The Defence Ministry will invest in high-technology devices to protect state agencies' websites from being hacked again, says Gen Prawit Wongsuwan.
Deputy Prime Minister and Defence Minister Gen Prawit said Thursday the government is looking at various high-tech options to protect the websites from hackers after a series of recent attacks. By "high-tech" he apparently meant software.
The incidence of website attacks over the past few months has affected the government's ability to secure the country's security, he said.
Authorities are putting their heads together to find solutions, he added.
No details on the kind of anti-hacking software the government was looking at, or the cost, were given.
Gen Prawit made his comments Thursday after cyber attackers claiming to be associated with the Anonymous collective knocked more than 300 Thai court and government websites offline on Tuesday in retaliation against the death sentences given to the two convicted men from Myanmar over the Koh Tao murders.
In a Facebook post to a non-official Anonymous page, the hackers, believed to be the same Myanmar group that defaced Royal Thai Police websites on Jan 5, said they had shut down "all Thai Court of Justice (CoJ) websites in protest over the Koh Tao murder verdict".
Justice Minister Paiboon Koomchaya said he had asked the Department of Special Investigation's chief to look into the case.
Technology Crime Suppression Division (TCSD) chief Suphaset Chokchai said a police check revealed the CoJ's website was attacked about 10pm on Tuesday. The hackers managed to force it offline.
"If the CoJ lodges a complaint with police, his division is able to start an investigation immediately," Pol Maj Gen Suphaset said.
CoJ spokesman Suebpong Sripongkul confirmed all legal data including the Koh Tao rulings had been retrieved.
The court has a backup copy of all documents for the Koh Tao case, he added.
The attackers, however, also stole and posted publicly extensive legal records, including employee lists.
Files posted by Anonymous and examined by the Bangkok Post appear to be from the court system, as the Anonymous posters claimed.
An SQL database file of 1.1 gigabytes contains thousands of names, ID card numbers, photos, email addresses, personal phone numbers and more — all in clear text.
Hundreds of records identified as lists of court employees include the actual log-in and passwords each employee uses to access the Court of Justice's intranet system known as MIS.
Also included are records of thousands of "court users" — people who have used or passed through the justice system, complete with ID details.
The court's officials are collecting evidence on the website attack to pursue legal action against the offenders, who violated the Computer Crime Act, Mr Suebpong said.
Information and Communications Technology (ICT) Minister Uttama Savanayana said the ministry has assigned the Thai Computer Emergency Response Team, or ThaiCERT, to help webmasters looking after the sites to identify technical issues related to data security.
Webmasters will be advised on how to make the sites less vulnerable to attack.
Mr Uttama said the CoJ's websites had returned to normal Thursday. However, it appeared Friday that the court system's intranet was still offline.
Prinya Hom-anek, founder of ACIS Professional, a local cybersecurity training firm and secretary of the Thailand Information Security Association, said the attack on the Thai government websites was not a normal matter.
They were not trying just to deface the sites but could also have taken over confidential databases.
It is also possible the hackers uploaded their own information onto the website. Data forensics are required to find the full extent of the hack.
"Such a cyber threat is real and has become a risk for the state and the police, and it must be dealt with seriously. Legal data should not be put online or else it would be at risk," he said.
"Having a dedicated agency to take care of national cyber security is a must. Instead of trying to find the culprit or even a scapegoat, it's better to have an efficient management and an effective approach to cope with cyber threats," he said.
A specific cyber agency was needed to take care of the public sector in particular. He said a cyber security law was also important.
A national cyber security agency and a national cyber security council should be established to help prevent further attacks and protect state data.
The agency should handle any operations that involve cyber threats while the council would be responsible for policy-making.
It could take some six to 12 months to draft and implement the law, Mr Parinya said.
