Don't use a VPN in United Arab Emirates – unless you wanna risk jail and a $545,000 fine A royal edict from the president of the United Arab Emirates (UAE) may have effectively made it illegal for anyone in the country to use a VPN or secure proxy service. Those caught could face jail time and fines of between 500,000 and 2,000,000 UAE dirham (US$136,130 and $544,521). The change was announced this week by the UAE …
Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery
Sounds as though it's only if you're using it to commit or conceal a crime, that 'new language' doesn't seem to cover use of VPN for legitimate purposes. There's also no mention of VPN in the linked article.
Plus it's not a 'fraudulent' address, it's a perfectly valid address.
Not that I think I'd want to argue the semantics, mind...
"Sounds as though it's only if you're using it to commit or conceal a crime, that 'new language' doesn't seem to cover use of VPN for legitimate purposes."
Surely that's the only interpretation - either that or they've just painted a gigantic target on their backs in the cyber-warfare stakes.
"Sounds as though it's only if you're using it to commit or conceal a crime, that 'new language' doesn't seem to cover use of VPN for legitimate purposes."
Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime ,or preventing its discovery
Yeah it does. Also, no, it doesn't specifically mention VPN but it covers any spoofed or otherwise hidden IP. So that includes Tor.
The question becomes what does the "or preventing its discovery" phrase really mean. Preventing the discovery of "a crime" or preventing the discovery of the "false" or "third-party address".
I guess like many laws it's intentionally written sufficiently vague so as to mean whatever they wish it to mean.
I'd imagine it'll be enforced along the lines of the way alcohol laws are enforced - with complete hypocrisy and as an excuse to collar you if they want to. It's technically illegal to consume alcohol without a personal licence, which you can get as a resident, but not as a visitor. That's right, those drinks you had on holiday in Dubai could have seen you get 70 lashes or a couple of years inside. Yet the hotels all sell booze. And it's not a problem for almost all people almost all of the time, but when it is a problem, it's a big one. Ask that honeymooning husband a couple of years back...
The VPN thing is going to be partly military driven (they listen in on walkie-talkie traffic and I'll bet a quid they could listen to your cellphone calls without problems, seeing as the only two networks are government ones) and partly financial (a penny going to Skype is one not going to Etisalat/Du - and that's a lot of pennies going on OTT).
Most likely you'll still watch your VPN mucky movies and Netflix just fine almost all of the time for almost everyone visiting, but if the police do want a chat with you for any reason it'll become another part of what you'll be fucked for.
"Not that I think I'd want to argue the semantics, mind..."
Difficult to do from a UAE lockup. If you've ever lived in that neck of the woods, you'd know that the local rozzers aren't too worried about semantics.
AC because ... reasons (and, no, I'm not there at the moment, or using a VPN)
If you've ever lived in that neck of the woods, you'd know that the local rozzers aren't too worried about semantics.
I've had various offers to go and work there, but the increase in pay was not enough to convince me to walk into such conditions of employment and environment. I can handle the alcohol and religious aspects, but from what I hear from some expats the local rozzers aren't too bothered with checking facts either, especially if "encouraged" by someone important. As you said, it's rather hard to argue from a lockup.
That being said, given the work I do I have strong reservations about travelling to the US too - it's not quite as bad, but as a foreigner...
Likewise, I've had offers. . . but the risks of working there far outweigh the benefits.
Plus, last time I was offered, it wasn't THAT much of a premium over .us pay, and their government had just announced that they had hired Blackwater (in their current incarnation, think it's "Xe". . . ) to raise an 800-1000 man counter-insurgency force. If they have THAT much of a problem, decided I wanted to be nowhere NEAR that cross-fire. . .
the use of a VPN is not illegal, many insurance companies, and other financial concerns use a VPN address to conduct day to day business. Therefore the identification on what is being used will be a problem. For example if the insurance office in Dubai were to contact head office in say London then it would not be a problem. Also to use a VPN in itself will cause untold aggro for businesses in Dubai that I guess that airlines, insurance companies, banks and the like will be clamouring to get clarification. Either that or Dubai will grind to a halt. Worse, if you use OpenDNS this stops outside sources plugging in to your routing effectively also being a sort of VPN and many commercial and educational sources use that. This is one of the silly laws drafted by a non technical person on a high tech world.
Due to something I did here in France (totally legal, it just pi55ed off FT) and went thru OpenDNS, FT attempted everything in the book to hack my system and block my internet without cutting it off. They failed and went away knowing that the system of OpenDNS worked. They knew because I told them but they did not like the result. (basically the old "dead" sorry live box did not work too well) However, it is not and was not illegal but they knew not what I was doing!
"In the UAE, you are presumed guilty and have to prove your innocence."
A relative has worked in Saudi for many years. You become an extremely careful driver and learn to drive extremely defensively. Why? Because the locals drive like idiots and if they crash into you, it's your fault in the eyes of the cops. If you weren't in their country you'd not have been able to "cause" the accident.
Sounds like they're going after the little people. We do a lot of business in the Middle East. Even our satellite office, in Dubai, uses VPN to connect to the mother ship (though there are alternatives, if need be). All our support is done via support VMs, using vpnc at each end... Real pain in the arse that Skype is largely blocked in the region (unless over VPN).
Similar situation in China, where they don't give a shit about the foreign business traveller, but god forbid anyone local knows much about the outside world.
Due to the civil setup of minority rulers lording it over the plebs, the security services across the Gulf have always been somewhat of the hyperactive/overbearing/enthusiastic style, and mostly inwardly focussed on the local population. Can't have dissidents asking why 50% of the oil profits dissapear into the royal bank account rather than, say improving the schools, can we?
The VoIP ban was put in place once they realised they couldn't tap it. Now technology has moved on, other countries here opened it back up, possibly because while it is very tricky to snoop a vpn-wrapped VoIP channel, an unencrypted one is fair game and it's just the UAE and the Magic Kingdom blocking VoIP now, I believe.
At least living in the region you know you're living in a police state, and know your calls are being monitored and your Internet browsing tracked, rather than say the US where it's done but they say they don't.
The UAE advertises itself as Western and open, but it is actually deeply conservative. If you want to base your business in a the Gulf, go to Bahrain. Of the GCC countries I've lived and worked in, and even with the troubles, it is by far the most 'normal' GCC state with the leglislature based on English law. And it is much cheaper to live and work there than Dubai.
Bootnote - while I was doing a regional network redesign a decade ago, we spoke with Etisalat about extending the company's internal VoIP to our UAE branches. The response was that as it was a business, and as long as we didn't tell anyone, and as long as we kept buying their very expensive IPLCs, we could go ahead... Saudi let us do it officially, which frankly we didn't expect. Naturally we didn't mention that we were connecting it to the global infrastructure with call-out from any country where we had a decent sized office.
...why not stretch your legs and walk around those big terminal buildings? Or do a little shopping, get a coffee, heck-with-it-go-on-stare-at-the-ceiling-until-your-flight-is-called. Just keep your internet-tapping fingers away from the keyboard, lest you (or some service running on it) send some nefarious packets.
Not all VPN systems are good at making sure your DNS queries are also tunnelled, so it may well be getting local look-ups that Google is using to decide on your location.
Proper privacy / anonymity on t'Internet is surprisingly hard to achieve, as the occasional arrest of folk who piss off those in power (or those funding them e.g. the RIAA, etc) find out.
Web servers don't geolocate you. That's not how it works.
Browsers use an API that is located client side (that most humans find attractive to enable to feel less miserable when surfing) which determines the geolocation of the phone by calling its internal local geo- services (A-gps,gps,wifi SSIDs enumeration, etc.). The result if this lookup is then transmitted to the web service.
Consequently, your IP is not involved at all. It's only involved when you explicitly disable all geo services in your phone, and only then, "Google" will use an IP lookup, because there's nothing better.
If activating a VPN really hid your location, millions of VPN users would immediately stop using VPNs because "Pokemon Go" or "Tinder" or "Google Maps" wouldn't work.
Most human beings want to feel anonymous without the hassle of being anonymous.
My company has its regional HQ in Dubai. When out of the office, we use a VPN to get to the corporate network. THere are hundreds if not thousands of companies operating in the Emirates that do this.
All of that VPN communication is now illegal.
I would not be surprised if the day after the first arrest for using a corporate VPN, their is not a flurry of announcements of company relocations. It is already hellishly expensive to base yourself in Dubai. There are plenty of other places in the region that would welcome you with open arms.
I think this could become a 'footgun' moment.
That connection would be going through the STATE-OWNED cellular network. Given the complete lack of proper security / authentication on the 3G/4G network and how trivial it is to MitM on it, I would consider it far less secure than just using a regular connection.
Maybe if the dongle was connected to a secure satellite via a tight-beam antenna, but even then the response coming back down would be known by the state...
WTF. Hopefully 'legitimate' VPN use is OK otherwise it's not great if you need to VPN to an office for network access.
The UAE has had an interesting run with comms. Remember back in 2009 or so I think Etisalat got a company to create an application to intercept emails on Blackberry devices. http://www.theregister.co.uk/2009/07/14/blackberry_snooping/ . Turns out it wasn't too efficient (a thread just polled) which killed battery life and rapidly let people know they had this malware installed!
DOn't get raped in the UAE : getting raped is a crime in the UAE. http://edition.cnn.com/2016/06/12/middleeast/qatar-dutch-woman-rape-report-held/ https://www.theguardian.com/world/2015/oct/26/hundreds-of-women-prosecuted-for-extramarital-sex-in-uae-finds-bbc
http://www.detainedindubai.org/rape-victim-jailed
Once upon a time, most societies saw women as property... Even ours. Unfortunately for women, those societies still suffocated by religiosity of an Abrahamic nature usually still do.
Just to show it isn't a Muslim-only thing, the Bible is quite clear about it.
http://skepticsannotatedbible.com/says_about/rape.html
This post has been deleted by its author
I have a (quite large) list of countries I do not consider for work / holidays on various ethical grounds (can be irritating, lots of historic sites I would love to see are in areas where I refuse to go e.g. a place where women have about as few rights as a pet gerbil)
But I'm happy with the compromise, I would sooner keep my conscience clean than work in the gulf despite the silly money on offer.
Not a place I've ever had any interest in visiting, thankfully. Though a lot of flights use Dubai as a hub. I wonder if the law is also applicable to business passengers who may happen to use VPN briefly in the airport?
If VPN is banned, then surely they must also ban SSL/TLS as it amounts to much the same.
SSTP uses SSL certificates - https://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol - Could the authorities tell that you are VPN's or browsing secure websites?
It's really useful when hotels crack down on VPN outbound connections.
Is Satellite broadband affected by these rules?
Friend of mine goes to Dubai 3+ times a year. Last year one of his coworkers stopped showing up to work. It was declared his suicide of being beaten to death, then jumping out of the high class hotel window was why....
He still goes for the money. No money is worth dying over, or surrounding yourself with insanely violent people.
with it's bLIAR/Blunkett '4 years or your password' legislation.
The obvious bypass is to use a Satphone.
In days of yore, satellite handsets required large, external antennae. One of my units is a Inmarsat Isatphone pro and, like the Globalstar GSP-1700, has a fold-away antennae which makes it less obtrusive when not in use.
Gets past Chinese customs who have hawk-eyes for satphones.
... the point is to be able to label a large part of your population as criminals at will. If you don't like someone, claim they used some sort of VPN that falls under that rule... and you will have destroyed their life.
Heavy fines for things that are not wrong in the public view are one way to suppress your population. China plans to use another system, they create a scoring value for every person in their country. If you are good you get a better value, if you have been at some demonstration or posted something critical on a social network you get a worse value. Those values are then taken to determine if you can get a flat or if you can get a place at the kindergarten for your children.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
