There have been recent press reports that the law in the UAE concerning the use of virtual private networks (VPNs) has changed. Some online publications have also stated that the use of VPNs in the UAE has become illegal. The purpose of this Update is to clarify the position and to set out the law regarding VPNs as it currently stands.

In short, the use of VPNs to commit a crime by accessing unlawful content (such as online gambling services, indecent material and television and other media content not licensed for access in the UAE) remains an offence under UAE law, although the penalties have been increased significantly. To explain in more detail:

  1. the legal position regarding the use of VPNs in the UAE is set out in Federal Law No. 5 of 2012 (the Cybercrime Law).Pursuant to Article 9 of the Cybercrime Law it is an offence to use a VPN to commit a crime, or to try to prevent its discovery.
    This provision of the Cybercrime Law is unchanged. The use of a VPN to commit a crime has been an offence under the Cybercrime Law since its introduction in August of 2012
    Federal Law No. 12 of 2016 has introduced some amendments to the Cybercrime Law (details below). However, Article 9 is unaffected by these amendments, and it remains lawful to use a VPN in the UAE unless the use is to commit a crime or to try to prevent its discovery.
  2. The legal position regarding the use of VPNs has also been clarified by the UAE’s Telecommunications Regulatory Authority (TRA) which issued a public statement on 1 August 2016 confirming that:
    there are no regulations which prevent the use of VPN technology by companies, institutions and banks to access their internal networks through internet. However, business users can be held accountable, like the use of any other technology, if it has been misused."
  3. The confusion surrounding the impact of Law No. 12 of 2016 seems to have emanated from inaccurate reporting on some foreign news websites. It seems that these inaccurate reports were spotted and shared by members of the public on social media.
  4. Law No. 12 of 2016 does increase the penalties for breaching Article 9 of the Cybercrime Law. Previously the potential fines ranged from AED 150,000 to AED 500,000. These have now been increased to range of AED 500,000 to AED 2 million. This is in addition to a potential custodial sentence, which existed previously.
  5. Any penalty imposed under Article 9 of the Cybercrime Law for using a VPN to commit a crime can potentially be imposed in addition to any penalty which is imposed in relation to the original crime.This, together with the increase in the level of fine, signifies that the UAE Government considers the use of a VPN to commit a crime to be a serious matter.However, whether the change in the level of fine will result in an increase in prosecutions remains to be seen.
  6. It is, however, clear that using a VPN to commit a crime gives rise to a risk of prosecution with potential serious consequences.Examples of crimes that may be committed using a VPN include the following:
    • accessing and using online gambling services – Federal Law No. 3 of 1987 (the Penal Code) provides that it is an offence to gamble and the Cybercrime Law provides that it is an offence to transmit, send, save, publish or re-publish gambling activities;
    • accessing indecent or obscene materials – the Cybercrime Law provides that is an offence to transmit, send, save, publish or re-publish pornographic materials and any other materials that may contravene public morals; and
    • accessing and viewing television content which is broadcast and accessible online outside the UAE and which is not licensed for use in the UAE.For example, the BBC iPlayer service provides users of the service with online access television programmes which were originally broadcast by the BBC in the UK. However, the BBC’s Terms of Use for online services makes it clear that users who are outside the UK are not entitled to access, view and/or listen to video or live television services through the BBC’s online platform.

As a consequence, the use of a VPN to access content on the BBC iPlayer Service (or any other platform which is restricted to users in the UK or elsewhere outside the UAE) can amount to an unauthorised exploitation of a copyright work prohibited under UAE Federal Law No. 7 of 2002 (the Copyright Law). This would give rise to criminal offences under both the Copyright Law and the Cybercrime Law, with the new more severe penalties now applying under the Cybercrime Law.

The extent to which the Cybercrime Law will be used to combat these types of offences remains to be seen. However, anyone in the UAE who uses a VPN to access unlawful content in this way is at risk of having very substantial penalties imposed as a result of the changes under the Cybercrime Law.