UAE now banning Virtual Private Network (VPN) access. Are business travelers exempt?

Question

According to a few news articles, the UAE is passing a new law with heavy penalties for using a Virtual Private Network (VPN).

Another report says:

Travelers also come under this law and if caught using any VPNs could face fines as well as jail time.

The text of the law will be:

Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery, shall be punished by temporary imprisonment and a fine of no less than Dh500,000 [£100,000] and not exceeding Dh2,000,000 [£400,000], or either of these two penalties.

Allegedly it's to protect local companies, but also obviously helps penalise those circumventing blocks of say, Whatsapp.

However, many people legitimately need to connect to their company VPNs for work. If you're in the UAE for business reasons, are there ways to get an exemption from this law?

Answer 1

This article is from an official Emirates news agency, which confirms the change (Federal Law 12/2016). This is a change to Federal Law 5/2012, replacing Article 9 (the translation into English is odd because the verb phrase goes first). The level of the penalty has increased (minimum 150K → minimum 500K; maximum 500K → 2M). Incarceration is changed from "imprisonment" to "temporary imprisonment", which might mean that previously the term was life. In either case, they have an "and" problem that the punishment is "(temporary) imprisonment and a fine ... or either of these two penalties". Presumably the Arabic version is dispositive.

Apart from that, the new version of the law identifies the offender as

Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery

whereas the old law only said

whoever uses a fraudulent computer network protocol address by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery.

Thus the meaning of "computer network protocol address" is defined as being equivalent to "IP address".

In other words, there is no substantive change beyond the stiffer penalty. There does not seem to any provision allowing one to ask for exceptions. Article 30 of the underlying law strongly suggests that there is no exception and you should not ask.

On a separate note, only Etisalat and Du are authorized to provide telecommunications services, pursuant to Federal Decree Law No. 3/2003. This article from August 24, 2015 also links to a number of related articles indicating that everything is illegal.