Emirates Detainees Advocacy Center

UAE’s cybercrime law...is not intended for cybercrime

9 Feb 2022
متوفر باللغة


The UAE was one of the first Arab countries to enact an Information Technology (IT) crimes law in 2006. It was later replaced by Federal Law No. 5 of 2012 on Combating Information Technology Crimes, and then amended in 2016 and 2018.

Recently, the authorities announced the adoption of Federal Legislative Decree No. (34) of 2021 on Combating Rumours and Cybercrime, which is to replace the previous Federal Law No. 5 of 2012 on Combating Information Technology Crimes. The new law entered into force on January 2.

As expected, it further restricts freedom of expression in the UAE and does not address the problems of previous laws, instead retaining the criminalization of acts protected under international law and introducing new offences that did not exist in previous laws.

In this study prepared by the Emirates Detainees Advocacy Centre (EDAC), we highlight the role of the new cybercrime law and previous laws in restricting freedom of opinion and expression in the country, as well as their apparent contradiction with international standards for freedom of expression.

When we apply international standards for freedom of opinion and expression to the UAE's Cybercrime Law, we will find that most of the provisions of these laws do not meet legitimate restrictions on freedom of expression, but go beyond them to hinder dialogue, restrict freedom of expression, and limit civil space.

This study confirms that the enactment of cybercrime laws in the UAE did not arise in response to a societal problem resulting from the proliferation of the Internet and the accompanying spread of cybercrime, but was in response to the desire of ruling elites to control new media and restrict freedoms.

Brief History

The UAE was one of the first Arab countries to respond to the challenges posed by the tremendous technological development that accompanied the emergence of the Internet. It was the first to pass a separate law to address cybercrime. In 2006, Federal Law No. (2) on combating information technology crimes was approved.

The main objective of this law is to combat some crimes prevalent on the Internet, such as data theft, network hacking, drug promotion and defamation. In addition, prison penalties and financial fines were simple compared to subsequent laws. Financial fines did not exceed 50K dirhams, and the maximum prison sentences were no more than 7 years. The number of the law articles amounted to only 29 articles.

In 2012, a radical shift occurred in the authorities' approach to the cybercrime law, as they abolished the 2006 law, and replaced it with Federal Law No. 5 of 2012 on combating IT crimes.

It became clear that the goal of the new law was not to combat cybercrime but to combat freedom of expression, as the number of articles of the law was doubled to 51 instead of 29, and a large number of restrictions and vague and loose terms were added that criminalize freedom of expression.

International organizations have repeatedly criticized this law, as Human Rights Watch said it “effectively closes off the country’s only remaining forum for free speech” and the decree’s vaguely worded provisions provide a legal basis to prosecute and jail people who use information technology to, among other things, criticize senior officials, argue for political reform, or organize unlicensed demonstrations.

A study issued by the “Friedrich Naumann Foundation for Freedom” on cybercrime laws in Arab countries revealed that the UAE Cybercrime Law of 2012 and its amendments is the "The most stringent among Arab states" as It includes punishments that limit freedom of expression. And it is unique in criminalising acts that are not mentioned in any other Arab laws.

The new law contained harsh penalties of up to life imprisonment and huge fines of up to one million dirhams (272,000 dollars), in addition to many restrictions that criminalize freedom of expression. In fact, the law contained unique crimes that are not found in any law in the world.

Because of the severity of the penalties and high fines, this law has spread an unprecedented state of fear in the UAE, and citizens have begun to impose great self-censorship for fear of breaching it, especially since materials were used to convict a number of journalists and human rights defenders in the UAE.

In 2016 and 2018, the authorities made minor amendments to the law on combating IT crimes, but they did not significantly affect the substance of the 2012 law and did not address its problems, as the law remained a clear threat to freedom of expression.

At the end of last year, the authorities announced their intention to make new updates in the UAE legislation with a view to reforming it, including cancelling the 2012 counter-IT Crimes Law and changing its name to “Combating Rumours and Cybercrime Law

Unfortunately, the new law was worse than the previous one, as it retained all the articles criminalizing freedom of expression, and added new restrictions that were not found in the previous law, such as Article 52 titled “Spreading rumors and false news”, a new crime that did not exist in the any law previously. The number of articles of the law was raised to 74 instead of 51, and the new law tightened penalties and raised fines to 10 million dirhams (2,723,000 US dollars).

Vague & Loose Definitions

The new law that was passed used a large number of vague definitions and broad terms that do not meet the standards of clarity of law, lack certainty, and its exact standards are impossible to predict, as these terms are not formulated precisely enough to make individuals able to regulate their behaviour and know what is allowed or prohibited.

For example, under Article 1 of the new law, “unlawful content” is defined as content that aims, among other things, to “harm the security or sovereignty of the state or any of its interests […] or decrease confidence among public […] State authorities or any of its institutions.

In fact, this definition needs another set of definitions, so what does the term " decrease confidence among public" mean? What is meant specifically by the term "harm state security"? The term “state security” is a broad word that carries a wide range of interpretations and meanings, and the use of such loose words gives the authorities the power to ban all kinds of online speech that may criticize the authorities or the UAE’s rulers.

Article 53 of the law imposes a heavy fine of between 300K and 10 million dirhams (approximately $82K to $2,7 million) on any individual who uses the Internet or an online account to store or share “illegal content.”

One of the things that can be noted is that the law used the same words to define some terms or used an equivalent word for them without adjusting the meaning or specifying the meaning clearly. For example, the law defines “false data” as false or misleading data. This cannot be considered a definition in any way, and not only a synonymous word, and on this criteria, most of the definitions were vague and do not contain any clear meanings or interpretations, and if they were completely abolished from the law, they would not make any clear difference.

Criminalization of freedom of expression

The new law includes dozens of articles that explicitly prohibit freedom of expression, and violate international standards, Article 22 of the law, for example, imposes a prison sentence for using the Internet for any organization or institution sharing documents, reports or data that would “harm the interests of the state or its government agencies.” or offend “its reputation, prestige or position.”

In addition, Article 43 criminalizes and punishes with imprisonment for defamation, which under the same article is considered an aggravating circumstance of the offense when directed against a public official, however, Articles 22 and 43 do not specify the maximum or minimum prison sentences for such acts.

Even if we turn a blind eye to the broad and vague terminology, the absence of a maximum penalty in these articles effectively enables authorities to impose disproportionate penalties for acts protected by Article 19 of the Universal Declaration of Human Rights.

It is noteworthy that Article 22, originally included in the 2012 Cybercrime Law, was used by judicial authorities to sentence human rights defender Ahmed Mansour to 10 years in prison, and he is still arbitrarily detained until today.

Article 25 of the 2021 Law criminalizes “mockery” or “damaging the reputation or prestige of the state, one of its authorities, institutions, any of its founding leaders, the state’s flag or currency.” Article 28 also penalizes the use of the Internet to disseminate information or data that “includes insulting foreign country".

All of these articles, previously used by the authorities against Emirati human rights defenders, peaceful critics and political opponents, criminalize freedom of expression and violate the right of individuals to criticize the authorities.

Also, the new law contains articles that clearly restrict the work of journalists and control the media, for example, Article 19 prohibits publishing and sharing any content, data or information that “does not comply with the standards of media content issued by the concerned authorities”, and this article simply means that dissemination of any information that does not comply with the whims of the authorities constitutes a crime punishable by law.

Criminalization of "Fake News"

The new law added new restrictions and crimes that were not found in previous laws, such as Article 52, which is titled "Spreading rumours and false news."

This article imposes a maximum prison sentence of one year on the use of the Internet or any electronic device to spread "false rumours" that are inconsistent with "what has been officially announced" by the state.

This simply means that publishing any information that contradicts the information published by the government is considered a “false rumour” and its owner will be punished, meaning that the other opinion is completely prohibited, and the information published by the state is the only true, and publishing its opposite is a crime.

The same article also criminalizes a large number of acts, such as “broadcasting any sensational propaganda that incites public opinion or disturbs public security [...] or harms the public interest, the national economy, public order, or public health.” Also, the prison sentence is increased to two years if any of the acts directed against “one of the state authorities or institutions, or if they were committed during epidemics, crises, emergencies or disasters.”

The criminalization of vague and inaccurate acts such as “inciting public opinion” or “disturbing public security”, which may be subject to broad interpretation by a judge, does not meet the standards of legal clarity and predictability, and thus such broad terminology can be used to target human rights defenders, whistleblowers, journalists or activists who seek to publish information that may not be in line with the political interests of the state or its rulers, which effectively means curtailing freedom of expression and control over the media.

Prohibition of Demonstrations &The Right to Peaceful Assembly

Similar to the 2012 law on combating IT crimes, the new 2021 law criminalizes legitimate acts protected by the right to freedom of peaceful assembly.

Article 26, for example, criminalizes the use of the Internet to “plan, organize, promote or invite demonstrations or rallies” without obtaining prior approval from the relevant authorities, and in the same article, the law imposes a fine of 200K to one million dirhams (approximately $54,450- $272,260 USD) for such acts, in addition to a prison sentence, without setting a maximum prison sentence for such acts.

Here, we recall that Clément Nyaletsossi Voule, the UN Special Rapporteur on the rights to freedom of peaceful assembly and of association, when he said: ”peaceful protest is not a privilege but a fundamental freedom that everybody needs to enjoy”, and therefore its exercise should not be subject to prior authorization from the authorities  as he additionally asserts “in case of failure In properly notifying [authorities], organizers, community leaders, or politicians must not be subject to criminal or administrative sanctions resulting in fines or imprisonment.”

Accordingly, organizing an assembly without obtaining approval from the authorities must a fortiori, not result in any penal sanctions or fines.

Victims of UAE’s Cybercrime Law

The UAE authorities use the so-called cybercrime law and the harsh penalties contained in it as a weapon to suppress political activists and human rights defenders. It has been used extensively in recent times to suppress political opponents. Dozens of Emirati and Arab activists have fallen victim to arbitrary imprisonment because of this law.

Perhaps Ahmed Mansour is the most prominent case when authorities used this law against him, as he was convicted in May 2018 under Article 22 of the charge of “spreading false information that harms national unity and the country’s reputation” due to tweets on Twitter, and the judiciary sentenced him to 10 years in prison, and a fine of One million dirhams (272,000 US dollars).

In addition, the authorities used the cybercrime law against activist Amina Al-Abdouli, due to tweets sympathetic to the Syrian revolution. On October 31, 2016, the UAE judiciary sentenced her to 5 years in prison and a fine of 500,000 dirhams ($136,000 USD), confiscation of her electronic devices and closing her email. The accusation was “inciting hatred against the state and disturbing public order, undermining the reputation of state institutions and publishing false information that endangers the state’s relations with its allies,” under the Cybercrime Law.

Then the authorities used this law against her again while she was in prison, and sentenced her and her colleague, Maryam Al-Balushi, to an additional 3 years in prison, on charges of "spreading false information that disturbs public order", because of their appeal to human rights organizations through leaked audio recordings.

The UAE judiciary had previously sentenced the Jordanian journalist, Tayseer Al-Najjar, in 2015 to 3 years in prison and a fine of half a million dirhams (about $135,000 USD), because of a Facebook post that criticized the UAE's position on the Israeli war on Gaza in 2014. Abu Dhabi saw the post as an insult to state symbols in accordance with Article 29 of the 2012 Law on Combating Information Technology Crimes.

In 2015, the UAE judiciary also sentenced 4 Jordanians, Baha Matar, Maher Abu Al-Shawareb, and the two brothers Abdullah and Yasser Abu Bakr, to prison, and each of them was fined one million dirhams for “publishing news that endangers the interests of the state” for circulating news about the Yemen war on their WhatsApp group.

An Emirati court also sentenced Jordanian activist Ahmed Al-Atoum in October 2020 to 10 years in prison on charges of “acting against a foreign country that would offend political relations or expose the country’s citizens, employees, money or interests to the risk of reprisals,” due to Facebook posts that criticized in which the government of his country.

Among other cases, what was revealed by the state-run newspaper, "Emarat Al-Youm ", on March 27, 2019, regarding the sentencing of the citizen "H.A.A.T.", to 10 years in prison after being convicted of “creating and establishing accounts on social networking sites (Facebook and Twitter), and publishing Media materials, including articles, video clips, and false and malicious information, which are baseless, offend the UAE society, stir up confusion, unrest and sectarian strife, and strike social cohesion and national unity”. The Friedrich Naumann Foundation for Freedom presented this case as an example of harsh sentences of the UAE cybercrime law.

Perhaps the latest victim of the cybercrime law is the Syrian activist Abdul Rahman Al-Nahhas, who was sentenced by the UAE judiciary in September 2021 to 10 years in prison for "insulting the prestige of the state", because of an email he sent to the French embassy, ​​requesting asylum because he was unable to work from the UAE.

These cases are only minor examples of the UAE authorities' misuse of the cybercrime law in order to suppress freedom of expression and to be a weapon against activists and human rights defenders, and there are dozens of examples.


  1. It is clear from the above that there are many texts in the UAE’s Cybercrime law referred to in the study that do not comply with international treaties and conventions.
  2. UAE legislation tends to toughen penalties, which goes beyond the principle of proportionality of punishment with the gravity of the crime committed, and some penalties may reach the stage of revenge against the defendants and not an attempt to reform them.
  3. There is a lack of legislative discipline in terms of “elastic” acts of criminalization in UAE law in a way that may allow the expansion of criminalization and punishment texts and go beyond what the legislator saw in practical application.
  4. The UAE authorities have clearly used the cybercrime law to control social media and punish human rights activists.


  1. To completely abolish the current cybercrime law and amend it to comply with international standards for freedom of opinion and expression.
  2. The restrictions contained therein on the freedom of electronic publishing must be in accordance with international standards.
  3. Senior officials should have no legal protections beyond those afforded to the general public and should not be immune from criticism of their actions.
  4. To not expand the imposition of freedom-depriving penalties or block websites on the Internet except in the most serious crimes, provided that the punishment is proportional to the act violating the law.
  5. Imposing high fines on violators has a clear negative impact on freedom of opinion and expression and causes citizens to impose self-censorship, deterring them from exercising their right to expression due to their fear of exaggerated penalties.
  6. Sanctions should aim at general deterrence and private deterrence, and not be a means of retaliating against the violator
  7. To not impose sanctions aimed at protecting public officials and public figures in a way that exceeds the protection of individuals, and that the public interest is the goal of punishment or innocence, and officials must bear criticism to a greater degree than ordinary citizens.
  8. To stay away from vague words in punitive legislation that can be interpreted more than once, and that illegal acts are formulated in a clear manner that is understood by the general public, not just judges and/or lawyers.
  9. To reducing the fines and compensating those affected in a fair manner. Fines and compensation should not have a negative impact on the freedom of public dialogue. Compensation of employees and public figures must be symbolic.