Federal Law Number 5 of 2012 Concerning Combating Information Technology Crimes (Cyber Crimes Law)
Date of publication in the Official Gazette
13 August 2012
The United Arab Emirates
Institution writing the commentary
STA Law Firm
The legislation being commented is dedicated to cybercrimes and explores means and methods of punishing an individual who commits such crime. It was issued on 13 August 2012 by the President of the United Arab Emirates H.H. Sheikh Khalifa bin Zayed upon the proposal of the Minister of Justice and the approval of the Council of Ministers. The Federal Law Number 5 of 2012 Concerning Combating Information Technology Crimes (The Cyber Crimes Law) repealed and replaced its predecessor Federal Law Number 2 of 2006. The primary purpose of the new law is to criminalize persons who get unlawful access to the computer network, electronic information system or website, and also those who indulge in destructing, omitting, deleting, copying, modifying, deteriorating, altering or publishing any data or information.
The main purpose of examining this law is to see how which standards are set to protect technology and the information from attacks in the digital world. Ensuring data privacy and safety is a crucial task for all organizations and individuals. Nowadays, data is an essential asset every company has; the data of the private individual, if stolen, may be used against the individual and can lead to severe consequences.
Before analysing the legislation, it is essential to explore what kind of threats are there. At present, there are several categories of issues the users may face in the digital sphere:
- Hackers are people who "trespass" into computers from remote locations: they can cause the breached computer or system to malfunction, or use it to host a website, spread viruses or send spam.
- Viruses, which infect computers through file sharing and email attachments, can delete files, attack other computers and make systems run slowly.
- Spyware, which is software that piggybacks on programs that are downloaded, collects information about a user's online habits and transfers personal information without their knowledge.
- Identity thieves, which obtain unauthorized access to personal information, such as financial account and social security numbers. They can then use obtained information to commit crimes such as theft or fraud.
- Ransomware, wherein, perpetrators deprive users access to software programs and files, often by encrypting them, and later demand the same users to pay a ransom in order to remove the restriction.
The Cyber Crimes Law of 2012 divides cybercrimes into several categories, being:
- Unauthorized access to an electronic site
Whoever gains access to an electronic information system, a website, computer network or information technology means without authorization or unlawfully remains therein, will be criminally charged for breaching the law and the punishment for the same shall be an imprisonment and a fine not less than one 100,000 AED and not in excess of 300,000 AED or either of these two penalties. However, if such activity resulted in deletion, destruction, omission, disclosure, deterioration, alteration, copying or publication of any data, the punishment shall be imprisonment for at least 6 months and a fine not less than 150,000 AED and not in excess of 750,000 AED or either of these two penalties. If the mentioned data were personal, the one who committed a crime would face imprisonment for at least 1 year and a fine between 250,000 AED and 1,000,000 AED or either of these two penalties.
If it was found that such unlawful activity was conducted in the course of work, the individual who committed a crime is subject to imprisonment for a period of at least 1 year and by a fine ranging from 250,000 AED to 1,000,000 AED or either of these two penalties. Any unlawful activity related to the government data, or confidential information pertaining to a financial, commercial or economic facility can result in temporary or permanent imprisonment and a fine ranging from 250,000 AED to 2,000,000, AED, which will depend on what has been done with the obtained data.
What is evident from the punishment meted out is the fact that the government is taking cybercrimes quite seriously and aims to deter anyone from indulging in the same.
Forgery of any electronic document of the federal or local government or authorities or federal or local public establishments is a criminal offence with the punishment being temporary imprisonment and a fine not less than 150,000 AED and not in excess of 750, 000 AED. However, if the forged documents belonged to any other authority not mentioned in this Article, the punishment will be both imprisonment and a fine not less than 100,000 AED and not in excess of 300,000 AED or either of these two penalties.
- Medical data
Crimes against data or information related to medical examinations, medical diagnosis, medical treatment or care or medical records are met with punishment in the form of temporary imprisonment.
- Bank accounts data
If anyone gains access, without authorization, to credit or electronic card numbers or to bank accounts numbers or data, they shall be punished by imprisonment and a fine. However, what they intend to do with that information is relevant to the punishment as well. If there is an intent to use these numbers and data to gain control over someone else’s funds or to benefit from the services which they provide, a punishment of imprisonment for at least 6 months and a fine not less than 100,000 AED and not in excess of 300,000 AED or either of these two penalties shall be given. If the individual who committed the crime has reached to take over the funds of others whether, for himself or others, he shall be punished by imprisonment for at least 1 year, and a fine not less than 200,000 AED and not in excess of 1,000,000 AED or either of these two penalties.
Whoever forges, reproduces or counterfeits a credit or debit card or any other electronic payment method by using any computer program, shall be punished by imprisonment and a fine not less than 500,000 AED and not in excess of 2,000,000 AED or either of these two penalties.
If anyone, without an authorization, obtains a secret number, code, password or any other means to access either an electronic information system, information technology means, a website or a computer network, they will be punished by imprisonment and a fine ranging from 200,000 AED to 500,000 AED or either of these two penalties.
- Activities that prejudice public morals
If an individual is found guilty of establishing and managing a website or sends, publishes or re-publishes through the computer network gambling activities or pornographic materials and whatever that may afflict the public morals of the nation, they will be punished by imprisonment and a fine not less than 250,000 AED and not in excess of 500,000 AED or either of these two penalties. This penalty also applies to whoever produces, prepares, sends or saves for distribution, exploitation or display to others through the computer network, gambling activities or pornographic materials and whatever that may be in contradictory to the public morals of the nation.
The deliberate acquisition of pornographic materials involving juveniles by using a computer network or electronic information system or electronic website, by an individual shall be punished by imprisonment for at least 6 months and a fine ranging from 150,000 AED to 1,000,000 AED. Also, anyone enticing or aiding another person, by using any information technology means, to engage in prostitution will be punished by imprisonment and a fine not less than 250,000 AED and not in excess of 1,000,000 AED or either of these two penalties.
If an individual accuses or insults another person of a matter of which he shall be subject to punishment, by using a computer network, he hall be punished by imprisonment and a fine between 250,000 AED and 500,000 AED or either of these two penalties. If insult or slander is committed against a public servant in the course of or because of his work, it shall be considered an aggravating factor of the crime.
- Invasion of privacy
According to the Cyber Crimes Law of 2012, invasion of privacy includes but is not limited to:
- Interception, eavesdropping, recording, transferring or disclosure of communications, or audio or visual materials.
- Publishing news, electronic photos, scenes, comments, statements or information even if true and correct.
- Photographing others or creating, disclosing, transferring, copying or saving electronic photos.
Such acts of invasion of privacy are punishable by imprisonment for at least 6 months and a fine not less than 150,000 AED and not in excess of 500,000 AED or either of these two penalties.
- Human trafficking
If anyone is found guilty is establishing or running a website or publishing information on a computer network in relation to human trafficking or human organs or dealing in them illegally will be met with a punishment of temporary imprisonment and/or a fine not less than 500,000 AED and not in excess of 1,000,000 AED.
- Terrorist activity
Whoever is found guilty of establishing or managing a website or publishing information for the interest of a terrorist group or any other unauthorized group or association, or body with the intent to aid communication with their leaders or members or attract new members, or to praise or promote their ideas, finance their activities or provide actual assistance for the purpose of publishing methods for manufacturing explosives or incendiary devices or any other devices used in terrorist acts, will be punishable by imprisonment for at least 5 years and a fine not less than 1,000,000 AED and not in excess of 2,000,000 AED.
- Collection of donation without authority
Should anyone be found guilty of establishing or managing a website or publishing information on the computer network or any information technology means so as to promote the collection of donations without having license accredited by the relevant authority shall be punished by imprisonment and a fine not less than 200,000 AED and not in excess of 500,000 AED or either of these two penalties.
- State security and reputation
The Cyber Crimes Law states that if anyone establishes, manages or runs a website or uses information on the computer network with the intention to incite acts or transmit or publish information or news or any pictures which may expose the national security and the higher interests of the State or disturbs its public order shall be punished by temporary imprisonment and a fine, not in excess of 1,000,000 AED.
It is further established that whoever publishes any information, statements, news or rumors on a website or any computer network with the intention to make sarcasm or damage the reputation or prestige the State or any of its institutions or its President or any of the Rulers of the Emirates, the Deputy Rulers of the Emirates, the Crown Princes, the national peace, national anthem or any of its symbols, shall be punished by temporary imprisonment and a fine not less 1,000,000 AED. Moreover, if anyone establishes or manages a website, or publishes information on a computer network aiming to overthrow, change the ruling system of the State or to disrupt the provisions of the applicable laws and the constitution in the country or contrary to the basic principles which establishes the foundations of the ruling system of the State will be punished by life imprisonment.
- Narcotics and money laundering
If anyone deliberately commits any act in relation to narcotics and money laundering, such as:
- Illegal transfer or deposit of funds with intent to conceal or disguise the source of funds.
- Illegal possession, attainment or use of funds with the knowledge of its illicit origin,
- Disguising or concealing the nature of the illicit funds, or its origin, movement, related rights or ownership.
by the use a computer network or electronic information system will be punished by imprisonment up to 7 years and by a fine of not less than 500,000 AED.
In accordance with the Cyber Crimes Law, a person who has committed a crime will be deported once the individual has seen out the punishment that has been handed out to them.
- State security & Exemption
The Cyber Crimes Law of 2012 has laid down the following offences as crimes against the State:
- Unauthorized access to any website, computer network or information technology, to obtain confidential information of financial, commercial or economical stature. (Article 4)
- Establish or publish any idea or work on a website or computer network that promotes hatred, racism, riot and damages the national unity, social peace or public morals. (Article 24)
- Establish or publish any idea or work on a website or computer network that promotes the interests or activities of a terrorist group or any unauthorized organization or aids in manufacturing incendiary devices that can be used in terrorist acts. (Article 26)
- Establish or publish any idea or work on a website or computer network that endangers national security, the higher interests of the Nation or troubles the public order of the Nation. (Article 28)
- Establish or publish any idea or work on a website or computer network that aims to damage the reputation of the Nation, any of its institutions, Rulers, flags or any symbols. (Article 29)
- Establish or publish any idea or work on a website or computer network with the aim to overthrow, change or disrupt the ruling system or oppose the basic principles that constitute the foundations of the system. (Article 30)
- Provide incorrect and inaccurate information to organizations and authorities through a computer network or other information technology means which can result in damaging the reputation or interests of the Nation. (Article 38)
An exemption has been provided by the law from punishing those individuals who have provided the authorities with information pertaining to crimes that affect the security of the Nation, wherein such information has resulted in either the discovery of such a crime or led to the arrests of such perpetrators.
The Cyber Crimes Law of 2012 was established in order to keep up with technological advancements and how they can be used to facilitate crimes. The stringent punishment structure, that covers a wide array of offences from unauthorized access to data to money laundering, shows the intention behind the legislature when it came to creating this law, and further enhances the scope of the Ministry towards protecting the Nation and its cyber assets from any possible threats.
By the issue of such proactive legislation, it is evident that UAE government is determined to protect its residents and assets and strive to ensure a positive outreach towards battling crimes of such stature.