Countering Rumours and Cybercrimes Law

Article (1) Definitions

For applying the provisions of this Decree-Law, the following words and expressions shall denote the meaning ascribed thereto respectively, unless otherwise required by the context: UAE: The United Arab Emirates Government Entities: Any federal or local government entity, or any company or establishment in which any of these entities holds at least 25% of its capital. Competent Authorities: The federal or local authorities concerned with electronic and cyber security inside the UAE. Information Technology (IT): All forms of technologies used for creating, processing, storing, exchanging and using electronic information systems (ISs), information programs, websites, information network, and any means of information technology equipment (ITE). Cyber: Everything relating to computer networks, the internet, and the various information program as well as all the services they perform. Data or Information: An organized or unorganized package of data, facts, concepts, instructions, views, or measurements taking the form of digits, characters, words, symbols, images, videos, signals, sounds, maps, or any other form, and which are interpreted, exchanged or processed by persons or computers, so that after being processed or circulated, they produce what is called "the information". Government Data and Information: Electronic data or information pertaining or belonging to any of the government entities and are not made available to the public. Personal Data and Information: Information or data pertaining to natural persons whenever these information or data are relating to their private lives or personal identities, or whenever linking these information or data, whether directly or indirectly, would lead to revealing the person's identity. Confidential Information and Data: Any information or data that are not permitted to be accessed by or disclosed to Third Parties, without prior permission of the person who has the power to grant this permission. Route Data: The data of an information technology means produced by an information system to show the source of communication and its transmitter and receiver interfaces, time, date, size, and duration, and the type of the service. Website: A virtual space or domain on the information network that depends on smart software which enables its users to make available, exchange, or disseminate any content, whether text, audio, visual or data content. This includes social media websites, networks and platforms, personal pages and accounts, weblogs, e-services and etc. Electronic Information System (IS): An information program or collection of information programs that are designed to process, manage or store electronic information that can execute the instructions or commands using the information technology equipment, including the applications and the like. Information Technology Equipment (ITE): Any magnetic, optical or electrochemical electronic equipment or any other tool used for processing electronic data, or performing logical and mathematical processes or storage functions, including any tool that is connected or linked to it, directly or indirectly, and which enables this tool to store or communicate the electronic information to others. Electronic Account: Any account created with an information network broker in order to use the services of this broker. Content: The electronic information, data, and services that provide value to its receivers in specific contexts. Illegal Content: The content whose subject constitutes one of the crimes punishable by law, or whose publication, circulation or recirculation inside the UAE would compromise the UAE's security, sovereignty or any of its interests, the public health, or public peace assurance, or the friendly relations between the UAE and other countries, or would affect the results of elections of members of the Federal National Council (FNC) or of the Consultative Councils of the emirates of UAE, or would incite hostility and hatred among different groups of persons, or would decrease the public's confidence in any of the government authorities' or entities' performance of any duty or task or exercise of any powers. False Data: The rumors and data which are false or misleading, in whole or in part, whether by itself or within the context where they appear. Electronic Robot (E-robot): an electronic program that is created or modified for the purpose of running automated tasks efficiently and quickly. Electronic Document (e-document): An informational record or statement that is created, stored, extracted, copied, sent, communicated or received by electronic tool on a medium. Hacking: The unauthorized access, access in violation of the provisions of the license, or illegal access to or stay on an information system (IS), or a computer, or operating system (OS) of a device, machine, vehicle or information network and the like. Leakage: The deliberate disclosure or revelation of information or data without the knowledge or authorization of the owner of the system. Such data may be classified as sensitive, private or confidential. Interception: Viewing, monitoring, or acquiring data or information for the purpose of eavesdropping, disrupting, storing, copying, recording, circumventing, or altering the content, or for misusing, rerouting or redirecting for illegal and unlawful reasons. Cyberattacks: Every deliberate and planned targeting of ISs, infrastructure, electronic networks, or ITE that reduces the capabilities and functions of any of them, whether for personal purposes or for the purposes of intercepting, intruding, hacking, leaking, or exposing data or information to risks, or for disrupting the operations and the like. Encryption: Converting information or information systems or tools into a form that is unreadable or unidentifiable unless returned to their original form using a password or the encryption tool involved. Electronic: Everything relating to electromagnetic, optical, digital, automated or photogenic technologies or the like. Electronic media: Every physical medium used for storing and circulating electronic data and information, including compact discs (CDs), optical discs, electronic memory, or the like. Digital Evidence: Any electronic information having a probative force or value and is stored, transmitted, extracted or derived from computer sets, information networks and etc. It may be gathered and analyzed using special technological devices or applications. Information Network: A connection between two or more information programs and information technology equipment that allow users to get access to and exchange information. Internet Protocol (IP) Address: A digital identifier assigned to each information technology equipment on the information network and is used for connection purposes. Information Network Broker: Every person providing any information network brokerage services including social networking services, search engines, collecting the contents transmitted through the information network, sharing videos ...etc. Service Provider: Every public or private natural or legal person providing users with IT-based access to the information network. Financial, Commercial or Economic Establishment: Any establishment that acquires its financial, commercial or economic standing under the license granted to it by the competent authority inside the UAE. Child: Every person under the age of eighteen calendar years. Child Pornography: Producing, displaying, disseminating, possessing or circulating a photo, movie, or a drawing through any means of communication, social networks, or any other means or tool that shows the child involved in a dishonorable situation in a sexual act or show whether real, fictional or simulated. Electronic Advertisement: Every advertisement through an electronic means that aims to promote the sale of a product or the provision of a service, directly or indirectly. Misleading Advertisement: Advertising any goods or a service based on the provision of deceptive information or omission of essential or basic information related to the goods or the service involved, and which would affect the consumer's decision and motivate them to seek to acquire it; so that the consumer would not have acquired the same had it not for that information. Data or Information Processing: Performing or carrying out a single process or a group of processes involving the data or information, whether such information and data are pertaining to natural or to legal persons. This includes collecting, receiving, recording, storing, modifying, transmitting, retrieving and deleting that information. User: Every natural or legal person using or taking advantage of IT services in any form. Writs of correction and removal of false data: The notices issued by the competent authorities to one or more persons for correcting, removing or deleting illegal content, or to correct, remove or delete false information or data in the form or manner those authorities deem appropriate during the period stated in the notice. Disable order: The notices issued by the competent authorities to an information network broker through which illegal content or false data is published. The broker is required under this notice to disable, in the form or manner deemed appropriate by these authorities, the users' access to the said content or data within the period stated in the notice. Access Blocking Orders: The orders issued by the competent authorities to the service provider inside the UAE in case of failure to perform the other instructions mentioned in this Decree-Law in order to take actions to disable users' access in the UAE to the website or electronic account.

Article (2) Hacking

Chapter One: Crimes Against Information Technology

1. Whoever hacks a website, an electronic IS, an information network or a piece of ITE shall be punished with imprisonment and/ or a fine of not less than (AED 100,000) one hundred thousand dirhams or more than (AED 300,000) three hundred thousand dirhams. 2. If the hacking results in damages, destruction, or interruption of work; or disruption of a website, an electronic IS, an information network or a piece of ITE, or cancellation, deletion, destruction, disclosure, damage, alteration, copying, dissemination, re-dissemination, or acquiring any data or information, or loss of confidentiality of data and information, the penalty shall be imprisonment for at least (6) six months and/ or a fine of not less than (AED 150,000) one hundred fifty thousand dirhams or more than (AED 500,000) five hundred thousand dirhams. 3. If the hacking is committed for acquiring data or information for illegal purposes, the penalty shall be imprisonment for at least one year and/ or a fine no less than (AED 200,000) two hundred thousand dirhams or more than (AED 500,000) five hundred thousand dirhams.

Article (3) Hacking the Government Entities' Information Systems

Chapter One: Crimes Against Information Technology

1. Whoever hacks a website, electronic IS, information network or a piece of ITE belonging to the government entities shall be punished with temporary imprisonment and a fine of not less than (AED 200,000) two hundred thousand dirhams or more than (AED 500,000) five hundred thousand dirhams. 2. If the hacking results in damages, destruction, or interruption of work, or disruption of a website, electronic IS, information network or a piece of ITE, or cancellation, deletion, destruction, disclosure, damage, alteration, copying, dissemination, or re-dissemination of any data or information or loss of their confidentiality, or if crime is committed as a result of a cyberattack, the penalty shall be imprisonment for at least (5) five years and a fine of not less than (AED 250,000) two hundred fifty thousand dirhams or more than (AED 1,500,000) one million and five hundred thousand dirhams. 3. If the hacking is committed for acquiring data or information of the entities mentioned in Para. (1) of this Article, the penalty shall be temporary imprisonment for at least (7) seven years and a fine of not less than (AED 250,000) two hundred fifty thousand dirhams or more than (AED 1,500,000) one million and five hundred thousand dirhams.

Article (4) Causing Harm to Information Systems

Chapter One: Crimes Against Information Technology

1. Whoever willfully causes harm, destruction, interruption or disruption of a website, electronic IS, information network or a piece of ITE, shall be punished with imprisonment for at least one year and/ or a fine of not less than (AED 500,000) five hundred thousand dirhams or more than (AED 3,000,000) three million dirhams. 2. If the harm is inflicted upon a banking, media, health or scientific entity, if the harm is intended for achieving an illegal purpose, or if the crime is committed as a result of a cyberattack, the penalty shall be temporary imprisonment and a fine of not less than (AED 500,000) five hundred thousand dirhams or more than (AED 3,000,000) three million dirhams.

Article (5) Harm to Information System of Government Entity and Critical Facility

Chapter One: Crimes Against Information Technology

Whoever willfully causes harm, destruction, interruption or disruption of a website, electronic IS, information network or a piece of ITE belonging to one of the government entities or critical facilities shall be punished with temporary imprisonment and a fine of not less than (AED 500,000) five hundred thousand dirhams or more than (AED 3,000,000) three million dirhams. If the crime is committed as a result of a cyberattack, this shall be deemed an aggravating circumstance.

Article (6) Infringement of Personal Data and Information

Chapter One: Crimes Against Information Technology

1. Whoever acquires, possesses, modifies, destroys, reveals, leaks, cancels, deletes, copies, disseminates, or re-disseminates any personal electronic data or information using the information technology or any ITE without permission shall be punished with imprisonment for at least (6) six months and/ or a fine of not less than (AED 20,000) twenty thousand dirhams or more than (AED 100,000) one hundred thousand dirhams. 2. If the data or information aforementioned in Clause (1) of this Article are related to examinations, diagnosis, medication, healthcare, medical records, bank accounts, or e-payment information and data, this shall be deemed an aggravating circumstance. 3. Whoever receives, keeps, or stores the data and information referred to in Clauses (1) and (2) of this Article, or accepts to handle or use them despite knowledge of the illegality of acquiring them shall be punished with imprisonment and/ or a fine.

Article (7) Infringement of Government Data and Information

Chapter One: Crimes Against Information Technology

1. Whoever acquires, possesses, modifies, destroys, reveals, leaks, cancels, deletes, copies, disseminates, or re-disseminates any government confidential data or information without permission shall be punished with temporary imprisonment for at least (7) seven years and a fine of not less than (AED 500,000) five hundred thousand dirhams or more than (AED 3,000,000) three million dirhams. 2. If the acts stipulated in Clause (1) of this Article cause harms to the UAE, or results in loss of confidentiality of the operation of electronic systems and software pertaining to military and security facilities and concerning the communication and transmission of confidential information, the penalty shall be temporary imprisonment for at least (10) ten years and a fine of not less than (AED 500,000) five hundred thousand dirhams or more than (AED 5,000,000) five million dirhams. 3. Whoever receives, keeps, or stores the data and information referred to in Clause (1) of this Article, or accepts to deal with or use them despite knowledge of the illegality of acquiring them shall be punished with temporary imprisonment.

Article (8) Infringement of Data of Financial, Commercial or Economic Establishments

Chapter One: Crimes Against Information Technology

Whoever acquires, possesses, modifies, destroys, reveals, leaks, cancels, deletes, alters, copies, disseminates, or re-disseminates any confidential data or information pertaining to any financial, commercial or economic establishment without permission using the information technology or any ITE shall be punished with temporary imprisonment for at least (5) five years and a fine of not less than (AED 500,000) five hundred thousand dirhams or more than (AED 3,000,000) three million dirhams.

Article (9) Unauthorized Acquisition of Third Party's Codes and Ciphers

Chapter One: Crimes Against Information Technology

1. Whoever acquires the PIN code, cipher, or password or the like pertaining to a website, information system, information network or ITE without permission or authorization of the person concerned shall be punished with imprisonment and/ or a fine of not less than (AED 50,000) fifty thousand dirhams or more than (AED 100,000) one hundred thousand dirhams. 2. If the person who acquires the PIN code, cipher, or password and the like without permission or authorization of the person concerned accesses or enables third parties to access the website, information system, information network or the ITE with the intent to commit a crime, he shall be punished with imprisonment for at least (6) six months and/ or a fine of not less than (AED 300,000) three hundred thousand dirhams or more than (AED 500,000) five hundred thousand dirhams.

Article (10) Circumventing the Information Network with the Intention of Committing a Crime

Chapter One: Crimes Against Information Technology

Any person who circumvents the protocol address of an information network by using an address belonging to another person, or by any other means, with the intent to commit a crime or to prevent its detection, shall be punished by temporary imprisonment and a fine of not less than AED 500,000 (five hundred thousand dirhams) and not exceeding AED 2,000,000 (two million dirhams), or by either of these two sanctions.

Article (11) Creating Fake Emails, Websites, and Electronic Accounts

Chapter One: Crimes Against Information Technology

1. Whoever creates a fake website, an account or an email and attributes it falsely to any natural or legal person shall be punished with imprisonment and/ or a fine of not less than (AED 50,000) fifty thousand dirhams or more than (AED 200,000) two hundred thousand dirhams. 2. If the offender uses or enables third parties to use the fake account, email or website in a matter offensive to the person affected shall be punished with imprisonment for at least (2) two years. 3. If the fake website, account or email is attributed to one of the government entities, the penalty shall be imprisonment for not more than (5) five years and a fine of not less than (AED 200,000) or more than (AED 2,000,000) two million dirhams.

Article (12) Illegal Interception and Disclosure of Information

Chapter One: Crimes Against Information Technology

1. Whoever obstructs or intercepts the access to an information network, website, or electronic IS or any electronic connection, information or data shall be punished with imprisonment and/ or a fine of not less than (AED 150,000) one hundred fifty thousand dirhams or more than (AED 500,000) five hundred thousand dirhams. 2. If the offender discloses or leaks the information, data or purport of the communication obtained through the interception shall be punished with imprisonment for at least one year and fine of not more than (AED 1,000,000) one million dirhams. 3. If the interception involves the communication, information or data of one of the government entities, the penalty shall be temporary imprisonment.

Article (13) Collecting and Processing Personal Data and Information in Violation of the Legislation

Chapter One: Crimes Against Information Technology

Whoever uses the information technology or ITE to collect, save, or process personal data and information of nationals and residents of the UAE in violation of the legislation in force in the UAE shall be punished with imprisonment and/ or a fine of not less than (AED 50,000) fifty thousand dirhams or more than (AED 500,000) five hundred thousand dirhams.

Article (14) Forging E-documents

Chapter One: Crimes Against Information Technology

1. Whoever forges an e-document belonging to any of the federal or local government or the public federal or local authorities or entities shall be punished with temporary imprisonment and a fine of not less than (AED 150,000) one hundred fifty thousand dirhams or more than (AED 750,000) seven hundred fifty thousand dirhams. 2. If the forging involves documents belonging to entities other than those mentioned in Clause (1) of this Article, the penalty shall be imprisonment and/ or a fine of not less than (AED 100,000) one hundred thousand dirhams or more than (AED 300,000) three hundred thousand dirhams. 3. The penalty prescribed for forgery crime shall be imposed on whoever knowingly uses the forged e-document.

Article (15) Hacking E-Payment Instruments

Chapter One: Crimes Against Information Technology

Whoever forges, clones or copies any credit card, debit card, or any e-payment instrument, or captures its data or information using any of the ITE ISs shall be punished with imprisonment and/or a fine of not less than (AED 200,000) two hundred thousand dirhams, or more than (AED 2,000,000) two million dirhams. The same penalties shall be imposed on whoever: 1. Makes or designs any ITE or software with the intention of facilitating any of the acts stipulated in Para. (I) of this Article. 2. Uses without authorization any credit, electronic, or debit card or any other e-payment instrument, or any of its data or information with the intention of obtaining for himself of for third parties any funds or properties of others, or to utilize the services made available to third parties by these cards or instruments. 3. Accepts using these forged, fake, or copied cards or e-payment instruments or data seized or obtained illegally despite being aware of their illegality.

Article (16) Using Electronic Systems to Commit Crimes and to Conceal Evidence

Chapter One: Crimes Against Information Technology

Any person who possesses, acquires, prepares, designs, produces, imports, makes available, or uses any information program, information technology mean, passcodes, or codes, or uses encryption, with the intent to commit any of the crimes stipulated in this Decree-Law, conceal their evidence or traces, or prevent their detection, shall be punished with imprisonment for a term of not less than two (2) years and/or a fine of not less than AED (200,000) two hundred thousand dirhams and not exceeding AED (1,000,000) one million dirhams.

Article (17) Crimes Committed by Administrator of Website or Electronic Account

Chapter One: Crimes Against Information Technology

Whoever manages, creates or uses a website or account on an information network with the intent to commit or to facilitate the commission of a crime punishable by law shall be punished with imprisonment for at least one year and/ or a fine of not less than (AED 300,000) three hundred thousand dirhams or more than (AED 500,000) five hundred thousand dirhams.

Article (18) Tampering with Digital Evidence

Chapter One: Crimes Against Information Technology

Everyone responsible for managing a website or an account on an information network, an e-mail, or an IS and conceals or tampers with digital evidence pertaining to any of the crimes stipulated in this Decree-Law with the intent of impeding the work of the searching, investigations, and interrogations teams or other competent authorities shall be punished with imprisonment for at least (6) six months and/ or a fine of not less than (AED 200,000) two hundred thousand dirhams.

Article (19) Dissemination of Data or Information Not Compliant with Media Content Standards

Chapter One: Crimes Against Information Technology

Everyone responsible for managing a website or an electronic account that has posted on any of it any content, data or information that does not comply with the media content standards issued by the authorities concerned shall be punished with imprisonment for not more than one year and/ or a fine of not less than (AED 30,000) thirty thousand dirhams or more than (AED 300,000) three hundred thousand dirhams.

Article (21) Advocacy and Promotion of Terrorist Groups

Part One: Content Crimes: Article (20) Inciting the Suspension of the Provisions of the Constitution and Laws

1. Whoever creates, manages, or supervises a website or publishes information or data pertaining to terrorist group(s), society, or organization or an illicit body via the information network or the ITE with the intention of facilitating communication with their leaders or members, attracting members, promoting or advocating their thoughts, financing their activities, providing actual assistance to them, or disseminating the methods of manufacturing incendiary devices, weapons, ammunition, explosives or dangerous materials or any other tools used in terrorist acts shall be punished with life imprisonment a fine of not less than (AED 2,000,000) two million dirhams and not exceeding (AED 4,000,000) four million dirhams. 2. Whoever downloads, re-broadcasts, or reposts the contents of any of the websites aforementioned in paragraph (1) of this Article using any means whatsoever, or re-accesses these sites to view this content, or disseminates any content that incites hatred shall be punished with imprisonment for a period not exceeding (5) five years and a fine of not less than (AED 500,000) five hundred thousand dirhams and not exceeding (AED 1,000,000) one million dirhams. 3. The Court may – in cases other than recidivism – instead of imposing the penalties set out in paragraph (2) of this article, decide that the accused person be assigned to a counseling house or be placed under electronic monitoring and be prohibited from using any of the ITE for the period of time to be determined by the court, provided that it is not longer than the maximum penalty prescribed.

Article (22) Dissemination of Information to Harm the Interests of the UAE

Part One: Content Crimes: Article (20) Inciting the Suspension of the Provisions of the Constitution and Laws

Whoever uses information network or ITE and provides to any organization, institution, body, person or entity any information, data, reports or documents that are not authorized to be published or circulated and would harm the interests of the UAE or its government agencies, or would harm its reputation, prestige or dignity, shall be punished with temporary imprisonment.

Article (23) Incitement to Harm the Security of the UAE and to Assault Judicial Officers

Part One: Content Crimes: Article (20) Inciting the Suspension of the Provisions of the Constitution and Laws

Whoever creates, manages, or supervises a website or uses information on the information network or on the ITE with the intention of inciting actions, disseminating or broadcasting information, news, cartoons or any other images which would endanger the security of the UAE and its higher interests, or would harm the public order, or incite assaulting the judicial officers or law enforcement officers shall be punished with temporary imprisonment and a fine of not more than (AED 1,000,000) one million dirhams.

Article (24) Promoting Sedition and Harming the National Unity

Part One: Content Crimes: Article (20) Inciting the Suspension of the Provisions of the Constitution and Laws

Whoever uses of information network or any ITE to create, manage, or supervise a website or to disseminate information, programs or thoughts that include incitement, promotion or advocation of sedition, hatred, racism, or sectarianism in a manner which would harm the national unity, social peace, public order, public morals or would endanger the UAE's interests shall be punished with temporary imprisonment and a fine of not less than (AED 200,000) two hundred thousand dirhams or more than (AED 1,000,000) one million dirhams.

Article (25) Mockery and Tainting the Reputation of the UAE and its Public Figures

Part One: Content Crimes: Article (20) Inciting the Suspension of the Provisions of the Constitution and Laws

Whoever publishes information, news, data, visual images, visual or optical materials or rumors on a website, any information network or ITE with the intention of mocking or damaging the reputation, prestige, or dignity of the UAE, any of its authorities, institutions, any of its founding leaders, the UAE's flag, currency, peace, coat of arms, or national anthem, or any of its national public figures shall be punished with imprisonment for not more than (5) five years and a fine not exceeding (AED 500,000) five hundred thousand dirhams.