ERBIL, Kurdistan Region - The Iraqi parliament on Monday gave a first reading to one of its longest-delayed bills: a cybercrime law that has repeatedly been withdrawn or shelved under pressure from civil society and international human rights watchdogs, who argue it restricts freedom of speech and imposes disproportionate penalties for broadly and vaguely defined offenses.
According to the bill's text, a copy of which was obtained by Rudaw, individuals charged under the law could face fines exceeding 35 million Iraqi dinars (around $27,000) and life imprisonment.
The harshest penalties are reserved for crimes involving espionage, national security, trafficking of illicit materials, sexual exploitation, and financial crimes.
Describing the law's purpose after its first reading, the Iraqi legislature said it aims to establish a "punitive system for perpetrators of information technology crimes" that carry "numerous risks" and "inflict significant losses on institutions and individuals."
"These crimes target and compromise data or information, infringe upon the private lives of individuals, threaten national security and sovereignty, weaken confidence in modern technologies, and threaten human creativity," it added.
Iraq's courts currently rely on the 1969 Penal Code to prosecute digital offenses. Supporters of the new bill argue that this outdated framework fails to address modern digital crime, making a more expansive legal structure necessary.
‘Anticipated’ unanimous support in the parliament
Speaking to Rudaw English on Tuesday, Sherwan Dubardani, Iraqi lawmaker and member of the national security committee, said he expects a swift passage of the bill following intensive discussions during the second reading that would also integrate comments from civil society and human rights groups.
“The bill was introduced by the Iraqi parliament presidency with no factions or parliamentarians showing objections,” Dubardani said.
He added that it is “too early” to conceive the passage of the bill in its current form, citing possible changes to the definitions and punitive measures while stressing “necessity of such a law to regulate digital life and address its threats.”
The bill was first introduced by the Iraqi council of ministers under the ex-preimer Nouri al-Maliki in 2011. The political establishment sought greater control over digital infrastructure following the regional so-called Arab Spring protests, which demonstrated the power of social media to mobilize the public.
In 2012, Human Rights Watch described the bill as "part of a broad effort by authorities to suppress peaceful dissent by criminalizing legitimate information sharing and networking activities."
Suspended following pressure from advocacy groups, the bill was also reintroduced in 2019, 2020, and 2022. The underlying reason at the time was the eruption of the Tishreen protests in 2019 in Baghdad and southern provinces, eventually leading to the death of at least 600 protesters.
“What floated it back again was the recent and ongoing anti-corruption crackdown,” Dubardani claimed, noting that the campaign has resulted in a widespread defamation as well as the dissemination of forged information about state officials, parliamentarians, and political leaders.
Believed to be relevant to the campaign, Article 14 (3) of the bill imposes imprisonment and a fine of not less than $27,000 against “anyone who publishes or broadcasts false or misleading facts with the intent to weaken confidence in the financial system, electronic commercial and financial papers, and the like.”
Iraqi Prime Minister Ali al-Zaidi, in coordination with the Federal Integrity Commission, announced an operation dubbed Operation Dawn last week.
The operation has so far netted dozens of Iraqi politicians and lawmakers, former officials, and senior government employees, along with tens of millions of dollars in stolen assets and seized state properties illegally transferred into private ownership.
As the operation continues, Iraqi social media has been flooded with images of the arrested individuals and their alleged illicit assets - including, in some footage, large sums of cash and items such as gold-plated underwear. It remains unclear whether this footage is authentic or AI-generated.
“The bill is also in the advantage of the civilians who often fall victim to the various crimes committed in the electronic space,” Dubardani said.
Glimpse of the content
The bill consists of 32 articles divided across 10 sections, with subjects encompassing unlawful access, card payments, electronic blackmail, crimes against “morals and public decency," fraud, intellectual property, state security, personal life, “misusing electronic means,” and organized crimes.
Differing penalties are prescribed for offences committed under each category.
Penalties vary by category. For instance, someone who intentionally forges or fabricates a document, signature, or payment card against a civilian faces a prison term of up to seven years; the same offense committed against the state or public sector carries a minimum sentence of seven years.
Moreover, the bill imposes between four to seven years prison time - in addition to up to 25 million Iraqi dinars (around $19,000) - on individuals implicated in producing, sharing, or inciting pornography or prostitution.
The penalties become significantly harsher when it comes to “crimes affecting state security,” with the imposed prison time reaching life sentence and fines no less than 35 million Iraqi dinars (around $27,000).
Punitive measures are specifically attributed to a person who ‘intentionally uses computers, their programs, systems, or information network belonging to security, military, or intelligence agencies with the intent to harm them, copy from them, send their content to a hostile entity, or utilize them to execute crimes affecting the internal or external security of the state, or facilitate concealing the features of such crimes or covering them up.”
Acts of terrorism, “stirring up an armed rebellion,” and weapon trading also fall within this category. Another broad crime is “publishing or broadcasting false or misleading facts with the intent to weaken confidence in the financial system, electronic commercial and financial papers, and the like.”
