Bangkok Post: The world windows to Thailand

In the physical world, the police need help from forensic teams to collect evidence to solve crimes and catch culprits. Similarly, in the digital world, digital forensics are a crucial part of the fight against cyber criminals and hackers. The evidence these professionals can gather against suspects can be presented in court.

Forensic investigators typically follow a standard set of procedures by after physically isolating the computer to make sure it cannot be accidentally contaminated, then make a digital copy of the hard drive.

Concerns over cyber crimes have led government agencies, research agencies and educational institutions to join hands in building digital forensic resources in Thailand, as well as boosting research and confidence in electronic transactions through strengthening cyber security.

Asanee Kawtrakul, Deputy Executive Director at the National Electronics and Computer Technology Center (Nectec), said in the past year in Thailand, there have been many big cases related to computer crimes, especially the posting of false information about His Majesty the King's health which caused damage to national security and alarmed the public, causing the stock market to plunge during trading at that time.

But at present there is a limited number of specialists in the digital forensics field in Thailand, leading government authorities to prioritise their tasks. For example, the Department of Special Investigation signed a Memorandum of Understanding (MOU) with Nectec to increase capabilities in electronic-related crime investigations and digital forensics.

This MOU brings in Nectec as a technology expert to assist law enforcement and establish digital forensics, while a further MOU has been signed to foster collaboration between the government and two universities, in which they will train students in digital forensics and research capabilities for three years to assist government investigation authorities and increase Thailand's expert workforce.

Nectec director Pansak Siriruchatapong added that Nectec has partnered with an undisclosed agency in the US to learn about advances in digital forensic technology, as Thailand's expert base remains limited because it does not yet have the required access to advanced computer technique-intensive hardware, software and network areas.

Pansak said Thailand needs to gain and share knowledge about connectivity, as one billion computers worldwide are connected to the internet and Thailand alone has 16 million internet users.

Sujate Jantarang, President of Mahanakorn University of Technology, said the university would roll out its digital forensics operations in the wake of "highly sophisticated" cyber attacks on Google's systems , which were believed to have originated in China and aimed at Chinese human rights activists. That such a big and important internet company could be attacked reflects how important computer security issues are nowadays, said Sujate.

This integration collaboration from three parties in the digital forensic area could help to solve a shortage of supply in the information security and digital forensic field which is estimated at some 300 persons each year.

Thailand already has both an Electronic Transactions Law to encourage people to do their transactions online and a Computer-Related Crime Act to punish cyber criminals.

"You can imagine how bad experiences online - especially when the culprits cannot be traced - can affect the confidence of computer users, in terms of both their social life and their transactions online, and how this in turn can affect national security and economy," Sujate said.

The university will add digital forensics to its Master of Science in Information System Security course, which will train 120 experts within two years.

Moreover, it will allocate a budget of at least 20 million baht per year to invest in digital forensic laboratory equipment for both student workshop purposes and to serve external government agencies. The university will focus on network forensics first, while Nectec will focus on computer forensics.

For Mahidol University, this collaboration between three parties will strengthen each core competency through sharing knowledge, tools and research, according to Rawin Raviwongse, the Faculty of Engineering Dean.

This case will encourage research entities and the university to use their research capabilities to solve real social problems and more importantly to increase training in this area.

"Morals and ethics are key for learners because a lack of such could lead [experts] to use their skills and knowledge in the wrong way, such as manipulating digital evidence," Rawin noted.

Kanat Poolsawasd, Head of Computer Engineering Department at Mahidol University's Faculty of Engineering, said the university will open three major disciplines related to digital forensics under their Computer Engineering degree, which will cover industrial applications in research and development of digital forensic hardware. The other two areas are computer forensics and enterprise architecture software.

Chaichana Mitrpant, Acting Director, Digital Forensic Technology Laboratory, Nectec, said equipment in the digital forensics field is very expensive due to certified costs, which tempt the centre to produce its own equipment.

For example, a certified cloning harddisk drive device from import vendors may cost 500,000 baht, while building its own prototype will cost Nectec less than 10,000 baht. However, in this case, DSI and Nectec have to discuss with the court how to prove that equipment accepted for use as tools for gathering digital evidence can be trusted.

Kanat added that one Mahidol University professor plans to develop Hard Drive Duplication equipment that can be used in forensic processes both in stand-alone and RAID drives, as well as handheld duplication that can be carried to crime scenes, including hard disk write block tools, and the university plans to collaborate with Western Digital in media storage forensics.

Kanat continued that the University Lab will act as an outsourcing arm for the Central Institute of Forensic Science Thailand to assist any investigate cases that relate to digital technologies.

For example, in the case of the Santika pub fire on New Year's Eve 2008, a digital camera with memory card was recovered from the scene. It was hoped that an agent could recover data from the memory card and possibly find evidence of the source of the fire. Unfortunately, in that case, that memory card had been damaged beyond repair.

Sujate added that in the cyber world, criminals use various advanced techniques, which is mere prevention laws are not enough to protect the country, and greater enforcement is required to enable the government and investigative experts to bring criminals to court.

Relate Search: Asanee Kawtrakul, Deputy Executive Director, National Electronics and Computer Technology Center, Memorandum of Understanding