On May 23rd, the UAE President, His Highness Sheikh Khalifa bin Zayed Al Nahyan, issued Federal Law No. 12/2016 whereby it amended Federal Law No. 5/2012 on combatting information technology crimes.
The law has been wrongly reported by UAE media, which suggested that it was now punishable to use VPNs (Virtual Private Networks). This led to a lot of confusion, in the UAE market, about whether the use of VPNs has become illegal in the country, especially after penalizing the use of VoIP telephony (such as Viber, Skype, etc.) without a license (as per the UAE telecommunications law).
Federal Law no. 12 of 2016 amends only article 9 of Federal Law no. 5 of 2012 on combatting information technology crimes. A small comparison between the old and new texts may help clarify the definitive position on whether the use of VPNs is legitimate or not.
Article 9 of Federal Law no. 5 of 2012 (the old text) states: “Any person that circumvents the protocol address of the internet by using a delusive address or an address belonging to third party or by any other means for the purpose of committing a crime or preventing its discovery shall be punished by imprisonment and a fine not less than (AED 150.000) and not exceeding (AED 500.000) or by any of these punishments”. In contrast, the amendment introduced via Federal Law no. 12 of 2016 now reads: “A punishment of temporary imprisonment and a fine of not less than five hundred thousand Dirhams (AED 500,000) and not more than two million Dirhams (AED2,000,000), or either of these two penalties, shall be imposed on whoever uses a fraudulent computer network protocol address by using a false address or a third-party address or by any other means for the purpose of committing a crime or preventing its discovery”.
The primary change is merely an increase in the applicable fines. The legal stance on the use of VPNs has not changed. It is still considered a crime if it is used “fraudulently” or with the aim of “committing or concealing a crime”. Therefore, the use of VPNs, if licensed and for legitimate purposes, does not constitute a punishable crime under the UAE law.
In consequence, the UAE’s official Telecommunications Regulatory Authority (TRA) issued a statement to clarify the ambiguity engulfing the new amendment. It confirmed that the law governing virtual private networks (VPNs) in the country was only targeting illegitimate users.
The question is not whether the use of VPN is illegal or not; it is actually what constitutes a “crime” in information technology. In principle, any misuse of information technology, or use without license, may be considered a crime under UAE technology laws (Telecommunications Law & Combating Cyber Crimes Law). The use of VPNs falls under this same classification.