Saudi Arabia’s Battle Against Identity Theft: An Examination of the Saudi Anti-Cybercrime Law 2007

In the digital age, identity theft has become a global concern as cybercriminals employ various methods to acquire personal information. Saudi Arabia, like many countries, has enacted the Anti-Cybercrime Law 2007 to address this issue. In this article, we examine how effective this legislation is in combating identity theft in the Saudi Arabian context.

Defining Identity Theft

Identity theft, a term that has gained considerable attention, is not consistently defined. It can range from using someone’s personal information without consent for unlawful purposes to manipulating an identity to commit fraud. For the purpose of this article, we define identity theft as obtaining someone’s personal information without lawful cause.

Pre-2007 Legal Framework

Before the enactment of the Anti-Cybercrime Law in 2007, identity theft, whether committed physically or through digital means, was not an offense under Saudi law. This omission was addressed with the introduction of Article 4 in the Anti-Cybercrime Law.

The Role of Article 4

Article 4 outlaws attaining bank or credit data, or data pertaining to ownership of securities, without lawful cause. This article makes various identity theft methods, such as phishing, pharming, using malware, and hacking, applicable offenses under the law.

Phishing

Phishing, a social engineering technique that involves sending emails or messages to trick users into disclosing personal information, is a widely used method of identity theft. Saudi Arabia’s Anti-Cybercrime Law covers phishing under Article 4, making it an offense to attain financial data without lawful cause. It is important to note that those who engage in other offenses, such as unauthorized access or data interference, to commit identity theft may also be held liable.

Pharming

Pharming, a sophisticated method of identity theft, involves hacking into a DNS or redirecting users to false websites. This technique often happens without the user’s knowledge. While the attacker needs to first unlawfully gain access to accomplish the attack, securing this unauthorized access makes them liable for prosecution. Articles 93(1) and 93(2) of the Regulation of Telecommunications Law cover unauthorized access, making it a separate offense.

Using Malware

Using malware to acquire personal information is another common identity theft method. Attackers embed links or attachments with malicious software. If a victim clicks on such an attachment, the attacker can install key loggers, allowing them to capture sensitive information. In this case, the attacker is held liable for altering a computer program under Article 5(2) of the Anti-Cybercrime Law.

A Notable Weakness

One significant weakness in the Saudi Arabian legal framework pertains to the lack of criminalization for buying or selling other people’s financial data. While the buyer has committed the actus reus of the offense under Article 4(2), there is currently no explicit provision in the Anti-Cybercrime Law that covers such an action.

Conclusion

The Saudi Anti-Cybercrime Law 2007 shows commendable efforts to address identity theft in the digital landscape. It covers various identity theft methods and holds those responsible accountable. However, the lack of criminalization for buying or selling other people’s financial data remains a notable weakness.

Ongoing efforts to strengthen this legislation in the digital age are crucial to effectively combat identity theft in Saudi Arabia. By addressing this weakness and updating the law to address new threats, Saudi Arabia can continue to provide its citizens with robust cybersecurity protection and safeguards against identity theft.

• Phishing
• Pharming
• Using Malware
• Lack of Criminalization for Buying/Selling Financial Data
• Importance of Strengthening Laws in Digital Age
• Commendable Efforts of the Saudi Anti-Cybercrime Law
• Ongoing Efforts to Combat Identity Theft in Saudi Arabia.