Opposition Advisor Urges Government to Secure AI Passport Domain
An opposition adviser warned that Thailand's new AI Passport program initially used an insecure .net domain for registration, demonstrating the security flaw by purchasing a similar domain himself before the government switched to a safer .
At parliament on August 19, 2024, at 2 p.m., Nithikorn Bunyakulgajarng, an adviser to the opposition leader and subcommittee member on enhancing Thailand's digital competitiveness, discussed the Ministry of Digital Economy for Society opening registration for the TH-AI Passport program. He expressed concern that the initial registration domain de.aipass.net used a .net extension, which anyone can easily register. He demonstrated this by showing he had paid 600 baht that morning to register a similar .net domain with additional letters added. He recommended the government should use a .go.th domain instead when handling personal data requests. He noted that the domain has since been updated to .go.th.
Nithikorn stated that registration is currently underway and the program will launch on August 31, with two-factor authentication using the ThaID app and government apps providing stronger security than previous username and password systems. However, additional information is being requested, such as job title and salary, so he urged the government to protect the data carefully. The program aims to register 5 million people; currently about 500,000 have registered.
When asked about concerns regarding data theft or scammers, Nithikorn warned that similar domains can still be easily registered, and it is unknown whether others have registered variations with added letters like AA or SS. He recommended the government pre-register similar domain names to prevent impersonation and block counterfeit websites that may emerge in the future. He also advised the public to be cautious and question any excessive data requests.
Regarding parliamentary oversight, Nithikorn said the budget tracking committee has requested key documents, including bidding documents from three bidders, to verify whether past processes were legitimate. He emphasized the importance of receiving these documents to answer questions about previous concerns regarding specifications and bidding timelines. He urged relevant agencies to submit the information as quickly as possible.
