When Iranian missile and drone attacks on the United Arab Emirates began earlier this year, cybercrime laws also came into focus as the conflict played out in the sky—and online. Authorities announced arrests linked to misleading videos, AI-generated clips, illegal filming, and the spread of misinformation.
For many residents, the reaction was one of surprise: How could a screenshot, forwarded video, or social media post become a criminal matter? The answer lies in legal frameworks that were already in place.
During ordinary times, many forms of online misconduct can carry penalties under the UAE’s cybercrime laws. But during crises, emergencies, or disasters, the stakes rise considerably. UAE law Article 52 criminalizes using the internet to spread false news, misleading rumors, or content contrary to official announcements, as well as material that could disturb public peace, spread panic, or harm public order.
In normal circumstances, the minimum penalty is one year in prison and a fine of 100,000 UAE dirhams. During epidemics, crises, emergencies, or disasters, those figures double to a minimum of two years and 200,000 UAE dirhams. The recent conflict did not create a new law. It triggered stricter penalties under one that already existed.
Legal consultant Ahmed Elnaggar, managing partner of Elnaggar & Partners, says the rationale for arrests related to online activity is consistent with that framework. “Content shared during emergencies is assessed not only for its accuracy, but also for its potential impact on stability, security, and public perception,” he says. “What might appear as commentary or documentation can, in such contexts, be interpreted as harmful or unlawful communication.”
Authorities ordered the arrest of defendants accused of publishing misleading videos, including AI-generated clips, and circulating material deemed harmful to public order and security. Abu Dhabi Police also announced the arrest of 375 people for illegally photographing designated locations and spreading misinformation online.
From a legal standpoint, Elnaggar says, all content from unverified or unofficial sources during a conflict carries serious risk. “Only content issued by official, approved UAE public authorities should be treated as safe to share,” he says.
Long before the recent conflict, the UAE’s cybercrime framework has always extended beyond hacking, stolen passwords, and online fraud. Under Federal Decree-Law No. 34 of 2021, it also covers privacy violations, false information, misuse of digital platforms, online defamation, and other forms of harmful online conduct.
For residents, tourists, creators, and anyone carrying a smartphone, the practical lesson is simple: Some common online habits can have legal implications.
When a Screenshot Stops Being Harmless
Screenshots have become a language of their own. They document conversations, settle arguments, provide evidence in disputes, and occasionally serve no purpose beyond making a group chat briefly more interesting. But once a private exchange is copied and shared, it may no longer be treated as private—and intent is not always the only factor considered under the law.
Elnaggar puts it plainly: “The law does not distinguish between formal publication and informal sharing when the outcome is the same.”
A screenshot becomes legally problematic, Elnaggar says, when it exposes private communications without consent, distorts the context of what was said, or contributes to reputational harm. “The law assumes responsibility at the point of disclosure,” Elnaggar says. “Even if content was originally shared in confidence between two parties, redistributing it can transform a private exchange into a regulated media act with legal consequences.”
Many users assume intent is the deciding factor. The law, broadly speaking, does not.
Forwarding Still Counts
A related misconception is that only the person who created problematic content carries any risk. That the person who wrote the message, filmed the video, started the rumor—not the person who simply passed it on—is at fault. That doesn’t hold up under UAE law.
The legal definition of media activity is broad enough to capture not only original creators but anyone who participates in the circulation of content. “Publishing and republishing are treated in the same way. Liability is attached to the act of publication itself,” Elnaggar says.
The law states explicitly that the person responsible for a media activity bears responsibility for what is published—and that this applies, Elnaggar says, “whether the activity is permitted or not.”
Forwarding a message in a private group, in other words, is not a neutral act. “From a legal perspective,” Elnaggar says, “forwarding is a conscious step in the chain of dissemination, and therefore subject to the same scrutiny as original posting.”
This is particularly relevant in a region where WhatsApp, Telegram, Snapchat, Instagram, and X are central to how information moves. During fast-moving events, rumors often travel faster than official statements.
There is a further point that surprises most people: The legal risk does not begin at the moment of sharing. During armed conflict, filming or photographing security-related activity—even without posting it anywhere—moves outside the cybercrime law and into the territory of the penal code, which carries significantly harsher penalties. For foreign nationals, that can include deportation. In some cases, Elnaggar says, the consequences can be more severe.
In other words: During a conflict, the safest phone is one you don’t point at the sky.
This story originally appeared on WIRED Middle East.
