As such, the Cybercrimes Decree Law was approved in secret. This approach was entirely inconsistent with the principles of transparency, community participation, and National Policy Agenda 2017-22: Putting Citizens First. According to the latter document, the government stresses its commitment to full partnership with, and openness to, the civil society in public policy and law-making making processes. The Decree Law also stands in stark contrast against international conventions, to which the State of Palestine acceded, and relevant international principles.

The approval of the Cybercrimes Decree Law was met with widespread opposition from civil society organisations. Al-Haq led a lobbying and advocacy campaign to amend and bring the Decree Law into full compliance with international human rights conventions. In this vein, Al-Haq published detailed comments on the Cybercrimes Decree Law. Based on these comments, Al-Haq held multiple meetings with civil society organisations to consolidate their position on the Decree Law. Al-Haq also organised meetings and workshops, which brought together human rights defenders and activists to explain the risks posed by the Cybercrimes Decree Law, and contribute to creating a public opinion that rejects the violations its provisions invoke. On 30 August 2017, Al-Haq sent a legal notice to the Prime Minister, demanding that substantive amendments be made to the Cybercrimes Decree Law to ensure consistency with the provisions of the Palestinian Basic Law and international human rights conventions and standards.

Al-Haq sent two submissions to the United Nations Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, Mr. David Kaye, including Al-Haq’s comments on the Cybercrimes Decree Law and violations of the right to freedom of expression and freedom of the press in Palestine. On 16 August 2017, the Special Rapporteur sent a notice to the Palestinian government, including his comments on the Cybercrimes Decree Law, with a special focus on the overbroad terms and harsh penalties it prescribes. The Special Rapporteur expressed concern about, inter alia, blocking websites and mandating internet service providers to cooperate with security agencies by collecting, storing, and sharing users’ information data for at least three years. In his notice, the Special Rapporteur was also concerned about the reported detention of journalists and activists on charges of insulting persons of high standing; the blocking of almost 30 websites following a decision from the Public Prosecution; the decision to lift parliamentary immunity of PLC members; the order by the Attorney General to confiscate and remove a novel, A Crime in Ramallah, from the local market; among other violations.

On 31 July 2017, under the aegis of the Palestine Liberation Organisation (PLO), Al-Haq participated in dialogue sessions with the government to amend the Cybercrimes Decree Law. Al-Haq is also a member of the Drafting Subcommittee for the Dialogue Committee. However, the dialogue failed because security agencies continued to arrest journalists and activists on grounds of the Cybercrimes Decree Law. Such detentions violate the pledge made by the Attorney General on 12 August 2017 in the presence of Al-Haq and civil society organisations during dialogue sessions. The Attorney General pledged that no citizens would be arrested on the basis of the Cybercrimes Decree Law until relevant deliberations were concluded and the Decree Law was amended in line with international human rights standards. However, at the time, security agencies detained activist Issa Amro, and a number of journalists, including Mamdouh Hamamrah, Amer Abu Arafah, and Tareq Abu Zeid. On 13 September 2017, civil society organisations announced their withdrawal from the Dialogue Committee and the failure of the dialogue sessions. Following that, comments developed by the Drafting Subcommittee and approved by civil society were published.

In light of Al-Haq’s and multiple civil society organisations efforts to amend the Cybercrimes Decree Law, the Ministry of Justice (MoJ) hosted a dialogue session on 24 October 2017 and presented a Draft Law by Decree Amending the Law by Decree on Cybercrimes No. 16 of 2017 (hereinafter Draft Amendment to the Cybercrimes Decree Law). This draft was proposed by the Public Prosecution, the Office of the High Commissioner for Human Rights (OHCHR), and the Legal Advisor to the President. Al-Haq participated in the dialogue session and nominated prominent organisations to examine the proposed draft, at the request of the MoJ. The proposal removed a number of articles in the Cybercrimes Decree Law, particularly those providing overbroad and loosely defined terms providing for criminalisation, including Article 20, used by the authorities to detain a number of journalists. The Draft Amendment to the Cybercrimes Decree Law also mitigated the harsh penalties prescribed for several cybercrimes. However, these amendments did not match the demands of Al-Haq, the Independent Commission for Human Rights (ICHR), the Palestinian Bar Association, and many other civil society organisations – all of whom developed a unified position and provided substantive comments on the proposed amendments.

On 5 November 2017, a meeting was held with the Minister of Justice, following his request. In addition to the Ministry of Foreign Affairs (MoFA), the meeting brought together civil society organisations, including Al-Haq, ICHR, and OHCHR, who presented comments on the Draft Amendment to the Cybercrimes Decree Law. An agreement was made to continue the dialogue and create an enabling environment to come up with amendments, which would be compatible with international conventions and standards. The Palestinian government’s commitment expressed to the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression was also reaffirmed. The government reiterated a pledge made by the President and Prime Minister to amend any provisions of the Cybercrimes Decree Law that are not consistent with the conventions that the State of Palestine acceded to without reservations. Al-Haq also submitted a detailed notice to the Minister of Justice, including substantive comments on the Draft Amendment to the Cybercrimes Decree Law.

Between 19 - 22 November 2017, extensive meetings were held by the Committee on the Alignment of Legislation with International Conventions, to discuss the Draft Amendment to the Cybercrimes Decree Law, which had been established pursuant a decision from the Council of Ministers. Members of the Committee includes ministries, government bodies, the ICHR, as well as representatives from civil society organisations as observers and participants in the Committee’s deliberations, and without having the right to vote. Al-Haq and Defence for Children International  Palestine Section (DCI – Palestine) represented civil society organisations in this debate over the amendments to the Cybercrimes Decree Law.

By the end of the discussions held by the Committee on the Alignment of Legislation with International Conventions, the majority of substantive comments submitted by Al-Haq on behalf of civil society organisations and by the ICHR, and supported by the MoFA, were rejected. Consequently, questions arise about the significance of this Committee, the role it plays, and the continued role of civil society organisations in debating regulations upheld by the official authorities in spite of explicitly contravening the provisions of the Palestinian Basic Law, international conventions, and relevant international standards.

Furthermore, on 4 December 2017, Al-Haq sent a detailed notice to the Minister of Foreign Affairs in his capacity as the Chairman of the National Standing Committee for Following up with the State of Palestine’s Accession to International Conventions and Treaties. The notice included Al-Haq’s substantive comments, agreed upon between civil society organisations, on the Draft Amendment to the Cybercrimes Decree Law. It also provided an overview of outcomes of the dialogue within the Committee on the Alignment of Legislation with International Conventions. Al-Haq demanded that the Minister of Foreign Affairs intervenes to ensure that the Draft Amendment to the Cybercrimes Decree Law is in harmony with international human rights conventions and standards. Al-Haq’s substantive comments covered, inter alia, the need to limit the capacity of officers vested with judicial powers to the police, the closure of juridical persons (e.g. media institutions), the blocking of websites, the search of devices and information technology tools, and communications surveillance.

In its desire to engage public opinion in its comments on the Draft Amendment to the Cybercrimes Decree Law, proposed by the Public Prosecution, OHCHR and the Legal Advisor to the President, and debated within the Committee on the Alignment of Legislation with International Conventions; Al-Haq published its detailed comments on the Draft Amendment to the Cybercrimes Decree Law. The comments highlight the provisions of the Cybercrimes Decree Law which need to be amended to ensure full compliance with the international conventions to which the State of Palestine has acceded and international standards.

Al-Haq’s Comments on the Draft Amendment to the Cybercrimes Decree Law

1. Article 2 of the Draft Amendment to the Cybercrime Decree Law (Article 3 of the original Decree Law) should be amended. Article 2 provides that “[a] specialised unit for cybercrimes shall be established within the police agencies and security forces. It shall enjoy the capacity of officers vested in judicial powers. The Public Prosecution shall supervise the officers tasked with judicial duties, each within the sphere of his jurisdiction.” This Article vests in all security forces, including military agencies, the capacity of officers vested with judicial powers to prosecute cybercrimes. By contrast, Draft Article 3 of the Cybercrimes Decree Law addresses security agencies, which enjoy the capacity of officers tasked with judicial duties. This is an unjustified expansion of power violating a number of rights and freedoms.

Al-Haq reiterates its objection to this provision, even though it addresses security personnel who enjoy the capacity of judicial officers. In the context of enforcing the provisions of the Cybercrimes Decree Law, it results in continued overlapping of tasks and powers between security agencies. Experience has demonstrated that, based on this capacity, a particular security agency would detain a person. Following their release, the person is immediately detained by another security agency on the same charges. This allows for human rights violations, such as arbitrary detention in contravention of Article 9 of the International Covenant on Civil and Police Rights (ICCPR). It also allows further security control over civil life thus politicising human rights and freedoms, relapsing into a police state.

According to Article 21 of the Penal Procedure Law, the Civil Police agency possesses officers with judicial powers. In the sense of the International Convention on Cybercrimes (the Budapest Convention), cybercrime is a civil offence that falls squarely within the jurisdiction of the Civil Police. The Draft Amendment to the Cybercrimes Decree Law provides for international cooperation for combating cybercrimes, requiring the exchange of information, collection of evidence, and extradition. Among all security forces, the agency that is solely authorised to cooperate with the International Criminal Police Organisation (Interpol) is the Civil Police. Under Article 4 of the Interpol Statute of 1956, which the State of Palestine has acceded to, a designated unit of the Civil Police agency can cooperate with Interpol. Article 43 of the Arab Convention on Combating Information Technology Offences (Arab Convention) also provides for the presence of a specialised body dedicated 24 hours/day to ensure the provision of prompt assistance for the purposes of investigation, procedures related to information technology offences, or to gather evidence in electronic form regarding a specific offence. Such a body shall be able to communicate promptly with the corresponding body, namely the Civil Police agency, in any other State Party. Communication is channelled through the Arab Office for Criminal Police, which reports to the Council of Arab Interior Ministers. In addition, the Convention on the Rights of the Child, General Comment 10 of the Committee on the Rights of the Child, and Palestinian Law by Decree No. 4 of 2016 on the Protection of Juveniles, assigns the powers of investigation and collection of evidence in cybercrimes involving children in conflict, with the law to the Civil Police agency only. Considering the aforementioned, Al-Haq stresses that the power to prosecute cybercrimes should be exclusively assigned to the Civil Police agency, which is inherently vested with judicial powers.

A case cannot be made that other security agencies are vested with judicial powers. In fact, the issue concerns the officers tasked with judicial duties “for the purposes of enforcing the Cybercrimes Decree Law.” In accordance with the aforementioned justifications, overlapping legislative tasks and powers need to be eliminated. Al-Haq is of the view that this requirement effectively allows a clearer and more effective role to be played by the Police in civil life. However in relation to cybercrimes, official authorities refused to limit the powers of security agencies vested with judicial powers, instead insisting on continued overlapping tasks and powers under relevant regulations. The end result is a process of arbitrary detentions that violate international conventions.

2. Regarding the right to freedom of expression and freedom of the press, the newly introduced Article 9 of the Draft Amendment to the Cybercrimes Decree Law should be amended. In relevant discussions, civil society organisations proposed a paragraph to be added either to this article or under the introductory section of the Decree Law. The paragraph provides that “[i]t shall be prohibited to construe or interpret any provision under this Law by Decree in a manner that prejudices the freedom of expression and right to privacy, enshrined in the Basic Law, international conventions to which the State of Palestine acceded, and relevant international standards.” This proposed provision is duly relevant to legislative harmonisation with international conventions. It reflects on the role that the Judicial Authority plays in the harmonisation process in cybercrimes cases brought before courts. In its latest decision, the Supreme Constitutional Court confirmed that international conventions are superior to domestic legislation. However, official authorities in the Committee on the Alignment of Legislation with International Conventions refused to include this proposal as an amendment to the Cybercrimes Decree Law.

3. Article 11 of the Draft Amendment to the Cybercrimes Decree Law, which criminalises “hate speech”, should be amended. This article provides that “[e]ach person who creates a website, an application or an electronic account, or disseminates information on the information network or on an information technology tool with the intention of displaying any written words or threatening behaviours which aim to deliberately arouse racial or religious hatred shall be punished by confinement for a period of at least one year”. Article 19, a London-based NGO that works towards promoting freedom of expression and right of access to information, asserts that penalties imposed on hate speech should principally be civil. Although in particularly grave cases, criminal penalties can be imposed. To ensure that hate speech is not confused with the right to freedom of expression, Al-Haq recommends the removal of the phrase “any written words” from the said provision.

Hate speech is an incremental act or a “behavioural pattern”, which implies the meaning of “instigation”, i.e. lobbying and incitement, rather than mere words. To this avail, General Comment 35 of the Committee on the Elimination of Racial Discrimination considers that, to qualify dissemination and incitement as offences punishable by law, the following contextual factors should be taken into account: the content and form of speech (whether the speech is provocative and direct, in what form it is constructed and disseminated, and the style in which it is delivered); the position or status of the speaker; the reach of the speech; and the objectives of the speech (Para. 15). The General Comment also requires that states parties should take into account “the imminent risk or likelihood that the conduct desired or intended by the speaker will result from the [hate] speech in question” (Para. 16). Accordingly, Article 11 should be amended.

4. Article 15 of the Draft Amendment to the Cybercrimes Decree Law (Article 35(2) of the original Decree Law) needs to be amended. The Article provides: “The Attorney General or one of his assistants shall be entitled to issue an order to immediately collect and provide any data, including communication traffic, electronic information, traffic data or content information which he deems necessary for the benefit of the investigations”. This Article excludes the Judicial Authority from surveilling communication traffic and from the order to immediately collect and provide data. The process should be implemented at the request of the Attorney General or one of his assistants as well as a by a decision from the “competent court”. As is prescribed by paragraph 1 of the same Article, the competent judge of the Court of Conciliation shall be entitled to permit the Attorney General or one of his assistants (amended as such during relevant discussions) to monitor communications and telephone conversations in order to search for evidence relating to the offence”. Also, the Public Prosecution is an adversary party to penal cases, which judicial bodies are competent of adjudicating. In both cases, the “gravity of the offence” should be taken into account. This criterion should be applicable to crimes and misdemeanours punishable by confinement for a period of not less than one year. Otherwise, this provision will derogate from the relevant guarantees established by Article 51 of the Penal Procedure Law.

In his 2017 report to the Human Rights Council, the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression asserts that surveillance of telecommunications may be ordered by judicial authorities. In this context, the Criminal Code of Canada requires law enforcement to submit requests for the disclosure of telephone records in criminal investigations to a judge for approval. In Portugal, for example, the authorities must obtain a judicial order to compel relevant bodies (internet service providers) to disclose communications data (Para. 19).

This is further confirmed by the 2014 International Principles on the Application of Human Rights to Communications Surveillance. According to Principle 6, “determinations related to Communications Surveillance must be made by a competent judicial authority that is impartial and independent.” The authority must be separate and independent from the authorities conducting Communications Surveillance. Those whose communications are being surveilled should be notified of a decision authorising Communications Surveillance to enable them to challenge the decision. Delay in notification is only justified when it would seriously jeopardise the purpose for which the Communications Surveillance is authorised, or there is an imminent risk of danger to human life. The user affected is notified as soon as the risk is lifted as determined by a Competent Judicial Authority. States [and internet providers] should publish, at a minimum, cumulative information on the specific number of requests approved and rejected, the requests by the service provider and by the investigating authority, type, and purpose, and the specific number of individuals affected by each.

5. Article 30 of the original Cybercrimes Decree Law should be amended. Without taking into account the “gravity of the offence,” this provision allows that a juridical person (e.g. a media outlet) be dissolved or deprived from initiating their activity for a maximum period of five years. The Article provides that “[i]n the event an offence provided for under this Law by Decree is committed in the name, or on behalf, of a juridical person, it shall be punished by a fine that is not less than five thousand Jordanian dinars and not more than ten thousand Jordanian dinars. The court shall be entitled to render a ruling, depriving the juridical person from initiating its activity for a maximum period of five years, or may decide to dissolve it, without prejudice to the criminal liability of the natural person, who is a subsidiary thereto.” Although dissolution or temporary cessation may be ordered by a court ruling, this penalty is excessively harsh. It affects all employees of the juridical person. According to the provisions of this Article, the penalty can potentially be prescribed for simple misdemeanours. However, it must be associated with “serious crimes”, which requires that it be provided for and inflicted by the said Article.

By contrast, Article 36 of the old Penal Law of 1960 stipulates that [for a corporate body to be suspended or dissolved], a crime or misdemeanour with a penalty of at least two years [in prison] should be committed. Hence, the consequences and economic impacts of this provision on all the people employed by the juridical person must be limited and exclusively applied to serious criminal offences. This should be in line with the principles of necessity and proportionality under Article 19(3) of the ICCPR (Restrictions on the right to freedom of expression) and General Comment 34 of the UN Human Rights Committee on Article 19 of the ICCPR.

6. Articles 33 and 34 of the original Cybercrimes Decree Law should be amended. These provisions give the power to the Public Prosecution or the person it delegates from among the officers tasked with judicial duties to search people, places and information technology tools relevant to an offence without an order from the competent court. The Public Prosecution shall also be entitled to permit the seizure of electronic devices, tools, means, data and information, as well as the confiscation of the information system wholly or any other information technology tool which may help to uncover the truth. This measure can be implemented without the accused or owner of the devices being present when the search and seizure take place. Also, the duration of the search warrant is not identified and the derogation from the safeguards for the accused persons in the investigation phase. In principle, these procedures must be initiated at the request of the Public Prosecution and based on the decision of a competent court. They need to be implemented in the presence of the accused person or owner of the devices, who should sign the search record. The competent court decision should also be limited to a specific period of time in order to maintain safeguards for accused persons in the preliminary investigation phase, and to ensure consistence with relevant international conventions and standards.

This is further confirmed by the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression in his 2013 report (A/HRC/23/40) to the UN Human Rights Council. In the “conclusions and recommendations”, the report states: “Communications surveillance should be regarded [by States] as a highly intrusive act that potentially interferes with the rights to freedom of expression and privacy and threatens the foundations of a democratic society. Legislation must stipulate that State surveillance of communications must only occur under the most exceptional circumstances and exclusively under the supervision of an independent judicial authority. Safeguards must be articulated in the relevant law, the scope and duration of potential measures, the grounds required for ordering them, the authorities competent to authorize, carry out and supervise them, and the kind of remedy provided by the national law.” (Para. 81). This is further reiterated by the 2014 International Principles on the Application of Human Rights to Communications Surveillance. According to Principle 6, “determinations related to Communications Surveillance must be made by a competent judicial authority that is impartial and independent. The authority must be separate and independent from the authorities conducting Communications Surveillance.” It is worth noting that searching information technology tools is included within the definition of communications surveillance under these International Principles.

7. Article 40 of the original Cybercrimes Decree Law should be amended. This Article allows the Sate to block websites within 24 hours on the grounds of records submitted by security agencies to the Attorney General. Security agencies can submit a request to this effect to the Attorney General, whereby websites can be blocked upon the approval of the Conciliation Court judge. This measure is implemented during the course of investigation and within 24 hours, flagrantly derogating from the safeguards for accused persons, in contravention of the Basic Law. It also undermines guarantees of a fair trial as established by Article 14 of the ICCPR. Article 40 also uses overbroad terms to justify the blocking of websites, such as national security, public order, and community safety. This is in violation of Article 19(3) of the ICCPR and the Human Rights Committee’s General Comment 34 on Article 19 of the ICCPR. Accordingly, overbroad terms may not be used because they render meaningless and jeopardise the right to freedom of expression. The Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression highlighted in his notice to the Palestinian government, dated 16 August 2017, the need to amend this Article because it violates the right to freedom of expression. However, the Committee on the Alignment of Legislation with International Conventions insists that it does not contradict international human rights standards.

Against this backdrop, Article 40 must be deleted. It provides: “(1) In the event websites hosted within or outside the State post any statements, figures, images, films, propaganda or other material, which may threaten the national security, community safety, public order or public morals, Investigation and Interdiction Units shall be entitled to submit a report to this effect to the Attorney General or to one of his assistants and request an authorisation to block the website(s) or to block some of their links from being displayed. (2) Within 24 hours, the Attorney General or one of his assistants shall file the request for authorisation to the Conciliation Court, together with a note of his opinion. The court shall render its decision, either accepting or rejecting the request on the same day it is filed.”

In relation to websites and media sites, this provision is also in conflict with Article 27 of the Basic Law, which prescribes that “[n]o warning, suspension, confiscation, cancellation or restriction shall be imposed upon the media” except in pursuance of a judicial ruling. Hence, the said measure cannot be implemented during the course of investigation and within 24 hours without the observance of the guarantees of a fair trial. The said measure also contravenes the Human Rights Council Resolution (A/HRC/32/L.20) of 2016, which “[c]ondemns unequivocally measures to intentionally prevent or disrupt access to or dissemination of information online in violation of international human rights law and calls on all States to refrain from and cease such measures” (Para. 10). The Human Rights Council also considers that access to the internet is a human right.

In addition to compliance with the principles of necessity and proportionality, blocking websites should be approached in line with the proposals on the dissolution of juridical persons (see the Comment on Article 30 above). In other words, a final court decision must be rendered, ensuring the guarantees of a fair trial. As mentioned above, the application of this provision should also be limited to serious crimes. Blocking websites is as grave as dissolving a juridical person; e.g. a media institution. Along this vein, in 2011, a joint declaration on freedom of expression and the Internet was issued by the UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, the Organisation for Security and Co-operation in Europe (OSCE) Representative on Freedom of the Media, the Organisation of American States (OAS) Special Rapporteur on Freedom of Expression, and the African Commission on Human and Peoples’ Rights (ACHPR) Special Rapporteur on Freedom of Expression and Access to Information. Clause 3 of the joint declaration states that: “[m]andatory blocking of entire websites, IP addresses, ports, network protocols or types of uses (such as social networking) is an extreme measure  analogous to banning a newspaper or broadcaster  which can only be justified in accordance with international standards, for example where necessary to protect children against sexual abuse.” In sum, the comments on the procedures and guarantees, which apply to the dissolution of juridical persons, must equally be applicable to the blocking of websites.

8. Article 40 of the original Cybercrimes Decree Law should be deleted. This Article provides that “[e]ach person who commits, takes part, intervenes in or instigates an act, which constitutes an offence under any applicable piece of legislation, using the electronic network or any information technology tool shall be punished by the same penalty which is prescribed for such offence under such legislation.” This provision restores all the “overbroad terms” that were removed in the proposed amendments to the penal provisions. This is particularly the case of crimes against the internal and external security of the State provided under the 1960 Penal Law in force. Overbroad terms also include, inter alia, the crimes of undermining “solemnity of the State” and “weakening the national sentiment”. These and dozens of other overbroad terms prescribed by the Penal Law are inconsistent with Article 19(3) of the ICCPR and General Comment 34 of the Human Rights Committee on Article 19 of the ICCPR. This loosely drafted provision of the Cybercrimes Decree Law criminalises the acts of “libel and slander”, particularly those which target public figures as prescribed by the Penal Law. Such crimes have already been removed from the scope of penal provisions under the Decree Law.

Accordingly, Article 46 should be deleted in view of its explicit violation of international conventions and standards. It is not valid to argue that this Article is based on Article 21 of the Arab Convention on Combating Information Technology Offences, which provides that “[e]very State Party shall commit itself to increasing the punishment for traditional crimes when they are committed by means of information technology.” A regional convention cannot be invoked to violate fundamental international human rights conventions, to which the State of Palestine is party. In his notice to the Palestinian government, the UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression confirmed that all “overbroad terms” under the Decree Law which contradict Article 19(3) of the ICCPR and General Comment 34 should be reviewed.