Saudi Gazette runs this story about the coming into force of new laws in Saudi Arabia governing cyber crimes. The crimes carry penalties of up to 10 years’ imprisonment and fines of up to SR 5 million (US $1,333,333.) The article translates the law as published in the Saudi daily Al-Watan, which I reproduce below the fold.
The law is harshest on those promoting or committing acts of terrorism by way of computers. The laws, I think, are generally unobjectionable, but Article Six has several areas that are potentially open to abuse in that they seek to restrict social behavior that is not considered criminal in most other countries. So, in sum, it’s two steps forward and half a step back.
THE Cyber Crimes Law endorsed earlier this year by the Council of Ministers came into force on Saturday.
Committees of representatives from the various government agencies and governorates have been formed to trace and probe such crimes, reported the Arabic language daily Asharq Al-Awsat.
A website called the “Internet Police” has been set up to receive reports and complaints about cyber crimes.
“The Internet Police website has been designed in a way to offer advice and legal consultations by 30 legal and security experts including lawyers. It is also involved in fighting cyber crimes,” Khaled Al-Ghamdi, a cyber crimes security expert said.
The Cyber Crimes Combat Regulation has stiffened penalties against all kinds of electronic wrongdoing.
The new law provides stiff fines and jail time for electronic blackmailing and stealing from bank accounts or financial bond funds, as well as terrorist activity including hosting or designing web sites for terrorist organizations.
Those involved in these activities will face up to 10 years in prison, and/or a fine of up to SR5 million.
The regulation warned that “encroaching upon the public order, religious values, public conduct or the inviolability of private life through the Internet or the computer” would be punished by a prison term of up to five years and/or a fine as high as SR3 million.
Tampering with networks that provide users with Internet services, or “spoiling” them, could mean four years in prison and/or a fine of up to SR3 million.
The new regulation was approved by the Council of Ministers after being referred by the Ministry of Telecommunications and Information Technology. When the laws were first announced, officials said they were determined to deter anyone who tries to defame or harm others through the use of information technology, especially through cameras on mobile telephones.
The Arabic language daily Al-Watan published the full text of the regulations as follows:
The regulation aims at limiting the occurrence of cyber crimes by specifying the crimes and penalties for each, so that they lead to the following:
1) Achieving information security.
2) Safeguarding the rights of legitimate use of the computer and the Internet.
3) Protecting the public interest, public conduct and morals.
4) Protecting the national economy.
Whoever commits any of the following cyber crimes will be punished by imprisonment for one year and/or a fine not exceeding SR500,000:
1) Eavesdropping on, tapping or obstructing information sent through the Internet or a computer without legal justification.
2) By hacking, threatening or blackmailing a person to carry out some action or abstain from some action, even if the action or abstaining from it is lawful.
3) Hacking or other intervention into a Web site in order to alter its design, destroy it, amend it or use its address.
4) Encroaching into others’ private lives through the misuse of cameras on mobile telephones, or similar devices.
5) Defaming others or harming them through the different means of information technology.
Whoever commits any of the following cyber crimes will be imprisoned for a period not exceeding three years and/or fined an amount not exceeding SR2 million:
1) Confiscating for himself or others any money that has been transferred or tampering with the signature on a receipt through cheating or adopting a pseudonym or impersonating others.
2) Reaching bank or credit information related to securities ownership to get information or money or services without legal justification.
Whoever commits any of the following cyber crimes will be punished by imprisonment for a period not exceeding four years and/or a fine not exceeding SR3 million:
1) Hacking into a Web site in order to delete, erase, destroy, leak out, change or republish personal information.
2) Stopping the Internet from functioning, causing a breakdown, destroying it, deleting programs or data available in the Internet or used in the Internet, or erasing, leaking out or amending such programs or data.
3) Blocking access to Internet service or jamming it or hampering it in any way.
Whoever commits any of the following cyber crimes will be imprisoned for a period not exceeding five years and/or fined up to SR3 million:
1) Producing anything that may encroach upon the public order, religious values, public morals, or the inviolability of private life or preparing such material, sending, or storing it through the Internet or a computer.
2) Establishing a Web site and/or publishing it for human trafficking purposes.
3) Creating material or data related to pornographic or gambling networks that violate the public morals, or publishing or possessing such materials.
4) Establishing a Web site and/or publishing material about drugs or psychotropics, or promoting them or the manner in which they are used, or facilitating drug trading.
Whoever commits any of the following cyber crimes will be imprisoned for a period not exceeding 10 years and/or fined up to SR5 million:
1) Establishing a Web site for terrorist organizations and/or publishing it in order to aid the leaders of these organizations or any of their members, or promoting their ideas, or financing them, or publishing how to make explosives or other weapons used in terrorist acts.
2) Hacking into a Website or an information system directly, or through the Internet, in order to obtain data concerning the internal or external security of the Kingdom or the national economy.
The prison sentence or fine should be at least half the maximum penalty if a crime is committed in any of the following cases:
1) If a person commits a crime through an organized gang.
2) It the person is in a public post and the crime is related to this post, or if he commits the crime using his authority or influence.
3) If minors are enticed or exploited.
4) If previous local or foreign verdicts have been issued convicting the person of similar crimes.
Whoever instigates others, or assists or agrees with them to commit any of the crimes stipulated in this regulation will also be punished, provided the maximum penalty is not exceeded. The penalty must not exceed half the penalty stipulated for this crime if the original crime did not take place.
Whoever attempts to commit any of the crimes mentioned in this regulation will be punished by half the maximum penalty.
The court has the right to exempt from penalties anyone who takes the initiative to report cyber crimes to authorities before they come to learn about it and before harm takes place, although reporting the crime after its occurrence helps in exempting the person from penalties provided reporting the crime leads to arresting the rest of the criminals or the equipment and tools used in the crime.
Implementation of this regulation will not violate the rules in related regulations, especially those concerning intellectual property rights and international agreements to which the Kingdom is a party.
While not violating the rights of good intentions, a verdict can be passed to confiscate the devices, equipment, programs or means used in any crime mentioned in this regulation or financial gains obtained from it. It is also allowed to pass a verdict to close down a Web site or location providing Internet service permanently or temporarily, if it is a source for committing any of these crimes and the crime is committed with the owner’s knowledge.
According to its powers, the Telecommunications and Information Technology Commission will provide technical support to security authorities during the capture of criminals in such crimes, investigating them and during the trials.
The Commission for Prosecution and Investigation will investigate crimes mentioned in this regulation and carry out the prosecution.
This regulation shall be published in the official gazette and it will come into force after 120 days of publishing it.