Iain Thomson of The Register writes:
A royal edict from the president of the United Arab Emirates (UAE) may have effectively made it illegal for anyone in the country to use a VPN or secure proxy service.
Those caught could face jail time and fines of between 500,000 and 2,000,000 UAE dirham (US$136,130 and $544,521).
The wording is ambiguous and technologically illiterate. Essentially, it seems, you are not allowed to use systems that hide the fact that you’re committing a crime or covering one up. If you’re routing your network traffic through a secure VPN or proxy server, you could be evading the eyes of the state while breaking a law, and that’s now a big no-no.
You could claim you were using the VPN or proxy for legit reasons, and that no criminal activity was being committed or concealed, but since your packets were encrypted, you may have a hard time proving your innocence.
That certainly does sound like a bit of a pickle for businesses and individuals who want to use the internet safely while in the United Arab Emirates.
You want to run VPN software to secure your communications, and keep your confidential information out of the hands of hackers sniffing data out of the air at public Wi-Fi hotspots, and beyond the grasp of over-reaching intelligence agencies. There are also plenty of people who have legitimate excuses for using the internet anonymously, and concealing their true identity.
But let’s take a closer look at the wording of this new legislation:
Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery, shall be punished by temporary imprisonment and a fine of no less than Dh500,000 and not exceeding Dh2,000,000, or either of these two penalties.
The key thing to emphasise in the above is, I would argue, the words “for the purpose of committing a crime or preventing its discovery”.
Hopefully the UAE is planning to use this legislation to crack down on illegal activities on the internet, rather than those who use a VPN and other secure proxy services legitimately.
But if you were to find yourself *forced* to reveal what you had been doing (to prove it wasn’t illegal) well, you’ve just flushed your privacy down the lavatory.
I would worry that we could find ourselves slipping into a situation where the very use of a VPN and encrypted communications is considered itself inherently suspicious, rather than sensible.