Anti-Cybercrime Law

The following words and phrases, wherever used in these Regulations, shall have the meanings indicated in front of them unless the context requires otherwise: 1. Person : Any natural or legal person, public or private. 2. Information system : A set of programs and tools designed to process and manage data, including computers. 3. Information network : A link between more than (1) one computer or information system to obtain and exchange data, such as private and public networks and the World Wide Web (Internet). 4. Data : Information, commands, messages, sounds, or images that are, or have been, prepared for use in a computer, and everything that can be stored, processed, transmitted, and created by a computer, such as numbers, letters, symbols, etc. 5. Computer programs: A set of commands and data that include instructions or applications that when run in a computer, or computer networks, perform the required function. 6. Computer : Any fixed or movable wired or wireless electronic device that contains a system for processing, storing, sending, sending, receiving, or browsing data, and performs specific functions according to the programs and commands given to it. 7. Unauthorized Access: The intentional entry of a person into a computer, website, information system, or computer network to which that person is not authorized to access. 8. Cybercrime : Any act committed involving the use of a computer or information network in violation of the provisions of this Law. 9. Website : The place where data is made available on the information network through a specific address. 10. Capture : Viewing or obtaining data without a valid legal justification.

This law aims to reduce the incidence of cybercrimes by defining these crimes and the prescribed penalties for each of them, which leads to the following: 1. Helping to achieve information security. 2. Preserving the rights resulting from the legitimate use of computers and information networks. 3. Protecting the public interest, morals, and ethics. 4. Protecting the national economy.

Any person who commits any of the following cybercrimes shall be punished by imprisonment for a term not exceeding (1) one year and a fine not exceeding (500,000) five hundred thousand riyals, or by (1) one of these (2) two penalties: 1. Eavesdropping on, capturing or intercepting what is transmitted through the information network or a computer device without a valid legal justification. 2. Illegal entry to threaten or blackmail a person; to induce him to do or refrain from doing an act, even if it is legal to do or refrain from doing so. 3. Illegal access to a website, or accessing a website to change its design, damage, amend it, or occupy its address. 4. Invasion of privacy by misusing a cell phone with a camera, or the like. 5. Defamation of others, and harming them, through various means of information technologies.

Any person who commits any of the following cybercrimes shall be punished with a term of imprisonment not exceeding (3) three years and a fine not exceeding (2,000,000) two million riyals, or (1) one of these (2) two penalties: 1. Seizing for himself or others a movable property or a deed, or signing this deed, by means of fraud, taking a false name, or impersonating a false character. 2. Accessing - without a valid legal justification - banking, credit, or securities ownership data to obtain data, information, funds, or the services they provide. Article 5 : Any person who commits any of the following cybercrimes shall be punished with a term of imprisonment not exceeding (4) four years and a fine not exceeding (3,000,000) three million riyals, or (1) one of these (2) two penalties: 1. Illegally accessing, deleting, destroying, leaking, damaging, altering, or republishing private data. 2. Suspending, disabling, destroying, erasing, deleting, leaking, damaging, or amending programs or data contained or used therein. 3. Obstructing, interfering, or disrupting access to the Service by any means whatsoever.

Any person who commits any of the following cybercrimes shall be punished with a term of imprisonment not exceeding (5) five years, a fine not exceeding (3,000,000) three million riyals, or (1) one of these (2) two penalties: 1. Producing, preparing, sending or storing anything that may prejudice public order, religious values, public morals, or the sanctity of private life through an information network or a computer device. 2. Creating or publishing a website on the Internet, or a computer device, for human trafficking, or facilitating dealing in it. 3. Creating, publishing or promoting materials and data related to pornographic networks or indecent gambling activities. 4. Creating a website on the Internet, or a computer device, or publishing it, for trafficking in drugs or psychotropic substances, or promoting them, or methods of abuse, or facilitating dealing with them. The judgment determining the penalty may include a provision to publish its summary at the expense of the convicted person in (1) one or more local newspapers or in any other appropriate means, depending on the type of crime committed, its gravity, and its impact, provided that the publication is made after the judgment has acquired final status. Article 7 : Any person who commits any of the following cybercrimes shall be punished with a term of imprisonment not exceeding (10) ten years, a fine not exceeding (5,000,000) five million riyals, or (1) one of these (2) two penalties: 1. Creating or publishing a website for terrorist organizations on a computer network or a computer device to facilitate contact with the leaders of these organizations, or any of their members, or to promote their ideas or funding, or to publish how to manufacture incendiary devices, explosives, or any tool used in terrorist acts. 2. Illegal access to a website, an information system directly, or through the information network, or a computer device to obtain data affecting the internal or external security of the state, or its national economy.

The penalty of imprisonment or fine shall not be less than (1/2) half of its maximum limit if the offense is accompanied by any of the following cases: 1. The offender commits the crime through an organized criminal group. 2. The offender occupies a public position, and the crime is related to this position, or the offender commits the crime using his powers or influence. 3. Deceiving and exploiting minors and the like. 4. Previous local or foreign convictions of the offender for similar offenses.

Anyone who incites, assists, or agrees with another person to commit any of the crimes stipulated in this Law shall be punished, if the crime is committed on the basis of such incitement, assistance, or agreement, by a penalty not exceeding the maximum limit of the prescribed penalty, and by a penalty not exceeding (1/2) half of the maximum limit of the prescribed penalty if the original crime did not occur.

Anyone who attempts to commit any of the offenses stipulated in this Law shall be punished with a penalty not exceeding (1/2) half of the maximum limit of the prescribed penalty. Article 11 : The competent court may exempt from these penalties any offender who takes the initiative to inform the competent authority of the crime before learning of it and before the damage is caused, and if the report is made after learning of the crime, the report must lead to the seizure of the remaining offenders, if there are several of them, or the instruments used in the crime.

The application of this Law is without prejudice to the provisions contained in the relevant laws, especially those related to intellectual property rights, and the relevant international agreements to which the Kingdom is a party.

Without prejudice to the rights of bona fide individuals, the devices, programs, or means used to commit any of the offenses stipulated in this Law, or the funds obtained therefrom, may be confiscated. It may also be ordered to close the website or the place of providing the service permanently or temporarily when it was a source of committing any of these crimes, and the crime was committed with the knowledge of its owner.

The Communications and Information Technology Commission shall, in accordance with its competence, provide technical support and assistance to the competent security entities during the stages of seizing and investigating these crimes and during the trial.

The Investigation and Public Prosecution Authority is responsible for investigating and prosecuting the crimes stipulated in this law.

This Law shall be published in the Official Newspaper and shall enter into force (120) one hundred and twenty days after the date of its publication.