A draft law aiming to combat cybercrimes in Egypt was approved in late September. The controversial legislation, which is still pending approval by the Cabinet, incriminates internet users for crimes ranging from hacking official emails, to publishing “illegitimate ideas.”

Yasser al-Qady, minister of communication, insists that the law seeks to protect the rights and duties of service providers and consumers by prohibiting irresponsible information technology (IT) use, such as breaches that might encroach on the rights of individuals and institutions.

This is not the first attempt to pass legislation criminalizing online activity. An earlier draft of the law was submitted by the Ministry of Justice to the Cabinet in March 2015, which was identical to a draft submitted to the parliamentary Proposals and Complaints Committee by MP Tamer al-Shahawy last May.

The Egyptian Initiative for Personal Rights, Support for Information Technology and the Association for Freedom of Thought and Expression issued a joint policy report last June titled “Anti-Technology,” commenting on the draft submitted in May. The three NGOs all assert that the draft “violates the principle of equality before the law and contains penalties regarding the use of information technology.” The report refers to the “animosity” of those who drafted the law toward the internet, adding that the proposal leaves “nothing much to be added should this law be passed, other than a total ban on internet use.”

The most recent draft doesn’t differ significantly from earlier proposals, according to the director of Support for Information Technology Ahmed Kheir, save for some improvements in the legal formulation.

Crimes you can be penalized for
Under the new law internet users may be punished for everything from hacking and using the black market, to the possession of material that may “offend public morality.”

• Using the internet or any other IT tool to unjustly benefit from communication services, including audio, visual and audiovisual services.
  Penalty: Imprisonment and/or a fine ranging between LE10,000 and 50,000.
• Accessing a restricted private website, account or information system, whether intentionally or accidentally.
  Penalty: A minimum prison sentence of one year and/or a fine ranging between LE50,000 and LE100,000.
• Damaging, deleting, changing, copying or republishing data or information after illegally accessing a website, account or an information system.
  Penalty: A minimum prison sentence of two years and/or a fine ranging between LE100,000 and LE200,000.
• Unjustly interrupting any information, data or other exchange through an information network or computer.
  Penalty: A minimum prison sentence of one year and/or a fine ranging between LE100,000 and LE250,000.
• Hacking an email account, website or account of an individual.
  Penalty: Imprisonment and/or a minimum fine of LE30,000.
• Hacking an email account or website belonging to an official.
  Penalty: A minimum prison sentence of six months and/or a fine ranging between LE50,000 and LE200,000.
• Damaging, disabling, distorting, concealing or changing the design of a personal website.
  Penalty: Imprisonment and/or a fine ranging between LE20,000 and LE100,000.
• Deliberately or unintentionally accessing a website and unjustly remaining there, or exceeding the authorized time or level of access, or hacking into a website, email, private account or information system belonging to, run by or servicing the state or an official.
  Penalty: Two year prison sentence and/or a minimum fine of LE100,000.
• Damaging, destroying, distorting, changing, copying or republishing data, information, websites, private accounts, information systems or emails.
  Penalty: Imprisonment and a fine ranging between LE500,000 and LE2,000,000.
• Setting up, administering or using a website, private account or information system with the aim of illegitimately trading ideas, drugs, arms and human organs, or the facilitation or advocacy of any of these forms of trade.
  Penalty: Three to 15 years in prison.
• Using the internet, or any means of IT to partially or wholly publish, copy, make available or present material protected by intellectual property laws.
  Penalty: A minimum prison sentence of one month and/or a fine ranging between LE50,000 and LE100,000
• Using the internet or another IT tool to partially or wholly publish, copy or present material protected by intellectual property laws, with the aim of marketing or profiting,
  Penalty: A minimum prison sentence of six months and/or a fine ranging between LE100,000 and LE200,000.
• Possessing, purchasing, selling, making available, manufacturing, producing, importing, exporting or exchanging any devices, equipment, tools, programs, access codes, passwords or other similar information with the aim of using them to commit, facilitate or conceal any of the aforementioned crimes.
  Penalty: A minimum prison sentence of two years and/or a fine between LE300,000 and LE500,000.
• Setting up an email account, website or private account, falsely claiming it to belong to a real person or an official.
  Penalty: Imprisonment and/or a fine ranging between LE5000 and 20,000.
• Using a fake email, website or private account to offend the person with whose name the account was established.
  Penalty: A minimum prison sentence of two years and/or a fine ranging between LE10,000 and LE30,000.
• Producing, preparing, adapting, sending or storing material that may offend public morality with the aim of use, distribution or presentation to others.
  Penalty: A minimum prison sentence of one year and/or a fine between LE50,000 and LE100,000.
• Disrupting public order, exposing society to danger, harming the country’s national security and economic condition. Obstructing the work of the authorities, the provisions of the constitution, legislation or regulations and harming either national unity or social peace.
  Penalty: Life sentence.

Things you can be penalized for without actively committing a crime
Several articles also outline punishment for crimes which internet users may commit unwittingly, in some cases penalizing the victims of cybercrime.

• If you learn the website, private account, email or information system you manage has been subjected to any of the above infringements and you fail to notify the authorities immediately.
• Failing to undertake necessary precautionary measures, enabling any of the above crimes to be committed.
  Penalty: A one-year prison sentence and/or a fine between LE10,000 and LE100,000.
• Failing to warn unauthorized users that a website you manage is only for authorized users, requesting immediate withdrawal from the site.
  Penalty: A maximum prison sentence of one year and/or a fine ranging between LE20,000 and LE100,000.

What experts think about the law

It is primarily a punitive law
The policy report published by the NGOs considers the majority of the articles in the law to be punitive. It highlights that the legislation fails to address procedural issues that should be seriously considered given the widespread and increasing use of the internet as a primary mode of communication, source of information and space for organization and assembly.

It contains vague notions
Referring to a section of the legislation which criminalizes “illegitimate ideas,” executive director of the Association for Freedom of Thought and Expression Mohamed al-Taher says that he has never heard of such a law, expressing surprise at the vague use of the term.

It penalizes the same crimes differently simply because they are committed online
In a presentation addressing the logic behind the legislation, privacy advocate Amr Gharbeia notes that the main problem with the new law is that it penalizes crimes encompassed by Egypt’s Penal Code differently simply because they take place online. For example, crimes related to hampering public morality will have a different penalty if they are committed in the press or on television.

It penalizes the same crime differently depending on who it harms
The draft law stipulates different penalties for the same crime if it affects different parties, as Kheir points out, citing mainly the differentiation between regular citizens, the state and officials. Accordingly, the report compiled by NGOs states that the law protects the strong more than the weak, without enforcing harsher penalties for officials who commit any of the indicated crimes using their position of authority, public measures or public funds.

It criminalizes the victims
Kheir also expresses surprise that victims of internet crimes can be punished under the proposed law, and the report also highlights that some provisions “practically criminalize the administration of information systems, a profession which has become necessary for any modern economic activity.” Company directors, according to report, are also incriminated under these provisions and it is very hard to provide them with defense.

It obstructs critical IT studies
The NGO report additionally states that the law will “criminalize the use of technology, obstructs information system studies, obliterates the information industry and threatens programmers, students, researchers and engineers. It does so by outlawing the necessary studies on securing information systems. This includes reading, studying and writing programs and reviewing their systems and security.” Kheir believes that these restrictions threaten the digital security industry in Egypt.

It essentially legalizes internet control
Taher says that the draft law fits within the general context of Egypt today, where the state seeks to maintain control over civil society and the media. In his view, the state is trying to increase its control on the only space remaining for citizens, which is the internet.

However, he adds that this attempt is impossible, stating “even if they manage to close all websites, this will only mean the creation of alternative ones. In this case, users will develop more advanced technical know-how on to escape the grip of the authorities, which will further render attempts at control impossible.”