Author(s):Amrutha M

ATT(H)ack- Anti-Cyber Crime Law in Saudi Arabia

“Cyberterrorism could also become more attractive as the real and virtual worlds become (tightly) coupled, with automobiles, apps, and other devices attached to the Internet.”

- Dorothy Denning

The clandestine and privacy advantages, the information superhighway, and the possibility to buy your plane ticket last minute, comparing airfares - the certitude of Internet today has made it easier for individuals to e-socialize, access information, and conduct business.

We Eat. Sleep. Live the World Wide Web. With spellbound raise of the technology, evil minds keep themselves updated with indefinite and unethical routes through which they can trespass the ambit of privacy of an individual or entity. With this malignant issue fast rising, the legislature across the World have codified laws to tackle the menace of cyber crimes. The international community, governments, and commercial enterprises are yet adjusting to an unprecedented array of challenges posed by hackers, cyber criminals and those who resort to cyber espionage.

In this article, we discuss the Anti Cyber Law in Saudi Arabia with particular emphasis on criminal acts and punishments.

Taking the dictionary reference for the term Cyber, which is a combining form meaning Computer, computer network or virtual reality used in the development of compound words (cyber talk, cyber art, cyberspace) and by extension i.e. expressing future visions. A more precise definition is of, relating to, or involving computers or computer networks (as the Internet) and the cyber marketplace. Looking into what a cybercrime is, a crime that involves a computer and a network or when a computer used in the commission of a crime, or it may be the target, the person is said to have committed the Cybercrime. Cybercrimes are broadly categorized into three categories namely,

Cybercrime against Individual Cybercrime against Property Crime against Government Email Spoofing Credit Card Skimming Hacking Spamming Intellectual Property Crimes Denial of service attack (Dos) Phishing Software Piracy E-mail Bombing Cyber Stalking Domain name disputes Logic Bomb Cyber Defamation Identity Theft Data Diddling Voyeurism Sale of Illegal Articles Cyber Pornography Cyber terrorism

Albeit different from the other two categories, crimes against the government get categorized as cyber terrorism. If successful, this type of the offense can wreak havoc and cause panic amongst the civilian population. In this category, criminals hack government portals, military websites or circulate propaganda. The perpetrators can be terrorist outfits, or unfriendly governments of other nations and the Kingdom of Saudi Arabia has been vulnerable to two such attacks in 2013 and 2016. According to Gulf News Journal, nearly 65 percent of the country’s population already has access to the internet, and the state ranks seventh globally concerning individual social media accounts, and it has more than 40 percent of the Middle East and North Africa region’s Twitter users. Saudi Arabia tops the list of countries impacted by the advanced targeted cyber attack in META (Middle East, Africa, and Turkey). It also has a significant share in computer networks, accounting for 30.1 percent of the total cyber attacks in the region during the first half of this year, said a report issued by Fire Eye, a leader in cyber security.

‘The Internet is an excellent tool, But technology is increasing faster than the safety message is’

- Pam Weaver

The Legal System in Saudi Arabia

Shariah principles protect individual’s right to privacy and prohibit any invasions thereof. Shariah policies prohibit disclosure of secrets except in cases where the owner of the sensitive information accepts to disclosure or is a matter of public interest. The Holy Quran and the Sunnah do not stipulate a penalty for disclosure of secrets, however, as explained earlier, divulgence of sensitive information may be punishable by a fine that a judge, in his discretion, deems appropriate and equitable. Such penalty may attract a fine, charge the offender with imprisonment or deprivation of specific rights such as suspension of a practicing license. In determining the severity of penal acts or action(s), the judge will take into consideration the damage sustained by a victim and also consider whether such loss is actual or consequential.

Combating the Enemy: Cybercrime Law in Saudi Arabia

Saudi Anti-Cybercrimes Law (the Law) was issued by Royal Decree Number M/17, dated 26th March 2007. This law consists of sixteen (16) provisions. Broadly, the sixteen articles set out the key definitions, scope and objective, sentences, and fines. The law aims at combating cyber crimes by identifying such crimes and determining their punishments to ensure information security, safeguard rights on the legitimate use of computers and information networks, protection of public interest, public morals, and common practices and values, protection of national economy. Additionally, Arab Cybercrime Agreement Number 126 of 2012 (the Agreement) enacted and approved in the year 2012 introduced sweeping changes. The Agreement primarily addresses the rise in electronic crime which embraces such crimes as credit card frauds, internet crimes, cyber terrorism, creation and distribution of viruses, hacking, system interference, illegal access and interception, and so on. The Agreement also aims at strengthening cooperation between Arab countries in combating cyber crimes. The Agreement further signifies the importance of enforcing the Copyrights Law. The Agreement imposes Penalties on those in violation of the Agreement terms and conditions. The proposed amendment to Article 6 of the Law that could allow offenders to be publicly named and shamed. The additional powers granted to the judiciary under the amended provision will allow the publication of a summary of the decision one or more local newspapers or any other medium deemed suitable by the court in the connection of the type of the crime, its severity, and its impact. The publication release only happens once the verdict gains the status of the final ruling and the offender may also incur the costs of publication. Cyber crime attracts severe punishment by the Saudi Ministry of Interior and the Communications and Information Technology Commission, and penalties exacted for identity theft, defamation, electronic piracy, email theft and other unlawful activities.

Revisiting the penal features of the Royal decree on March 26, 2007

Crime Fines Imprisonment § Acquisition of moveable property or bonds for oneself or others or signing such bonds through fraud or use of false name or identity. Up to 2 million Riyals Not exceeding 3 Years § illegally accessing bank or credit card data or data as to ownership of securities with the intention of obtaining data, information, the position of funds or type of services offered. § Unlawful access to computers with the intention to delete, erase, destroy, leak, damage, alter or redistribute private data. § Causing the information network to halt or failure or destroying, removing, leaking, or modifying or reconstructing existing or stored programs or data. § Obstruction of access to, distortion and causing interruption or cessation of any form of services and by any means. Fine of up to three (3) million Saudi Riyals Up to 3 million Riyals Not exceeding 4 years § Production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, and privacy, through the information network or computers, § the construction or publicizing of a website on the information or data of any type), the IT system(s) or computer (in general) to promote or facilitate human trafficking. § the preparation, publication, and promotion of material for pornographic or gambling sites which violates public morals. § the construction or publicizing of a website on the information network(s) or computer linked data to act, deal or trade in, distribute, a demonstrated method of use or facilitate dealing in narcotic and psychotropic drugs. Up to 3 million riyals Not exceeding 5 years § Spying on, interception or reception of data transmitted from an information network or a computer without lawful authorization. § Unlawful access to computers with the intention to threaten or blackmailing a person to accept, or asking him/her from refraining from taking action, be it lawful or unlawful. § Illegal access to a website, or hacking a website with the intention to change its design, destroy or modify it, or occupy its URL. § Invasion of privacy by employing camera-equipped cellular or mobile devices and the like. § Defamation and infliction of damage upon others through the use of various information technology tools and devices. Uo to 5 hundred thousand riyals Not exceeding 1 year § the construction or publicizing of a website on the information network or on a computer for terrorist organizations to facilitate communication with leaders or members of such organizations, finance them, promote their ideologies, publicize methods of making incendiary devices or explosives or any other means used in terrorist activities. § Unlawful access to a website or an information system directly or through the data network or any computer with the intention of obtaining data jeopardizing the internal or external security of the State or its national economy. Up to 5 million riyals Not exceeding ten years. § The crime is committed through organized crime. § The offender holds a public office and the crime performed relates to that facility or where the crime stems from employing one's undue influence, or authority. § The luring and exploiting of minors and related offenses. § The offender has a prior conviction of similar crimes within or outside the Kingdom. The fine may not be less than fifty percent (50%) of the maximum if the wrong combines with one of the mentioned crimes. The imprisonment may not be less than half of the maximum if the offense links with one of the said crimes

Further, the Saudi Anti-Cyber Crime Law aims to secure the safe exchange of data, protect the rights of users of the computers and the internet, and to protect the public interest and morals as well as people’s privacy. In recognizing the position and urgency, the Saudi authorities are reviewing the Anti-Cybercrime Law to amend it so as to initiate legal proceedings against social networking sites such as Twitter for allowing accounts which aim at posting or in general dealing with adultery, and the acts of homosexuality, or atheism.

Known Cases of Cyber Crimes And Cyber Attacks in Saudi

i. The unethical and illegal cyber attack on Aramco Company in August 2012 by a group calling itself "Cutting Sword of Justice" claimed responsibility. Aramco is one of the well-known oil companies owned by the Saudi Arabian government. In a matter of hours, 30,000 computers got partially wiped or wholly destroyed by a virus resulting in the deletion of data on the company’s hard-drives. Saudi Aramco's ability to supply 10% of the world's oil was suddenly at risk.

ii. Multiple attacks from outside the country targeted Saudi Arabia’s government websites, crippling these websites for quite some time until they were disabled. These attacks were discovered to belong to hundreds of IP addresses from different parts of the world.

iii. In January 2012, the official Website of King Saud University (KSU) got hacked by some unknown Hacker, and a database of 812 Users got exposed included phone numbers, addresses, and passwords.

iv. Saudi hacker, 0XOMAR, published over 400,000 credit cards online and threatened Israel to release 1 million credit cards in the future. In response to that incident, an Israeli hacker published over 200 Saudi's credit cards online.

v. In December 2016, cyber criminals attacked various departments of Saudi Government. These included the Saudi’s General Authority of Civil Aviation. Thousands of computers got destroyed in the Saudi air office in the so-called “digital bomb” detonation which leads systems of several agencies to wipe out at once.

Conclusion

The Internet has taken the world to altogether a new level. As they say, A coin has two sides! The unknown 'side advocates' threat and terror without boundaries and with no proof. The placement and recruitment of young, influenced and innocent individuals or persons by terror groups is a stance of Cyber exploitation. The Internet can be used to make things as well as break things! It is used to address social issues while some use it as a prime platform to express freedom of Speech and religious views. With this level of cyber threat, stronger defense systems are the need of the hour.

The only thing that can stop a bad guy on the internet is a Good chap on the Internet!