A virtual private network (VPN) allows an individual or a business to acquire an additional level of security online, and at the same time, one is able to access geographically restricted foreign content. However, whether or not your use of VPN is legal will be determined on your online behaviour.
Technically, VPN enables the user to communicate with shared or public networks in a way as if they were directly connected to such networks. Global corporates with headquarters in several geographies may use VPN to connect to their international locations for added security features. Simply put, a VPN technology enables the creation of a private network while you are using a public connection by hiding your internet protocol (IP), which is your public identity and therefore your online activities are essentially untraceable. The important advantage is that a VPN provides a secure connection and greater privacy than public wi-fi or a secured hotspot.
The use of VPN by individuals and business
Whereas businesses may have several protocols in place to ensure data security, VPNs may still be necessary, especially when remote working and social distancing measures are being adopted by companies globally. Since employees and offices are spread over several geographies, it becomes even more essential for the transportation of data over a secured and encrypted network.
Individual users who are connected to the internet may access VPN remotely from a different location and once they are connected, they may avail the benefits of resources available on the secured and private network as if they were directly connected to the network’s server.
Will you commit an illegal act, if you use VPN?
Article 9 of the Federal Decree-Law No. 5/2012 on Combating Cyber Crimes as amended by Federal Law No. 12/2016 requires the satisfaction of essential ingredients to penalise anyone who has used a VPN service to commit a crime, namely:
A person who circumvents the computer network protocol address by using a false address or a third-party address or by any other means; and commits a crime or prevents its discovery.
Whereas the earlier provision in the Cyber Crimes Law provided for a lesser penalty, however the updated provision has increased the penalty.
Notwithstanding, neither the earlier provision nor the updated one penalises the use of VPN on its own. In order for such use to be considered illegal, the essential test is to determine whether a crime or prevention of the discovery of such a crime was committed. Article 9 provides for a punishment of imprisonment and a fine not less than AED500,000 and not exceeding AED2,000,000.
Does this mean that the use of VPN is legal?
The UAE’s Telecommunications Regulatory Authority has recently stated in public with regards to the use of VPNs confirming that there are no laws prohibiting the use of VPN by businesses, corporate institutions and banks to access their networks, provided such VPN technology is not misused.
The most important question is what would be considered as a misuse and thereby an offence to be punishable under Article 9 of the Cyber Crimes Law. The spirit of the legislation is to prohibit online conduct dangerous to the community. Therefore, if the VPN is being used for legal purposes, the mere use of the VPN itself would not amount to an illegal offence.
Where businesses are operating remotely and employers are providing employees with access to VPNs for business continuity purposes, the employers should still consider precaution when such access is granted to their employees, especially providing a disclaimer to the employees that the use of VPNs is only for business purposes and any misuse shall be at their own risk and consequences.
