back to article Don't use a VPN in United Arab Emirates – unless you wanna risk jail and a $545,000 fine

A royal edict from the president of the United Arab Emirates (UAE) may have effectively made it illegal for anyone in the country to use a VPN or secure proxy service. Those caught could face jail time and fines of between 500,000 and 2,000,000 UAE dirham (US$136,130 and $544,521). The change was announced this week by the UAE …

  1. SteveK

    Legitimate use of VPN fine?

    Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery

    Sounds as though it's only if you're using it to commit or conceal a crime, that 'new language' doesn't seem to cover use of VPN for legitimate purposes. There's also no mention of VPN in the linked article.

    Plus it's not a 'fraudulent' address, it's a perfectly valid address.

    Not that I think I'd want to argue the semantics, mind...

    1. Afernie

      Re: Legitimate use of VPN fine?

      "Sounds as though it's only if you're using it to commit or conceal a crime, that 'new language' doesn't seem to cover use of VPN for legitimate purposes."

      Surely that's the only interpretation - either that or they've just painted a gigantic target on their backs in the cyber-warfare stakes.

    2. Tommy Pock

      Re: Legitimate use of VPN fine?

      "Sounds as though it's only if you're using it to commit or conceal a crime, that 'new language' doesn't seem to cover use of VPN for legitimate purposes."

      Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime ,or preventing its discovery

      Yeah it does. Also, no, it doesn't specifically mention VPN but it covers any spoofed or otherwise hidden IP. So that includes Tor.

      1. Eddy Ito

        Re: Legitimate use of VPN fine?

        The question becomes what does the "or preventing its discovery" phrase really mean. Preventing the discovery of "a crime" or preventing the discovery of the "false" or "third-party address".

        I guess like many laws it's intentionally written sufficiently vague so as to mean whatever they wish it to mean.

        1. Mark 85

          Re: Legitimate use of VPN fine?

          I think you hit it... They should have clarified "its". Perhaps the translation is faulty but I doubt it.

          1. Roq D. Kasba

            Re: Legitimate use of VPN fine?

            I'd imagine it'll be enforced along the lines of the way alcohol laws are enforced - with complete hypocrisy and as an excuse to collar you if they want to. It's technically illegal to consume alcohol without a personal licence, which you can get as a resident, but not as a visitor. That's right, those drinks you had on holiday in Dubai could have seen you get 70 lashes or a couple of years inside. Yet the hotels all sell booze. And it's not a problem for almost all people almost all of the time, but when it is a problem, it's a big one. Ask that honeymooning husband a couple of years back...

            The VPN thing is going to be partly military driven (they listen in on walkie-talkie traffic and I'll bet a quid they could listen to your cellphone calls without problems, seeing as the only two networks are government ones) and partly financial (a penny going to Skype is one not going to Etisalat/Du - and that's a lot of pennies going on OTT).

            Most likely you'll still watch your VPN mucky movies and Netflix just fine almost all of the time for almost everyone visiting, but if the police do want a chat with you for any reason it'll become another part of what you'll be fucked for.

    3. Anonymous Coward
      Anonymous Coward

      Re: Legitimate use of VPN fine?

      "Not that I think I'd want to argue the semantics, mind..."

      Difficult to do from a UAE lockup. If you've ever lived in that neck of the woods, you'd know that the local rozzers aren't too worried about semantics.

      AC because ... reasons (and, no, I'm not there at the moment, or using a VPN)

      1. Anonymous Coward
        Anonymous Coward

        Re: Legitimate use of VPN fine?

        If you've ever lived in that neck of the woods, you'd know that the local rozzers aren't too worried about semantics.

        I've had various offers to go and work there, but the increase in pay was not enough to convince me to walk into such conditions of employment and environment. I can handle the alcohol and religious aspects, but from what I hear from some expats the local rozzers aren't too bothered with checking facts either, especially if "encouraged" by someone important. As you said, it's rather hard to argue from a lockup.

        That being said, given the work I do I have strong reservations about travelling to the US too - it's not quite as bad, but as a foreigner...

        1. Keith Glass
          Trollface

          Re: Legitimate use of VPN fine?

          Likewise, I've had offers. . . but the risks of working there far outweigh the benefits.

          Plus, last time I was offered, it wasn't THAT much of a premium over .us pay, and their government had just announced that they had hired Blackwater (in their current incarnation, think it's "Xe". . . ) to raise an 800-1000 man counter-insurgency force. If they have THAT much of a problem, decided I wanted to be nowhere NEAR that cross-fire. . .

    4. Sebastian A
      Joke

      Re: Legitimate use of VPN fine?

      You're breaking the law by using a VPN, so using a VPN is breaking the law while using it to break the law while you're connected to a VPN illegally. Simple.

      1. Roger Mew

        Re: Legitimate use of VPN fine?

        the use of a VPN is not illegal, many insurance companies, and other financial concerns use a VPN address to conduct day to day business. Therefore the identification on what is being used will be a problem. For example if the insurance office in Dubai were to contact head office in say London then it would not be a problem. Also to use a VPN in itself will cause untold aggro for businesses in Dubai that I guess that airlines, insurance companies, banks and the like will be clamouring to get clarification. Either that or Dubai will grind to a halt. Worse, if you use OpenDNS this stops outside sources plugging in to your routing effectively also being a sort of VPN and many commercial and educational sources use that. This is one of the silly laws drafted by a non technical person on a high tech world.

        Due to something I did here in France (totally legal, it just pi55ed off FT) and went thru OpenDNS, FT attempted everything in the book to hack my system and block my internet without cutting it off. They failed and went away knowing that the system of OpenDNS worked. They knew because I told them but they did not like the result. (basically the old "dead" sorry live box did not work too well) However, it is not and was not illegal but they knew not what I was doing!

    5. Anonymous Coward
      Anonymous Coward

      Re: Legitimate use of VPN fine?

      In the UAE, you are presumed guilty and have to prove your innocence. So the Law effectively bans the use of encryption, as the State simply making an accusation makes conviction a given.

      Civil Society: It's not for everyone.

      1. John Brown (no body) Silver badge
        Facepalm

        Re: Legitimate use of VPN fine?

        "In the UAE, you are presumed guilty and have to prove your innocence."

        A relative has worked in Saudi for many years. You become an extremely careful driver and learn to drive extremely defensively. Why? Because the locals drive like idiots and if they crash into you, it's your fault in the eyes of the cops. If you weren't in their country you'd not have been able to "cause" the accident.

  2. Anonymous Coward
    Anonymous Coward

    Time to dig out the old dial up modem...

    ...and call your anonymising service directly?

    Slow but sure

    1. John Brown (no body) Silver badge
      Joke

      Re: Time to dig out the old dial up modem...

      They have highly trained police dogs that listen in to dial-up and will bark if they hear the "wrong" type of packets passing by.

      1. Anonymous Coward
        Anonymous Coward

        Re: Time to dig out the old dial up modem...

        They have highly trained police dogs

        Even if they're a bit heavy handed, that's no way to talk about the local plods..

        :)

  3. Anonymous Coward
    Unhappy

    It's ok....nothing to see...

    ...no human rights abuses...no oppression of it's people...nothing to see. Move along.

    Now, where did I put the papers on the arms deal I'm working on.

    1. Anonymous Coward
      Childcatcher

      Re: It's ok....nothing to see...

      > Now, where did I put the papers on the arms deal I'm working on.

      The PM just took them. She hurriedly scribbled something on the back of them while reading this article, then daeshed out...

  4. Anonymous Coward
    Anonymous Coward

    Let's see if it affects business

    Sounds like they're going after the little people. We do a lot of business in the Middle East. Even our satellite office, in Dubai, uses VPN to connect to the mother ship (though there are alternatives, if need be). All our support is done via support VMs, using vpnc at each end... Real pain in the arse that Skype is largely blocked in the region (unless over VPN).

    Similar situation in China, where they don't give a shit about the foreign business traveller, but god forbid anyone local knows much about the outside world.

    1. Mark 85

      Re: Let's see if it affects business

      The odds are it's about terrorism. Probably won't get used much if at all against corporates and contractors. The whole country seems to be contractors as I guess the locals have so much money they hire someone else to do the work.

      1. Anonymous Coward
        Big Brother

        Re: Let's see if it affects business

        It's never really about "because terrorists."

        It's always about controlling dissent.

        ...and the difference between those two things is profoundly important.

      2. Anonymous Coward
        Anonymous Coward

        Re: Let's see if it affects business

        Due to the civil setup of minority rulers lording it over the plebs, the security services across the Gulf have always been somewhat of the hyperactive/overbearing/enthusiastic style, and mostly inwardly focussed on the local population. Can't have dissidents asking why 50% of the oil profits dissapear into the royal bank account rather than, say improving the schools, can we?

        The VoIP ban was put in place once they realised they couldn't tap it. Now technology has moved on, other countries here opened it back up, possibly because while it is very tricky to snoop a vpn-wrapped VoIP channel, an unencrypted one is fair game and it's just the UAE and the Magic Kingdom blocking VoIP now, I believe.

        At least living in the region you know you're living in a police state, and know your calls are being monitored and your Internet browsing tracked, rather than say the US where it's done but they say they don't.

        The UAE advertises itself as Western and open, but it is actually deeply conservative. If you want to base your business in a the Gulf, go to Bahrain. Of the GCC countries I've lived and worked in, and even with the troubles, it is by far the most 'normal' GCC state with the leglislature based on English law. And it is much cheaper to live and work there than Dubai.

        Bootnote - while I was doing a regional network redesign a decade ago, we spoke with Etisalat about extending the company's internal VoIP to our UAE branches. The response was that as it was a business, and as long as we didn't tell anyone, and as long as we kept buying their very expensive IPLCs, we could go ahead... Saudi let us do it officially, which frankly we didn't expect. Naturally we didn't mention that we were connecting it to the global infrastructure with call-out from any country where we had a decent sized office.

        1. allthecoolshortnamesweretaken

          Re: Let's see if it affects business

          " ... it's just the UAE and the Magic Kingdom blocking VoIP now, I believe.

          Does that mean I can't use Skype in Disneyland?

  5. Anonymous Coward
    Anonymous Coward

    This is the same country...

    That looks to Tourism to save it after the Oil runs out. As a model, it just doesn't work. Especially if you consider the lethal rising temperatures. Roll on UAE 2050!

    1. Eddy Ito
      Joke

      Re: This is the same country...

      Lethal rising temperatures? That does explain why it seemed the seats on the plane resembled handbaskets on my last trip there.

    2. Roq D. Kasba

      Re: This is the same country...

      Dubai has tourism and money laundering, but no oil to speak of. Then Abu has a shedload of oil.

  6. Anonymous Coward
    Anonymous Coward

    Next time you change planes in Dubai...

    ...why not stretch your legs and walk around those big terminal buildings? Or do a little shopping, get a coffee, heck-with-it-go-on-stare-at-the-ceiling-until-your-flight-is-called. Just keep your internet-tapping fingers away from the keyboard, lest you (or some service running on it) send some nefarious packets.

    1. Anonymous Coward
      Anonymous Coward

      Re: Next time you change planes in Dubai...

      Hmmm, don't they not call flights there?

      eg you have to get to the correct gate, at the time right, using your own initiative

  7. Sampler

    SSL

    As you're encrypting data between source and destination, you could feasibly be using it to mask a crime, so would this fall under it?

    1. Dadmin

      Re: SSL

      Good point! Also, don't encrypt files, that means you're a criminal. Natch.

      They need to go back to the abacus. Then, you can see the crimes right there in the beads. Shake it, and you're nicked, mate. ;)

    2. Version 1.0 Silver badge

      Re: SSL

      Using SSL doesn't count - it's easily broken.

  8. Efros

    Interesting

    When I use my VPN in incognito mode the home page is Google.ae, the VPN is supposed to be UK based. No clue what's going on there.

    1. Paul Crawford Silver badge

      Re: Interesting

      Not all VPN systems are good at making sure your DNS queries are also tunnelled, so it may well be getting local look-ups that Google is using to decide on your location.

      Proper privacy / anonymity on t'Internet is surprisingly hard to achieve, as the occasional arrest of folk who piss off those in power (or those funding them e.g. the RIAA, etc) find out.

    2. Magani
      Unhappy

      Re: Interesting

      "When I use my VPN in incognito mode the home page is Google.ae..."

      You might want to rethink your VPN provider.

    3. Version 1.0 Silver badge

      Re: Interesting

      It's "Alphabet" now ... the VPN goes to .ae because it's the first name in the TLD list and becomes the default.

    4. uqrxur

      Re: Interesting

      Web servers don't geolocate you. That's not how it works.

      Browsers use an API that is located client side (that most humans find attractive to enable to feel less miserable when surfing) which determines the geolocation of the phone by calling its internal local geo- services (A-gps,gps,wifi SSIDs enumeration, etc.). The result if this lookup is then transmitted to the web service.

      Consequently, your IP is not involved at all. It's only involved when you explicitly disable all geo services in your phone, and only then, "Google" will use an IP lookup, because there's nothing better.

      If activating a VPN really hid your location, millions of VPN users would immediately stop using VPNs because "Pokemon Go" or "Tinder" or "Google Maps" wouldn't work.

      Most human beings want to feel anonymous without the hassle of being anonymous.

  9. John Tserkezis

    Says it all.

    "Less than 15 per cent of the desert kingdom's inhabitants are locals, with the rest of the population made up of expatriates"

    The place is so fucked up, that not even the locals want to live there.

    'Nuff said.

  10. Winkypop Silver badge
    FAIL

    His Highness Sheikh Rattle and Roll

    Is advised by very silly men (definitely not women)

  11. Anonymous Coward
    Anonymous Coward

    Great way to attract business (NOT)

    My company has its regional HQ in Dubai. When out of the office, we use a VPN to get to the corporate network. THere are hundreds if not thousands of companies operating in the Emirates that do this.

    All of that VPN communication is now illegal.

    I would not be surprised if the day after the first arrest for using a corporate VPN, their is not a flurry of announcements of company relocations. It is already hellishly expensive to base yourself in Dubai. There are plenty of other places in the region that would welcome you with open arms.

    I think this could become a 'footgun' moment.

  12. Baldy50

    Internet dongle

    It may have DL caps and slower but your not connecting to the Internet through any of their servers.

    1. Crazy Operations Guy

      Re: Internet dongle

      That connection would be going through the STATE-OWNED cellular network. Given the complete lack of proper security / authentication on the 3G/4G network and how trivial it is to MitM on it, I would consider it far less secure than just using a regular connection.

      Maybe if the dongle was connected to a secure satellite via a tight-beam antenna, but even then the response coming back down would be known by the state...

  13. Ynox

    WTF. Hopefully 'legitimate' VPN use is OK otherwise it's not great if you need to VPN to an office for network access.

    The UAE has had an interesting run with comms. Remember back in 2009 or so I think Etisalat got a company to create an application to intercept emails on Blackberry devices. http://www.theregister.co.uk/2009/07/14/blackberry_snooping/ . Turns out it wasn't too efficient (a thread just polled) which killed battery life and rapidly let people know they had this malware installed!

  14. Anonymous Coward
    Anonymous Coward

    DOn't get raped in the UAE

    DOn't get raped in the UAE : getting raped is a crime in the UAE. http://edition.cnn.com/2016/06/12/middleeast/qatar-dutch-woman-rape-report-held/ https://www.theguardian.com/world/2015/oct/26/hundreds-of-women-prosecuted-for-extramarital-sex-in-uae-finds-bbc

    http://www.detainedindubai.org/rape-victim-jailed

    1. smartypants

      Don't blame the UAE

      Once upon a time, most societies saw women as property... Even ours. Unfortunately for women, those societies still suffocated by religiosity of an Abrahamic nature usually still do.

      Just to show it isn't a Muslim-only thing, the Bible is quite clear about it.

      http://skepticsannotatedbible.com/says_about/rape.html

    2. Crazy Operations Guy

      Re: DOn't get raped in the UAE

      Not just in the Middle East, women are treated horribly around the world, not just the Middle East... In over half the US, it is perfectly legal to rape your wife, same story in large chunks of Europe and all of the remaining continents.

  15. This post has been deleted by its author

    1. tiggity Silver badge

      Re: Don't like the idea of slave labour? Don't go on holiday to the UAE

      I have a (quite large) list of countries I do not consider for work / holidays on various ethical grounds (can be irritating, lots of historic sites I would love to see are in areas where I refuse to go e.g. a place where women have about as few rights as a pet gerbil)

      But I'm happy with the compromise, I would sooner keep my conscience clean than work in the gulf despite the silly money on offer.

      1. uqrxur

        Re: Don't like the idea of slave labour? Don't go on holiday to the UAE

        Same here, I have a list of countries with ethics I can't accept for freelancing gigs. Ironically, the US have entered that list three years ago, after I realized what goes under "federal tax".

  16. Anonymous Coward
    Anonymous Coward

    Not a place I've ever had any interest in visiting, thankfully. Though a lot of flights use Dubai as a hub. I wonder if the law is also applicable to business passengers who may happen to use VPN briefly in the airport?

    If VPN is banned, then surely they must also ban SSL/TLS as it amounts to much the same.

  17. CrashM

    SSL?

    There is no mention of make encryption illegal, therefore using SSL should be fine, and can you tell the difference between HTTPS and SSTP (SSL VPN).

  18. Paul IT
    Big Brother

    SSTP anyone?

    SSTP uses SSL certificates - https://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol - Could the authorities tell that you are VPN's or browsing secure websites?

    It's really useful when hotels crack down on VPN outbound connections.

    Is Satellite broadband affected by these rules?

  19. Nathan 13

    Not somewhere

    I would ever choose to go, but some of these countries really do treat their citizens (especially female ones) like pieces of shit dont they lol

  20. Velv
    Big Brother

    So glad I live in the UK where we don't have leaders putting laws in place to make sure the state has access to everyone's communications...

    </sarcasm>

  21. Anonymous South African Coward Bronze badge
    Trollface

    Brainwave - send the Boss over to the UAE and have his laptop connect to beeg.com via VPN every hour for 20 minutes per session, downloading *.* during each session...

  22. ma1010
    Unhappy

    Don't worry - we're next

    You mean a government has outlawed encryption they can't penetrate? Who'dathoughtit?

    We're (all of us, world+dog) next. Gotta have toll booths, checkpoints and plenty of other government obfuscation on that "Information Superhighway." It's for your protection!

  23. Mahhn

    Accused don't often get trials

    Friend of mine goes to Dubai 3+ times a year. Last year one of his coworkers stopped showing up to work. It was declared his suicide of being beaten to death, then jumping out of the high class hotel window was why....

    He still goes for the money. No money is worth dying over, or surrounding yourself with insanely violent people.

  24. JaitcH
    Thumb Up

    Dubai ... beginning to look like Blighty

    with it's bLIAR/Blunkett '4 years or your password' legislation.

    The obvious bypass is to use a Satphone.

    In days of yore, satellite handsets required large, external antennae. One of my units is a Inmarsat Isatphone pro and, like the Globalstar GSP-1700, has a fold-away antennae which makes it less obtrusive when not in use.

    Gets past Chinese customs who have hawk-eyes for satphones.

    1. Christian Berger

      Re: Dubai ... beginning to look like Blighty

      Well obviously even with a satphone those rules would apply to you. And as far as I know at least some Iridium satphones send their GPS-Position data in clear when they establish a phone call.

  25. Christian Berger

    The point is not to ban VPNs...

    ... the point is to be able to label a large part of your population as criminals at will. If you don't like someone, claim they used some sort of VPN that falls under that rule... and you will have destroyed their life.

    Heavy fines for things that are not wrong in the public view are one way to suppress your population. China plans to use another system, they create a scoring value for every person in their country. If you are good you get a better value, if you have been at some demonstration or posted something critical on a social network you get a worse value. Those values are then taken to determine if you can get a flat or if you can get a place at the kindergarten for your children.

  26. raving angry loony

    About right...

    The terms "technologically illiterate", "UAE", and "guilty until proven guilty" sounds exactly like the UAE I worked in all those years ago. I see they haven't changed much. I see I'll still never be going back. Nothing is worth that kind of bullshit.

  27. Anonymous Coward
    Anonymous Coward

    Invisible man

    The invisible man has just walked past me and I did not see him.!

    What a ludicrous situation. If someone is using a VPN and gets discovered, it is not that secure, so couldn't expect to fit the punishment.

    Who is fooling who.?

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like