You write something online. Nothing heroic. Nothing controversial. A joke about the electricity that never works or a sarcastic comment on a minister’s speech.
Weeks later, your phone rings.

There is a law you’re being held accountable under, and there’s a good chance it has the word “cybercrime” in the title, which is strange because you didn’t hack anything!
Cybercrime laws have been passed around like a recipe in the SWANA region. Oman enacted a new one this year. Jordan pushed its version through in under a month, and Iraq’s draft has been rising from the dead since 2011.

• Broad and unclear definitions
  Oman’s concept of “misuse of technology” and the UAE’s reference to “harming the public interest” are examples of broad terms that are not clearly defined in legislation. That isn’t random drafting: a vague clause means whatever the prosecutor needs it to mean, and the power to define the law moves from parliament to whoever decides to charge you.
• Mixing cybercrime with speech control
  Insulting religion and breaking into a database fall under the same law, with similar penalties and the same prosecutors. Rules about “morality” and “national unity” are written like  rules about malware, so insulting an official and attacking a power grid are  treated as one of the same.
• Public order justification
  The law does not require proof of actual harm. There is no clear threshold, no evidence of damage, and no consistent standard for judges to apply. The phrase itself can be enough.
• Criminalizing “false information” without defining falsity
  Who decides what is false? Often the institution doing the complaining, and when the target is a state body, nobody needs to file a complaint at all. Satire, leaks, early reporting on a disaster all become fair game.
• Disproportionate penalties
  The punishment doesn’t match the supposed offense. Some draft laws propose life imprisonment and huge fines for content said to “undermine the state’s highest interests”. Life in prison for a post. The state doesn’t need to use it often, even a few sentences are enough to make everyone else afraid to post.
• Licensing requirements for online publishing
  In some countries, bloggers, news sites, and influencers must register with the authorities before publishing. A license can be refused and can be taken away later. Who decides who’s an influencer anyway?
• Extraterritorial reach
  Some statutes claim jurisdiction over anything accessible within the country, meaning that leaving does not necessarily place someone beyond reach. So for example, members of the Omani diaspora remain at risk wherever they are. So if someone criticizes the government from abroad, a case can still open at home and a court can convict them without them in the room, and we never know what might happen when they return to their country again.
• Controversial relationships with tech companies
  Governments order platforms to remove content, and those that refuse face fines or blocking. At the same time, nothing protects users’ data from the companies or from the state. In some cases, governments that threaten these platforms in public quietly ask them for data on people they’re prosecuting.
• Emergency or exceptional procedures bypassing normal courts
  Some “cybercrimes” never reach a normal criminal court. They go to state security or military prosecutors instead. That means no public hearing, no written judgment explaining why you were convicted, and often no right to appeal.

So, why is “cybercrime” such good branding? Because nobody organizes a protest for hackers. Call it a censorship law and you get concerns, statements, hashtags, and condemnations from international organizations. Call it a cybercrime law and all a government needs is a press release about protecting values and families from harmful content, because “cybercrime” sounds technical and precise. That is what makes it effective.
Ironically, nearly every government doing this has signed the International Covenant on Civil and Political Rights (ICCPR), which guarantees freedom of expression.
To spot this type of law, there are some basic questions you can ask: Are the terms defined? Is speech lumped in the same law as hacking? Who decides what is false/offensive/inappropriate?
If a law is vague, mixes speech with hacking, punishes insults like sabotage, then it simply isn’t a cybercrime law.  It’s a stone covered in bonbon packaging.

The post How governments design laws against you and call it cybersecurity appeared first on SMEX.