2017-09-17

Ramallah

West Bank

Dr. Hanan Ashrawi

Head of the PLO Department of Culture and Information 

Ramallah – Palestine

 

Subject: a legal memo regarding the Decree-Law No. (16) for 2017 on Cybercrimes, presented by the ICHR and member CSOs in the joint committee for the review of the Decree-Law on Cybercrimes, established by the PLO Department of Culture and Information

 

The Independent Commission for Human Rights (ICHR) along with Civil Society Organizations (CSOs), which are members of the joint committee for the review of the Decree-Law on Cybercrimes, extend their warmest greetings to you, hoping that this memo finds you well, and expressing their gratitude for the initiatives and efforts made on your part to establish the joint committee.

 

In commitment to their social responsibility before the public, the abovementioned institutions, together with a wide range of civil organizations as well as national figures in the fields of human rights and law, have shown a great concern regarding the Decree-Law on Cybercrimes from the first moment it was referred by the Council of Ministers to the President for approval, on 25/06/2017, without consulting with CSOs or asking them for their opinion, followed by the issuance and publishing of the decree-law in the Palestinian gazette on 09/07/2017, particularly that this law directly affects the daily life of citizens as well as their basic rights and freedoms, especially their right to the freedom of expression and their right to privacy, both guaranteed by the Declaration of Independence 1988, the Basic Law 2003 and its amendments, and the UN human rights conventions which Palestine has acceded-to in May 2014.

 

After conducting reviews and studies on the said decree-law in accordance with the Amended Basic Law and the international obligations of the Palestinian State, the CSOs and the ICHR observed that the decree-law contains provisions that put the basic rights and freedoms of citizens at serious risk, which violates the Amended Basic Law and international human-rights treaties (attached is a detailed memo on the reasons for rejecting the decree-law). As a result, the said CSOs and the ICHR have taken the initiative to address the relevant official authorities to suspend the aforementioned decree-law immediately and to start a widespread community discussion in this regard.

 

In the same context, the Head of the PLO Department of Culture and Information, Dr. Hanan Ashrawi, has taken an initiative on 18/07/2017 to establish a joint committee consisting of the organizations listed below, along with a large number of official institutions (Council of Ministers, Public Prosecution, Advisory and Legislation Bureau, Ministry of Telecommunication and Information Technology, Ministry of Information, and Ministry of Justice), for the purpose of reviewing the said decree-law and amending it in compliance with the Amended Basic Law and the UN human-rights treaties, while maintaining the basic rights and freedoms of the citizens.

 

The committee started to carry-out its work immediately after its formation. The demands of the member CSOs to change the date on which the decree-law enters into force until the committee finishes its work was rejected. However, the CSOs showed good intentions and resumed their work after obtaining an obligation from the Attorney General on 13/08/2017 that the Public Prosecution will not abide by any of the provisions of the said decree-law which relate to the detention of citizens, the extension of their detention, or their referral to court. The committee resumed its work hoping to come up with a better version of the decree-law so as to guarantee the basic rights and freedoms of the citizens. Having said that, at the beginning of September a citizen from Hebron was detained on the grounds of expressing his opinion through social media channels, pursuant to Article (20) of the Decree-Law on Cybercrimes. This was preceded by the detention of seven journalists from different West Bank governorates based on the same Article. As a result, things has gone back to square one for the member CSOs, which have then reached a consensus to declare the failure of the joint committee in fulfilling its duties, and to announce their position explaining their demands and reasons for rejecting the decree-law in detail based on a number of parameters as follows:

 

- The Declaration of Independence 1988;

- The Amended Basic Law 2003 and its amendments;

- The UN human rights conventions which Palestine has acceded-to, particularly the International Covenant on Civil and Political Rights 1966 and the General Comment No. 34 of the UN Human Rights Committee;

- The Arab Convention on the Prevention of Information Technology Crimes for the year 2010, in line with the Amended Basic Law and the UN human rights conventions;

- The Council of Europe Convention on Cybercrime (Budapest) for the year 2001, in line with the Amended Basic Law and the UN human rights conventions;

- The International principles for the implementation of human rights in relation to telecommunication control, issued by an international group of experts in communications and information technology in 2014.

 

Furthermore, the practical application of the decree-law during the short period that has passed warns of the possibility of using the decree-law in suppressing rights and freedoms. Our reasons for rejecting the said decree-law, noted by the ICHR and the CSOs that are members of the joint committee, are as follows:

 

1. GENERAL REASONS FOR REJECTION (GENERAL NOTES):

- Using ambiguous, general and unspecified terms in indictments:

In several texts related to indictments, the decree-law includes general and ‘loose’ terms such as, public order, public ethics, social peace, and State security. These terms are not suitable to be penal texts according to the principle defining the legitimacy of crime punishments as stipulated in Article (15) of the Amended Basic Law, which states that any text related to indictments shall be clear and unambiguous without being subjected to the authorities responsible for enforcing the law, be it the security services, the Public Prosecution or the courts. Without such clarity, enforcing these texts may cause prejudice to the principle of equality and non-discrimination. Furthermore, the use of these terms affects one’s right to know the legal norm. It cannot be imagined that a citizen would know what a crime is and is not when there is a lack of clarity in the legal text.

 

- Putting personal privacy at risk:

In many of its articles, particularly the ones that deal with the procedures of investigation, evidence-gathering and preliminary investigation, the decree-law gives wide ranging powers for the security services and the Public Prosecution to inspect electronic devices, have access to information systems and monitor phone calls and electronic conversations without being subject to review by the courts –as appropriate-. This is particularly important due to the fact that the Public Prosecution is considered an adversary in the criminal prosecution, which directly infringes fair trial guarantees, violates the principle of equality between the adversaries, and violates the right of the accused person to defend himself.

 

- Blocking electronic sites:

Disregarding fair trial guarantees, the decree-law grants power for the security services, the Public Prosecution and the courts to block electronic sites, which violates the individual’s fundamental right to use the internet pursuant to the Human Rights Council resolution for 2016 on the promotion, protection and enjoyment of human rights on the Internet; the right to the freedom of expression; and the right to receive and transmit information.

 

- The severity of punishments:

Most of the punishments provided for in the decree-law are severe and disproportionate when compared to the relevant criminal act. In some cases, the penalties can reach hard labor, which contravenes the modern approach to punishment and that it should be based on reform and rehabilitation.

 

- Overall protection of human rights:

The decree-law does not contain any text that provides general protection of human rights and fundamental freedoms; a text that sets general boundaries defining the competencies of each authority, and at the same time portrays a human rights philosophy on which the decree-law is founded. This is particularly important because the decree-laws which deal with cybercrimes often cause prejudice to the privacy of individuals and affect their private lives. For example, the decree-law does not require that any text mentioned in the decree-law shall not be perceived or interpreted in a way that does not conform to the fundamental rights and freedoms guaranteed by the Amended Basic Law and the international human rights conventions. Also, the decree-law does not address the validity/invalidity of the penal measures taken based on its provisions by linking them to certain necessary conditions such as the legality, necessity, legitimate purpose and suitability of the measure taken.

 

- Unjustified expansion in the range of indictments:

The decree-law widens the range of indictments by imposing severe penalties on those who commit conventional crimes through the use of information technology without giving any justification. All crimes should be handled in the same way regardless of the tool used to commit the crime. Any anti-cybercrimes law must be limited only to the following aspects:

- Crimes against the information system which are related to the confidentiality of data.

- Crimes related to computers, namely fraud; forgery; theft; blackmail and threats.

- Content-related crimes, particularly child pornography on the Internet.

- Combating organized crime on the Internet, especially terrorism; money laundering; and human trafficking.

- Crimes related to intellectual property rights.

- Clarifying the criminal procedures of the prosecution of the accused individuals in the above-mentioned crimes, while ensuring the indictee the highest level of fair trial guarantees and maintain his right to the privacy of his personal life.

- Clarify the procedures of international cooperation in combating electronic crimes, taking into account the constitutional principles pertaining to the prohibition of the extradition of Palestinian citizens to foreign authorities, and the fact that Palestine is a State living under occupation.

 

2. SPECIFIC REASONS FOR REJECTION (DETAILED NOTES):

- Indictment and punishment:

- Article (1):

This article does not conform to the principle of legality for crimes and penalties and violates the individual’s right to know the legal norm, as it gives “hacking” a very ambiguous and multi-interpretable definition. Not explaining the means by which access to IT channels was conducted and only describing it as an illegal or unauthorized access does not conform to the principle of legality for crimes and penalties and violates the individual’s right to know the legal norm. The Budapest convention defines hacking as accessing IT systems or the electronic web by infringing security measures or making use of security loopholes.

 

Furthermore, the definition of user data puts the privacy of users at risk, as is it a very broad definition that might as well include all of the user’s personal information, including content-related information which might have nothing to do with the crime in question. This poses a serious threat to the right to privacy.

 

Moreover, the definition of an employee according to this Article includes employees in the private sector, public sector, and non-governmental sector. This has no reasonable or legal justification, as legal normss usually separate the provisions that apply to public employees from the ones that apply to other employees due to the difference in powers and responsibilities between them (each one holds a different legal status compared to the other one).

 

- Articles (6:26):

These Articles are not suitable for the reality of digital security; they criminalize the production or possession of many applications, which may be used to test the security and safety of networks, software and information systems, and which are originally created to uncover security loopholes in communication networks, systems, software, and other applications, without considering having bad intentions a requirement for punishment over these acts.  

 

- Article (8):

This Article contradicts with the principle of legality and violates the individual’s right to know the legal norm, as the stated unlawful character as a requirement for criminalizing the use of personal encryption is ambiguous, in addition to the fact that Article (1) of the decree-law does not present a definition for unlawful character. Also, this Article violates the person’s right to privacy in that it criminalizes the use of personal encryption since each person has the right to choose freely whether or not to encrypt their messages.

 

- Articles (16: 20: 51):

This Article contains the terms “public ethics, public order, State security, social peace, and national unity”, all of which are general and ambiguous terms that cannot serve as penal texts, as texts pertaining to indictment and punishment must be clear and unambiguous, as well as not subject to those who are responsible for enforcing the law. In addition, this Article implies a violation of one’s right to know the legal norm. It is implausible to think that a citizen would be able to determine what is considered a crime and what is not considered a crime when there is a lack of clarity in the penal text. Furthermore, any restrictions on the freedom of expression and media must be stated clearly, unlike the aforementioned terms, which contradicts with the General Comment No. (34).

 

- Article (21):

This Article contains unjustified restrictions on the freedom of expression, which violates Article (19) of the International Covenant on Civil and Political Rights and the General Comment No. (34). The term sanctities of religions is very broad and unspecific; it might refer to religious leaders and their views, which should not be a reason for the restrictions imposed on the freedom of expression as stipulated in the General Comment No. (34). The same applies to the term of abuse.

 

- Article (22):

This Article contains unjustified restrictions on the freedom of expression, and it does not differentiate between libel and slander against public officials and other officials. According to the General Comment No. (34), merely considering some form of expression as offensive to a public official does not necessarily justify the imposition of punishments even if the provisions of the Covenant is to the advantage of the public officials as well. In addition, all public officials, including those on top of the pyramid of political authorities like the heads of states and governments, are lawfully subject to criticism and political opposition. On the other hand, libel and slander against ordinary figures should not be subject to penal indictment. Pursuant to the said General Comment, it should be subject to the rules of civilian rather than penal accountability. Furthermore, this Article contains a general and ‘loose’ term that is not suitable to serve as a penal text: “family principles and values”, which contradicts with the principle of legality and violates the individual’s right to know the legal norm.

 

- Article (24):

This Article contains a general and loose term: “racial strife”; a term that is not suitable as a penal text. This term in specific has been used before by the Palestinian political parties for the purpose of restricting the freedom of expression and arresting persons on political grounds.

 

- Article (28):

This Article implies an unjustified constraint which has to do with the tool of the crime rather than the consequent damages of the crime. All crimes should be handled in the same way regardless of the tool used to commit these crimes.

 

- Article (48):

This Article poses a threat to the freedom of journalists and the right to access information, as publishing penal proceedings is not considered a crime unless they were accompanied by a court order prohibiting the publishing pursuant to the Penal Code. This is in addition to the phrase “except in authorized cases”, which is general and loose and cannot serve as a penal text according to the principle of legality and the individual’s right to know the legal norm.

 

- Article (50):

This Article unjustifiably criminalizes ordinary citizens for not reporting cybercrimes even though such a punishment should only be limited to public officials according to Article (24: 25) of the Penal Procedure Law No. (3) for the year 2001 and its amendments.

 

- Blocking electronic sites:

- Article (40):

This Article categorizes the blocking of websites as a precautionary -investigative measure that does not follow the regular proceedings. This not only violates the right to the freedom of expression, the right to access information and the right to fair trial, but also contravenes with the international standards which consider Internet use a fundamental human right and a key factor for sustainable development 2030. According to the UN Human Rights Council resolution on the promotion and protection of human rights on the Internet (A / HRC / 32 / L.20) 27/06/2016), any deliberate or intentional obstruction of access to the dissemination of information and the deliberate blocking and tampering of Internet services is a convicted act. Moreover, this Article justifies the blocking of websites using general and ambiguous terms such as, “public order and public security”, which contradicts with the principle of legality and violates the individual’s right to know the legal norm.

 

- The obligations of service providers:

- Article (32):

This article obligates Internet and telecommunications companies to cooperate and assist the competent authorities in the collection, recording and temporary storage of electronic data or information, which poses an unprecedented threat to privacy. The international standards require that governments do not force Internet providers to include surveillance and eavesdropping features in the systems they operate, produce or offer for the public, the government, etc.  Furthermore, service providers should not be compelled to collect or retain certain information for the purposes of government surveillance. Governments may not, by these principles, require service providers to collect or store in advance - precautionary - any data, as individuals have the right to express their opinions anonymously, and the government must refrain from requiring service providers to ask for the identities of the users of telecommunications services (Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, 16 May 2011, para. 84).

 

- Penal procedures:

- Articles (33: 34):

These articles constitute a threat to the privacy of individuals by granting the Public Prosecution, an adversary in the criminal case, direct access to information technology means that are extremely confidential and private, exceeding the privacy of homes. Also, they grant the Public Prosecution access to devices, tools, data and information, traffic data, data related to users and communication traffic, and content-related information, without an order from the competent court.

 

- Article (35):

This article infringes the guarantees provided by the Penal Procedure Law in terms of monitoring landline and mobile telecommunications by Article (51); it expands the enumeration of offenses through which surveillance can be carried out to include all crimes even if the crime’s penalty is to pay a fine, and it gives authority to the Deputy Prosecutor rather than the Attorney General or his assistant to request surveillance. In addition, this Article does not require that the accused person be notified of the surveillance as required by the international standards pertaining to the application of human rights in the field of communications control.

 

- Article (37):

This Article also infringes the guarantees provided by the aforementioned Article (51) by expanding the enumeration of crimes through which surveillance can be carried out, so that it includes all crimes even if the penalty is paying fine. The said infringement is also evident in the period given for the competent authorities to implement the objection, since the period mentioned (three months) may involve long-term and unjustified surveillance to reveal many of the accused person’s private information, which is not related to the crime.

 

- Articles (38: 39):

These Articles involve prejudice to the independence of the judge, interfere with his moral certainty and, as a result, they conflict with the principle of judicial certainty and the criminal judge's freedom of proof. The criminal judge has full freedom in approving the evidence he sees appropriate. He is also free to weigh each of these evidence separately. The legislator, or anyone else, may not intervene in this field.

 

- Article (44):

This Article does take into account the special nature of Palestine at the national level, knowing that Palestine is a State living under occupation.

 

- Article (45):

This Article involves prejudice to the independence of the judge and interferes with his moral certainty by obliging the court to seize all technological means and data systems in all crimes and all convictions, without subjecting the matter to the court’s discretion. The same applies to blocking electronic sites. Originally, judgments to block certain websites should be issued at the discretion of the court and does not necessarily apply to all crimes.

 

- Article (58):

This Article authorizes the Minister of Communications and Information Technology to appoint officials from the Ministry who enjoy judicial control, without specifying their job titles and administrative levels, which may run counter to the rules of jurisdiction and experience. Moreover, judicial control is granted only by law and not by an administrative decision.

 

- Article (3):

This Article violates the rule of jurisdiction and competence in an unprecedented manner. It gives judicial control to units specialized in cybercrimes, stating that these units should be established as part of the police and security forces, which would serve as a fertile land for conflicts of interests and responsibilities, which eventually influences public rights and freedoms. In addition, paragraph 3 of the Article in unnecessary since the jurisdictions, authorities and responsibilities of the Public Prosecution and regular courts in terms of investigation and adjudication is already organized under the law regulating the judiciary, particularly the Penal Procedure Law.

 

Demands:

Based on the above-mentioned observations, which address most of the provisions of the decree-law, in promotion and protection of the rights of citizens and their fundamental freedoms, and in fulfillment of the obligations of the State of Palestine, we believe that the Decree-Law No. (16) of 2017 on Cybercrime cannot serve as a basis for the legislation regulating electronic crimes. We stress than any other legislation pertaining to the combat against cybercrimes must take into account the notes mentioned above, which are based on the Amended Basic Law, the Declaration of Independence and the international human rights treaties, and it should take into consideration the vitality of community participation in the preparation and drafting of its provisions. 

 

The Independent Commission for Human Rights (ICHR)

Al-Haq Organization

The Human Rights Council

Women’s Center for Legal Aid and Counselling

Media Development Center/ Birzeit University

The Palestinian Non-Governmental Organization against Domestic Violence against Women (Al-Muntada)

The Palestinian Journalists Syndicate

The Palestinian NGOs Network (PNGO)

The Palestinian Center for Development and Media Freedoms (MADA)

The Coalition for Accountability and Integrity (AMAN)

MUSAWA – The Palestinian Center for the Independence of the Judiciary and the Legal Profession