The Thai government must investigate the ISOC cyber team leaks

On 25 March 2025, opposition parliamentarian Chayaphon Satondee disclosed leaked internal documents during a parliamentary no-confidence debate that exposed the operations of a Cyber Team under a Joint Command Centre run by Thai police and military units, including those from the Internal Security Operations Command (ISOC).

The documents revealed that this unit had been conducting coordinated smear campaigns against civil society, attempting attacks on activists’ social media accounts, and actively monitoring organisations it deemed threats to national security.

Amnesty International was explicitly identified as a “high-value target.” The targets were not limited to Amnesty. Thai Lawyers for Human Rights, iLaw, young human rights defender Anna Annanon, and numerous pro-democracy figures were also named. The leaked materials showed the Cyber Team instructing officials to respond aggressively to Amnesty’s social media posts about excessive use of force against protesters, portraying the protesters as violent.

During the 2023 election period, the team targeted the social media accounts of prominent activists and Amnesty International Thailand’s then Executive Director, Piyanut Kotsan, through attempted brute-force attacks. Monitoring of Amnesty’s platforms continued at least until October 2024.

These revelations did not come from nowhere. They are consistent with a well-documented pattern.

Amnesty’s own research published in May 2024 highlighted how Thai authorities and state-aligned actors have systematically deployed digital surveillance and online harassment, with smear campaigns disproportionately impacting women and LGBTI human rights defenders.

In February 2021, Meta’s Coordinated Inauthentic Behaviour report confirmed that ISOC had orchestrated inauthentic online operations targeting Amnesty and other civil society groups. And in November 2024, the UN Committee against Torture expressed serious concerns about Thailand’s use of spyware and digital smear campaigns, calling for prompt and impartial investigations.

Citizen Lab, the University of Toronto’s digital security research group, independently analysed the leaked documents and concluded that the information they contained could not have been reasonably sourced from a private individual, attributing them to the Royal Thai Armed Forces and/or the Royal Thai Police.

The Thai government's response during the parliamentary debate was a categorical denial of involvement, when investigation is a requirement of international law. As a State Party to the International Covenant on Civil and Political Rights (ICCPR), Thailand is obligated to protect individuals' rights to hold opinions without interference, to freedom of expression, and to guard against arbitrary and unlawful intrusions into privacy.

Under the ICCPR and the UN Guiding Principles, the state has a duty not only to refrain from committing abuses but to undertake any necessary measures to prevent, investigate, punish, and redress abuses perpetrated, including by non-state actors operating on its behalf.

When a sitting MP presents documentary evidence of state-directed cyber operations in open parliament, and when an independent forensic research lab corroborates the authenticity of that evidence, the threshold for triggering an investigative obligation has clearly been met. A blanket denial, without any transparent inquiry, is itself a failure to fulfil this duty.

Thailand secured a seat on the UN Human Rights Council in September 2023 on the back of commitments to develop policies protecting human rights in digital spaces. As Amnesty’s Thailand Researcher Chanatip Tatiyakaroonwong has stated, Thai authorities must honour those commitments, starting by ending these harmful campaigns and ensuring a safe environment for human rights defenders.

We must demand the Thai government investigates these very serious allegations of digital repression. Email me at [email protected] if you would like to get involved in a letter writing campaign to the Embassy of Thailand in London that builds pressure on the Thai government.

Source: Amnesty International (2025). "Thailand: Authorities must end malicious smear campaigns and cyberattacks on civil society." 7 April 2025.

See also: Fittarelli, A., Wongsapakdee, K. & Scott, M. (2025). "How Thai Authorities Use Online Doxxing to Suppress Dissent." Citizen Lab.