UAE now banning Virtual Private Network (VPN) access. Are business travelers exempt? According to a few news articles, the UAE is passing a new law with heavy penalties for using a Virtual Private Network (VPN). Another report says: Travelers also come under this law and if caught using any VPNs could face fines as well as jail time. The text of the law will be: Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery, shall be punished by temporary imprisonment and a fine of no less than Dh500,000 [£100,000] and not exceeding Dh2,000,000 [£400,000], or either of these two penalties. Allegedly it's to protect local companies, but also obviously helps penalise those circumventing blocks of say, Whatsapp. However, many people legitimately need to connect to their company VPNs for work. If you're in the UAE for business reasons, are there ways to get an exemption from this law?
This article is from an official Emirates news agency, which confirms the change (Federal Law 12/2016). This is a change to Federal Law 5/2012, replacing Article 9 (the translation into English is odd because the verb phrase goes first). The level of the penalty has increased (minimum 150K → minimum 500K; maximum 500K → 2M). Incarceration is changed from "imprisonment" to "temporary imprisonment", which might mean that previously the term was life. In either case, they have an "and" problem that the punishment is "(temporary) imprisonment and a fine ... or either of these two penalties". Presumably the Arabic version is dispositive. Apart from that, the new version of the law identifies the offender as Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery whereas the old law only said whoever uses a fraudulent computer network protocol address by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery. Thus the meaning of "computer network protocol address" is defined as being equivalent to "IP address". In other words, there is no substantive change beyond the stiffer penalty. There does not seem to any provision allowing one to ask for exceptions. Article 30 of the underlying law strongly suggests that there is no exception and you should not ask. On a separate note, only Etisalat and Du are authorized to provide telecommunications services, pursuant to Federal Decree Law No. 3/2003. This article from August 24, 2015 also links to a number of related articles indicating that everything is illegal.
Yes, it's illegal. 18 USC 1030 (a) (5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [shall be punished as provided in subsection (c) of this section]. &quot;Damage&quot; is defined at (e)(8) to mean &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;. Your proposed attack would certainly cause impairment to the availability of the Stack Exchange system and the data and information which it hosts. Whatever else you may think about the Stack Exchange terms of service, they certainly do not authorize any user or moderator to &quot;destroy the site&quot; in any sense such as you describe. It's not necessary for the TOS to explicitly say &quot;you may not do X&quot;; it's enough that they don't say that you may do it. To use a firewall analogy, it's &quot;default deny&quot;. &quot;Protected computer&quot; is defined in (e)(2) to mean, essentially, any computer that is used in or affects interstate commerce. Which means practically every computer that has ever accessed the Internet, and certainly includes Stack Exchange servers. So your proposed attack would include all the elements of a violation of this section. Such a violation is punishable by up to five years' imprisonment if it causes a loss of more than $5000 (see (4)(A)(i)(I)), which if such an attack were successful, it certainly would. Greater penalties are possible in certain circumstances. Even if the loss does not exceed $5000, or if the attack is merely attempted but without success, it is still punishable by one year imprisonment or a fine ((4)(G)(i)). There is nothing in the terms of service saying you will go to federal jail for destroying stack exchange. Irrelevant. It is not up to Stack Exchange Inc. or its TOS to determine who does or doesn't go to federal prison. Rather, it is up to Congress to determine what conduct deserves such punishment (as they did in 1984 by enacting this law), up to federal law enforcement and prosecutors to investigate and make a case against an alleged violator, and up to the federal courts to determine if the accused is guilty and how they should be punished.
Are my assumptions correct? Yes, this is precisely the sort of thing that would fall under the purview of "the purposes of the legitimate interests pursued by the controller or by a third party", as it fundamentally enables you to deliver the service to the data subject, and its also difficult to argue that "such interests are overridden by the interests or fundamental rights and freedoms of the data subject" given its a fundamental part of delivering the service before any consent can be given. Its not the intention of the GDPR to solely require a direct relationship between the data controller and data subject, its intention is to allow the data subject to control more of the relationship than they did previously - in some cases, that control remains with the data controller, which is why not all of the lawful basis for processing rest on consent. So long as you ensure that the CDN provider has a relevant privacy policy and is identified as a data processor in your privacy and data policy then you are good to go. In my mind, this is similar to the issue of how the data subjects packets get to you from their computer - we aren't including all of the network providers who carry the packets between the data subject and the processor (despite the fact that those providers will have access to much of the same information as the CDN, such as IP address, source, destination etc), even though in many cases we don't know that information (for example which route it will take over the internet). The only difference here is that as the data controller, you know about the CDN and can include it in your policies, so you should.
The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, you hold Thai citizenship, your users are in the USA and the signal transits through the U.K., Belgium, Germany, Canada and Poland then you are subject to the laws of each and every one of them. In addition, if China has reason to believe that the stored files contain matters relating to their citizens then they can take an interest. And so on and so forth ... A country has jurisdiction wherever it wants to have jurisdiction subject to the limits of and its ability to actually enforce its laws. What you are proposing is certainly illegal in many countries and you need to seek professional legal advice - not rely on strangers on the internet.
If the Kenya legislature passes such a law, they can impose such a requirement on Kenyans who want to create such social media groups. Note that this is a license from the Kenyan government, not a copyright or trademark license. In effect, it is a tax on running a social media group, along with various regulations. I have no idea if this bill is at all likely to pass. If it does pass, it might be hard to enforce, as it would probably require cooperation from Facebook and other social media platforms, and the companies which run those platforms are not located in Kenya, and might not cooperate.
I know the OP is asking about America, but its also worth knowing about other countries. This is legal if both subscriber and subscription are within the EU. There was also a court case about this. In another case in 2014 the pub lost, but that seems to have been because the decoder was only licensed for domestic use. These cases were for satellite decoders rather than Internet streaming, but the legal issues would be the same. Both these cases involved British pubs, so obviously this law doesn't apply to them since Brexit.
The issue is more likely that there is no law or regulation allowing the use of dogs to sniff passengers in the US for matters not related to crime, whereas Dubai, a monarchy, has a different political system. In general, you have the constitutional right to move about in the U and the right not to be unreasonably seized, a right which may not exist in some other jurisdictions. That right can be restricted in accordance with law, but there has to be some such law. It is not a crime to have covid, or to travel while infected (it is a crime to carry bombs and drugs on a plane). One area where there is some restriction is where there always has been a restriction, namely entry into the US. There is (was) covid screening at certain airports for flights from certain countries. This directive indicates the airport restrictions, but does not explain what screening will take place. The above DHS site says that &quot;the passenger will be asked about their medical history, current condition, and asked for contact information for local health authorities. Passengers will then be given written guidance about COVID-19 and directed to their final destination, and immediately home-quarantine in accordance with CDC best practices&quot;. It is not clear whether a mandatory temperature check without even reasonable suspicion of a crime would constitute an unreasonable search (body searches are subject to higher standards than property searches, it seems), and constitutional law surrounding searches has emphasized the primacy of privacy in search law, not the fact of physically entering property of the body. Some airlines and airports offer voluntary temperature checking, so it might be possible if someone has a covid-sniffing dog to offer voluntary sniff testing, especially if it is offered by a private concern and does not have the appearance of government mandate (which would require a law).
Most of the question has nothing to do with the law, it's about technical how-to or how-does, which should be asked in Information Security SE. There are two possible legal questions: is it legal to break into a computer system and take a database of passwords, and it is legal to acquire such a database obtained by someone else. As should be known in the US, per 18 USC 1030, breaking into a computer is illegal in the US. Given that, it is extremely unlikely that Google illegally breaks into other computer systems to obtain passwords. The aforementioned law criminalizes accessing computers without authorization, not (just) &quot;taking&quot; stuff from computers without authorization. The law does not criminalize receipt of illegally obtained material. Passwords are not protected by copyright. If Google were to induce someone to break into a computer system to get passwords, that would be legally actionable, however there is no law penalizing innocent receipt of illegally-obtained passwords (insofar as they are not protected by copyright). It is not illegal to access the dark web, at least in the US (probably it is illegal in Saudi Arabia). Using stuff gotten from the dark web can easily be illegal (e.g. logging in to someone's bank account, or forging a passport). There are many services which monitor the dark web and report breaches, which is totally legal.