State of PalestineLaw by Decree No. 10 of 2018 on Cybercrime, Unauthorised Access and Computer Interference
Law by Decree No. 10 of 2018 on Cybercrime, arts. 4-9
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Access restriction, Prohibition
- Audit expectation
- none
What it requires
- Do not access a website, system, network, or means of information technology without authorisation, or continue accessing it after learning the access is unauthorised, or exceed the scope of authorised access (art. 4(1)).NIST AI RMFMAP 4.1
- A heavier penalty applies where the accessed data is government data, or where the access results in cancelling, deleting, altering, publishing, republishing, or otherwise damaging electronic data, or in impersonating the site's owner or manager (art. 4(2)-(4)).
- Do not obstruct or disrupt access to a service, device, programme, or data source on the network (art. 5).no control in the NIST AI RMF
- Do not introduce anything that suspends or disrupts a system's operation, or damages, deletes, or modifies a programme, on the network (art. 6).no control in the NIST AI RMF
- Do not receive, record, intercept, or wiretap data sent through the network without authorisation (art. 7).NIST AI RMFMAP 4.1
- Reading a public, unauthenticated page without exceeding any scope of access a site has authorised has not itself been held to violate this decree; no Palestinian court decision construing 'exceeds the authorised access' for a public page was found.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 4(1)'s base unauthorised-access offence carries confinement plus a fine of 200 to 1,000 Jordanian dinars; article 4(4)'s most aggravated tier, access resulting in data alteration or republication committed against government data, carries imprisonment of up to five years plus a fine of 3,000 to 5,000 dinars. Article 6's disruption offence separately carries imprisonment of up to five years plus a fine of 3,000 to 5,000 dinars. Article 51 doubles any of these penalties on repetition of the offence.
Penalty structure
5,000 Jordanian dinars is the ceiling among articles 4 and 6's most aggravated tiers; the base unauthorised-access offence under art. 4(1) caps at 1,000 dinars, with intermediate tiers at 2,000 and 3,000 dinars for other circumstances art. 4 and art. 6 enumerate.
- Rule
- Fixed only
- As of
- Currency
- JOD
- Fixed cap
- 5,000
Who enforces it
Enforcement body
Regular Palestinian courts and the Public Prosecution hear cybercrime cases, with a specialised unit within the police agency and security forces, under the Public Prosecution's judicial supervision, handling investigation.
What it makes you log
Logging duty
Articles 4 to 9 punish unauthorized access, obstruction of service, introduction of disruptive items, interception, decryption outside legal permission and related conduct, and set no duty to create, keep or produce a log or record. The row cites those articles only; Article 31 of the Law requires a service provider to keep subscriber information for not less than three years and to keep collected electronic information temporarily at a court's direction, a duty on service providers outside the cited articles. Article 2 applies the Law to its offences perpetrated wholly or partly inside or outside Palestine or whose impact extends inside Palestine.
- Kind
- None
- As of
What this law does
Article 4 punishes deliberately and illegally accessing a website, system, network, or means of information technology, exceeding authorised access, or remaining present after learning the access is unauthorised, with an aggravated tier where the target is government data and a further aggravated tier where the access results in cancelling, deleting, altering, publishing, republishing, or otherwise damaging data, or impersonating the site's owner or manager.
Article 5 punishes obstructing or disrupting access to a service, device, program, or data source; article 6 punishes introducing anything that suspends, disrupts, damages, deletes, or modifies a program; article 7 punishes receiving, recording, intercepting, or wiretapping data sent over the network without authorisation; article 8 punishes decoding encrypted data or misusing another person's encryption key or electronic-signature device; article 9 punishes illegally benefiting from communication services.
The decree, promulgated on , repealed its predecessor, Law by Decree No. 16 of 2017 on Cybercrime, in its entirety.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .