(Beirut) – The Libyan House of Representatives should repeal a 2022 Anti-Cybercrime Law that restricts freedoms of speech, Human Rights Watch said today. The authorities in eastern Libya should immediately release anyone they are holding under this law for peaceful expression.
Eastern-based authorities on February 16, 2023, announced that they would start enforcing an Anti-Cybercrime Law passed by the Libyan House of Representatives in September 2022. Four United Nations experts have criticized the law as infringing the rights of free expression, privacy, and association and said it should be revoked. On February 17, the Libyan authorities arrested a singer and an online content creator, both women, for allegedly violating that law and for violating “honor and public morals.”
“Libyans should have the right to free expression whether online or offline,” said Hanan Salah, associate Middle East and North Africa director at Human Rights Watch. “It is not OK to trample on that right in the name of fighting cybercrime.”
In their March 2022 commentary, the UN experts said the bill under consideration at that time “could have a grave impact on the enjoyment of the right to freedom of opinion and expression and the right to privacy.” The experts are the special rapporteurs on the promotion and protection of the right to freedom of opinion and expression; the rights to freedom of peaceful assembly and of association; the situation of human rights defenders, and the right to privacy.
The eastern-based House of Representatives, which remains the country’s legislative authority since its election in 2014, did not consult civic groups, technologists, or cybercrime experts, and, though a draft version of the law was leaked, no version was formally published before it was adopted.
Two authorities vie for national political legitimacy and control in Libya; The Tripoli-based Government of National Unity (GNU) nominated by delegates in March 2021 after UN-facilitated political talks, and the rival eastern and Sirte-based administration, the Government of National Stability (GNS), nominated by the House of Representatives in March 2022 and allied with the Libyan Arab Armed Forces (LAAF).
The Benghazi-based Interior Ministry under the GNS announced on February 17, 2023, the arrest and detention in Benghazi of Ahlam al-Yamani, a popular folk singer, and Haneen al-Abdali, a blogger and content creator, “in connection with cases against honor and public morals and for violating the Cybercrime Law No. 5 of 2022.” The announcement provided no details about the arrests or the objectionable content.
It said they had been arrested “for insulting the status of the chaste and dignified Libyan woman in our conservative society with acts and behaviors that are foreign to us and offend our customs, traditions and true religion.” There has been no further news about their judicial status.
The law as adopted is close to the draft the UN experts criticized, though with some changes such as length of prison terms and amount of fines.
While there is no global common understanding of what constitutes cybercrime or how to address it, cybercrime can pose significant threats to people’s lives and livelihoods with significant implications for human rights. Yet governments – in the guise of fighting cybercrime – have used vague cybercrime laws to shut down online platforms, imprison bloggers, attack members of marginalized communities, and crush dissent.
Efforts to counter cybercrime often criminalize online expression and conduct protected under international standards, and authorize the use of intrusive tools to investigate crimes without proper safeguards such as judicial oversight and support for independent data protection regulators. These negative trends prompted the UN General Assembly to decry the misuse of vague cybercrime laws to target human rights defenders on two separate occasions.
The key shortcomings of the Libyan Anti-Cybercrime Law include vague and overbroad definitions that could invite prosecution for peaceful expression and punishment with prison terms of up to 15 years and stiff fines. In one example, the law stipulates that the use of the internet and new technologies is lawful only if “public order and morality” are respected.
The law grants the National Information and Security and Safety Authority (NISSA), the body responsible for monitoring and surveillance of information and communication technologies, extensive authority to block access to websites and censor online content without a judicial order in cases of “security requirement or urgency” or when the content in question is counter to “public morality.” The law does not define “public morality” in this context. The agency can also block content if it is deemed to contain “racial or regional slurs and extremist religious or denominational ideologies that undermine the security and stability of the society.” Again, the law does not define these terms.
It provides the agency with far-reaching authority to conduct targeted or mass surveillance in a way that could violate the right to privacy as it includes surveillance of electronic messages between individuals or conversations without a clear description of when this would be permissible. In addition, state institutions including data protection authorities and the judiciary should be fully independent. In Libya, the justice system is weak and partially dysfunctional. Judges, prosecutors, and lawyers are under constant threat of harassment, intimidation, and physical attacks by armed groups and militias, which limits their ability to be neutral adjudicators in cases of executive overreach.
The law allows Libyans to use encryption technologies or related tools only if NISSA gives its explicit consent after obtaining a license. The law also requires the agency’s approval for the production, acquisition, distribution, marketing and exportation and importation of encryption tools or related tools.
It stipulates that anyone who “through the world-wide web or the use of any other electronic means, propagates or publishes information or data threatening public security or peace” in Libya or any other country, could face a lengthy prison term. Phrases such as “threatening public security or peace,” which also appear in other Libyan legislation, are unacceptably broad in any law governing speech acts.
The law also gives Libyan authorities wide-ranging powers of prosecution for acts committed abroad, as long as the reverberations are felt in Libya. This would also include people in countries that would not consider those activities illegal.
Because of its overbroad definitions of offenses, the anti-cybercrime law violates the International Covenant on Civil and Political Rights (ICCPR), ratified by Libya in 1970.
In its General Comment No. 34, the UN Human Rights Committee, the independent expert body that interprets the ICCPR and monitors state compliance with it, states that restrictions on free expression should be constructed and interpreted narrowly, and “may not put in jeopardy the right itself.” It says a government may impose restrictions only if they are prescribed by legislation and meet the standard of being “necessary in a democratic society,” are proportionate and not overbroad. Further, restrictions to protect national security “are permissible only in serious cases of political or military threat to the entire nation,” and that “harassment, intimidation or stigmatization of a person, including arrest, detention, trial or imprisonment for reasons of the opinions they may hold,” violates the covenant.
“The Anti-Cybercrime Law adds to the slew of existing laws in Libya that violate basic rights and freedoms and that need to be reformed, including on freedom of speech, assembly, association and so-called crimes against the state,” Salah said.
