Published November 2016
The recent introduction of the Federal Law No. (12) of 2016 (“Amendment”) which amends the Federal Decree-Law No. (5) of 2012 on Combating Cybercrimes (“Law”) has sparked a debate on the use of virtual private networks (“VPNs”) in the UAE. Whilst the Amendment does not substantially alter the Law it has increased the fines which may be levied on a person using a VPN to commit a crime or circumvent its discovery.
A VPN is particularly important in the context of the transfer of sensitive data across shared networks. Large corporates with a global presence have an inherent need to be connected with international offices and as such the use of VPN is central to maintaining system integrity and security. Consumers also use VPNs to access content which is not locally available.
Article 9 of the Law provides the applicable penalties for a fraudulent use of a VPN, as follows:
Whoever uses a fraudulent computer network protocol address by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery, shall be punished by imprisonment and a fine of no less than one hundred and fifty thousand dirhams and not in excess of five hundred thousand dirhams, or either of these two penalties.
Article 1 of the Amendment replaces the text of Article 9 of the Law and increases the applicable fines for breaching Article 9 of the Law, as follows:
Whoever uses a fraudulent computer network protocol address by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery, shall be punished by temporary imprisonment and a fine of no less than five hundred thousand dirhams and not in excess of two million dirhams, or either of these two penalties.
The Amendment resulted in a concern amongst many users as the question was raised whether the legitimate use of a VPN in the UAE would be criminalised based on the Amendment. However, the Telecommunications Regulation Authority clarified the position by reinforcing that the use of a VPN itself would not constitute a crime, so long as the VPN is being used for legitimate purposes. Accordingly, the primary objective of the Amendment is to target individuals or businesses who manipulate internet protocol (IP) by using false addresses for the purposes of committing a crime or preventing its discovery.
The issue that does arise is that there is little clarity on what may be considered a “crime”. While the Amendment does not elaborate on this aspect, in practical terms, a wide range of offences could be categorized as crimes which could be punishable under the Amendment. Guidance may be sought from the Law and other applicable laws in the UAE for this purpose.
Any activity carried out on the internet which may have national security implications or which may be classified as nefarious behaviour or behaviour which is against general public policy is punishable under the Law. Some of the main offences under the Law include but are not limited to:
Accordingly, any person using a VPN to indulge in the above listed activities would be committing a crime, and would be liable upon conviction to pay the increased fines stipulated in the Amendment.
The Amendment does provoke businesses to reassess their use of VPNs and their information technology policies. This is particularly important given the indirect liability that employers may face based on use of VPNs by employees from their work place. Corporates should therefore ensure that employee usage of an employer's VPN platform does not breach the laws of UAE. From an individual perspective, care should be taken to ensure that VPNs are not used to access immoral content or content that incites religious intolerance or content that violates the other laws of UAE, including gambling websites or content that promotes use of illegal drugs.
If you are interested in discussing the content of this article, please contact: Zahra Saleem Baig, Associate (email@example.com).
The legal alert contained above is for informational purposes only and not for the purposes of providing any form of legal advice. You are requested to contact your legal counsel to obtain advice in respect of any particular issue or problem. Use of and access to this legal alert does not create any attorney-client relationship between Anjarwalla Collins & Haidermota, Legal Consultants and the user or browser.