A decade after the Assad regime silenced the mass peaceful demonstrations with brute military force across Syria, the government continues to consolidate its power by criminalizing freedom of speech and expression, and shrinking civic spaces to stifle any form of dissent or perceived opposition. Such censorship has escalated in recent years given growing discontentment with the deteriorating socioeconomic conditions across regime-held areas and traditionally pro-government supporters. As the regime struggles to maintain the status-quo, a revised cybercrime law, Law no. 20 of 2022, was introduced in April 2022 to further restrict any form of perceived political dissent, repealing the 2012 law which was already weaponized by government authorities to target citizens. The following analysis uncovers how the new cybercrime law is part and parcel of the repressive legal tactics levied by the Syrian regime to criminalize freedom of expression and the free flow of information under the pretext of combating cybercrime.
Background and context
Cybercrime law No. 17 of 2012 penalized “anyone who incites or promotes crime through computer networks,” and had general provisions that primarily contained digital crimes such as forgery, theft, and wrongful impersonation with sentences that ranged from one to three years and a fine up to $1,500. Article 30 increases the punishment for cybercrimes as defined in the law once they violate the state or public stability. The 2012 law regulated the digital space along with the Penal Code, media regulation law No. 108 of 2011, and Counterterrorism law No. 19 of 2012. This framework criminalized and restricted freedom of speech and expression across online platforms, which gave leeway for the government to instrumentalize the 2012 law to detain activists and journalists throughout the decade and to commit gross human rights violations.
The prosecutions over social media activity were often based on loose interpretations of the available provisions and did not take place in courts that specialized in cybercrime. Rather, cases concerning crimes that occurred in the online space appeared before traditional civil and criminal courts in the system. As such, the Military Field Court and Counterterrorism Courts, which are closer to military-security branches, supervised cybercrime cases without offering conditions of fair trial or having the proper legal regulation. On this note, former minister of justice Najem Al-ahmed emphasized in 2018 the need to establish specialized courts for cybercrime seeing that online crimes were growing and becoming “part of the announced war on Syria as they were used to incite terrorism.”
In 2018, law No. 9 of 2018 was approved after being voted by the parliament. It includes the establishment of specialized courts of first instance for cybercrime-related cases and the delegation of 58 judges who were trained to detect and prosecute cybercrimes.
The 2022 law had been in the work for some time and was slowly eased into the collective conscience before its official adoption. While the parliament was holding discussions, Minister of Justice Ahmed Sayed stated that cybercrimes are “threatening the fabric of society” due to the “spread of modern communication tools.” In October 2021, the head of the cybercrime branch at the ministry of the interior claimed that 1,200 crime reports were filed since January 2021 and that 160 individuals were arrested for crimes related to online forgery, blackmail, libel, and defamation. In December 2021, the regime-affiliated Watan newspaper “leaked” the news of the parliament’s intention to amend the law and included a statement by the Minister of Telecommunications Iyad Khatib about the necessity for the amendment and regulation of the developed online devices and tools. These repetitive statements seemed part of a concerted governmental effort to slowly introduce the new cybercrime law which passed on April 18, 2022 and came into effect on May 18.
Legal analysis of the 2022 law
Law No. 20 of 2022 expands the definition of cybercrime beyond the 2012 law and criminalizes digital content published on social media platforms and authorizes sweeping government surveillance of internet users under the pretext of combating cybercrimes—all of which have a chilling effect on freedom of expression and the free flow of information. Vague provisions within the legislation provide Syrian authorities broad discretion to penalize individuals for activities that allegedly insult national institutions and public officials, undermine the prestige and morale of the state, and threaten the country’s financial and economic integrity. The law regulated new initiatives that emerged in response to the country’s current political and socioeconomic crises, such as the electronic card “smart card” system that the government implemented in 2019 to ration basic goods. Furthermore, the law imposes harsh monetary and criminal penalties on internet service providers if they fail to store digital data of internet users and disclose it upon government request.
Expanding the state’s police powers to cyberspace
Although “traditional cybercrimes” such as slander, defamation, libel, and spreading false news have been routinely weaponized in the past by Syrian authorities to restrict online civic space, Law No. 20 has further legalized repressive tactics to criminalize digital activities. With the new law, Syrian authorities increased the surveillance and targeting of citizens under the pretext of combating illicit or fraudulent use of the “smart card” when purchasing basic necessities like bread.
Under Articles 24 and 25 of the law, the crime of “electronic slander” includes the sharing of information—slander or humiliating—in a non-public manner, extending to communications between two private individuals. The punishment for doing so publicly or sharing information about public employees increases—from up to three months imprisonment and a fine of up to 500,000 Syrian pounds (SYP) (approximately $105) to imprisonment of up to one year and a fine of up to 1 million SYP (approximately $210). The law fails to expound on what is considered slander, libel, or humiliation, creating ambiguity as to how it is applied and providing authorities with great discretion to undermine freedom of expression and privacy rights.
Similarly, Article 26 criminalizes the sharing of digital content including images, audio, and audiovisual, deemed “contrary to decency or modesty” with a six months to one year prison sentence and a fine of 1 to 2 million SYP (approximately $210 to $420). Individuals who publish indecent or immodest content through online networks or share it with a third party risk a one to two year prison sentence and a fine of 2 to 3 million SYP (approximately $420 to $630). Harsher punishments are imposed for blackmailing someone or threatening to publish prohibited content and offenses committed against minors. While this provision can be utilized to prevent and deter cyber-bullying, similar laws in countries across the MENA region have been weaponized to target women for debauchery and violations of public morality.
Articles 27-29 are of particular concern for excessive government abuse given their broadly defined vague offenses against the state that also impose harsh monetary and criminal penalties for committing “crimes against the constitution”; “undermining the prestige of the state”; and “undermining the financial position of the state.” Under Article 27, the publishing of digital content challenging the constitution or undermining the sovereignty of the state by calling for systemic change, is punishable by seven to 15 years in prison and a fine of 10 to 15 million SYP (approximately $2,100 to $3,150). This provision effectively criminalizes freedom of expression and opinion, prohibits public demonstrations, and stifles peaceful dissent from Syrian advocates who seek government reform. Moreover, undefined offenses relating to undermining the prestige and financial integrity of the state leaves no room for fundamental freedoms of expression that are considered to threaten “national unity” as understood by the regime.
An increase in targeted individuals and cybersurveillance
In an effort to expand the scope of targeted individuals under cybercrime laws in Syria, Articles 4 and 5 of the law stipulate that internet and information service providers are “not to change, modify or delete any digital content stored or hosted by it.” Failing to comply with the requirements may result in a prison sentence of six months to one year and monetary damages ranging from 5 to 7 million SYP (approximately $1,100 to $1,500). An even greater criminal and monetary punishment is imposed if the violation occurs against a public entity. Such legal requirements not only inhibit the right to privacy and impose disproportionate punitive measures, but also broaden the scope of cybercrimes and targeted entities. Other provisions guarantee unchecked government discretion to target everyday internet users and restrict the free flow of information: Article 35 imposes direct liability on re-publishing prohibited “digital content”, and Article 37 allows blocking websites on a temporary basis or permanently if the website or information system is used to intentionally commit one of the prohibited activities.
Legal ambiguities resulting from some articles in Law No. 20 that overlap with the Penal Code can have a widespread impact on citizen’s rights. Unfettered data collection and government surveillance of digital activities offer no real alternative for citizens to express their opinion without the omnipresent threat of arrest and imprisonment. Furthermore, state security agents, or judicial police, within the ministry of interior’s Cybercrime Combating Branch have expansive powers under the 2022 law, including the authority to monitor social media platforms, collect and store data that may amount to criminal evidence, investigate cybercrimes, conduct search and seizures of devises, and arrest perpetrators after obtaining a warrant from the public prosecutor. Although the law disbanded the Anti-Cybercrime Department established in March 2012 which granted state security agencies the authority to handle cyber-related offenses, the continued involvement of state security services in combating cybercrimes leaves little room for independent oversight.
Implementation and anticipated consequences of the law
The preamble of the law states that it aims “to combat cybercrime in parallel to the development of communication networks and their growing usage in society, protect legal interests, regulate liberties in the digital space and limit the misuse of technology.” Such an outlook concurs with governmental officials’ statements about the purpose behind the new law. Minister of Communications Iyad Khatib clarified that the law merely seeks to preserve privacy and the “prestige of the state.” He conceded that violations on this scale could be unmeasurable but ensured nonetheless that “it does not mean protecting a minister or any official.”
Authorities have already started targeting individuals and groups under the law. Just in June, the ministry of interior announced the arrest of 11 people in Aleppo for spreading disinformation on state institutions to “Qatari-run social media pages.” Prosecutions are mainly occurring in regime-held areas in which the state is able to exert control and persecute civilians for expressing their opinions online. A recent report from the Syrian Network for Human Rights highlights this trend and the regime’s reliance on cybercrime law in some instances to charge and arrest suspect cases. Even within the national legal system, the law violates the stipulations of the 2012 Syrian constitution, especially Articles 33, 42, and 37 regulating freedom of belief and opinion as well as the right to privacy and confidentiality in telecommunications. It also breaches Syria’s obligations with international conventions and treaties it ratified, including Articles 18 and 19 of both of the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights.
In particular, the unclear and broad wording of the new cybercrimes give ample discretion for the judiciary to interpret the law in a manner that threatens freedom of expression. In a country notorious for its surveillance of citizens and absence of due process, having laws that hold not only citizens but also private telecommunication companies and internet providers accountable to the state’s repressive measures only reinforces the dangerous prospects for violations to freedom of expression. Civil society organizations such as Access Now, North Press Agency, and Syrians For Truth and Justice have raised multiple concerns about the nature and anticipated consequences of the law—specifically in relation to the broad discretion given to the judiciary to interpret the law.
According to academic Mondher Khaddam, the cybercrime law is a calculated strategy by the Syrian regime to protect its unity and prestige when it is fragmented, weakened, and under foreign auspices. From this angle, having broad and vague provisions that regulate open speech under the pretext of safeguarding “national unity” criminalizes all forms of expression critical of the Syrian regime, including traditional pro-regime supporters who are frustrated by the prolonged economic crisis as explained by Syrian lawyer Hassan-al Aswad: “These laws are primarily aimed at the popular supporters of the regime. The goal is to silence people and prevent Syrians from criticizing the actions of the authority.”
Furthermore, the law lays foundation for infractions within the Syrian legal system seeing that it penalizes and overlaps with crimes that are already regulated in other texts, such as the general code of penalties of 1949 as amended by law No. 15 of 2022. Because of this, citizens’ security is threatened as it is unclear which laws they would be violating. The possibility of one act falling under the scope of multiple legal instruments increases the risk of unjustified penalties and adds a layer of ambiguity and inconsistent application of the law.
Cyber authoritarianism across the MENA region
In recent years, there has been an increasing trend across the MENA region of governments leveraging overly-broad and vague cybercrime laws to shrink civic space, obstruct freedom of expression and opinion, and hinder access to a free flow of information. The rise of digital authoritarianism operates in tandem with the criminalization of speech and censorship of digital content through the establishment of special government monitoring units. Although the pre-existing lack of privacy rights in Syria has been of grave concern, Law No. 20 further guarantees government agencies the right to access user identification information from internet service providers and to track their activities.
According to credible insider information, Syria’s ministry of interior designated a special sub-division within the Cybercrime Combating Branch to monitor published social media posts and other digital communications, and create a database of alleged cybercrimes identified from the collected data. Such practice is similar to Egypt’s 2018 cybercrime law whereby government agencies have broad and unregulated discretion to order the blocking of websites and censor digital content without legal justification. According to a government issued decree, Egyptian prosecutors have “the responsibility of monitoring social media accounts and websites […] and taking any necessary action toward criminal proceedings when such content is found.”
Authorities in the region have weaponized the law to deploy exploitative practices in violation of their constitutional and international human rights obligations. Legalizing the crackdown on activists, social media users, journalists, and other members of civil society, state security officials often arbitrarily arrest, detain, and in some instances, torture, assassinate, or forcibly disappear people under the pretext of combating cybercrimes, counterterrorism, or national measures. When such violative tools are extended to the digital space, the silencing of citizen’s voices becomes deafening while the stifling of peaceful political organizing increases with impunity.
Meroua Zouai is the Legal Associate at TIMEP, and Mondher Tounsi is a Legal and Policy Intern at TIMEP.