then the information could be forwarded to the ISP. 

          Nevertheless, the IP address obtained may still not be sufficient to identify which particular computer was used for posting the messages since it could be just the IP address of the server or an intermediary computer. For example, when a person is connected to internet in his office, the IP address that appears could belong to the server computer used by the office. From existing evidence, KT Zmico Securities used ‘leased line’ internet connection provided by CS Loxinfo, and the IP address traced by CS Loxinfo would be that of the office’s server. In order to identify which workstation was used for posting the messages, an inquiry had to be made to acquire internet traffic data from KT Zmico Securities.

          If the internet traffic data cannot be acquired, in order to identify a poster, traces of internet use in computers have to be detected and examined. Though the data is deleted, there are ways to detect the remaining traces. 

           Asst Prof Dr. Chitthat responded to the defense lawyer’s question that the evidence found from examining the seized computer was not sufficient to prove if any posting or uploading was conducted. 

          The defense lawyer gave him a copy of letter from Microsoft Copr regarding access to the email [email protected], then Asst Prof Dr. Chitthat explained that the left column in the table is IP address, the middle showed login time, and the last column the status of connection, whether it was successful or not. PDT stands for the Pacific Day Time Zone and it was seven hours behind the standard time. 

          Based on the IP address, it could be traced back to the user via which ISP. The defense lawyer asked Asst Prof Dr. Chitthat to try tracing to the user of the IP address which appeared in the Microsoft’s letter. After searching, Asst Prof Dr. Chitthat said the first part of the IP address numbers referred to the KT Zmico Securities via CS Loxinfo; the second part of the IP address referred to True Internet, and the third part of the IP address referred to a registered company ‘Fortress’ based in New Jersey, USA. 

          Asst Prof Dr. Chitthat stated that without internet traffic data, if an attempt is made to search the computer directly using a search engine, even though instances of the phrases or texts are found in the computer, it does not mean the user of the computer is the person who posted the messages. Whenever an access to any website is made, related phrases and texts shall be recorded in the computer automatically. Thus, when using software to find the phrases, they may exist in the computer. 

          As to the report of computer examination used as evidence in this case, since the findings simply indicate that certain words had been found in several instances, but as it was not possible to verify where the phrases were stored, the evidence was not enough to verify if the phrases had been generated from accessing the website, or from posting anything into the website. It was also found that the hdd was formatted on 12 May 2009, it was normally the erasing of folders, but not the data, and it would have increased empty space. 

          Based on the computer examination, the user of the computer was ‘KathaP’ who first accessed the computer on 13 May 2009. But the documentary evidence failed to verify the relationship between ‘KathaP’ and ‘wet dream’.

          The public prosecutor asked Asst Prof Dr. Chitthat was it correct that for the duration of 13 May 2009 – 30 October 2009, the user ‘Kathap’ accessed the computer using this name, but not the other names? Asst Prof Dr. Chitthat replied that if other users have logged in, their names should have been recorded in the examination report. But they were not there. 

Examination of defence witness no. 3 Ms. Sarinee Achavanuntakul, expert in stock market and investment

          Ms. Sarinee testified that stock trading takes place in two durations, from 9.00-12.00 and 14.00-17.00. The ‘core market’ period lasts for 30 minutes prior to the start of trading and after the trading during which time stock orders can be placed. 

          On 14 October 2009, the stock prices immediately plunged at the start of the trading. Investors were gossiping as to what cased the stocks to nose-drive. It became clearer in the afternoon that news about the worsening condition of the hospitalized King was the reason that prompted foreign investors to sell-off their stocks massively. A stock sell-off could be attributed to different reasons. Foreign investors might overhear the rumours, and though they could not verify if they were true, they decided to sell their stocks. Otherwise, they just dumped their shares in order to buy them back at cheaper prices later. Rumours created psychological impact and makes the stock market vulnerable. 

          Ms. Sarinee recalled that she came across the rumour by reading it on the morning of 15 October 2009 and news from Bloomberh, USA, explained what happened. Then, other international syndicates followed and reported the same news including AFP, Reuter, etc. They all reported about the havocs in the stock market on 14 October 2009 and attributed it to the grave condition sustained by HM the King. 

          The defense lawyer asked the witness to read the phrases in the plaint and asked if they would have caused a sell-off in stock exchange. Ms. Sarinee said it would have borne no impact, since they were posted around 15.00 on 14 October 2009 and the mentioning of the sell-off in stock exchange was also correct since the slump began since morning already. In addition, investors normally rely on more credible sources of news, but Fah Deaw Kan webboard was not the source that most investors would rely on. 

          The public prosecutor asked the witness if there is good news, the stock prices will go up, and if there is bad news, the prices will go down, is that correct? Ms. Sarinee said in most cases, the market responds to bad news. The public prosecutor asked since the witness was a columnist, if there was any rumour about bad news, would she write to spread it or not? Ms. Sarinee replied that she would write to warn readers to rely on their discretion. The defense lawyer cross-examined and Ms. Sarinee explained that when the posting was made, all investors had already been informed of the rumour. The phrases were written just to remind readers of the existence of the rumour and were mixed with some feeling. 

The verdict

            On 25 December 2012, the Court read the verdict with the following main points;

          1. The phrases mentioned in the plaint were not true. They have caused panic among the public and affected national security. 

          The Court of Lower Instance deems that the posting made on 22 April 2009 regarding HRH Princess Maha Chakri Sirindhorn was not true. It makes general public think HM the King is simply in favor the yellow shirts and so is HRH Princess Maha Chakri Sirindhorn. It may cause damage to national security and cause panic among the public. 

          Another posting was made on 14 October 2009 concerning rumours about the King. It makes people think the King is terminally ill and nearly dies and it is untrue. It may also cause damage to national security and cause panic among the public since actually during the time, the King was hospitalized at the Siriraj Hospital. The defendant intentionally used the symbol ‘XXX’ to remind readers of the King. 

          Also on 22 April 2009, there was a demonstration by the Red Shirts. When the message was posted as such, it might make people think the King is in favour of the Yellow Shirts, though it is not true. The King and all of his children loved all sides to no exclusive satisfaction. They stay above political conflicts. Given the political neutrality of HM the King and HRH Princess Maha Chakri Sirindhorn, the phrases were not true and may have exacerbated political division and it may compromise national security and disrupt peacefulness and order in society. Thus, the defendant is found guilty as complained. 

          The report about the sell-off in stock exchange was written with the symbol ‘xxx’ referring to the King. Thai people were aware that he was ill, but was getting better. As a Thai citizen, the defendant should know full well that the postings were not true. It is undeniable that the postings have affected the stock exchange causing a sell-off in stock exchange. If the market was already in red, it would get even worse as reflected by testimony from the defendant witness who was an expert in investment. It shall cause damage to national stability including its economy and society. As for the post about rumours about the King’s health, the court said that HM the King was the centre of the spirit of people of all groups, as evident in the recent 5 December event when a lot of people came out to wish HM well, so it could not be denied that public panic would not happen [as a result of the comment].

          And even if the news was a rumour or not, the defendant had no right to spread it, particularly if it was rumour which was excessively untrue and false and it may damage the reputation of the King. News in the internet can spread very fast. If the defendant is allowed to do this, he would have slighted or wrongly accused any people and he would evade his responsibility toward society and individuals by claiming that he just relied on a rumour even though such an act was a violation of people’s rights and unlawful. 

          The phrases mentioned in the plaint were not true and have caused panic among the public. Two counts of offence. 

            2. The defendant did carry out the offence.

          Mr. Aree Jiworarak from MICT verified that the user of the login name was the defendant who used [email protected] as his personal email. It was further found out from inquiring the banks that the email address was used for opening his bank accounts. In addition, the National Intelligence Agency has investigated and found the IP address and has Mr. Aree tested it by sending a message to the email address. When the email message was clicked on the other end, the same IP address was detected. And by CS Loxinfo as an internet service provider, it was found out that the IP address belonged to the company in which the defendant was working. 

          Ms. Siwatcha Baiya, a computer expert testified that after examining the hard disk drive in the computer used by the defendant at his officer, the term www.’sameskybooks’.org was found for more than 29,000 instances, and the login name ‘wet dream’ for more than 240 instances. Also, the name of the user was found in kathap@www.’sameskybooks’(1.txt). It is thus credible that the defendant had made access to the website and applied as a member. It reflected the testimony by a computer expert who was the defendant witness that in order to post any message, a person has to apply for its membership first. And each user has unique username and password.

          Pol Lt Col Phiraphat Siriworachaikun, an inquiry officer, testified that he had informed the defendant of the charge and the defendant confessed to it. He admitted to using the email address to apply for membership in the Fah Deaw Kan webboard using his login name as ‘wet dream’.

          Therefore, as the username ‘wet dream’ was found in the defendant’s computer, it could not be challenged that the defendant simply read the website, but never posted anything. Otherwise, how could the username was not found in other computers used by the defendant?

          Also, the documents seized from the back of the defendant’s car, and the defendant admitted to owning them, contain messages offensive to the monarchy. And some of the phrases are identical to the phrases in the plaint. Thus, it is credible that the defendant shared the idea or believed in the phrases and posted them. The posting about the sell-off in stock exchange was related to the defendant’s work anyway, and audio record of conversation between the defendant and his client contain similar messages. 

          While the inquiry officer informed the defendant of his charge, a lot of reporters were present there. It did not appear that the officers force him to confess to the charge. The defendant simply claimed that he was under pressure and feared that he would not be granted bail. But during the latter two interrogations of the defendant with an interval of one year, and the defendant had time to get himself prepared, he again confessed to the charge. Thus, it is believed that the defendant confessed to the charge voluntarily. Though the confession was based on hearsay evidence and had been used against him, it is believed by the Court. 

          Reviewing all prosecution evidence, the case circumstances and confessions at the investigation level, considering that all prosecution witnesses are state officers and have had no conflict with the defendant before, the evidence supports the accusation that the defendant was the poster using the login name as ‘wet dream’.

          That the defendant challenged that on 1 November 2009 during 8.00-9.00am, his email was accessed by somebody else since he was in a training course at the headquarters and had no internet connection on both his computer and his mobile phone, was just some unfounded claim with no supporting evidence. Though his name appeared in the participant list, but the list does not have any boxes showing the incoming and outgoing times. Thus, it is not convincing that someone else was using the email address. 

          That defendant challenged that the police should have asked for information from concerned companies and the owner of  ‘sameskybooks’ website and requested for interrogation of the website’s owner, the Court deems that it is subjected to the officers to use any lawful means to investigate. On the contrary, if the defendant was not the offender as alleged, he should have brought the website’s owner to testify and it should have been easily done so by the defendant.

          The verdict

          The defendant was found guilty under the Computer Crime Act’s article 14 (2) on several counts, and he shall be penalized three years for each count, altogether six years. It was, however, reduced to four years due to his confession upon arrest and during the investigation.