The Thai cabinet gave the green light on 8 May 2025 to a new National Cyber Defense Command, consolidating the armed forces’ network protection under a single headquarters. Prime Minister Paetongtarn Shinawatra signed the decree in Bangkok, assigning the unit to the defence ministry with an initial allocation of 3.6 billion baht (about US $98 million) and a workforce of 450 personnel drawn from the army, navy and air force. Back‑channel planning for the command began late last year after the National Cyber Security Agency (NCSA) recorded a sharp rise in sophisticated attacks.
In December alone, NCSA sensors logged 3,800 “high‑grade” assaults on government IP addresses – three times the average monthly count for 2023. The majority of the probes were traced to IP blocks linked to Eastern Europe and Southeast Asia, according to telemetry shared with reporters on 7 May.
Defence Minister Phumtham Wechayachai said the spike pushed the threat level past a critical threshold, noting that the military could no longer rely on fragmented IT cells within each service. The new headquarters will sit alongside existing cyber‑crime police and civilian agencies, but its mandate is limited to defending .mil domains and classified intranets, leaving offensive cyber operations to the Royal Thai Signals Department in line with the constitution’s prohibition on military action against civilians. Leadership and structure A three‑star general will command the unit, reporting directly to the defence minister rather than to the chiefs of staff.
The command will operate three directorates – Threat Intelligence, Network Security and Digital Resilience – which will run continuous watches from a joint‑operations floor inside the army’s Chaeng Watthana compound. The first commander will be Air Chief Marshal Panpakdee Pattarakul, formerly head of the air force’s cyber‑warfare wing.
For its inaugural year, the command’s work plan focuses on modernising legacy logistics software still running on Windows XP and segregating weapons‑control LANs from routine administrative email. “Our first audit found firewalls older than the junior officers managing them,” ACM Pankdee told Thai PBS. A 40‑person red‑team of ethical hackers will be created to test frontline units, beginning with a 15‑day “Cyber Krait” exercise slated for October.
International and domestic partnerships Bangkok has quietly enlisted foreign expertise. A liaison officer from U.S. Cyber Command arrived in February, and Israel’s Rafael Advanced Defense Systems signed a memorandum on 3 May to provide endpoint‑detection tools and train 60 Thai analysts in Tel Aviv this summer.
Local firms are also courting a share of the budget; Advanced Info Service (AIS) has offered dark‑web monitoring feeds, with contracts expected to be fast‑tracked in July. Academic involvement will increase as the defence ministry endows Chulalongkorn University’s Faculty of Engineering with 200 million baht to launch a cyber‑defence research institute. Students completing a one‑year reserve‑officer course can apply their lab work toward military service, a move aimed at easing the talent shortage. Privacy concerns and political reaction Civil‑liberties organisations warn the command’s surveillance powers could expand beyond military networks.
The enabling decree permits the unit to “request” traffic logs from any domestic ISP when a threat is declared – a capability currently reserved for civilian regulators. iLaw, a Bangkok‑based NGO, argues the language is vague enough to cover political dissent. “We fear mission creep,” researcher Arthit Suriyawongkul said.
Prime Minister Shinawatra countered that any data request must be approved by a civilian oversight board that includes the digital‑economy minister and the national human‑rights commissioner, citing the 2019 Cybersecurity Act, which already allows emergency data access in critical incidents. Opposition Move Forward Party MPs plan to scrutinise the command’s budget in upcoming parliamentary hearings, suggesting the funds would be better spent on civilian hospitals and schools. Regional context Thailand’s step follows similar moves by Indonesia and Vietnam, while Singapore’s Digital and Intelligence Service has been operational since 2022 and Malaysia is debating a comparable structure.
NCSA deputy director‑general Chaiwut Thanakamanusorn warned that the Mekong region’s bandwidth is becoming a contested asset as manufacturing and logistics shift away from China. The agency’s latest threat report predicts ransomware attacks on ports and airports will double year‑on‑year, underscoring the perceived need for a hardened military backbone.
The command’s formal activation ceremony is scheduled for 1 August, when the first batch of 150 conscripts trained as network defenders will graduate. Until then, temporary task forces drawn from each service will maintain 12‑hour shifts monitoring colour‑coded dashboards inside a secured Bangkok data centre.
