December 17, 2020
Iraqi Council of Representatives
Baghdad-International Zone-Convention Centre
Baghdad, Iraq
December 21, 2020
Re: Draft Law on Combating Cybercrimes pending before the Iraqi Council of Representatives
Dear Members of the Iraqi Council of Representatives,
We, the undersigned organisations, are writing to express our deep concern regarding the provisions contained within the draft Law on Combating Cybercrimes, which was reintroduced before the Iraqi Council of Representatives on November 23, 2020. We are particularly concerned by the draft law’s criminalisation of vaguely defined acts and its use of overly broad terms. Such ambiguous language would enable undue restrictions on the right to freedom of opinion, expression, and the press and does not help prevent cybercrime or ensure effective cybersecurity for Iraqi internet users. As such, we urge you to immediately withdraw or substantially amend the draft legislation to bring it in line with the Iraqi Constitution as well as international human rights law.
While we welcome the removal of life imprisonment, among others, as punishment for acts that are protected by the right to freedom of opinion and expression, and additionally support the removal of criminal sanctions for libel and defamation, we remain concerned that the criminalisation of other overly broad acts remains inscribed within the draft legislation.
Insufficient protection of the right to freedom of expression
The amended draft law introduces article 4, which maintains that “the provisions of this law guarantee the freedom of individuals, civil society institutions, and media institutions to express their opinion and the freedom of objective opposition and constructive criticism within the limits established by the constitution and the laws in force.” While we welcome provisions guaranteeing the right to freedom of expression, we are concerned with the phrase “within the limits established by the constitution and the laws in force”.
Indeed, several laws in force still contain vague provisions that govern the role of the media, among others, and contravene international law. Although the Constitution protects the right to freedom of expression, article 16 of the 1968 Publications Law prohibits insulting the president, prime minister or the government. Moreover, despite the Constitution’s ban on the creation of special courts according to its article 95, in 2010 a special court was established by the Supreme Judicial Council to prosecute journalists.
Furthermore, the draft text still contains a provision stating that the Penal Code and the Code of Criminal Procedures apply to all acts not included within the provisions of the draft law. This is concerning since the speech offenses contained in articles 433, 434, and 435 of the Penal Code in relation to defamation and insult are in breach of international standards on freedom of expression.
In light of these additional restrictions, we recall that the right to freedom of expression may only be restricted if limitations are necessary and proportionate for the protection of “the rights or reputations of others” or for the protection of “national security or of public order (ordre public), or of public health or morals,” according to article 19(3) of the International Covenant on Civil and Political Rights (ICCPR), which has been ratified by Iraq. As additionally stated by the Iraqi Constitution, “the State shall guarantee in a way that does not violate public order and morality […] freedom of expression using all means.”
In this regard, we recall the UN Human Rights Committee’s General Comment 34, which affirms that protecting public order and morality may not be invoked by the state “to suppress or withhold from the public information of legitimate public interest that does not harm national security or to prosecute journalists, researchers, environmental activists, human rights defenders, or others, for having disseminated such information.”
Overly ambiguous terminology
While we welcome the removal of a provision that criminalises “violating religious, moral, familial or social principles and values” through the use of the internet, a computer device or its equivalent, we are concerned that the proposed text contains other overly broad and vague terms that should be removed from the draft legislation.
Indeed, the draft law’s criminalisation of vague and imprecise acts, which may be subject to broad interpretation by the judge, does not meet the criteria of legal clarity and predictability. Under a new suggested article titled, “Crimes violating the confidentiality and integrity of data, electronic information and information systems,” the draft text criminalises entering a website or using a computer “with the intention of obtaining data or information affecting the national security or the national economy of the country,” subjecting such acts to imprisonment for a maximum of ten years in addition to fines. Such a provision could, for example, be used against whistle-blowers, journalists, human rights defenders or other internet users seeking or disseminating information on corruption or human rights abuses, which are in the public interest and are protected under the right to freedom of expression, including the right to seek, receive and impart information.
The use of imprecise and broad terms such as “violating religious, family or social principles” or “affecting the national security or national economy of the country” provides the authorities with excessive discretion that could lead to stifling the right to freedom of expression online. The draft law should not include overly broad terms and should instead establish strict cases or define the proposed offence specifically. The use of ambiguous terminology stands in clear contradiction to article 38(1) of the Iraqi Constitution. As further affirmed by the Human Rights Committee’s General Comment 34, “a norm, to be characterized as a 'law', must be formulated with sufficient precision to enable an individual to regulate his or her conduct accordingly.”
Threats to the right to seek, receive and impart information and ideas of all kinds
The draft text, moreover, contains provisions that violate article 19 (2) of the ICCPR, which protects the right to “seek, receive and impart information and ideas of all kinds.”
Under the first paragraph of a newly introduced article on “Crimes violating the confidentiality and integrity of data, electronic information and information systems,” anyone who “listens to any messages through the internet, computer devices or their equivalent, or takes it or intercepts it without a permit to do so from the competent authority or the owner,” shall be sentenced to imprisonment for a maximum of two years, in addition to fines.
Another suggested amendment introduces an article titled “Crimes of Public Order and Morals,” which, in its third paragraph, imposes a prison sentence of a maximum of ten years against anyone who violates “the sanctity of individuals’ private or family life by taking pictures or publishing news or audio or video recordings related to them, even if they are true.” Such acts may be subject to a penalty of imprisonment for “a period of not less than two years and not exceeding five years,” in addition to fines.
If included in the final draft, the aforementioned provisions would undermine the work of Iraqi activists, journalists and a whole range of internet users. Both provisions would lead to the criminalisation, for example, of criticism of public figures, including politicians or government officials under the pretext of “the sanctity of one’s private or family life.”
We regret that the draft law does not provide any exception with regard to public figures. The UN Human Rights Committee has emphasised that public figures and institutions should tolerate a greater degree of criticism than the general public, and that laws prohibiting insult or disrespect of heads of state or public figures, including those exercising the highest political authority such as heads of state and government, the military and other public institutions, or flags and symbols, are contrary to international standards.
We are concerned that this provision could further allow the Iraqi government to use the protection of the right to privacy as a pretext not to release information that is in the public interest into the public domain. Individuals may also be subjected to prison sentences for merely seeking or sharing information that is critical of governmental or public officials. In many public interest news stories, including crime and health reporting, private family matters can become important topics of public discourse; under this broadly worded term, such reporting could be censored. Without freedom to discuss private issues in public, few civic campaigns will get off the ground. While the State has an obligation to protect the right to privacy and the reputation of all individuals, allegations of abuses of this kind, whether of public figures or private individuals, should be treated as a matter of civil litigation as the use of the criminal law for such means is disproportionate.
Moreover, under the draft law, “applications” fall under the definition of an information system. This means that smartphone apps, such as WhatsApp, Facebook Messenger, and others, would be subject to mass surveillance, leading to further restrictions on freedom of expression.
Additionally, the overly broad language used in this section would likely result in the unintentional consequence of criminalising and chilling information security research. Most security research and vulnerability discovery processes for Information Communications Technology (ICT) systems require researchers to check systems, ranging from using network probes to conducting penetration tests and other steps to uncover vulnerabilities, exploits, and bugs. An overbroad provision that criminalises legitimate efforts at security research would on the contrary result in less secure ICT systems and online platforms in Iraq, making it easier for malicious actors to exploit.
As humans are directly impacted by potential threats in cyberspace, including cyberattacks, due attention should be paid to the human dimension of cybersecurity. This includes direct and indirect harm to individual well-being manifesting itself in a range of ways including loss of life, loss of access to vital services, financial loss, undermining of democratic institutions and processes, suppression of the rights to freedom of expression and freedom of association, and failure to respect the right to be free from arbitrary or unlawful interference with privacy.
We regret that the draft law does not provide sufficient preventive and protective measures that could take into account the complexity of cybercrime.
Investigation and prosecution of cybercrimes
The amendments to the draft law’s “General and final provisions” chapter include the introduction of an article which states that the “Supreme Judicial Council is tasked with establishing specialised courts to hear criminal cases related to cybercrimes.” This provision stands in violation of the aforementioned article 95 of the Constitution, banning the establishment of special or extraordinary courts. We are concerned that the judicial appointment process is not clarified in the draft law, neither are the necessary guarantees for the structural and functional independence of the said court.
In the same chapter, another amendment introduces an article which establishes a National Centre for Digital Evidence. Under this provision, reports issued by the centre would constitute pieces of evidence that can be used by courts in criminal cases related to cybercrime. Nevertheless, the independence of the centre is neither established nor guaranteed under the draft law. The Iraqi authorities must ensure that the National Centre, in order to properly fulfil its duties, be independent of any influence from the executive branch.
While we understand the need to fill the legal vacuum posed by the absence of a specific legislation on cybercrime, we remain deeply concerned about the severe and undue restrictions imposed by the proposed draft Law on Combating Cybercrimes, which would have a serious impact on the exercise of the right to freedom of expression. This current draft text will not serve its stated purpose; that is, protecting Iraqis from cybercrime and cybersecurity vulnerabilities that place them at risk and prevent them from enjoying their rights under the Iraqi Constitution and the ICCPR. Noting that the draft text has been suspended, we urge you to withdraw the draft legislation or substantially amend it in order to bring it in line with the international human rights treaties to which Iraq is a party.
We thank you for your consideration.
Sincerely,
List of Signatories
Access Now
Amnesty International
Article 19
Committee to Protect Journalists
Iraqi Observatory for Human Rights
Iraqi Network for Social Media
MENA Rights Group
Peace and Freedom Organisation
PEN Iraq
Tahrir Institute for Middle East Policy (TIMEP)
