Human Rights Education

Punishments:

The punishments have been set out in Article 20 of the same body of laws. Depending on the conditions and circumstances surrounding the committed crime, and based on the size of the income or other benefits that this criminal activity generate for the corporate entity, the convicted party can be sentenced to paying cash fine which is 3 to 6 times greater than the usual amount [from 5 million to 40 million rials]. In addition, the perpetrator can be imprisoned for a maximum period of five years. Furthermore, the corporate entity concerned will be closed down temporarily, and this closure can last up to one to 9 months, and if the crime is committed again, the punishments will be aggravated, and the corporate entity will be closed for anything from 1 to 5 years.

If the maximum punishment for the said cyber crime exceeds the period of five years, the company will be closed down for 1 to 3 years, and if the crime is repeated, the company will be dissolved permanently, and the manager of that company will not be permitted to establish another company for a period of three years

Article 21: Working on the basis of the technical regulations, and with reference to the index provided by “the committee for determining criteria” for identifying unlawful material, the providers of [Internet] access have a duty to cleanse (filter) the content they make available to users to remove any material and content which have been declared unlawful by the Cyber Crime Law, or material which can be used to commit cyber crimes. In the event that they intentionally do not filter and remove unlawful content from their service, they will be disbanded altogether. However, if they pave the way for the public’s access to unlawful material because of carelessness or lack of knowledge and know-how, in the first instance, they will be sentenced to a cash fine of 20 million to 100 million rials, and in the second instance, they will be fined 100 million to 1 billion rials. If they commit the same offence for the third time, they will be closed down temporarily for anything between one and three years.

Note 1: If the unlawful content happens to belong to websites affiliated to the state public organizations and institutions – including establishments operating under the supervision and authority of the Vali-e Faqih [Supreme Leader Ayatollah Khamenei] and the three branches of state (that is the Judiciary, Legislative and Executive Powers] – or to non-governmental public institutions (according to the list of non-governmental public institutions and organizations, provided by the relevant laws approved on 19 Tir 1373 [July 1994] and their subsequent amendments and appendixes); or to political parties and associations, professional and guild-based organizations, Islamic organizations and societies, or establishments for the officially recognized religious minorities; and finally to other private individuals or corporate legal entities who are present in Iran and as such, their identities can be ascertained, and it is possible to communicate with them, then on the basis of instructions by the judicial authority dealing with the case, and on the condition that the unlawful content is removed immediately by the proprietors, then the website will not be blocked (filtered) pending the issuance of the final judicial verdict.

Note 2: When there is a private plaintiff involved, the blocking (or filtering) of the unlawful content will occur with the orders of the judicial authority dealing with that specific case.

The above Article envisages the establishment of a working group, or a committee, with the task of determining what constitutes criminal and unlawful content on computers, and then sharing its decisions to the Internet service providers. Article 20 has made the Internet service providers duty-bound to remove and filter these types of content from the Internet before providing the users with access and other services. If they fail to do this, they can expect two kinds of treatment:

A) If they fail to remove these content from the Internet intentionally and on purpose, they will be disbanded altogether

B) If these unlawful material remain on the Internet because of carelessness or mistakes by the service providers, then they will be sentenced to payment of fines.

Note 1 of Article 20 concerning unlawful content in websites which belong to well-known public, governmental or even non-governmental organizations, institutions and parties, has clarified that these types of content will not be blocked until the court has made a decision about whether or not they should be filtered. Therefore, the unlawful content appearing on the websites of recognized and well-known organizations, groups and parties will not be removed and filtered until the court decides the appropriate course of action.

It is clear that the essential prerequisite for the appearance of such cases in courts is that the Internet service providers must formally inform a court about the issue.

Note 2 of this Article also states that if a private plaintiff lodges a complaint against some unlawful computer content, the content will not be removed until the court has decided whether or not the material should be filtered.

Article 22: “Within a period of one month from the date of approval of this law, the Judiciary should establish the committee for determining the unlawful content in computers in the building of the General Prosecutor Office. The Ministers of Education, Communications and Information Technology, Intelligence, Justice, Science, Research and Technology and Islamic Guidance – or their delegates and representatives – as well as the Head of the Islamic Publicity Organization, the Head of the Voice and Vision Organization, the Commander of the Law Enforcement Force, and an expert in the field of information technology and communication – as determined and approved by the Majlis Commission for Mines and Industry – a member of the Islamic Majlis – selected by the Majlis Judicial and Legal Commission and approved by the Majlis as a whole – will make up the membership of the said committee. The State General Prosecutor will chair the committee.”

Note 1:  The committee must meet at least once every 15 days, and the presence of 7 members with the right to vote will give these meetings the official quorum they need. The decisions of the committee, furthermore, will be made on the basis of the votes of a relative majority of members.

Note 2: The Committee is obliged to hear complaints by different bodies about the kind of content which has been filtered, and it has to make the appropriate decisions about such cases. The verdict of the committee is final and binding.

Note 3: The Committee has a duty to produce a report every six months about the progress and status of removal and filtering of unlawful content from computer systems. The reports are to be submitted to the heads of the three branches of state, and the Chairman of the Supreme Council of National Security.

The above Article has set out to clarify the required membership composition of the committee for determining unlawful content, and has explained its duties and remit.

Article 23: “Immediately after receiving the orders and decisions of the committee for determining the unlawful content in computers, or the instructions of the judicial authority in charge of the case about the presence of unlawful content on computer systems, the providers of web hosting services have an obligation to prevent any further access to such content on their systems. If they internationally and purposefully refuse to implement the orders of the said committee or the judicial official in charge, they will be disbanded. However, if they somehow continue to provide access to such material due to their carelessness or genuine mistakes, in the first instance, they will be sentenced to pay a cash fine of 20 million to 100 million rials, and in the second place, the cash fine sentence will range from 100 million to 1 billion rials. Finally, if the crime is perpetrated for a third time, the offender will be closed down temporarily for one to three years.

Note: The providers of web hosting services have a legal obligation to inform the committee for determining the unlawful content in computers the moment they realize that such material is present among the general content they are providing.

According to this Article, immediately after receiving instructions either from the relevant judicial authority or the committee for determining the unlawful content in computers, demanding that such material should become inaccessible to the public, the centres responsible for providing hosting services are legally obliged to take immediate measures to implement these instructions. The law has envisaged two possible situations in connection with the failure of the web hosting centres to remove and filter out the content which has been deemed as unlawful:

A) When the instructions received have been ignored intentionally and on purpose

B) When the instructions have not been heeded due to carelessness or due to genuine mistakes

It can therefore be concluded that the providers of web hosting services are merely responsible in connection with implementing the orders of the committee for determining unlawful content in computers, or the relevant Judicial authority dealing with a specific case. Intentional refusal to heed these orders will bring about the closure of these centres, and failing to implement the said orders due to carelessness or mistakes will lead to a sentence of cash fine payment.

Article 24:  “Anyone who uses, without a legal permit, the bandwidth of the international route in order to establish telecommunication links, on the basis of the Internet protocol, between Iran and foreign countries and vice versa, shall be sentenced will be sentenced to imprisonment for a term of one to three years, or to a cash fine of 100 million to 1 billion rials, or both.

The subject matter of the above Article is the establishment of international telecom link through unlawful use of the Internet line bandwidth,

Instances where these punishments may be aggravated have been explained in Article 26 and thereafter, and we referred to these in the first part of this article. The final section of the Cyber Crime Law is mainly about the legal procedures and the methods of investigating and processing cyber crimes in general.

[Conclusion] A careful read of the content of the Cyber Crime Law will point us towards the fact that the legislators had merely sought to pave the way for exercising scrutiny, control and censorship. After all, the content of this law clearly shows that its essence and spirit is fundamentally different from principles and tenets such as the freedom of exchange of information, and the freedom of expression more generally. In reality, by formulating these laws, the legislator has created certain routes and channels for monitoring and invading the private sphere of people’s lives. The law also makes it possible for people with power and influence to meddle in the traffic and exchange of computer and telecommunication data among the ordinary people. Interestingly, the Cyber Crime Law has been approved even though according to the Constitution, censorship, as well as any kind of encroachment and eavesdropping on the private lives of other are prohibited. Unfortunately, when the focus in on safeguarding the authority and interests of the powerful elements in society, then the Constitution, as well as all international commitments, are simply forgotten.

Mahnaz Parakand

Punishments:

Imprisonment from 91 days to two years, or cash fine of 5 million to 40 million rials, or both

Article 18: Any person who uses computer and telecommunication systems to publish, or share publically by other means, lies and libellous material, with the intention of harming another person, or agitating and upsetting the minds of people or the state officials; or anyone, who – with the same intentions as the above mentioned ones – attributes some statements and conducts falsely and in a manner contrary to the actual events, either independently or indirectly and by quoting third parties – regardless of whether or not these actions inflict material losses on others, or damage their reputation and character, then in addition to the damages they have to pay to restore someone’s loss of reputation (if needed), they will be sentenced to prison term, ranging from 91 days to two years, or to cash fine of 5 million to 40 million rials, or both.

The crime the above Article refers to consists of two different criminal dimensions:

A) Spreading lies and libellous material

B) Falsely attributing some actions and deeds to another person

In both these dimensions, however, the purpose and reason behind committing that crime must be one of these two:

I) Causing harm and loss to someone else; or

II) Agitating the minds of the public or the state authorities.

In view of the content of Article 18 of the Cyber Crimes Law, the actions and conducts which constitute the means for the occurrence of the crime the Article refers to consist of the following:

A) With the intention of causing someone else to suffer from harms and losses, or agitating and disturbing the minds of the public or the state authorities, the perpetrator: A1) Publishes some lies and libellous material; or A2) Provides people with some false and libellous material; or B1) Falsely attributes some statements or actions to someone else, either directly, or indirectly and through citing a third party.

* It does not make any difference whether the party about whom false information is published is a private individual or a corporate entity.

* If the above-mentioned actions take place through computer and telecommunication systems, then the provisions of Article 18 of the Cyber Crime Law will apply to the crime which has taken place; otherwise the crime will come under the provisions of Article 698 of the Islamic Penal Law.

* The question about the actual occurrence of the crime is not affected by whether or not the perpetrator’s action has caused any harm or losses to the person about whom lies have been published and spread across society.

It is very important to pay attention to this point that providing a correct or incorrect account of something and sharing it with the rest of the public should revolve around news and information, rather than theoretical and analytical material. In other words, if someone makes a comment about social, historical and political issues through the channel of computer and telecommunication systems, he will not be committing any kind of criminal activity, no matter how incorrect and flawed his comment and analyses may be.

Point: Considering as a criminal activity the publication or sharing of incorrect information, or the false attribution of actions and statements to someone – when there is a clear intention to damage and harm that person (regardless of whether or not any damage or harm has been caused) is in contravention of the principle of freedom of expression. The only benefit and positive result that it produces is to pave the way for censorship, and provides a legal basis and justification for the government to impose greater control over computer and telecommunication systems. In addition, the channels and opportunities for any kind of criticism and analysis are closed off, and the Judiciary will be able to confront Internet users and in general the political, security and judicial authorities will be able to easily restrict the freedom of expression for people using computer and telecommunication systems.

* This crime is one which is centred on intent, and for its actual materialization, the following need to be proven:

First: The perpetrator must be aware in advance about the falseness of the material he is publishing about someone else.

Secondly: The perpetrator should be fully aware of the unlawfulness of his action – that is to say the publication and spread of lies about someone through computer and telecommunication systems.

Thirdly: The defendant has perpetrated the crime with full intent

Fourthly: The defendant has intended to cause harm and damage to others, or to agitate and disturb the public, or the state officials.

Punishments:

A) Obligation to restore the reputation and character of the plaintiff (that is if the court orders him to do so)

B) Imprisonment from 91 days to two years; or

C) Payment of cash fine of 5 million to 40 million rials, or both

Article 19: If cyber crimes are perpetrated under the name and auspice of a corporate entity and in pursuit of its interests, the corporate entity involved will bear criminal liability in the following circumstances:

A) When the head of the corporation has personally committed the cyber crime

B) When the head of the corporate entity has directly issued the orders for the perpetration of the cyber crime, which they is actually materialized

C) When one of the employees of the corporate entity perpetrates the crime either with the full information and knowledge of the head of the corporation, or as a result of the top man’s failure to exercise supervision and scrutiny

D) When all or at least a part of the activities of the corporate entity is concentrated on perpetration of cyber crimes.

Note 1: By the term “head”, the Article is referring to a person who has the authority and responsibility for decision making and supervision over the staff and management of the corporation

Note 2: The criminal liability of the corporate entity will not save the actual perpetrator from punishment. When there are no grounds to blame the corporate entity for the crime which has taken place, then punishments will be applied only to the individuals working within that corporation, rather than to the corporate entity as a whole.

Question: Who is a “corporate entity”?

Answer: All private, governmental, non-profit making companies and corporations, when they are registered officially as companies, rather than individuals, based on the procedures clarified by the law. Each of these companies and organizations consist of a number of share-holders and stake-holders, who have a private, individual legal status, which is separate and independent from the corporate legal status of the companies and organizations they are affiliated with.

According to this law, a corporate entity is deemed to deserve punishment when the following criteria are met:

A) When the cyber crime in question has been committed in the name and on behalf of a corporate entity

B) When the cyber crime is committed in pursuit of the interests of the corporate entity

Question: What is the criteria for determining if the cyber crime has been committed in the name, and on behalf of a corporate entity?

Answer:  These criteria have been specified by this law. Whenever cyber crimes are committed under conditions which the law mentions, they should be considered as crimes perpetrated by the corporation in pursuit of its organizational interests. The conditions that the law describes are the following:

1. The top manager of the corporate entity personally perpetrates a cyber crime under the corporation’s name and auspice and in pursuit of its interests. In other word, if Mr A, who also happens to be the boss of Company B at the same time, copies some data and information from the computer terminals of a third party and then shares them with others, one can apply the provisions of Article 19 to his actions when:

Mr A has committed this action under the name of Company B and in his capacity as its manager, and his purpose and intention has been to facilitate the advancement and growth of Company B and its interests.

However, when Mr A acts as a private individual and person, rather than as the manager of Company B, to commit the crime of unlawfully copying data and information from someone else’s computer terminal and then sharing the information with others through the means of computer and telecommunication systems, and if he does so in pursuit of personal objectives rather than for safeguarding the interests of Company B, then the provisions of Article 19 will not apply to this case.

Moreover, if the manager of Company B commits a cyber crime under the name of his corporation, but his action is not aimed at ensuring the corporation’s interests, once again the provisions of Article 19 will not be applicable here, and Company B will not carry any legal responsibilities as a corporate entity.

2. A case when the manager of Company B issues an order to make copies from data available in the computer terminals of another company, let us say Company C, or the computer system of an individual, for example Mr D, and if these data are then shared with others through the means of computer and telecommunication systems, two scenarios are possible here:

A) The computer data of Company C or Mr D are copied and distributed among others on the basis of orders by the manager of Company B. In this case, if the crime was committed in pursuit of the Company B’s interests, then it would be covered by Article 19, and the corporate entity would be the subject of the legal punishments. However, if some actions occur as a result of orders issued by the manager and these actions constitute cyber crimes, the provisions of Article 19 will not apply to them if they are not in pursuit of the corporation’s interests, and as such, Company B will not harbour any criminal liability.

B) No crime can be said to have occurred when computer data belonging to others are copied on the orders from the manager of the corporation, but the copied information is not shared with others, or nothing is done following the order by the manager.

3.1. If an employee of Company B embarks on copying the computer data of others and shares them with others with the knowledge of his company’s manager,  then Article 19 will applicable and Company B will carry criminal liability.

3.2. If an employee of a company commits a cyber crime as a result of lack of supervision by that company’s manager, and this crime serves the interests of that company and is committed under its name and authority, then the provisions of Article 19 will apply to the case.

4. If some of the activities of a corporate entity, such as Company B for instance, concentrate on copying the computer data of others, or to committing any other cyber crime, then that corporate entity will be criminally culpable.

Point: In Note 1 of this Article, a manager has been defined as someone who has the authority to represent a corporate legal entity, exercise supervision over it, and make decisions on its behalf.

Question: Normally, will one person hold the responsibility for representing a corporate legal entity, and making decisions on its behalf?

Answer: No, because: First, managing, representing and supervising a corporate legal entity is usually the responsibility of a board, who are elected by the share-holders and owners of the company. As such, usually one person does not hold all the key responsibilities. Secondly, corporate legal entities can also legally become members of the management board and leadership team of a corporate legal entity. For example, Company A can be selected as the top director, or a member of the management board, of Company B.

Therefore, the management board can be made up by a collective of individuals, or by a mixture of individuals and corporate legal entities. In this manner, if in a given corporation, one of the members of the management board orders an employee of the company to perpetrate a cyber crime, and this order is not a part of collective decisions adapted by the company’s management board, even though the employee perpetrates it believing that it was an order by the management of the company, then in the case of this criminal activity, only the person who has issued the order will be culpable from a legal point of view, and the corporate legal entity running the company will not carry any criminal liabilities.

Note 2: This note emphasizes that the criminal liabilities of a corporate entity do not excuse private individuals who are among the management board of a company from their own criminal liabilities. In this case, if the company’s top manager is a corporate entity, it seems that the applicable punishments will be handed out to the individuals who have attended the meetings of the management board and adapted positions and decisions there as representatives and on behalf of the said corporate entity.

Article 15: Anyone who uses computer or telecommunication systems or data carriers and storage devices to perpetrate the following activities, will receive the appropriate punishments described below:

A) If, in his efforts to make some “explicitly obscene” content available to other users, the perpetrator encourages, tempts and allures the users, or deceives, threatens and intimidates them, or if he engages in providing the users with training so as to facilitate their access to his content, he will be sentenced to prison term, ranging from 91 days to one year, or to a cash fine of 5 million to 20 million rials, or both.

When the same situation is present but in relation to the “obscene” and “frivolous” content [Mobtazal], then the cash fine payable will range from 2 million to 5 million rials.

B) If the perpetrator uses the means of enticement and persuasion, or deception, threat and intimidation, in order to make others engage in indecent sexual acts, or acts of sexual perversion, violent activities, use of illicit and mind-altering drugs, or suicide, or if he embarks on providing instructions and training to computer users to facilitate their involvement in the above-said activities, he will be sentenced to prison term, ranging from 91 days to one year, or to cash fine of 5 million to 20 million rials, or both.

Note: The provisions of the above Article, or that of Article 14, will not be applicable to those contents which are generated, distributed, stored, saved and sold or bought for scientific purposes, or for pursuing any other rational and positive intention.

All the activities which in the above Article make up the “material element” of the crime are considered as manifestations of aiding and abetting a crime, according to the Islamic Penal Law. However, according to this Article, engaging in these activities independently of any other activity, and in its own right, will constitute a criminal activity.

In Note A of this Article, it is clear that the essence of the crime it refers to is the act of placing people in situation where they are likely to be gain access to “explicitly obscene” content in computer or telecommunication systems. In other words, the goal and intent of the perpetrator must be enticing, persuading, alluring or using other means to direct individuals to situations and locations where they can access the “explicitly obscene” or merely “obscene” material on computer and telecommunication systems.

Based on Note A of the above-said Article, engagement in any of the following activities will constitute the “material element” of crime:

– Persuading or motivating people to access “explicitly obscene” or “obscene” content, or

– Threatening people to make them access “explicitly obscene” or “obscene” content, or

– Alluring users to access “explicitly obscene” or “obscene” content, or

– Tricking and deceiving people to access “explicitly obscene” or “obscene” content, or

– Making it possible for individuals, for instance by means of providing them with training and instructions, to access “explicitly obscene” or “obscene” content.

According to the above Article, it is not necessary for these actions to yield any particular outcome and result, and instead, the mere engagement of perpetrators in these activities constitutes a crime. However, first, these activities should essentially take place within the domain of computer and telecommunication systems; secondly, the perpetrator must be fully aware in advance about the obscene and explicitly indecent nature of the content on his computer and telecommunication systems; thirdly, the perpetrator must also have prior knowledge that the above activities in computer systems constitutes an unlawful and criminal activity; and fourthly, the defendant perpetrates these activities with a criminal intent, and with full awareness and knowledge of the legal status of such actions.

In Paragraph B of Article 15, the essence of the crime is the perpetrator uses the computer and telecommunication systems for the purpose of enticing, persuading, threatening, and… alluring individuals to commit indecent and immoral acts, or use narcotic and mind-altering drugs, or commit suicide, engage in violent conduct or in acts of sexual perversion.

Needless to say, the prerequisite for the occurrence of the crime in reality is that first, it should take place inside computer and telecommunication systems; the perpetrator must be fully aware of the illegal nature of his actions; and he should also have the specific purpose and intent for his activities.

Point 1: No clear definition has been provided for indecent acts, violent conduct or acts of sexual perversion, and this prepares the grounds for all kinds of approaches by the relevant officials, based on their own interpretations and point of view, against the people.

Point 2: The criminal activity that this Article refers to is in contradiction of the principle of respect for the private sphere of people’s lives. After all, to discover these crimes, it is necessary to gain entry into the computer terminals of citizens, and this is obviously in contravention of the principle of respect for the private lives of people.

Point 3: Although the notes to this Article emphasize that the crimes mentioned in Articles 14 and 15 do not include the material and content which are produced, distributed, stored, saved or bought and sold for scientific purposes or other rational and expedient interests and intentions, since no specific legal and logical criteria have been mentioned for determining what constitutes “rational and expedient interests”, the way has been paved for the influence of personal tastes and preferences, because everyone will have his own interpretation of the concept of “interests”.

Article 16:  Anyone who uses computer and telecommunication systems in order to alter or distort the picture, audio or moving images of another person, and then publishes the doctored material with the awareness of the changes which they have undergone, and this publication leads to the defamation of the original person, will be sentenced to prison term, ranging from 91 days to two years, or to cash fine of 5 million to 40 million rials, or both

Note: In the case where the alteration or distortion turns the original material into “explicitly obscene” content, the perpetrator will receive the maximums of both punishments.

The crime which Article 16 refers can be said to have occurred in reality when the following conditions are met:

A) Distribution of still or moving images or audio of individuals through computer and telecommunication systems

B) Alteration and distortion of the images and sounds of others through the use of computer and telecommunication systems, and then publishing the resulting material

C) Publication of altered or distorted images or sound of others through the channel of computer and telecommunication systems

D) The publication of the altered or distorted material should lead to the defamation of the character of the person to whom the original material belongs.

(Note) In Paragraph A, the mere act of publishing the image or voice of someone – even without alteration and distortion will constitute a criminal activity, if it leads to his defamation

However, the subject matters of Paragraphs B and C are two actions: altering or distorting the image or sound of someone else through utilizing computer and telecommunication systems; and secondly, the publication of the altered material through the said systems.

(Note) If the film, image or audio of others – which have been altered or distorted by computer and telecommunication systems – are published and distributed by means other than computer or telecom systems, then this action will not be covered by the criminal activity that Article 16 defines.

(Note 2) The above Article does not apply to cases where the distortion or alteration of someone’s image or voice by means other than the use of computer and telecommunication systems.

(Note 3) Another prerequisite for the occurrence of this crime is that the distortions of the original image or sound material have been done without the consent of person to whom they belong.

(Note 4) Another condition is that the perpetrator must be fully aware of the illegal nature of his actions and should also have a specific intention and purpose to perpetrate them.

(Note 5) The law has stated that society’s “norms” will determine the criteria to decide the occurrence of the crime

(Note 6) The type of the crime, and the fact that the private and individual-to-individual aspect of the crime dwarfs  the extent of its public impact, are factors which indicate that an initial complaint by a private plaintiff is essentially required for legal action to begin and a case file to be compiled against the perpetrator. Unfortunately, the law has not provided with any specific information and guidance about this particular aspect of the crime.

Punishments:

Imprisonment from 91 days to two years, or cash fine of 5 million to 40 million rials, or both

The Note added to this Article states that the punishments will be aggravated if the altering or distorting images or sound results in material which constitutes “explicitly obscene”  content.

Article 17: Anyone who uses computer and telecommunication systems to broadcast, distribute or share by other means audio or visual material depicting scenes from a private or family event, without the consent of the people involved – except on occasions permitted and sanctioned by the law – thereby causing them losses both materially and also in terms of their reputation and honour, will be sentenced to prison terms, from 91 days to two years, or to a cash fine of 5 million to 40 million rials, or both.

The subject matter for this Article is the publication and sharing of private films of different individuals (such as films recorded at their wedding receptions and birthday parties, or generally depicting of the sound and image of other people without their consent) through the channels of computer and telecommunication systems. The publication of images or movies of other people on computer and telecommunication systems constitutes a crime when the following criteria are met:

A) Lack of consent by the owners of the material

B) The action should cause the owners some losses or lead to damage to their name and reputation

C) The criteria which determines if the action has caused the said losses and harms will be society’s conventions and norms

D) The perpetrator must be fully aware of the illegal nature of his actions and engages in publishing other people’s private images or voice on purpose and with the intent of defaming them.

As the above Article stated, its essence has more of a private aspect than a public one, and it is clear that a case file can be compiled against the perpetrator in order to set in motion a legal action only after a private plaintiff comes forward. Unfortunately, with regards to this Article too, the legislators have not provide any further guidance.

Article 13: “Anyone who, without any legal permit and license, uses computer and telecommunication systems  in order to enter, alter, delete or distort computer data, so as to obtain financial benefits and further certain personal interests, either for himself or for a third party, will be ordered to return the properties of others to them, and in addition, may be sentenced to a prison term of 91 days to one year, or to a cash fine of 20 million to 100 million rials, or both. ”

The main subject matter of Article 13 is “computer or telecom fraud and embezzlement”. The crime of computer fraud is not limited merely to activities directed at computer data. Instead, for the crime of fraud to actually occur, the perpetrator or a third party should earn financial gains as a result of these activities.

In their definition of the crime of computer fraud, the legislator has outlined a number of conditions which must be met in order for computer fraud to take place in the eye of the law:

A) The perpetrator should engage in certain actions, such as:

— Removing or changing data found on another person’s computer terminals

— Copying the data onto another computer terminal

— Making changes to the data found on the computer terminals of another person

— Sabotaging the data stored on another person’s computer and telecommunication systems, or more generally, engaging in any other kind of meddling with another person’s computer data.

B) The outcome and result of the actions: The result and consequence of these unlawful activities must be the generation of financial gains

C) It does not make any difference if it is the perpetrator or a third party who will have some financial gains as a result of these unlawful conducts

D) The perpetrator should be aware that the computer terminal he is accessing belongs to another person

E) The perpetrator should be aware in advance that data on the computer terminal belong to another person

Punishment:

A) The money earned through fraud must be returned

B) Two kinds of punishments have been envisaged for this particular crime, and these can be carried out in three different ways:

— Sentence of prison term, from one to five years, or

–  Cash fine of 20 million to 100 million rials , or

– Both of the above penalties

As it can be seen from the above, an actual part of the punishment is that the perpetrator will not own the financial gains which have been earned as a result of the crime.

Article 14: Anyone who utilizes computer or telecommunication systems or data storage devices to publish, distribute or trade explicitly obscene [Farsi word: Mostahjan] content , or engages in saving and storing such content for the purpose of commercial transactions or for spreading corruption and immorality, will be punished by imprisonment terms ranging between 91 days to two years, or payment of fines within the range of five million to 40 million rials, or both.

Note 1: Perpetrating the above-mentioned actions in relation to less explicit obscene content [Farsi word: Mobtazal, which is often used to refers to frivolous and trite content] will lead to penalties equal to the minimum levels of each punishment. The term “less explicit obscene” content applies to content which contain some obscene and offensive scenes.

Note 2:  When the explicitly obscene material is distributed among fewer than 10 people, the perpetrator will be fined by one million to five million rials.

Note 3: If the perpetrators turn the activities mentioned in the above article of law into their profession, or when they engage in these illegal activities in an organized manner, they will be sentenced to receive the maximums of both the envisaged punishments – unless of course they are identified as “Corrupt on Earth” elements [for whom the usual punishment is the death sentence].

Note 4: The term “explicitly obscene” means audio, visual and textual material, whether real or fictional, which depict women or men in full nude, or the genitalia of men or women, or aspects of human sexual intercourse.

The crime which is the subject of Article 14 of the Cyber Crime Law is made up of two parts:

Part 1:

1.1- Publication of explicitly obscene material through computer or telecommunication systems, or data storage devices

1.2 – Distribution of explicitly obscene material through computer or telecommunication systems, or data storage devices

1.3 – Engaging in the trading of explicitly obscene material through computer or telecommunication systems, or data storage devices

Question: What is the outcome and result of the action which is perpetrated?

Answer: The outcome is to gain access to the data or computer or telecommunication systems which belong to another party.

Part 2:

2.1- Production of explicitly obscene material through computer or telecommunication systems, or data storage devices

2.2 – Storage of explicitly obscene material through computer or telecommunication systems, or data storage devices

2.3 – Saving and preserving explicitly obscene material through computer or telecommunication systems, or data storage devices

2.4 – When by producing, storing and saving explicitly obscene material through computer or telecommunication systems, or data storage devices, the perpetrator’s intent is to use them either for monetary income, or for spreading corruption and decadence on earth.

Question: What is the meaning of the term “obscene content and material”?

Answer: The above-mentioned Article has four notes, the first one of which defines “obscene content”, as material which include repulsive and sordid image or scenes. However, the criticism that one can direct at the said Article is that it fails to provide any clear definition about “sordid images and scenes”, which make up “obscene content” in the eye of the law. It is therefore not clear which features and characteristics render images and scenes as sordid and repulsive. Obviously, different people with different opinions, tastes, mentalities, upbringing, norms and customs, and cultural and traditional bases will have their own ideas about which images are pleasant and pleasing, and which ones are sordid and repulsive. This of course will lead to different approaches, based on individuals’ own personal viewpoints being adapted against the individuals who manage computer terminals. On the other hand, labelling a given action as criminal without providing a clear definition of it, and without providing clear examples and criteria for it will be contrary to some basic legal principles, such as the need for complete clarity about the boundaries between the lawful and the unlawful, or the principle which states one is innocent unless proven guilty.

Question: What is the meaning of the term “explicit obscene content and material”?

Answer:  The legislators have provided a definition for “explicitly obscene content” in Note 4 of the above Article. Accordingly, the term means audio, visual and textual material, whether real or fictional, which depict women or men in full nude, or the genitalia of men or women, or aspects of sexual intercourse between humans.

It seems that in view of the above definition, this Article of law will in fact apply to the publication, distribution and trading of many artistic and scientific books (for instance in the fields of fine arts, photography, psychology, medicine, the study of physiology of men and women, and…). In this manner, the grounds are prepared to confront and restrict researchers, scientists, artists and writers, or more generally, all the people who are involved in the production of such material , which are mainly produced, published and given public distribution by computer or telecommunication systems.

Point: In the concluding parts of the text of this Article, the mere act of storing and saving content which is considered by legislators as “explicitly obscene”, is classed as criminal activity, on the condition of course that the perpetrators’ intent for storing and saving such content is generating monetary profit or propagation of corruption on earth. What this means is that even if the “explicitly obscene” material is not used for trade and profit-making activities, the provisions mentioned in Part 2 of the Article will still apply to that type of criminal activity.

Some of the criticisms which one can make against the above Article include:

A) The text of the Article implies that as far as the intent of the perpetrator has not been actually carried out, it is not going to be possible to ascertain if the criminal act mentioned in the Article has taken place.

B) The intent of the perpetrator is something internal, which is known only for the person himself. It is the plaintiff’s responsibility to prove the presence of such intent.

C) Ascertaining the actual occurrence of the criminal act mentioned in the above Article – that is to say the storage or saving of “explicitly obscene” content – will require access to the content of the computer or telecommunication systems or the storage devices of individuals, and this in turn, will require entry into the said systems and devices belonging to the computer users. However, these procedures, which effectively  pave the way for monitoring of individuals’ computer terminal under some baseless pretexts, and as such they are in clear contravention of the principle of respect for the private spheres of people’s lives, or the principle of freedom of expression.

D) The above Article also runs counter to the principle of respect for freedom of expression too, because according to that principle, everyone is free to write, draw and generally express his own opinion, taste and preference as he sees fit. In other words, the principle of freedom of expression means people should be free in what they say or what they write, and should be able to produce expressions of their opinions in the forms of drawings, graphic designs, textual material, images, etc.

In Notes 2 and 3 too, the limits of the applicable punishments have been explained, with consideration for the special conditions which may be present.

Based on the content of Part 1 of Article 14, the publication, distribution or trading of “explicitly obscene” material is a crime with penalties. Furthermore, on the basis of the content of Part 2 of Article 14, the storage, saving or generation of “explicitly obscene” content constitute a criminal activity when the intent and purpose of the perpetrator is to earn an income, or to spread corruption on earth.

Point: The notable point is that Note 3 of the Article states that if the perpetrator turns the above-mentioned activities into his trade and job, or if he engages in them in an organized manner, he will be sentenced to the maximums of both punishments – unless he is found guilty of the crime of “spread of corruption on earth”.

First: No clear definition has been provided either by this Article of law or by the Islamic Penal Law provisions in general, about the crime of spreading corruption on earth, and there is therefore no clear-cut criteria for determining the occurrence of that particular crime. This issue clearly contradicts the principle that there should be absolute clarity about the definition of the crime and the punishment it can attract, especially in view of the fact that the absence of a clear definition will pave the way for approaches and treatments which are based on the personal views and interpretation of the relevant authorities.

Secondly: Given the mention of the possibility of the crime of spreading corruption on earth, the Article to some extent paves the way for an overlap between the deterrent punishments and the punitive penalties prescribed by the Islamic Jurisprudence.

As we said earlier, the Article is also in contravention of the principles of freedom of expression, respect for people’s private lives, and the clarity of the legal provisions for the crime and its punishment.

Punishment:

The Article in effect envisages three kinds of punishments:

– Imprisonment for a term between 91 days and 2 years

– Cash fine of between 5 million and 40 million rials; and

– Both these punishments

It should be noted that when it comes to the crime of “spreading corruption on earth”, the punishment envisaged for the convicted person is the death penalty

The Punishment:

There are two types of punishments for this crime and these are applicable in three ways:

1. The punishment of this crime could be imprisonment from one year to five years.

2. The punishment of this crime could be fine from 20 million rials up to 100 million rials. According to Article 54 of this law, the amount of the fine can be changed every three years, according to the rate of the inflation, by a proposal by the Head of the Judiciary and approved by the cabinet ministers.

3. The punishment of this crime could be both of these penalties.

Article 7: “If anyone knowingly uses some forged data, or cards or chips, he will be sentenced to the punishments stipulated in the above Article”

The subject matter of the crime in Article 7 is using false and forged data or electronic cards or chips.

The meaning of electronic cards is documents such as bank and credit cards, cards used for unlocking doors, etc…

The chip is a piece of electronic hardware and has a large number of transistors.

The knowledge and awareness of the perpetrator for using forged data or card or chip is an important and essential requirement for the actual realization of the crime. The perpetrator will not be covered by the definition of this crime if he does not know that the data or chip or … are forged and claims that he used the devices thinking that they were the original chip or electronic card.

The punishment:

The punishment for this crime is similar to the crime of forgery and there is no difference with the punishment for data forgery.

Article 8: “If anyone deletes or destroys or corrupts, or renders unusable, another person’s data without legal permission, he will be sentenced to imprisonment from six months up to two years or cash fine of 10 million rials to 40 million rials, or both of these punishments.”

The subject matters of the above Article is deleting, destroying, corrupting, damaging or making unusable another person’s data on computer and telecommunications systems.

The constituent features of the element of conduct in this crime are:

*Deleting others’ data without legal permission.

*Deleting others’ data carriers without legal permission.

*Corrupting others’ data without legal permission.

*Corrupting others’ data carrier without legal permission.

*Disrupting others’ data without legal permission.

* Disrupting others’ data carrier without legal permission.

*Making others’ data non-usable without legal permission.

* Making others’ data carriers non-usable without legal permission.

For the realization of the crime, it is necessary that the perpetrator knows that the data belong to another person. The crime does not occur if the perpetrator does not know that the data belongs to another person, and believing that the data was his own, he corrupts, deletes or disrupts them. Also, the crime does not materialize in practice if deleting or corrupting of another person’s data was authorized by law.

Therefore, there are two essential requirements for the realization of the crime of Article 8; that is deleting, damaging or corrupting another person’s data or data carriers:

The first: the data must belong to another.

The second: the perpetrator must know that the data belong to others.

The third: the perpetrator deletes or corrupts or disrupts or makes it non-usable without legal permission.

The forth: the perpetrator deletes or corrupts or disrupts or makes the others’ data or data carriers non-usable by intent and on purpose.

The punishment:

There are two types of punishments for this crime and these are applicable in three ways:

1. The punishment of the crime could be imprisonment from six months to two years.

2. The punishment of the crime could be a fine from 10 million rials up to 40 million rials. According to Article 54 of this law, the amount of the fine can be changed every three years based on the rate of inflation, through a recommendation by the Head of the Judiciary and the approval of the Government Cabinet.

3. The crime could receive both these punishments.

Article 9: “If anybody unlawfully disables or disrupts the computer or telecommunication systems or electromagnetic or optic waves, through actions such as entering, transferring, broadcasting, deleting, stopping, manipulating or corrupting them, he will be sentenced to imprisonment from six months up to two years or paying a fine from 10 million rials up to 40 million rials,  or both of these punishments”.

The subject matter of this Article is disabling, or disrupting the operation of, computer or telecommunication systems.

According to this Article, if someone commits some actions such as:

*Entering data or electromagnetic or optic waves

*Transferring data or electromagnetic or optic waves

*Broadcasting data or electromagnetic or optic waves

*Stopping data or electromagnetic or optic waves

*Manipulating data or electromagnetic or optic waves

*Corrupting data or electromagnetic or optic waves

Disables or disrupts the functioning of computer or telecommunication systems.

*For the actual realization of this crime, the perpetrator must know that the computer or telecommunication system belongs to someone else.

*The perpetrator should have no authorization for disrupting or disabling the functions.

*The perpetrator must be aware that his action leads to disabling or disruption of the computer or telecommunication systems or their functions.

*The perpetrator must know his action is a crime and disrupts or disables the functions of another person’s computer system intentionally.

The Punishment:

1. The punishment of the crime could be imprisonment from six months up to two years.

2. The punishment of the crime could be paying fine from 10 million rials to 40 million rials. According to the Article 54 of this law, the amount of the fine could be changed every three years based on the rate of inflation, by a proposal by the Head of the Judiciary and the approval of the Government Cabinet.

3. Both these punishments can be handed out to the perpetrator of this crime.

Article 10: “If anyone prevents the access of authorized individuals to the data or computer and telecommunication systems, by some measures such as hiding the data, changing the password or data encryption, he will be sentenced to imprisonment from 91 days to one year or to paying fine of between 5 million rials and 20 million rials, or both of these punishments.”

Preventing authorized individuals from accessing the data or computer and telecommunication systems is the subject matter of the crime mentioned in this Article.

Question: How is it possible to prevent individuals from access to data or computer and telecommunication systems?

Answer: The methods that have been mentioned in the body of the Article are:

*Hiding the data.

*Changing the Password.

*Encrypting data.

From the point of view of the legislator, any action that leads to prevention of access of authorized individuals to data or computer and telecommunication systems is a crime and according to this Article, they can be subjected to criminal prosecution.

The punishment:

The punishment could be imprisonment form 91 days up to one year or paying a fine from five million to 20 million rials.

Article 11: “If anyone, with the intent to endanger the safety, comfort and security of public, commits the actions that have been mentioned in Articles 8, 9 and 10 against the computer and telecommunication systems which are used to provide essential public services such as health care, water, electricity, gas, transport and banking, he will be sentenced to imprisonment from three years up to 10 years.”

The legislator has mentioned the crimes mentioned in Articles 8, 9 and 10 in relation to the computer and telecommunication systems which concern the essential public services.

Question: Which actions will lead to the materialization of the crime mentioned in Article 11 of the Cyber Crimes Law?

Answer: According to the content of Article 11, each of the following actions against computer or telecommunication systems that are related to the essential public services are crimes

*Disabling of computer and telecommunications systems or disrupting their function.

*Preventing the authorized individuals from accessing the data or computer or telecommunication systems.

*Deleting, corrupting, disrupting or making the data or computerized or telecommunication systems non-usable

Question: What is the subject matter of the crime mentioned in Article 11?

Answer: The subject matter of Article 11 is data and computer and telecommunication systems that are related to essential public services. This means someone who disables the computer or telecommunication systems that are related to the essential public services, or prevents the access of authorized individuals to that data or eliminates, corrupts, disrupts or renders unusable the data related to the essential public services.

Question:  What is the essential criterion for the realization of this crime?

Answer: The necessary condition for the realization of this crime is for the individual committing the above actions against computer and telecommunication systems which function in connection with the essential public services with intent and on purpose, to endanger the safety, comfort and security of the public. This means that the crime could not materialize if the perpetrator had no intent for endangering the safety, comfort and security of public.

Note: The perpetrator must know and be aware that the system is related to the essential public services. This means if the perpetrator did not know about the connection with the system and the essential public services, his actions will not necessarily be classed as crime.

For the crime to materialize in practice, it is necessary to prove that the perpetrator knew that the computer or telecommunication systems were related to the essential public services,  and he had the will and intent to endanger the safety and public peace and welfare.

The Punishment:

The punishment for this crime is imprisonment from three years to 10 years.

Article 12: “If anyone who steals another person’s data without permission while the original data are still available to their true owner, he will be sentenced to paying a fine from one million rials to 20 million rials, or to imprisonment from 91 days to one year or paying a fine of five million rials to 20 million rials, or both of these punishments.”

The subject matter of Article 12 of the Cyber Crime Law is computer-related theft

The legislator has predicted two situations for this offense:

The first situation: The content of the other person’s data is stolen but, the original data is available for its owner intact and unchanged. This means a situation when someone copies or downloads the other person’s data or their content without the permission of their owner . In this case, the original data is still available but the content of it is stolen. This action is a crime and the punishment is a cash fine of one million rials to 20 million rials.

The second situation: The contents of the data are stolen in addition to the original data and so, the original data are not available to their original owner. This means a situation where someone cuts or deletes another person’s data and adds them to his own data. The punishment of the perpetrator is imprisonment or paying fine or both.

Question: Someone enters the office or the house of another individual and steals some of the objects in the house or office and also the computer system and its hard disk and other additions, or might even take his laptop and all its accessories. Does this person commit the crime of robbery in addition to the crime of cyber theft because he has stolen the computer or laptop of someone else?

Answer: No. In your question, only the computer or the laptop have been stolen. The theft of a  computer or laptop on their own is just normal robbery of another person’s property. However, if by stealing the laptop, the perpetrator also manages to gain access into the data and content stored there, then his crime will come under cyber theft too.

Question: When someone copies or removes some data from another computer, with the permission of the data owner, and then enters it into his own computer, has he committed a cyber theft?

Answer: No. Such conducts will constitute the crime of computer theft when they take place without the permission of the data owner. In other words, one of the essential criteria which should be satisfied in the crime of theft is the absence of permission and consent from the victims.

Among the other criteria which have to be met for the crime of cyber theft to take place, one can mention the following:

– The perpetrator should be aware and conscious that the data in question belong to another person

–  The perpetrator embarks on his action with the intention of stealing, or in other words, in pursuit of the aim of accessing another person’s data and information, and making them his own property.

– The perpetrator must be aware and conscious that he is not authorized and allowed to access and take ownership of data which belong to other people.

Punishment:

As we said earlier, the law has envisaged two scenarios for the crime of cyber theft. The first one relates to cases where the perpetrator only steals the content of the data, and leaves the original data intact for the original owner. In this case, the punishment is only a cash fine. The second situation is when the perpetrator takes the data away and does not leave it for its owner. In this case, the guilty party can receive a prison term, or be ordered to pay fine, or receive both sentences.