Dubai: The legality around the use of virtual private networks (VPNs) has not changed and not all residents in the UAE who use the technology automatically face imprisonment and up to Dh2 million in fines, experts told Gulf News.

The confusion surrounding the impact of the law stemmed from “inaccurate reporting” by some foreign news websites, according to a UAE-based lawyer, who specialises in telecommunications, media and commercial laws.

What has been amended in the Cybercrime Law, which was passed in 2012, is the amount of fines that offenders will face, in addition to the existing provision on imprisonment. 

Kellie Blyth, a senior associate at Clyde & Co, suggested that private individuals, aside from corporate organisations, don’t run the risk of going to jail and paying a fine as long as they don’t use VPN to commit a crime. Any misuse of the technology, however, may still be punishable.

“The legal position regarding the use of VPNs in the UAE has not changed. It was and remains an offence to use VPN to commit a crime, or to try to prevent its discovery,” Blyth told Gulf News. “Previously, the potential fines ranged from Dh150,000 to Dh500,000. Now, they have been increased to any amount from Dh500,000 to Dh2 million. This is in addition to a potential custodial sentence, which existed previously,” she said.

The Telecommunications and Regulatory Authority (TRA) also issued a statement to clarify that companies, banks and institutions are not prohibited from using VPNs, adding that the law can be breached only when internet protocols are manipulated to commit crime or fraud.

IT security experts and government officials have come forward, as well, citing that VPNs are an integral part of the local economy.

"VPNs are critical for businesses or nearly all companies to securely exchange data between their branches and their partners, and to allow their employees to work remotely. Without it, financial transactions will not be secure,” said one IT manager.

"The leadership of the UAE in the field of internet applications and IT in general, is on the contrary to what has been circulated by some media regarding the use of VPNs," said Hamad Obaid Al Mansoori, director general of TRA.

"It is known that the UAE is keen to embody the directions of the UAE government's wise leadership regarding smart transformation, including the smart government, smart cities, Big Data and IoT, in addition to promoting investment, competitiveness and focus on building a knowledge-based economy and society."

The use of VPNs has landed the spotlight this week following social media rumours claiming that online users could land in jail and pay hefty fines if they get caught using a false or third-party address.

How VPN works

There are hundreds of thousands of VPNs out there. Generally, they work like secret tunnels, allowing companies and individuals to access the internet without exposing private information to the prying eyes of hackers. They also provide an extra layer of privacy protection when people browse the web using a public Wi-Fi hotspot at a coffee shop, in the hotel or other public places.

“VPN creates a security layer on your communication, which means that a third party cannot extract information on what you do inside the VPN tunnel,” Nicolai Solling, director of technology services at Help AG, told Gulf News.

“One use case that is applied in business on a daily basis is where employees outside of the organisational network using VPN to connect to internal company resources. Another example could be to protect yourself from attacks in a public access infrastructure,” he added.

And since their connection is encrypted, VPNs can effectively let online users surf anonymously and appear as if they’re somewhere else, so that blocked sites become accessible. In the UAE, VPNs have become widely popular among users of video and voice calling applications like Viber, Skype and other VoIP services.

The encryption feature is useful to online banking users, as well. “Some banks adopt a simple security measure of blocking IP ranges of countries known to perform a lot of financial fraud. If you are in one of those countries,  a VPN can make it seem like you are accessing the site from another location,” Solling said.

“In fact, encryption is happening natively in a lot of applications now. When you go to your e-banking, utility payments or social media sites, or utilise some smartphone communication apps, encryption is being carried out natively by using SSL in the browser or the application itself.”

What's new

The Cybercrime Law has recently been amended to include the following provision: “whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by another means for the purpose of committing a crime or preventing its discovery, shall be punished by temporary imprisonment and a fine of no less than Dh500,000 and not exceeding Dh2 million, or either of these two penalties.”

The new amendment, according to Blyth, merely increases the potential penalties and demonstrates  the seriousness of the government’s campaign against cybercrime.

“The increase in the level of fine signifies that the UAE Government considers any breach of Article 9 of the Cybercrime Law to be a serious matter,” she said. “Whether the change in the level of fine will result in an increase in prosecutions remains to be seen.”

The TRA supported this view in its more detailed statement on Tuesday that states: the law is not new in its essence and that the only changes were related to tightening the penalty or punishment for any violation."

When VPN use becomes illegal

However, there are still certain “offences” that could increase the risk of prosecution. “Using a VPN to commit an offence gives rise to a risk of prosecution,” said Blyth.

"Business users can be held accountable, like the use of any other technology if it has been misused," the TRA said. "Any misuse of the licensed and organised services in the UAE will lead to legal accountability. It is worth mentioning that the laws are targeting those who misuse the services and not those activities that are consistent with UAE's laws."

Blyth said examples of offences which may be carried out online using a VPN include accessing and using gambling services, accessing obscene materials and watching or listening to television, film and other media content that is not licensed for use in the UAE.

She, however, would not give a categorical answer when asked whether or not the use of VPN to link to sites that are otherwise inaccessible in the UAE due to regional restrictions such French TV channel or Netflix US, can be considered illegal.

“Some sites that can’t be accessed here aren’t necessarily blocked by the government. The French TV channel for example is prohibited from broadcasting in this market by France. So effectively, when you access the channel using a VPN, you’re breaching the French law, not the UAE’s,” said one expatriate from France who also works in the IT industry.

Few examples of VPN uses

1. Employees working remotely: Through a VPN, company staff working from home can log on to the organisational network and connect to internal company resources

2. Data protection: Users of free public Wi-Fi hotspots can expose themselves to hackers. Solling said there have been multiple examples across the globe where people have been attacked or fallen victim to digital eavesdropping while using an open wireless network in a coffee shop or at an airport.

3. E-banking services: To prevent hackers from accessing bank accounts, some banks block IP ranges of countries where financial fraud cases have been widely reported. If a customer happens to live in one of these countries, it may not be possible to access banking services online. In thise case, a VPN can make it seem like the user is accessing the site from another location,

Downsides

One of the downsides to allowing the public to use VPNs, however, is that some people can use it for criminal activities.

"All of the [encryption features of VPN] can also be applied by cyber criminals or even normal criminals to cover their tracks where they perform or plan activities and attacks," said Solling.

"A VPN tunnel could make an attacker appear to be based in a different country or location, thereby covering his tracks."

In effect, he said, VPNs can potentially hide the malicious activities of certain groups who are out to harm the safety of a country.

"For the same reason, the use of VPNs and encryption is a general concern from law enforcement all over the world and keeping the right balance between privacy and safety is a big balancing act taking up much space in newspapers and the media."