With rapid technological advances, new crimes have emerged that exploit information systems and social media. Law No. 63 of 2015 on Combating Information Technology Crimes criminalises these acts and imposes severe penalties.
Scope: the law covers any offence committed using a computer, information network, or IT means — whether against individuals, institutions, or the state.
Contents
1) Types of Cybercrime
- System offences: hacking — destruction — disruption — virus introduction.
- Content offences: defamation — spreading false information — online harassment.
- Financial offences: electronic fraud — card-data theft — unlawful transfers.
- Privacy offences: eavesdropping — capturing images — publishing personal data without consent.
- State-security offences: insulting the Emir — disseminating ideas inciting the overthrow of the regime.
2) Unauthorised Access and Hacking
Unauthorised access
- Entering a website or information system without authorisation.
- Exceeding the scope of authorisation granted.
- Remaining in the system after authorisation is revoked.
- Penalty is aggravated if damage results.
Aggravated hacking
- Hacking government or banking systems.
- Obtaining confidential or military data.
- Disrupting vital services (hospitals, electricity).
- Using the hack to commit another crime.
Article 2, Law 63/2015: punishes with imprisonment up to three years and a fine anyone who intentionally — without right — accesses a website or information system.
3) Content Offences
- Online defamation: publishing private information or images with intent to harm via social media.
- False news: broadcasting or publishing false news capable of harming the public interest.
- Insulting the Emir: using IT means in the insult — the penalty is aggravated.
- Obscene content: producing or distributing pornographic content via the network.
Freedom of expression: the law distinguishes between legitimate opinion and aggression — lawful criticism is not punished unless it becomes insult, defamation, or incitement. See threats and blackmail.
4) Cyber-Extortion
- Definition: threatening a person with the release of private information or images via IT means to compel an act or omission.
- Penalty: imprisonment up to three years and a fine — aggravated if the content is sexual or the victim is a minor.
- Attempt: attempted extortion is punishable even if no harm materialises.
- Reporting: the victim should report immediately to the Cybercrime Department at the Ministry of Interior.
5) Financial Cybercrime
- Electronic fraud: seizing others' funds through fraudulent electronic means.
- Payment cards: forging or using electronic payment cards without authorisation.
- Transfers: making unlawful money transfers by hacking banking systems.
- Digital currencies: using digital currencies for money laundering or financing prohibited activities.
Aggravation: the penalty is aggravated if the financial cybercrime is committed against a financial, banking, or government institution. See financial and commercial crimes.
6) Digital Evidence
- Admissibility: Kuwaiti law recognises digital evidence as a means of proof when lawfully obtained.
- Types: server logs — emails — app chat messages — geolocation data.
- Retention: service providers are required to retain user data for a specified period.
- Digital search: the prosecution may issue an order to search devices and electronic accounts.
7) Penalties
Principal penalties
- Imprisonment from months to ten years depending on the offence.
- Fines ranging from KD 1,000 to KD 50,000.
- Confiscation of devices used.
- Closure of the offending website or account.
Aggravating factors
- Offence committed against a minor.
- Exploiting an official position.
- Committed through an organised group.
- Affecting state security or economy.
8) Practical Guidance
For protection
- Use strong, unique passwords for each account.
- Enable two-factor authentication.
- Do not share personal data with strangers.
- Beware of suspicious links and phishing messages.
If you are a victim
- Do not delete conversations or evidence — preserve them.
- Report to the Cybercrime Department immediately.
- Do not comply with the extortionist's demands.
- Consult a specialised lawyer to protect your rights.
Victim of a cybercrime or need a defence in an IT-crime case? Contact Attorney Meshari Obaid Al-Enezi — Yumnaak Law Firm.
