Middlesex University Research Repository An open access repository of Middlesex University research http://eprints.mdx.ac.uk Al Antali, Waleid (2018) Strengthening e-crime legislation in the UAE: learning lessons from the UK and the EU. PhD thesis, Middlesex University. [Thesis] Final accepted version (with author’s formatting) This version is available at: https://eprints.mdx.ac.uk/25909/ Copyright: Middlesex University Research Repository makes the University’s research available electronically. Copyright and moral rights to this work are retained by the author and/or other copyright owners unless otherwise stated. The work is supplied on the understanding that any use for commercial gain is strictly forbidden. A copy may be downloaded for personal, non-commercial, research or study without prior permission and without charge. Works, including theses and research projects, may not be reproduced in any format or medium, or extensive quotations taken from them, or their content changed in any way, without first obtaining permission in writing from the copyright holder(s). They may not be sold or exploited commercially in any format or medium without the prior written permission of the copyright holder(s). Full bibliographic details must be given when referring to, or quoting from full items including the author’s name, the title of the work, publication details where relevant (place, publisher, date), pag- ination, and for theses or dissertations the awarding institution, the degree type awarded, and the date of the award. If you believe that any material held in the repository infringes copyright law, please contact the Repository Team at Middlesex University via the following email address: [email protected] The item will be removed from the repository while any claim is being investigated. See also repository copyright: re-use policy: http://eprints.mdx.ac.uk/policies.html#copy Strengthening e-crime legislation in the UAE: Learning lessons from the UK and the EU Waleid Al Antali M00474208 Submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy Middlesex University School of Law January 2018 1 Dedication My family are the most important persons to me and I dedicate this research to them. 2 Acknowledgements First and foremost, I would like to express my sincere gratitude to my supervisors: Professor Julia Davidson, Dr Elena Martellozzo and Renu Barton-Hanson, Associate Professor of Law. I feel honoured to have been their PhD student. I appreciate all the time, helpful suggestions and ideas which have made my studies extremely stimulating. The continuous support, motivation and immense knowledge of my supervisors and dedication to their role was unparalleled. Much gratitude for the most helpful discussions. The guidance and mentoring I received from my supervisors was truly outstanding. Thank you to Middlesex University London which provided me with a fantastic academic environment for my research. I have the fondest memories of my research time. My time at Middlesex University also allowed me to make wonderful new friends. Additionally, I am immensely appreciative to my expert research interviewees, who have shared their knowledge and expertise with me. Thank you for agreeing to participate in my research. Your contributions were invaluable and formed the foundation of my research. I am indebted to His Highness Sheikh Khalifa bin Zayed Al Nahyan. Completion of this PhD would not have been possible without the excellent education I received, as well as the support which furthered my academic pursuits. I would also like to take the 3 opportunity to acknowledge that I was very privileged to be taught by many excellent teachers. I am deeply grateful to my family and friends for surrounding me with the love and encouragement I needed during this challenging period of my life. I would especially like to thank my dear sister Ibtissam and my loyal friend Mohamed for their unwavering support in helping me to meet this goal. 4 Abstract The electronic revolution brought with it technological innovations that are now integral to communication, business, commerce and the workings of governments all over the world. It also significantly changed the criminal landscape. Globally it has been estimated that crime conducted via the internet (e-crime) costs more than €290 billion annually. Formulating a robust response to cybercrime in law is a top priority for many countries that presents ongoing challenges. New cybercrime trends and behaviours are constantly emerging, and debates surrounding legal provisions to deal with them by increasing online tracking and surveillance are frequently accompanied by concerns of the rights of citizens to freedom, privacy and confidentiality. This research compares the ways that three different legislative frameworks have been navigating these challenges. Specifically, it examines the legal strategies of the United Arab Emirates (UAE), the United Kingdom (UK) and the European Union (EU). The UAE is comparatively inexperienced in this area, its first law to address e-crime was adopted in 2006, sixteen years after the UK, and so the express purpose of this study is to investigate how e-crime legislation in the UAE can be strengthened. Drawing on a range of theoretical resources supplemented with empirical data, this research seeks to provide a comprehensive account of how key e-crime legislation has evolved in the UAE, the UK and the EU, and to evaluate how effective it has been in tackling cybercrime. Integral to this project is an analysis of some of the past and present controversies related to surveillance, data retention, data protection, privacy, non- disclosure and the public interest. An important corollary of this research is how e- 5 crime legislation is not only aligned with political and economic aims, but when looking at the UAE, the discrete ways that legislation can be circumscribed by cultural, social and religious norms comes into focus. 6 Abbreviations ACPO Association of Chief Police Officers CFR Charter of Fundamental Rights CJEU Court of Justice of the European Union CPS Crown Prosecution Service DDoS Distributed Denial of Service DIFC Dubai International Financial Centre DPP Director of Public Prosecution DRIPA 2014 Data Retention and Investigatory Powers Act 2014 Du Emirates Integrated Telecommunications Company EC3 European Cybercrime Centre ECHR European Convention on Human Rights EEA European Economic Area ENISA European Network and Information Security Agency Etisalat Emirates Telecommunications Corporation FATF Financial Action Task Force FSC Federal Supreme Court GCC Gulf Cooperation Council GCHQ Government Communications Headquarters GDPR General Data Protection Regulation IP Intellectual Property 7 IPS Internet service providers IPT Investigatory Powers Tribunal IT Information technology ITCs Information Communication Technologies NPCC National Police Chiefs Council NSA National Security Agency NESA National Electronic Security Authority PACE Police and Criminal Evidence Act 1984 RIPA Regulation of Investigatory Powers Act 2000 SIAs Security and Intelligence Agencies SOCA Serious Organised Crime Agency SCEDEA Scottish Crime and Drug Enforcement Agency UK United Kingdom UAE United Arab Emirates VoIP Voice Over Internet Protocol VPN Virtual Private Network 8 Table of Contents Dedication ...................................................................................................................................... 2 Acknowledgements ........................................................................................................................ 3 Abstract .......................................................................................................................................... 5 Abbreviations ................................................................................................................................ 7 Table of Contents .......................................................................................................................... 9 Chapter One: Introduction and Literature Review ................................................................. 13 1. Introduction ........................................................................................................................... 13 1.1 The Significance and Importance of the Research Topic .................................................... 15 1.2 The Scope of the Research .................................................................................................. 21 1.3 Research Aim and Objectives ............................................................................................. 25 1.4 Structure of the Thesis ......................................................................................................... 26 1.5 Defining Cybercrime ........................................................................................................... 29 1.6 The Theoretical Context of and Applicable Social Science Literature on Cybercrime ................................................................................................................................ 37 1.7 Cybercrime Laws in the UK ................................................................................................ 49 1.8 The European Approach Towards Cybercrime ................................................................... 56 1.9 Cybercrime Laws in the UAE ............................................................................................