Cybercrimes and the laws to suppress such crimes in Oman: Success and Challenges Dr. Muhammad Masum Billah College of Law, Sultan Qaboos University

 Not defined but listed under Cybercrime Law of Oman  Broad definition: any crime committed involving ICT devices (‘target cybercrimes’ and ‘tool cybercrimes’).  Narrow definition: crimes related to the integrity of data and computer system (mainly ‘target cybercrimes’).  Core cybercrimes: a middle way between the broad and narrow definitions: three broad categories. a) crimes against confidentiality, integrity, and availability of computer data or systems, b) computer-related crimes for financial or personal gain or harm, c) computer content-related crimes. Cybercrime: what is it?

 These three broad categories can be further divided into fourteen common cybercrimes as identified by The UN Office on Drugs and Crime (UNODC). They are:  1) Illegal access (hacking); [s. 3 of Cybercrime Law (CL), s. 52 of Electronic Transaction Law (ETL)]  2) illegal interference (aggravated hacking); [ss. 4, 5, 6 of CL, s. 52 ETL]  3) illegal interception; [s.8 of CL, s. 52 of ETL]  4) production, distribution or possession of computer misuse tools; [s.11 of CL]  5) breach of privacy; [s.16 of CL, s. 52 of ETL]

 6) computer-related fraud or forgery; [ss. 12, 13 of CL]  7) computer-related identity offences; [ss. 12, 13 of CL (fraud provisions)]  8) computer-related copyright and trademark offences; [s.26 of CL]  9) SPAM (unsolicited commercial s);  10) computer-related acts causing personal harm; [ss. 12, 13 of CL]  11) computer-related acts involving racism or xenophobia;  12) computer-related production, distribution or possession of child pornography; [s.14 of CL]  13) computer-related solicitation or ‘grooming’ of children; and  14) computer-related acts in support of terrorism offences. [s.20 of CL]

 Cybercrime Law of Oman directly addressed all these crimes except SPAM and offences related to racism and xenophobia. However, SPAM is usually the entry-point for various other crimes such as identity theft, online fraud, spread of virus or malwares etc. Such crimes can be punished under Cybercrime Law of Oman.  As for the racism and xenophobia, this may be punished under section 19 of Cybercrime Law which criminalizes the publication or possession of any material disturbing public order.

 Cybercrime Law of Oman covers some additional offences such as  - publication of materials affecting public order or religious value (s. 19)  - money laundering (s. 21),  - human trafficking (s. 22),  - trafficking in human organs (s.23),  - trafficking in weapons (s. 24)  - trafficking or promoting illegal drugs (s.25),  - trafficking in antiques and work of arts (s. 27)  [Note: most of these activities are also crimes under the Penal Code and other laws]

 Some of the above crimes are addressed exclusively in Cybercrime Law or additionally in other legislation (e.g. intellectual property rights).  With the widespread use of the ICT devices and Internet, any type of crime may have some computer or internet connection. Therefore, such crimes may involve electronic evidence such as , IP logs, SMS, and call logs in the telephone company’s computer.

 Oman has enacted two new pieces of legislation to specifically address computer and Internet related various issues and crimes. They are:  a) Electronic Transactions Law (Royal Decree No. 69/2008) and  b) Cybercrime Law (Royal Decree No. 12/2011)  In addition, provisions from Penal Code (Royal Decree No. 7/74) and laws related intellectual properties (Industrial Property Law and Copyright Law) can also be used to address some cybercrimes. Omani laws to suppress cybercrimes

 Electronic Transactions Law of Oman was enacted in As its name indicates, it is mainly concerned with various issues related to electronic transactions such as the validity of electronic transactions, electronic contracts and contract related issues, electronic signature, electronic evidence, and privacy and data protection in cyberspace.  However, it does address some of the cybercrimes, in particular, the target cybercrimes in its last chapter, Chapter 9. The chapter has only three sections (sections 52 – 54). Electronic Transaction Law of Oman

 The crimes under section 52 are punishable with imprisonment up to two years and/or fine up to RO5,000, while the crimes under section 53 will attract a maximum imprisonment of one year and/or maximum fine of RO1,500.  Section 54 authorizes the court to confiscate the tools used to commit cybercrimes.

 The crimes under sections 52 and 53 include:  hacking and aggravated hacking,  misuse of someone else’s electronic signature,  disclosure of another person’s deciphering key,  interception and decipher of encrypted information,  issuing electronic certificate or providing false information for any illegal purpose,  unauthorized disclosure of confidential data by a person with authorized access to such data, and  refusal to cooperate with IT authority (e.g., refusal to provide the deciphering key to the IT authority).

 In 2011, Oman adopted Cybercrime Law. It has thirty five sections.  Chapter One (sections 1-2): Definitions & General Provisions  - section 1: ‘cybercrime’,  - section 2: applies to any cybercrime which affects an Omani interest  Chapter Two (sections 3 – 10): Violation of safety, confidentiality of data & electronic information and the informational systems.  - hacking and aggravated hacking, illegal obstruction or interception, and cyberattacks Cybercrime Law of Oman

 s.3: simple hacking,  s.4: aggravating hacking of computer data or personal information,  s.5: aggravated hacking of medical report, diagnosis or treatment,  s. 6: hacking confidential information of govt. or a financial institution,  s.7: cyberattack on a website,  s.8: illegal interception or obstruction of data,  s.9: cyberattacks accompanied by modification of or damage to data,  s.10: denial of service attacks.

 Chapter Three (section 11): Misuse of Information Technology tools  - tools (any device, program, or password) to commit cybercrimes  Chapter Four (sections 12 – 13): Forgery & information Fraud  - fraud through ICT or modification of data causing gain or loss to someone  Chapter Five (sections 14 – 27): Content Crimes  - pornography including child pornography (s.14),  - inducement to prostitution (s.15),

 - violation of privacy or causing defamation (s.16), online gambling (s.17)  - online threat (blackmail) or extortion (s. 18)  - publication of materials affecting public order or religious value (s. 19)  - facilitation or promotion of terrorist activities (s. 20),  - money laundering (s. 21), human trafficking (s. 22),  - trafficking in human organs (s.23), trafficking in weapons (s. 24)  - trafficking or promoting illegal drugs (s.25),  - violation of intellectual property (s.26),  - trafficking in antiques and work of arts (s. 27)

 Chapter Six (section 28): Trespass on the Monetary Cards  - fraudulent making or using a credit or debit card  Chapter Seven (sections 29 – 35): Concluding Provisions  - cybercrime by a CEO, a board of directors, or a manager (s.29)  - attempt to commit a cybercrime (s.30), being an accomplice (s.31)  - confiscation of tools or money obtained in a cybercrime, shutting down a website, deportation of a convicted expatriate (s.32)  - exemption from punishment for cooperation (s.33)  - quasi-judicial power for the IT authority in applying these provisions (s.34)  - punishment under this law can be combined with other punishment (s.35)

 All the core cybercrimes are addressed in Cybercrime Law of Oman.  Any gap in the Cybercrime Law can be usually filled with provisions from other laws. Is Omani law on cybercrime adequate?

 Detecting the crimes  - Sophisticated tools to hide criminal activities  - Temporary nature of certain data (real time data collection needed)  Prosecuting the perpetrators of cybercrimes  - Many cybercrimes have a transnational elements.  - Issue of jurisdiction (territorial, active nationality, protective, passive personality and universal) (first three could be used for cybercrimes under Omani law: Penal Code and article 2 of Cybercrime Law)  - Main problem: to bring a cybercriminal from a foreign country to face trial Challenges in suppressing cybercrimes

 International cooperation  - Current scenario: cluster of groups  1. Arab Convention on Combating Information Technology Offences (2010)  2. Council of Europe Convention on Cybercrime (2001)  3. African Union Convention on Cyber Security and Personal Data Protection (2013)  4. Commonwealth of Independent States Agreement on Cooperation in Combating Offences related to Computer Information (2001)  5. Shanghai Cooperation Organization Agreement on Cooperation in the Field of Information Security (2009) How to overcome such challenges?

 - What needed? Broader cooperation through an International Convention not limited to a region or group of states.

 Oman has come a long way to address the problem of cybercrimes.  There is adequate legislation to prosecute almost any cybercrime no matter how we define the word ‘cybercrime’.  Since many cybercrimes are transnational, there is the need for broader cooperation in collecting evidence and prosecuting cybercriminals. Conclusion