Cybercrime in the UAE: Curtailing freedom of expression

Beyond the glitz and glam of the UAE lies a sinister cyber surveillance state
12 min read
16 July, 2019
The internet for many is a forum to express views and opinions, but in the UAE the government has implemented a succession of restrictive laws designed to curtail these freedoms.
Since its inception in 2012, cybercrime laws have been broadly used to target activists [Getty]
In the last decade, the UAE has adopted an increasingly draconian approach to online surveillance of both Emirate and foreign nationals as part of a broader trend of state repression, maintaining its increasingly authoritarian grip on the country's population. 

This approach mirrors the exponential increase in the number of internet users in the country in the last decade, changes in the flow of information and socio-political upheaval in the region.

As of 2016, 77.6 percent of the country's population were internet users, combined with the second highest rate of social media penetration in the Middle East, and the increasing popularity of social media and messaging apps.

Alongside technological changes, 2012 was witness to widespread uprisings and demonstrations across the region with the toppling of four heads of Arab states.

The UAE remained largely unaffected by the upheaval that occurred in other countries during the Arab Spring. However, conscious of the protests calling for social and political reforms and the influence of social media in mobilising activists, Emirate authorities were swift in dealing with any signs of dissent and increasing measures to curb internet freedoms; small sections of society calling for democratic freedoms and constitutional reforms were arrested.

The internet provides a forum for human rights defenders and activists to exercise their right to freedom of expression and speech. But, as technological advancements have increased, the government has implemented a succession of restrictive laws designed to curtail these freedoms. 
Conscious of the protests calling for social and political reforms and the influence of social media in mobilising activists, Emirate authorities were swift in dealing with any signs of dissent and increasing measures to curb internet freedoms
In recent years the UAE has become a tourism and trade hub, which has led to greater outside scrutiny of its practices, particularity its human rights record.

The country's carefully cultivated image of a modern, stable and open nation has been belied by allegations of arbitrary detention, torture.

Alongside this, Emirate authorities have attempted to shut down the use of the internet as a platform for freedom of expression and free association and assembly.  

Tolerant or repressive? UAE passes tough anti-discrimination law
Read also: Tolerant or repressive?
UAE passes tough anti-discrimination law
Several human rights organisations, including Human rights watch and Freedom House have produced damning reports on the enhanced internet restrictions and violations of user rights, and the resulting crackdown on freedom of speech, online activism and liberty.

Broad anti-terror and cybercrime laws have been used to target government critics and dissidents; alongside the blocking of websites critical of the regime's human rights record.

The country is 119 out of 180 countries on Reporters Without Borders (RSF), World Press Freedom Index, an important advocacy tool that provides a snapshot of media freedom in respective countries.

A range of activities related to freedom of expression have been criminalised. The government currently controls most of the information accessible to the population; particularly as most domestic UAE media outlets are state-owned.

Alongside this, Federal Law No 15 for 1980 concerning publications and publishing allows for the censorship of domestic and foreign publications. It is one of the most restrictive press laws in the Arab world. 

An overview of the new cybercrime laws

In 2012 UAE President, Sheikh Khalifa Bin Zayed Al Nahyan, issued Federal Legal Decree No. 5/ 2012 on combating cybercrimes expanding on Decree No. 2 for 2006 on Cybercrime.  

The decree contains a number of vaguely worded articles effectively criminalising individuals calling for democratic reforms, calling for a prisoner's release, publishing satirical cartoons and posting photos deemed inappropriate.

The decree covers information technology, including blogs, SMS, emails and social media. A wide range of other offences, including identity fraud, money laundering and pornography are also criminalised.

The decree contains a number of vaguely worded articles effectively criminalising individuals calling for democratic reforms, calling for a prisoner's release, publishing satirical cartoons and posting photos deemed inappropriate

However, it is the articles concerning restrictions on freedom of speech and freedom of assembly that are the broadest and of greatest concern to those critical of the country, with increasing attempts to curb even the most peaceful forms of dissent.

The authorities have attempted to portray the legislation as progression, citing the banning of discrimination based on racism and sectarianism. 

However, critics claim this is merely an attempt to distract from the main purpose of the legislation – to further crackdown on dissent

Human rights defenders and activists are two groups regularly targeted by the cybercrimes law, under the pretext of protecting national security. Emirate authorities use the law to prevent activists from highlighting human rights abuses in country.

There are several laws that appear frequently in the context of charges and convictions against citizens who have expressed views online that challenge or run counter to those of the state.

These include: Article 24 that subjects to imprisonment any individual who "runs a website or publishes [...] any information which would promote riot, hatred, racism, sectarianism, or damage the national unity or social peace or prejudice the public order and public morals", Article 28 that sentences anybody who "publishes information, news or cartoon drawings or any other pictures which may endanger the national security and the higher interests of the State or afflicts its public order"; and Article 29 that talks about publishing rumours to "make sarcasm or damage the reputation, prestige or stature of the State or any of its institutions or its president, vice-president, any of the rulers of the Emirates". 

The law also attempts to prohibit freedom of assembly and association, demonstrating the UAE's persistence in silencing calls for political reform.

The law also attempts to prohibit freedom of assembly and association, demonstrating the UAE's persistence in silencing calls for political reform

The TRA Telecommunications Regulatory Authority is responsible for internet regulation and compiling the list of websites to be censored. This often resulted in the blocking of websites containing information deemed politically or socially threatening to the state.

The UAE ranks high among countries that have reported the most 'inaccessible' websites. Websites containing political content have been subjected to the biggest clampdown.
Between 2007 and 2009 political filtering was upgraded from "selective" to "substantial."  

Some of the websites blocked include: California-based Arabic online newspaper Watan, secular pan-Arab online forum Modern Discussion, Al-Araby Al-Jadeed and The New Arab.

Other websites such as Gulf NewsThe National, and Emirates 24/7 face severe restrictions, while blogs and other forums sharing information are faced with similar restrictions.

WhatsApp is also blocked by the government, and many other messaging services are either restricted or severely monitored. Social media such as YouTube, Facebook and Twitter are unblocked, however filtering restricts access to certain information.

The targeting of activists and human rights defenders 

According to the Emirates Center for Studies and Media for the year 2016, a total number of 184 people have been arrested throughout the year for expressing their opinions – often political. More than half of those arrested were Emirate nationals.

Since its inception in 2012 the cybercrime law has been broadly used to target human rights defenders and activists.

"The UAE authorities aggressively pursue anyone who doesn't toe the party line, and cyberspace has become their chosen hunting ground for critics and dissidents," says Joe Stork, deputy Middle East director at Human Rights Watch.  

One such case is that of Osama Al Najjar, son of one of the so-called UAE94 – where 94 individuals were arrested on suspicion of attempting to overthrow the government.

Al Najjar was arrested on 17 March 2014 and subsequently charged and sentenced in accordance with Federal Law No.5 of 2012 on Combating Cybercrimes. He was charged with "designing and running a website on social media with the aim of publishing inaccurate satirical and defaming ideas and information that are harmful to the state institutions", "offending the state", "instigating hatred against the state and contacting foreign organisations and presenting inaccurate information". He was sentenced to three years in prison and given a fine of 500,000 Dirhams.

Under the State Security Chamber of the Federal Supreme Court, there is no right to appeal. Al Najjar was due to be released in March this year, however the public prosecution appealed to the Federal Supreme Court for the extension of his sentence under the pretext that he still "a threat to national security".

The court granted this extension and ordered Al Najjar to be transferred to a counselling centre. This is sanctioned under both under Article 40 of the Antiterrorism law and Article 43 of the cybercrime law which refers to the use of 'rehabilitation centres'.

It is also common for relatives of known human rights defenders and activists to be targeted by the authorities.

Given the broad and vague nature of the cybercrime law, individuals can be arrested and charged solely under one or more of the articles incorporated within it, but often it is used in conjunction with other laws to prosecute individuals.

In the case of Nasser bin Ghaith, after spending 18 months in detention, he was sentenced at the beginning of 2017 to 10 years in prison under Article 166 of the Penal Code, the 2012 cybercrime law, and the 2014 anti-terrorism law. 

In March 2017 renowned human rights activist Ahmed Mansoor was arrested also on alleged cybercrime offences. He has been held in solitary confinement without access to a lawyer or calls to his family.

Read also: Poor detention conditions of UAE activist Ahmed Mansoor may 'constitute torture', UN rights experts say

According to the public prosecutor, he is accused of using social media to "harm national unity and social harmony and damage the country's reputation". 

Israeli spyware company that sold snooping software to Saudi Arabia, UAE linked to WhatsApp hack
Read also: Israeli spyware company that 
sold snooping software to Saudi Arabia, 
UAE linked to WhatsApp hack

Mansoor was first jailed in 2011 for eight months after supporting a pro-democracy petition. In 2016 Mansoor received two SMS messages providing a link to alleged "secrets" about tortured detainees. Mansoor, suspicious of the messages, sent them to security researchers. The creation of the software was traced to Israel based NSO group, a company that "almost certainly supplies to the United Arab Emirates".

Researchers at Citizens Lab, in conjunction with Lookout Security, conducted an investigation into the messages, releasing the findings in a report entitled: The Million Dollar Dissident: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender.

According to the report, Mansoor was frequently the subject of spyware attacks by companies linked to the UAE authorities. He was the targeted by software sold by FinFisher and Hacking Team, both of which sell surveillance tools to governments.

Leaked documents revealed that that the Emirates was the hacking team's second biggest customer, paying them $634,500 to target 1,100 individuals.

Leaked documents revealed that that the Emirates was the hacking team's second biggest customer, paying them $634,500 to target 1,100 individuals

According to the report "spyware enables some governments and agencies, especially those operating without strong oversight, to target and harass journalists, activists and human rights workers".

Cybersurveillance is included under Article 43 of the cybercrime law which states that "the court may order to put the condemned under surveillance". The length of time and whether the law applies to individuals who have not yet been charged are not specified. The UAE currently has no legal framework that regulates the use of these technologies by the government against its citizens.

Targeting foreign nationals

Detained in Dubai: UAE no longer safe for tourists
Read also: Detained in Dubai:
UAE no longer safe for tourists

The majority of those arrested under the cybercrime law are Emirate citizens; however, the law has also been used against foreign nationals.

In 2014, US citizen Shezanne Cassim and two Indian nationals were arrested and sentenced to a year in prison and ordered to pay 10,000 UAE dirhams (£1,660) for a YouTube video which parodied Emirate youth culture. They were accused of "endangering national security". 

The charges demonstrate the vague and far reaching nature of the cybercrime law and the severity of restrictions placed on internet freedoms.  

In March 2017 Jordanian journalist, Tayseer al-Najjar was sentenced to three years in jail and fined 500,000 dirhams ($136,000) for a Facebook post in which he criticised the UAE's position on the Israeli war on Gaza in 2014.

He was held for a year without access to a lawyer before being charged with "insulting the state's symbols" on social media under Article 29 of the cybercrime law. He was released earlier this year.

"Jailing a journalist on spurious charges does far more to 'insult' the UAE and its symbols than anything Tayseer al-Najjar ever wrote," said Joe Stork, deputy Middle East director at Human Rights Watch.  

The legal framework of freedom of speech and violations under international law

The introduction of the repressive 2012 cybercrime law represents a further attempt to suppress even the most peaceful criticism. The use of the law to criminalise freedom of speech and expression is in contravention of international and regional laws, and the country's own constitution.

The right to freedom of expression and opinion is guaranteed under Article 30 of the Emirate constitution, which states: "Freedom to hold opinions and express them orally, in writing or by other means of expression shall be guaranteed within the limits of the law" and Article 31, guaranteeing the right to freedom of communication, states: "Freedom of communication by means of the posts, telegraph or other means of communication and their secrecy shall be guaranteed in accordance with the law". 

According to a government source the decree "does not restrict freedom of expression, which is guaranteed by the UAE constitution".  In theory this may be the case; however, in practice, the government uses its executive and legislative powers to curtail this rights.

From Thatcher to May: UK's 'shady relations' with UAE's authoritarian rulers are nothing new
Read also: From Thatcher to May: 
UK's 'shady relations' with UAE's 
authoritarian rulers are nothing new

The United Arab Emirates is also a signatory of the Arab charter on human rights. Article 26 of the Charter guarantees the right to "freedom of belief, thought and opinion" and Article 28 which guarantees that "all citizens have the right to freedom of peaceful assembly and association".

The country has still not ratified the International Covenant on Civil and Political Rights. Article 19 of the Covenant states that "everyone shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice". 

The suppression of freedom of speech, expression and association are not the only human rights abuses in the context of the cybercrime law. The whole process of arrests, trial and prosecution has been shown to result in a number of human rights abuses.

Individuals have reported being arrested without a warrant, they have been forcibly disappeared, remaining in secret locations for months without access to a lawyer and without any contact with the outside world. This places them at high risk of torture and other ill-treatment and the authorities often refuse to investigate allegations of torture.

The possible abuses that could occur following accusations related to the cybercrime law puts the accused at high risk. The process not only lacks transparency but automatically puts the charge itself into question.

In March 2015 United Nations Human Rights Council (UNHRC) announced that it would appoint a Special Rapporteur on the right to privacy in the digital space. The position was created to reaffirm and promote the rights to privacy and freedom of expression and information. 

Despite this there is no sign that authorities have taken on board the recommendation made by human rights organisations and UN representatives to ensure that the right to information, freedom of opinion and freedom of expression are protected, and that any claims of breach of these rights are thoroughly investigated.

Hannah Wallace is a freelance writer based in London who covers foreign policy and secular issues globally.