A leaked copy of Tunisia's new cybercrime draft law [ar] shows signs that the country's major achievements in the field of Internet freedom may soon come undone.
It is unclear whether the text, leaked on July 23, represents a final draft. It is similarly unclear whether the National Constituent Assembly will have sufficient time to debate or adopt the law, as fresh legislative elections are due to be held on October 26. The bill has not been submitted to the Assembly yet, but it has provoked many a raised eyebrow among Tunisian netizens.
Lawyer Kais Berrjab tweeted:
la loi relative à la lutte contre la cyber-criminalité = une arme de destruction massive entre les mains de tout pouvoir en place. #tunisie
— Kaïs Berrjab (@OstezEdgar) July 23, 2014
The anti-cybercrime law = an arm of mass destruction in the hands of any authority in place
What's wrong with the bill?
Vague and broad provisions in the bill could allow for the violation of user rights to privacy and free speech.
Article 24 provides a six-month imprisonment and TND5000 (about USD 2900) fine to anyone who uses “information and communications systems to spread content showing obscene acts and assaulting good morals.” The punishment increases to a three-year jail term if the content in question “incites to immorality”.
Le prochain Belaid ne sera pas assassiné. Il sera emprisonné pour atteinte aux bonnes moeurs. #A2T
— Habib M. Sayah (@Habsolutelyfree) July 23, 2014
The next Belaid [in reference to left-wing politician Chokri Belaid assassinated in 2013] will not be assassinated, but will be imprisoned for assaulting good morals
Article 25 punishes with five years’ imprisonment and a TND 50,000 fine anyone who “deliberately uses an information system to process others’ personal data, to link it to content that is contrary to good morals or feature it in a way which would damage their reputation or prejudice their esteem.” It is easy to imagine how such a law could be used to target bloggers or journalists writing about politicians’ activities.
Chapter four on “public security and national defense measures” gives the Ministries of Defense and Interior unchecked and broad powers to access, collect or intercept communications data without judicial control. Article 30 states the following:
Public authorities tasked with maintaining public order and national defense can exceptionally, and in accordance with the provisions of the fourth chapter of this law, access data stored in public or private databases, collect communications traffic or intercept, copy and store communications content to prevent organized and terrorist crimes…
Under article 31, Ministers of Interior and Defense can authorize in written form access to data related to the identification of users and collection of traffic data.
The draft further provides for heavy sentences for activities related to malicious hacking. Six years in jail and a TND 50,000 fine is the punishment for anyone found guilty of “deliberately impeding the functioning of an information system by introducing, sending, damaging, changing, deleting, canceling or destroying information data.”
The bill's purpose
The bill on Communications and Information Crimes is a project of the previous interim government of Ali Laarayedh. Indeed, former ICT minister Mongi Marzouk affirmed on several occasions that his ministry was working on a draft cybercrime law.
The bill aims to consolidate the legal framework under which the Technical Telecommunications Agency (better known by its acronyms ATT or A2T), operates.
The ATT was created by government decree (decree n° 2013-4506) last November with the task of providing technical support for judicial investigations into “information and communication crimes”. To this date, there is no comprehensive legal text in Tunisia on cybercrime which defines “information and communication crimes.” The bill would presumably seek to fill this legal void.
Last June, ATT general-director Jamel Zenkri told [fr] the local magazine Webdo:
Pratiquement, tout l’arsenal juridique nécessaire est déjà en vigueur. Il reste cependant une loi relative à la cybercriminalité qui sera bientôt élaborée.Cette loi définira exactement les différents crimes de l’Internet, et en fixera les peines. Elle apportera, aussi, plus de précisions quant aux obligations de l’ATT, lesquelles ne sont pas bien fixées. Par exemple, le décret ne détermine pas la période durant laquelle l’ATT doit conserver les données à caractère personnel avant de le détruire.
Practically, all the judicial arsenal necessary [for the ATT to operate] is already into effect. However, there remains the law related to cybercrime which will soon be drafted. This law will define exactly the different Internet crimes and fix the penalties. It will also bring more clarifications regarding ATT's obligations, which are not rightly fixed. For example, the decree does not determine the period during which ATT keeps personal data before destroying them.
Will this be Tunisia's “Patriot Act”?
La #A2T semble venir en douceur sous forme de #PatrioticAct version Tunisienne, tous droits numériques touchés a grande échelle.
— Karim Benabdallah (@karim2k) July 23, 2014
A2T seems to arrive smoothly under the form of the Tunisian version of the [Patriot] act. All digital rights largely affected.
The creation of the Technical Telecommunications Agency and the drafting of a new cybercrime law comes at a difficult time, as the Tunisian armed and security forces face growing security threats by armed Islamist groups affiliated with Al-Qaeda in the Islamic Maghreb. Only last week, these groups waged a deadly attack on the Tunisian armed forces in the mountainous Chaambi area on the border with Algeria, leaving fifteen soldiers dead.
Following the attack, a government crisis cell gave instructions to the Minister of Higher Education and ICTs to “take the necessary precautions to confront social media pages inciting to violence and terrorism,” and officials reiterated their calls to filter and monitor the Internet.
During a press conference on July 17, Interior Minister Lotfi Ben Jeddou stated that the Internet “remains outside the control of the State.” “We are currently working on activating the Technical Telecommunications Agency to track these cells seeking to train and recruit youth via the Internet, and Skype in particular.”
“This agency will also be tasked with censoring and controlling the cyberspace,” the Minister added.
It is worth mentioning that under Decree 4506 the ATT is only tasked with practicing communications surveillance. In no way does the decree state that the ATT should practice filtering of any type of content.
ATT head Jamek Zenkri said that his agency does not seek to practice Internet filtering. “Censorship of the Internet is not the prerogative of the ATT,” he added. In fact, Tunisian law does not establish any entity responsible for Internet filtering. The Tunisian Internet Agency (ATI) was obliged to do so under the regime of Zeine el-Abidine Ben Ali despite this legal void, but the technical apparatus for these activities has since been repurposed.
Progress under threat
Throughout the past three years that followed the ousting of dictator Zeine el Abidine Ben Ali, Tunisia made major strides in the field of human rights on the Internet. Interim authorities showed a strong commitment to ending Internet censorship practices, despite attempts to filter adult content and calls to filter content inciting to terrorism and violence. In June 2012, Tunisia hosted the Freedom Online Conference after joining the coalition of governments “committed to advance Internet freedom” in 2012.
The National Constituent Assembly's adoption of a new constitution banning “prior censorship” and enshrining the rights to access communication networks, personal data protection, and freedom of expression in January this year also represented a significant step forward, making Tunisia a clear leader on these issues in the MENA region.
But the lack of political willingness to scrap repressive Ben Ali era laws, in addition to the authorities’ hasty enactment of laws affecting users without public consultation, put all these strides at risk.
Raed, a member of the Tunisia Pirate party, tweeted [ar]:
لوكان القانون هذا يتعدى الانترنات إلي عرفناها وحبيناها توفى في تونس http://t.co/4eux2ox6vz http://t.co/M0x8Y5d8Rc
— Raed667 (@Raed667) July 23, 2014
If this law is adopted, the internet we have known and loved in Tunisia, will come to an end