Over the past few weeks, rumors have been swirling around the UAE after a law concerning the use of VPNs was updated. There's been a lot of confusion what exactly the update meant for the average person.
While there are no definitive numbers, anecdotally, there are a lot of VPN users in the Emirates. VPNs are used for a variety of business and personal purposes both legal and illegal. This includes securing financial transactions, streaming videos only available in other countries, making Skype calls, or more illicitly taking part in any other online activity that's blocked in this country.
However, while there was a recent uproar, VPN use in the region is not as confusing as it seems, and we've broken it down to get a clearer understanding of the rules when it comes to this technology.
UAE President His Highness Sheikh Khalifa bin Zayed Al Nahyan issued a new Federal law No. 12/2016 that amends Article 9 of the existing federal law No. 5/2012 on combating information technology crimes. Specifically it states:
"Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery, shall be punished by temporary imprisonment and a fine of no less than Dhs 500,000 and not exceeding Dhs 2,000,000, or either of these two penalties."
Not that much has changed recently. Using a VPN to commit a crime or prevent its discovery has been illegal since 2012 with the passing of the original law. The only thing that's been changed is that the fine has increased from 150,000 - 500,000 AED to 500,000 - 2 million AED.
What is a VPN?
A VPN, or Virtual Private Network, is a program that lets you surf the Internet through a computer located somewhere else, while keeping your online activity private. So basically, if you want to watch a YouTube video that's only available in the US or UK, a VPN allows you to securely access the video through a computer located in the US or UK.
Why use a VPN?
A VPN permits you to surf the web through a computer in another location, and it ensures that your traffic is secure, or more private, than if you were browsing without one. Without a VPN, it is possible for other people to see what sites and activities you are doing online those sites use a secure "HTTPS" connection (like Google or Facebook or banking sites). A VPN makes all of your web surfing private so other people can't see what sites or pages you are visiting. This is extremely important when you are connecting to public WIFI networks outside of your home. If you want to know more about what people can learn from your web traffic, check out this podcast.
While privacy is the most practical reason for using a VPN, many personal users don't care if the BuzzFeed quizzes they're taking and music videos they're watching on YouTube are not fully encrypted. Instead, they use a VPN to access video streaming services or editorial content that's blocked in the UAE or only available in a country outside of the UAE.
Would someone know if you're using a VPN?
It's possible to detect if someone is likely using a VPN because of their computer's web surfing pattern. Their computer will only be communicating with a single foreign computer or be connecting to a computer registered to the VPN provider. However, it isn't possible to know what those communications are because the communications are encrypted.
How would this law be enforced?
To be clear, there doesn't appear to be a change how the law is enforced, only in the penalty. This strongly suggests that the UAE isn't going to suddenly begin jailing iPlayer-watching expats for VPNing into the UK.
From a technical perspective, pro-actively enforcing a law against the criminal use of VPNs is extremely hard to enforce at scale. While it is possible to tell who is likely using a VPN, the encrypted connection makes it extremely hard to tell if it was used in the commission of a crime. It is more likely that this law would come into effect after a crime is uncovered by other means, such as a witness testifying to the crime or because part of the crime was committed while on an unencrypted connection. The authorities could then investigate the defendant's computer and uncover the VPN usage.
What's the bottom line?
There isn't a change in the way this law is enforced-- just the way punishment is carried out. To be clear, accessing any sites or using services banned in the UAE are illegal regardless of whether you are on a VPN or not. If using FaceTime is illegal without a VPN, it's illegal with a VPN too. However, it's unlikely that government officials are going to be tracking down individuals who are using FaceTime to connect with people back home, and instead will focus on high-priority cases involving fraud, piracy, and terrorism. However, venture at your own risk. It's still important to be aware of the rules surrounding this common web tool.