Paul* was happy that he could stay safe at home during the Covid-19 pandemic and conveniently buy a 20 baht pen through an e-commerce service.
"How can they provide a service for a 20 baht item?" said Prinya Hom-anek, a member of the National Cyber Security Committee (NCSC). His brother was the one who bought the pen.
"I asked him how long it took him to fill out his information for the company and he said 30 minutes. The company wanted his data. Data is the new oil as data means money. When we download applications, every program asks to access our data. Everyone should be careful about a free application because if it is free, you are probably the product," Prinya said.
What Prinya said could not be more true. In today's digital age, people use smartphones to conduct a wide range of online activities -- from financial transactions, online learning to online shopping. But along with consumer convenience comes great concern over data privacy especially recently when -- as part of Thailand's measure to handle the new round of Covid-19 -- the Centre for Covid-19 Situation Administration (CCSA) strongly urged Thais to scan the Thai Chana platform and download a contact tracing app called MorChana on to their phones.
The MorChana app uses GPS and Bluetooth to trace locations of a user and show whether the user has been in a risk area. Even though MorChana has been downloaded over 3.69 million times, many people voiced their concerns, wondering if the application will allow the government to invade their privacy.
"People may question why MorChana has to access Bluetooth. This is similar to a map app which accesses our locations and sends anonymous data to the app. All data are encrypted. The goal of MorChana's developers is to control the contagious disease, so it is reasonable to ask for access to Bluetooth. The app collects data to alert users to risk areas. I cannot guarantee that the app is totally safe in term of user privacy, but the government should be ethical enough to respect the users' privacy rights," said Chatpawee "Cee" Trichachawanwong, a well-known IT expert, comparing the MorChana application to a real-time navigation app.
Likewise, Prinya had already downloaded MorChana app on his smartphone.
"MorChana does not access much information from us. The information that they receive cannot lead to something dangerous. All data will go to the Department of Disease Control. If our privacy is invaded, the department will be sued. If you are worried that they will access your camera, you can turn off the access on the phone. To download the app is to help society and ourselves. The coronavirus is scarier than using MorChana. If you really do not want to use this app, you can just keep track of your itinerary," he said.
In 2018, the National Statistical Office of Thailand (NSO) reported that 17.9 million Thai people use computers while 56.7 million people use mobile phones and internet users are 36 million. According to Positioning, Google and TNS Australia conducted a survey, "Mobile App Usage Study", which had 1,000 Thai samples from a total of 10,000 samples in 2016. The survey found the average Thai user downloaded 32 mobile applications, never using about one-third of them. Thai people download games, social media apps and chat apps the most.
Chatpawee 'Cee' Trichachawanwong, a well-known IT expert. Photo courtesy of CeeMeAgain
Thai people are familiar with downloading applications on their mobile phones and spending a lot of time on social media and chat applications. To maintain social distancing during the pandemic, people turned to many online services such as shopping, food delivery and bill-paying apps. However, they are not really aware that their data may be collected by service companies.
"Ninety five percent of Thai people are not aware that their data is being collected. Their digital privacies are invaded for two reasons. First, companies collect data without informing users which is illegal. Second, since the terms and conditions of the app are extremely lengthy to read through, most users do not read them and just click accept or agree. Then, the companies can easily collect users' data," said Prinya.
Chatpawee said since criminals are also worried about exposure to the pandemic, there are more cybercrimes.
"Users must understand their risks when they access a website or an application. There are many ways of collecting data. Some companies may collect only a name and password. However, many people use the same password for every website and app. If a website or an app that they access is vulnerable and easy to hack, the password will be hacked and sent to a black market which can use this sensitive information to cause trouble for the user," said Chatpawee.
Apart from the MorChana app, some apps ask to access a lot of information from your phone including contacts, locations, photos, microphone, camera and Bluetooth. Prinya recommends that we can simply deactivate access of this function by going to "setting" and turning off the "allow app to access" control. As an NCSC member, Prinya, highly recommends gadget users to apply anti-malware protection on their devices, so the device will be safe from virus, malware and ransomware attacks. However, Chatpawee warned that the anti-malware programs cannot save users from some frauds such as phishing.
"A recent phishing case deceived users by using a bank's phone number. They sent an SMS to users under the guise of the bank and said the bank is upgrading the system and needs information. There is a link that when pressed will lead to a fake website of the bank and a page to fill out information. Users must be careful not to click on any suspicious link," Chatpawee warned.
"A friend of mine lost money due to the bank phishing. He said he received a fake SMS which had exactly the same number as his bank. The SMS was suspicious because it requested him to fill out his information all over again. After he completed the form, he lost much money in less than 10 minutes. In this case, the user should call his bank before filling out the form," said Prinya.
With concern for user privacy, some companies provide functions to secure privacy of users such as iOS14 by Apple and Incognito mode by Chrome.
"iOS14 notifies users with a green dot when an app turns on your camera and an orange dot warn users that their microphones are used. And people can browse on a website privately by using incognito on Chrome and private browsing of Safari on Apple's products," said Chatpawee.
People concerned about their personal data will welcome Personal Data Protection Act B.E. 2562, which will take affect on June 1. According to this law, businesses must request consent from users before collecting their personal data and data confidentiality must be protected.
"Companies which want users' personal data must think seriously because users have rights to privacy of their data. If company representatives violate the law such as misusing data, they will receive a penalty of either not exceeding one year imprisonment or a fine not exceeding 5 million baht. Many companies are not ready for this regulation yet, but they will adjust," said Prinya.
Even though there are security features and regulations to protect personal data, IT experts warn that gadget users must stay alert and safety conscious while using tech devices.
"When we click on 'accept', it means we accept any risks, so users must read terms and conditions carefully. Despite the large number of cybercrimes, there are few cybercops and they have to work on important cases. Hence, we have to look out for ourselves, but don't stay in a comfort zone to the extent of not trying any new features," Chatpawee advised.
"We must realise our rights and read the privacy policy carefully; especially, when it comes to financial transaction. When users are asked to agree to the terms and conditions, don't click on agree immediately.
"Be aware of it and try to provide as little information as possible because many businesses will use our data for marketing purposes. And don't download any unnecessary apps because apps also need our data," concluded Prinya.
* not his real name
Chatpawee 'Cee' Trichachawanwong, a well-known IT expert. Photo courtesy of CeeMeAgain
