Full Text in English of the Cybercrime Law of 2023

Draft Law No. ( ) of 2023

Cybercrime Law

Article (1): This Law shall be cited as (the Cybercrime Law for the year 2023) and shall come into force after thirty days of publication in the Official Gazette.

Article (2): The following words and phrases wherever mentioned in this Law shall have the meanings ascribed thereto hereunder, unless otherwise indicated by context:

Article (3):

Whoever intentionally accesses a website, information network, information system or information technology means or any part thereof by any means without authorization or in violation or excess of an authorization, shall be punished by imprisonment for a period not less than one week and no more than three months, or by a fine of not less than (300) three hundred Dinars and no more than (600) six hundred Dinars, or both penalties.

Where the access stipulated in paragraph (a) of this Article is for the purpose of cancelling, deleting, destroying, disclosing, posting, re-posting, damaging, blocking, altering, changing, transferring or copying data or information, or breach the confidentiality of data, or encoding, stopping or disabling the operation of information network, information system or information technology or any part thereof, the perpetrator shall be punished by imprisonment for a period not less than three months and no more than one year and a fine of not less than (600) six hundred Dinars and no more than (3000) three thousand Dinars. The penalty shall be imprisonment for a period not less than one year and no more than three years and a fine of not less than (3000) three thousand Dinars and no more than (15000) fifteen thousand Dinars if he achieves the result.

Whoever intentionally accesses a website to change, cancel, destroy or alter its contents, or occupy, encrypt, stop or enable it, or assumes its identity or the identity of its owner, the perpetrator shall be punished by imprisonment for a period not less than three months and a fine of not less than (600) six hundred Dinars and no more than (3000) three thousand Dinars.

Article (4):

Whoever enters or accesses without permission or in violation of or exceeds the permit to an information network, information technology, information system, or any part thereof belonging to ministries, government departments, public official institutions, public, security, financial, or banking institutions, or companies owned or contributed by any of these entities or critical infrastructure and has access to data or information not available to the public and affects the national security, foreign relations of the Kingdom, public safety or the national economy shall be punished by imprisonment for a period not less than six months and no more than three years and a fine of no less than ‎ (2500) two thousand five hundred Dinars and no more than (25000) twenty-five thousand Dinars.

Where the the entry or access stipulated in Paragraph (a) of this Article is to cancel, damage, destroy, modify, alter, transfer, copy, publish, re-publish, breach the confidentiality of, encrypt, delete, add, block, disclose or capture data or information, the perpetrator shall be punished with temporary servitude and a fine of no less than (5000) five thousand Dinars and no more than (25000) twenty five thousand Dinars, and shall be punished by temporary servitude for a period of no less than five years and a fine of (25000) twenty five thousand Dinars if he achieves the result.

Whoever intentionally enters or accesses a website belonging to ministries, government departments, public official institutions, public, security, financial, or banking institutions, or companies owned or contributed by any of these entities or critical infrastructure, with the aim of accessing data or information not available to the public and affects the national security, foreign relations of the Kingdom, public safety or the national economy shall be punished by imprisonment for a period not less than six months and no more than three years and a fine of no less than ‎ (2500) two thousand five hundred Dinars and no more than (25000) twenty five thousand Dinars.

Where the entry or access stipulated in Paragraph (c) of this Article is to cancel, destroy, modify, alter, transport, copy, delete, add, block or encrypt such data or information, the perpetrator shall be punished by temporary servitude and a fine of no less than (5000) five thousand Dinars and no more than (25000) twenty five thousand Dinars, and he shall be punished by temporary servitude for a period of no less than five years and a fine of (25000) twenty five thousand Dinars if he achieves the result.

Attempts to commit crimes stipulated in this Article shall be punished by the penalty prescribed for the same crimes.

Article (5):

Whoever creates an account, page, group, channel, or similar on social media platforms and falsely attributes the same to a natural or legal person shall be punished by imprisonment for a period of no less than three months or a fine of no less than (1500) one thousand five hundred Dinars and no more than (15000) fifteen thousand Dinars, or both penalties.

Whoever fabricates, creates, or designs a program, application, website, e-mail, or the like, and falsely attributes the same to a natural or legal person, shall be punished by imprisonment for a period of no less than six months and a fine of no less than (9000) nine thousand Dinars and no more than (15000) fifteen thousand Dinars.

If the acts committed in accordance with the provisions of Paragraphs (a) and (b) of this Article were falsely attributed to an official body or a public servant, or by impersonating his identity by virtue of his position, the penalty shall not be less than temporary servitude and a fine of no less than (15000) fifteen thousand Dinars and no more than (45000) forty five thousand Dinars.

Article (6):

Whoever intentionally inserts, publishes, or uses a program or program command through an information network or information technology means, or by using an information system to cancel, delete, add, destroy, disclose, damage, block, encrypt, modify, change, transmit, copy, or capture or enabling others to access data or information, obstructing, disrupting, stopping or disabling the functioning of the information system or accessing it, changing, canceling, destroying or modifying its contents or occupying it without authorization or in violation of that authorization or impersonating its identity or the identity of its owner shall be imprisoned for a period of no less than six months and a fine of no less than (2500) two thousand five hundred Dinars and no more than (10000) ten thousand Dinars.

Article (7):

Whoever intentionally and unjustly intercepts the data flow, captures its content, obstructs, alters, deletes, or records that content, whether it is sent through an information network, information technology, information system, or data exchanged within the system or the network itself, shall be punished by imprisonment for a period of not less than six months and a fine of not less than (1500) one thousand five hundred Dinars and not more than (6000) six thousand Dinars.

The perpetrator shall be punished by imprisonment for a period of no less than one year and a fine of no less than (3000) three thousand Dinars and not more than (6000) six thousand Dinars if he discloses, leaks or uses what he obtained through the interception.

If the interception was made against information, data, or any communication of an official authority, the penalty shall be temporary servitude for a period of no less than five years and a fine of no less than (15000) fifteen thousand Dinars and no more than (45000) forty five thousand Dinars.

Article (8):

He shall be punished by imprisonment for a period of no less than three years and a fine of no less than (2500) two thousand five hundred Dinars and no more than (10000) ten thousand Dinars, whoever:

Obtains intentionally and without authorization, or in excess of authorization, through an information network, information technology, or information system, data or information related to electronic payment means, or the implementation of electronic financial or banking transactions, or uses or publishes any of these data.

Fabricates, creates, develops, or designs any information technology means, information program, or program command with the intent of facilitating access to the data stipulated in Clause (1) of this Paragraph.

Accepted dealing with forged, counterfeited or copied cards or other means of electronic payment or data of electronic payment means that were illegally seized, knowing that they are illegal.

If the data and information are used to obtain the money of others or benefit from the services they provide, and the use did not lead to a result, he shall be punished with imprisonment for a period of no less than two years and not more than three years, and a fine of no less than (5000) five thousand Dinars and no more than (15000) fifteen thousand Dinars.

If the actions stipulated in Paragraphs (a) and (b) of this Article result in appropriating for himself or for others money owned by others or benefiting from the services it provides, the penalty shall be imprisonment for a period of three years and a fine of no less than (10000) ten thousand Dinars and no more than (20000) twenty thousand Dinars.

Article (9):

Whoever performs any of the acts stipulated in Articles (3), (5), (6), (7) and (8) of this Law shall be punished if such acts are committed on information system, information technology, website or information network related to money transfer, or the provision of payment, clearing, or settlement services, or any of the banking services provided by banks and financial institutions, shall be punished with temporary servitude for a period of no less than five years and a fine of no less than (25000) twenty five thousand Dinars and no more than (75000) seventy five thousand Dinars.

Article (10):

Whoever unlawfully appropriates for himself or for others any movable or immovable property or a document containing a pledge or discharge or by using any fraudulent method or by adopting a false name or impersonating an incorrect personality through an information network, information system, or any information technology means shall be punished by imprisonment for a period of no less than one year and a fine of no less than (5000) five thousand Dinars and not more than (25000) twenty five thousand Dinars

The attempt to commit the crime stipulated in Paragraph (a) of this Article shall be punished with the penalty prescribed for the crime itself.

Article (11):

Whoever possesses, without authorization, a device, program, or any prepared electronic data, password, or access codes, or submits, produces, distributes, imports, issues, or promotes them, with the aim of committing any of the crimes stipulated in this Law shall be punished with imprisonment for a period of no less than three months or a fine of no less than (2500) two thousand five hundred Dinars and no more than (25000) twenty five thousand Dinars, or both penalties.

Article (12):

Whoever circumvents the IP address by using a fictitious address or an address belonging to a third party, or by any other means, with the intention of committing a crime or preventing its discovery, shall be punished by imprisonment for a period of no less than six months or a fine of no less than (2500) two thousand five hundred Dinars and no more than (25000) twenty five thousand Dinars.

Article (13):

a.

Whoever sends, publishes, prepares, produces, saves, processes, displays, prints, buys, sells, transmits, or promotes pornographic activities or works using an information network, information technology, information system, or website, shall be punished by imprisonment for a period of no less than six months or a fine of no less than (3000) three thousand Dinars and no more than (6000) six thousand Dinars.

Prosecution for the crimes stipulated in Clause (1) of this Paragraph shall be carried out based on the complaint of the victim who has completed eighteen years of age, and the public right lawsuit shall be dropped by the forgiveness of the victim.

If the purpose of the acts stipulated in Clause (1) of this Paragraph is to direct or incite to commit a crime or with the intent of sexual exploitation, they shall be prosecuted without the need for a complaint, and the penalty shall be imprisonment for a period of no less than one year and a fine of no less than (6000) six thousand Dinars and no more than (15000) fifteen thousand Dinars.

b.

The actions stipulated in Clause (1) of Paragraph (a) of this Article shall be punishable by imprisonment for a period of no less than one year or a fine of no less than (6000) six thousand Dinars and no more than (30000) thirty thousand Dinars if this content is sexually stimulating images, recordings, drawings, or others of sexual organs, real or virtual sexual acts, or simulated sexual acts of a juvenile under eighteen years of age, or if the content is related to a person with a mental illness or a disability.

The acts stipulated in Clause (3) of Paragraph (a) of this Article shall be punished by imprisonment for a period of no less than two years and a fine of no less than (9000) nine thousand Dinars and no more than (30000) thirty thousand Dinars if the content is sexually exciting images, recordings, drawings, or others of sexual organs, real or virtual sexual acts, or simulation of a juvenile under eighteen years of age, or is designed to lure him, or the purpose is to direct or incite him to commit a crime, or with the intent to exploit him, or if this content is related to a person with a mental illness or mental disability.

Whoever possesses images, recordings, drawings or other data within the information system or data storage support, or sexually suggestive of real, virtual, or simulated sexual organs or sexual acts of a juvenile under eighteen years of age, or if the content relates to a person with a mental illness or mental disability, shall be punished by imprisonment for a period of no less than six months or a fine of no less than (3000) three thousand Dinars and no more than (6000) six thousand Dinars.

Article (14):

Whoever uses an information network, information technology, information system, or establishes a website to facilitate, promote, incite, assist, or exhort prostitution and debauchery, or seduce another person, or expose public morals, shall be punished with imprisonment for a period of no less than six months and a fine of no less than ‎ (9000) nine thousand Dinars and no more than (15000) fifteen thousand Dinars.

Whoever uses an information network, information technology, information system, or establishes a website for the purposes stipulated in Paragraph (a) of this Article to exploit those who have not completed eighteen years of age or who suffers from a mental illness or a mental disability in prostitution shall be punished by temporary servitude and a fine of no less than (15000) fifteen thousand Dinars and no more than (45000) forty five thousand Dinars.

Article (15):

Whoever intentionally sends, resends, or publishes data or information through an information network, information technology, information system, website, or social media platforms that includes fake e news targeting the national security and community peace, or defames, slanders, or contempt any person shall be imprisoned for a period of not less than three months or a fine of not less than (5000) five thousand Dinars and no more than (20000) twenty thousand Dinars, or both penalties.

The crimes stipulated in Paragraph (a) of this Article shall be prosecuted by the Public Prosecution without the need to file a complaint or claim a personal right if it is directed at one of the authorities in the state, official bodies or public administrations.

Article (16):

Whoever unjustly spreads, ascribes, or attributes to a person, or contributes to it through an information network, information technology, information system, website, or social media platforms, acts that would assassinate his personality shall be punished by imprisonment for a period of no less than three months or a fine of no less than (5000) five thousand Dinars and no more than (20000) twenty thousand Dinars, or both penalties.

Article (17):

Whoever intentionally uses an information network, information technology, information system, website, or social media platform to spread what is likely to stir up racist or sedition, targets social peace, incites hatred, calls for or justifies violence, or insults religions, shall be punished by imprisonment from one year to three years or a fine of no less than (5000) five thousand Dinars and no more than (20000) twenty thousand Dinars, or both penalties.

Article (18):

Any unauthorized person who establishes, manages or runs a website or a social media platform or publishes information on information network or an information technology means to promote, trade, or how to manufacture weapons, ammunition, explosives, or crackers shall be punished by imprisonment for a period of no less than two years and a fine of no less than (10000) ten thousand Dinars and no more than (30000) thirty thousand Dinars.

Article (19):

Whoever uses information network, information technology, information system, website, or social media platform to publish a recording, image, or video of what a person is keen to preserve and not show or conceal from the public with the intent of defamation, offense, or obtaining any benefit from that, even if he obtained such images photos, recordings, or videos legitimately shall be punished under complaint by imprisonment for a period of no less than three months and a fine of no less than (20000) twenty thousand Dinars and no more than (40000) forty thousand Dinars

Whoever uses information network, information technology, information system, website, or social media platform to perform installation, modification, or manipulation of a recording, image, scene, or video of what a person is keen to preserve and not show to the public with the intent of defamation, offense, or obtaining a benefit from that shall be punished by imprisonment for a period of no less than two years and a fine of no less than (25000) twenty five thousand Dinars and no more than (50000) fifty thousand Dinars.

Article (20):

Whoever requests or accepts for himself or for others a gift, promise, or any other benefit, whether inside or outside the Kingdom, to publish or re-publish illegal content or fake news, using information network, information technology, information system, website, or social networking platform shall be punished by imprisonment from one to three years and a fine equivalent to the value of what he requested or accepted in terms of cash or in-kind, provided that it is not less than (5000) five thousand Dinars.

Article (21):

Whoever calls for or promotes a competition, creates, manages or supervises website, publishes information on an information network, information technology, information system, website, social networking platform, or manages an electronic wallet with the aim of receiving or raising funds from the public with the intention of investing, managing, employing or developing them without a license from the competent authorities in the cases that require so, shall be punished by imprisonment for a period of no less than three months and a fine of no less than (5000) five thousand Dinars and no more than (15000) fifteen thousand Dinars, and the court shall rule to refund such funds.

Article (22):

Whoever establishes, manages or supervises a website, or publishes information on an information network, information technology, information system, website, social media platform, or manages an electronic portfolio to call for or promote the collection of donations or charity without a license from the concerned authorities or in violation of this license shall be punished by imprisonment for a period of not less than six months and no more than one year and a fine of no less than (3000) three thousand Dinars and no more than (5000) five thousand Dinars.

Article (23):

Any unauthorized person who publishes by using an information network, information technology, information system, website, social networking platform or by any other means of electronic publication, the names of persons who are in charge of implementing the provisions of the Law, their pictures, information or news, if the publication of that would offend them or endanger their lives, or if the legislation governing their work prohibits that, shall be punished by imprisonment for a period of no less than three months and a fine of no less than (5000) five thousand Dinars and no more than (25000) twenty five thousand Dinars.

Article (24):

The person responsible for the actual management of the website or social media platform, or the person in charge of any account, public page, group, channel, or the like, shall be responsible for the illegal content, and the crimes committed in contrary to the provisions of this Law related to the same content shall be punished in the same manner specified for its perpetrator.

The provisions of Paragraph (a) of this Article shall not apply to ministries, government departments, public official institutions, public institutions, and personal accounts unless it is proven that the owner of the personal account or the person in charge of any of these entities abstained from actually managing the website, social media platform, or account, public page, group, channel or similar to remove the illegal content at the request of the offended person or the competent authority.

Article (25):

Whoever commits any crime not provided for in this Law and is punishable under any legislation using an information network, information technology, information system or website, or participates, interferes or incites to commit it shall be punished with the penalty stipulated in that legislation.

Article (26):

Whoever intentionally participates in, interferes or incites the committal of any of the crimes stipulated in this Law shall be punished with in the same manner specified for its perpetrators.

Article (27):

The penalties stipulated in this Law shall be doubled in the following cases:

If the perpetrator committed his crime by taking advantage of his position, work, or powers granted to him.

If the victims are multiple.

If any of the crimes stipulated in this Law were repeatedly committed.

If the perpetrator committed his crime for the benefit of a foreign country or an illegal organization.

Article (28):

The court may reduce the penalties stipulated in this Law by half if the perpetrator provided information about any of the crimes stipulated in this Law before referring it to the public prosecutor and that would have resulted in the detection of the crime or its perpetrators or arresting them.

Article (29):

The application of the penalties stipulated in this Law does not preclude the imposition of any harsher penalty stipulated in any other law.

Article (30):

Without prejudice to the rights of bona fide third parties, and in the event of conviction, the court shall decide on its own the following:

Confiscation of devices, programs, tools, means, or materials used in committing any of the crimes stipulated in this Law, or the funds obtained therefrom.

Suspending, disabling or blocking the operation of any information system or website used in committing any of the crimes provided for or covered by this Law, in whole or in part, for a period determined by the court.

Deletion of information or data at the expense of the perpetrator.

Closing down the place that was used to commit any of the crimes stipulated in this Law for a period of no less than three months and no more than one year.

Whoever refuses or obstructs the implementation of any of the decisions stipulated in Paragraph (a) of this Article shall be punished by imprisonment for a period of no less than three months and a fine of no less than (3000) three thousand Dinars and no more than (6000) six thousand Dinars.

Article (31):

Subject to the terms and conditions stipulated in the legislation in force and the personal rights of the defendant, the employees of the judicial police, after obtaining permission from the competent public prosecutor or the competent court may:

Enter and inspect any place where evidence indicates that it was used to commit any of the crimes stipulated in this Law.

Inspect and examine the devices, tools, programs, operating systems, an information network, and the means that evidence indicates that they were used to commit any of these crimes.

The employee who conducted the inspection or examination shall organize a report of that and submit it to the public prosecutor or the competent court.

1. Subject to Paragraph (a) of this Article and the rights of bona fide third parties, the judicial police employees may seize devices, tools, programs, operating systems, the information network, and the means used to commit any of the crimes stipulated or covered by this Law, and the funds obtained therefrom, and keep the information and data related to the commission of any of them.
2. Those who are licensed according to the provisions of the Telecommunications Law and who have not participated in any crime stipulated in this Law shall be excluded from the provisions of Clause (1) of this Paragraph.

Article (32):

The competent public prosecutor or to the competent court, when the information system, website, service provider inside or outside the Kingdom, social media platforms, or the person responsible for any account, public page, public group, channel, or the like publishes any materials that violate the provisions of this Law or the legislation in force in the Kingdom shall have the right to issue an order to those in charge of it to take the following:

Remove, block, stop, disable, register or intercept the data path or any publication or content, or prevent access to it, or temporarily ban the user or publisher within the period specified in the decision.

Provide them with all the necessary data or information that helps reveal the truth, including the data of the owner or user of the website or the information system that helps in determining his identity and conducting legal prosecution.

Urgent preservation of data and information necessary to reveal the truth, store it and maintain its integrity.

Maintain confidentiality.

In case those in charge of the information system, social media platform, website, or service provider do not respond or reject the order stipulated in Clause (1) of Paragraph (a) of this Article, or if urgency so requires, the competent public prosecutor or the competent court may with a justified decision to issue an order to the competent authorities to block the information system, website, social media platform or service from the national network, or to block access to the violating content.

Whoever refrains from implementing or violates the orders of the Public Prosecutor or the competent court shall be punished by a fine of no less than (15000) fifteen thousand Dinars and no more than (30000) thirty thousand Dinars.

Article (33):

Cases committed in violation of the provisions of this Law are given the status of urgency, and their sessions are held at least once a week, provided that they are decided within a period not exceeding three months from the date they are received by the court bureau.

Article (34):

The Judicial Council nominates the necessary number of public prosecutors and specialized judges at each court of first instance or conciliation court to consider the crimes stipulated in this Law.

Article (35):

Evidence submitted, derived or extracted from devices, equipment, media, information network, information technology, information system, computer program or service provider shall be proof of evidence before the judicial authorities.

Data and information obtained from official authorities in other countries shall be proof of evidence before the Jordanian judicial authorities.

For the purposes of applying the provisions of this Law, the IP address is considered a means of proof before the judicial authorities.

Whoever conceals, tampered with, or destroys the evidence referred to in this Article or its effects, or obstructs the work of the competent authorities to access such evidence, shall be punished by imprisonment for a period of no less than three months.

Article (36):

The social media platforms outside the Kingdom, which have a number of subscribers exceeding one hundred thousand subscribers in the Kingdom, must establish office for them inside the Kingdom to deal with requests and notifications issued by the judicial and official authorities.

In case the social media platforms outside the Kingdom do not comply with Paragraph (a) of this Article, these platforms shall be notified by the Telecommunications Regulatory Commission of the obligation to comply with the aforementioned within a period not exceeding six months starting from the date of sending such notification.

If the period stipulated in Paragraph (b) of this Article expires and the social media platforms outside the Kingdom do not comply with Paragraph (a) of this Article, the Telecommunications Regulatory Commission may take the following measures, respectively:

Banning advertisements on these platforms in the Kingdom for a period of (60) sixty days.

In case the period stipulated in Clause (1) of this Paragraph expires, reduce the bandwidth of Internet traffic by (25%) on those platforms for a period of (60) sixty days.

In case the period stipulated in Clause (2) of this Paragraph expires, reduce the bandwidth of Internet traffic by (50%) on those platforms for a period of (60) sixty days.

In case the period stipulated in Clause (3) of this Paragraph expires, reduce the bandwidth of Internet traffic by (75%) on those platforms for a period of (60) sixty days.

Article (37):

Public right and personal right lawsuits are filed against the defendant before the competent judicial authority if any of the crimes stipulated in this Law were committed using an information network, information technology, information system, social media platform, website, or any electronic publishing means inside the Kingdom, or committed outside Kingdom and caused damage to any of its interests, citizens or residents, or resulted in the effects of the crime in whole or in part.

Article (38):

The Council of Ministers shall issue the regulations necessary to implement the provisions of this Law.

Article (39):

The Cybercrime Law No. (27) of 2015 shall be repealed.

Article (40):

The Prime Minister and the Ministers shall be responsible for the implementation of the provisions of this Law.

Errata/Updates:

12.8.2023:

• The sentence "[or], one of its members, or any public servant while carrying out his job or because of what he did by virtue of it" was errouneously kept in this tranlsation in Article 15.b. althought removed by the Lower House on July 27, 2023.
• Replaced previous terms with more proper translations, e.g.  'Authorization', 'Place', 'Protocol Address'
• Rephrased Article 18 for clarity.