Afef Abrougui, Independent Consultant and Researcher and Mohamad Najem, Executive Director, SMEX
Member countries of the Gulf Cooperation Council (GCC)—Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the United Arab Emirates (UAE)—are on a quest to untap the opportunities offered by technology to diversify their hydrocarbon-dependent economies. Sovereign wealth funds are investing in technology companies, tech giants and startups are incentivized to establish in the region, futuristic smart cities are under planning and governments are pouring money into improving and developing ICT infrastructure.
Such a business environment is conducive to both local and foreign tech startups and companies, and increasingly major players in the industry—including tech giants—are seeking to establish and operate in the region, despite potentially serious consequences for human rights. Digital authoritarianism is on the rise in the Gulf, as its autocratic monarchies deploy ever more sophisticated digital oppression tools and tactics to exert their power not only at home but also across the Arab region. Meanwhile international companies are turning a blind eye, favoring doing business in the region over human rights.
This paper is divided into three sections. In the first section, we explore what makes the GCC a conducive environment to the tech industry, and how the region’s governments, particularly Saudi Arabia and the UAE, are exploiting technology to oppress populations and crack down on human rights and dissent. In the third and final section, we discuss the human rights implications of tech companies’ operations in the region in the GCC’s repressive regulatory environment.
Gulf investments in tech
The UAE has for years established itself as a tech hub in the GCC and the Middle East. Dubai is home to the MENA region offices of tech giants like Facebook, Google, and Twitter. Since its launch in 2007, the Telecommunications and Digital Government Regulatory Authority’s ICT fund has been spearheading the development of the Information and Communication Technology (ICT) sector in the country by, for example, supporting and funding research and training in the field, in addition to incubator programs. The current UAE cabinet includes a minister for advanced technology tasked with “enhancing the contributions of advanced sciences to the development of UAE and its economy,’’ and a minister for artificial intelligence.
As the push for economic diversification gears up in the region, other Gulf countries, and Saudi Arabia in particular, are trying to catch up. With Crown Prince Mohamed Bin Salman’s ascent to power, Saudi Arabia embarked on a series of reforms and programs to restructure and diversify its oil-dependent economy as part of its 2030 Vision. For example, since the Vision’s announcement in 2016, the kingdom increased its fiber optic capacity, introduced new technical programs on artificial intelligence and cybersecurity, launched a centre for the fourth industrial revolution with the World Economic Forum, and started a programme to transform Saudi oil giant Aramco into a leader in other sectors, including cloud services.
A conducive environment for the tech industry
Multiple factors make the GCC a conducive environment to the tech industry. These include some of the highest internet penetration rates in the world, investments in infrastructure including fiber optic and 5G networks, and increased digitalisation.
Investments from the region’s sovereign wealth funds (SWFs), which has some of the largest funds in the world, are particularly attractive to technology companies and startups in the region and beyond. For example, in 2020, both Saudi Arabia’s Public Investment Fund (PIF) and Abu Dhabi’s Mubadala Investment Company acquired stakes in Indian technology company Jio Platforms, investing $1.5B and $1.2B, respectively. The acquisitions are part of the funds’ strategies to expand their ICT portfolios to contribute to economic diversification. PIF is also a shareholder in Uber after investing $3.5 billion in the American technology company that provides transportation and delivery services, including ride hailing and food delivery apps. The investment earned PIF a seat in Uber’s board of directors.
For its part, Mubadala has an ICT investment portfolio that includes social media apps and services, data centers, telecommunications and satellite operations. Most recently, it announced a direct investment of $75m in encrypted messaging app Telegram, which is headquartered in Dubai. Abu Dhabi Catalyst Partners, which is jointly owned by Mubadala and the New York-based Falcon Edge Capital, invested an equal amount.
The region is increasingly offering strong financial incentives such as tax breaks and low taxation rates for foreign and local businesses and investors. For example, as part of its 2040 Vision, Oman will exempt companies “in sectors aimed at economic diversification’’ from income taxes, if they start operating in the country between January 2021 and December 2022. The region’s multiple free economic zones offer similar incentives. Both Qatar and the UAE, have free trade zones exempting foreign companies from paying taxation and duties such as income and corporate taxes. In these zones, foreign business owners and companies can also fully own their business and do not need a local partner. In some of these zones, tech startups are offered additional benefits. For example, innovative technology-driven startups in the Abu Dhabi Global Market (ADGM) zone can benefit from competitive license fees for five years and access to the accelerator programmes of HUB71, a global tech ecosystem in Abu Dhabi supporting startups to grow. Under its Product Development Fund, Qatar Science and Technology Park (QTSP), a free zone hosting global tech companies, local startups and small to medium businesses offering “new high-tech products and services’’ can obtain grants that cover up to 50% of their total budgets.
Tech as a lever of power
Beyond serving as an opportunity for economic growth and diversification, for GCC governments technology is used as a lever of power to control dissent and populations.
At home, control over the digital space is maintained through the use of spyware, internet filtering technologies, and trolls deployed to harass activists and dissidents and manipulate online discourses. Technologies acquired from foreign companies are essential tools in the Gulf’s digital oppression toolbox. For example, Saudi Arabia, the UAE, Qatar and Oman have all previously purchased surveillance systems from UK defence company BAE systems. The purchases included Evident, an advanced tool developed by BAE’s Danish subsidiary that enables governments to conduct mass surveillance of users’ online activities, decrypt encrypted communications and determine the location of users based on data emitted by their mobile devices. In 2020, Israeli media reported that Bahrain, Oman, Saudi Arabia and the emirates of Abu Dhabi and Ras Al-Khaimah in the UAE signed contracts with the infamous Israeli NSO Group to acquire surveillance spyware. The usage of NSO spyware has previously been documented in these four countries and Qatar, including for the purpose of spying on dissidents, journalists and human rights defenders.
Recently, there have also been indications of an increased interest in tools and initiatives developed locally—with the support of foreign knowledge and skills in some cases. Of GCC states, the UAE has emerged as a leader in leveraging its resources to deploy and promote local projects and technologies to help ensure its control over its citizens and residents online and offline. The most infamous of these initiatives is the privately-owned and UAE-headquartered spy firm DarkMatter, which bills itself as a cyber-security company. DarkMatter is most notorious for its involvement in Project Raven, a spying campaign that targeted human rights defenders, critics of the Emirati government and other governments.  The company is also believed to be behind ToTok, a free messaging and video calling app released in 2019 and registered in the Abu Dhabi Global Market economic free zone. The app quickly gained popularity in the Emirates, where the government has for years enforced a strict ban on most VoIP apps, before security experts and technical analysis revealed it to be a spy tool of the government capable of, among other things, tracking the conversations and images of its users.
Similar tactics are deployed in regional geopolitics. This particularly manifest during the GCC diplomatic crisis of 2017, when Saudi Arabia, the UAE, Bahrain and Egypt cut diplomatic ties with Qatar and imposed an embargo on it for its support to Islamist groups, and specifically the Muslim Brotherhood, which is banned in Egypt, the UAE and Saudi Arabia, and its ties with Iran, a major regional rival for Saudi Arabia. Diplomatic ties with Qatar have since been restored, although experts warn that tensions remain.
The feud played out online as the main players in the conflict, and the UAE and Saudi Arabia in particular, stepped up their usage of technology to target rivals and support their allies in the crisis through surveillance, cyber espionage and online disinformation campaigns. For instance, just two weeks before ties with Qatar were restored in January 2021, CitizenLab, an interdisciplinary lab at the University of Toronto that studies information controls, uncovered a hacking campaign targeting the iPhones of 36 journalists working at the influential Qatari-funded Aljazeera in July and August 2019. The hackers, who the lab attributed to the UAE and Saudi Arabia, exploited a vulnerability in iMessage using NSO’s Pegasus spyware.
Technology has also been aiding Gulf governments in their attempts to exert political influence in the wider Arab region and bolster autocratic regimes and rulers. A number of previously documented cases of social media disinformation campaigns in the region bear the fingerprints of the UAE and Saudi Arabia, and their allies. For example, in June 2019, days after the Sudanese military and the government-operated paramilitary group known as the Rapid Response Forces (RSF) cracked down on a pro-democracy sit-in demanding an end to military rule, massacring at least 100 people, a propaganda campaign praising the Sudanese military appeared on social media. Experts believe the UAE and Egyptian governments were behind the campaign. Similar campaigns were waged in Libya, to support field marshal Khalifa Haftar, an ally of the Saudi-Emirati alliance and Egypt, in his attempt to overthrow a UN-recognized government.
Human rights sidelined
Saudi-Emirati dominance over the GCC, poor human rights records, and investments in the tech industry, and specifically digital oppression tools, is bad news for human rights and democracy across the Arab region. This raises serious concerns about the exploitation of international platforms and services that receive investments from these two autocratic countries or establish themselves in this regulatory repressive environment where protections for freedom of expression and privacy are lacking.
In the aftermath of the 2011 Arab uprisings, as they became wary of mass protests sweeping through the region and toppling long serving regimes in Egypt, Libya, Tunisia and Yemen, GCC governments stepped up the legislative machinery to further tighten their control over the digital space. As Ahmed Shaheed and Benjamin Greenacre show in their contribution to this volume, the adoption of cybercrime laws that contain content-related offences criminalizing peaceful speech under vague terms and provisions proliferated. For example, all GCC countries, with the exception of Bahrain, have provisions that criminalize and punish with imprisonment and fines prejudice to public order and morals in their cybercrime laws. In addition to fines, statements and calls to overthrow the regime or change the system are punished by up to 10 years in the Kuwaiti cybercrime law, 3 years in Qatar and an unspecified prison time in the UAE. Several other laws were also adopted. For example, in 2016, Bahrain enacted a law regulating newspapers in the digital space and requiring them to get permission from the authorities before disseminating news online.
Citizens and residents are afforded little privacy protections due to lack of strong data protection laws and rampant government surveillance. Under Saudi Arabia’s Cloud Computing Regulatory Framework, which was first introduced in 2018, Cloud Service Providers are required to “remove any Unlawful Content or Infringing Content from a Datacenter or other element of a Cloud System located in the Kingdom,” and notify the authorities of any content “that may’’ violate the country’s draconian cybercrime law.
Business & Human Rights
With the increased adoption of technology in the MENA region, especially the Gulf after the Arab Spring, international tech companies found the opportunity to expand and enter a new market. From a business perspective, this is a lucrative opportunity for these tech companies. For the monarchies in the Gulf, this is an opportunity to control the online space, and to build and improve their digital authoritarian empire. It was a win-win situation for companies and governments, but not for users in the Arab region, who are paying the price of international tech companies’ profit-driven decisions to do business in the GCC. Many tech companies like Facebook and Twitter naturally gravitated towards the UAE, the most economically and technologically developed country in the Gulf, as well one of its most repressive.
With these new partnerships between the Gulf’s authoritarian regimes and the tech companies came a price that normal citizens will pay. Tech companies like Facebook and Twitter claim that their platforms enable users to express themselves and exchange and access information. It wasn’t until the end of 2015 that SMEX got its first contact with the MENA policy person in one of these companies. His work was mostly managing relationships with governments in the region. It was clear for our team that human rights are barely a second thought.
When it comes to freedom of expression, one of the interesting cases that was brought up to our attention in 2018 is related to Apple, when iTunes MENA refused to upload five songs of an underground Lebanese band named “Al Rahel al Kabir” had their album removed from iTunes MENA. Our team at SMEX did some investigation, and we discovered that there is a third-party company hired by Apple, called Qanawati, that took the decision not to upload the songs since they identified them as sensitive to our region. The band was mocking ISIS leader, Baghdadi, and political oppression in the region. We did some campaigning and managed to get their music up through a Turkish third-party company, and the songs remained accessible on iTunes in the Gulf market.
In another example, Netflix censored an episode of comedian Hasan Minhaj’s program Patriot Actbecause of a request from the Communications and Information Technology Commission (CITC) for breaching the cybercrime law in the Kingdom. The episode mocked Mohammad Bin Salman, the Kingdom’s reaction to the disappearance of Jamal Khashoggi and the Saudi-led war in Yemen.
Privacy and data protection are also under scrutiny in the companies’ business operations in the region. Google announced a partnership with Aramco, a Saudi government-owned oil giant to start data centers inside Saudi Arabia which opens the door on collecting data from the whole region. Unfortunately, this is not the only project happening in the Gulf, with both Microsoft and Amazon on the same track.
Surveillance is a lucrative business opportunity for international tech spy firms and cyber security companies. For example, the UAE has been using Israeli NSO spyware to spy on its own citizens. In 2016, They tried to target Ahmed Mansoor, a prominent Emirati activist, with spyware exploiting an iOS vulnerability and capable of potentially hacking his phone. The operations failed, and Apple released an update to close this gap. This scandal didn’t stop UAE nor the NSO from doing more business in the region and target activists. It is believed that NSO and its spyware played a role in the killing of Jamal Khashoggi, the Washington Post columnist. Months prior to his assassination in October 2018, a successful surveillance operation targeted Omar Abdel Aziz, another Saudi dissident living in Canada. The surveillance against Abdel Aziz exposed his WhatsApp conversations with Khashoggi about their potential plans for social media activism against the Kingdom. He believes the campaign played a key role in Khashoggi’s killing inside the Saudi Consulate in Istanbul.
Tech companies are in bed with authoritarian regimes and dictatorships in the GCC, which represents a threat to human rights across the entire Arab region. As Western tech companies continue to expand their business operations in the Gulf, their tools and platforms are increasingly enabling these regimes to silence, surveil, torture and even kill their citizens. The implications for the digital space are far-reaching, particularly for the most vulnerable and at-risk communities including human rights defenders, journalists and dissidents who are at greater risks of surveillance, disinformation and harassment, and censorship and content takedowns.
 ’ICT Fund Introduction,’’ The Telecommunications and Digital Government Regulatory Authority (TDRA) of the United Arab Emirates (UAE), Accessed July 8, 2021, https://www.tdra.gov.ae/ictfund/en/about-us/ict-fund-introduction.aspx.
 ‘’Her Excellency Sarah Bint Youssef El Amiri,’’ The Cabinet of the United Arab Emirates, Accessed July 8, 2021, https://uaecabinet.ae/en/details/cabinet-members/her-excellency-sarah-bint-yousif-al-amiri ; ‘’His Excellency Omar Bin Sultan Al Olama The Cabinet of the United Arab Emirates, The Cabinet of the United Arab Emirates, Acceded July 8, 2021, https://uaecabinet.ae/en/details/cabinet-members/his-excellency-omar-bin-sultan-al-olama.
 Bahrain, Kuwait, Oman, Qatar, Saudi Arabia and the UAE have all launched long-term economic development plans emphasizing the role of technology, ICTs and the knowledge economy in diversifying their economies.
 ‘’Vision 2030 Kingdom of Saudi Arabia,’’ Accessed July 8, 2021, https://www.vision2030.gov.sa/ ; ‘’Progress and achievements,’’ Vision 2030 Kingdom of Saudi Arabia, Accessed July 8, 2021, https://www.vision2030.gov.sa/v2030/achievements/ ; Amanda Russo, ‘’Building Emerging Technology Governance Key to Realizing Saudi Arabia’s Vision 2030,’’ World Economic Forum, November 6, 2019,
https://www.weforum.org/press/2019/11/building-emerging-technology-governance-key-to-realizing-saudi-arabia-s-vision-2030/; Reuters Staff, ‘’Aramco to bring Google Cloud services to Saudi Arabia,’’ Reuters, December 21, 2020, https://www.reuters.com/article/saudi-aramco-alphabet-idUSKBN28V1SB.
 ICT’’, Arab Development Portal, November 2020, https://www.arabdevelopmentportal.com/indicator/ict-0 ; Rohma Sadaqat, ‘’Investments in ICT to drive digital economy,’’ Zawya, September 1, 2020 https://www.zawya.com/mena/en/economy/story/Investments_in_ICT_to_drive_digital_economy-SNG_183509343/ ; Sophie Smith, ‘’Digital Transformation in the GCC,’’ The Euro-Gulf Information Center, Accessed July 8, 2021, https://www.egic.info/digital-transformation-in-the-gcc.
 ‘’Top 100 Largest Sovereign Wealth Fund Rankings by Total Assets,’’ SWFI, Accessed July 8, 2021, https://www.swfinstitute.org/fund-rankings/sovereign-wealth-fund.
‘’Public Investment Funding Program 2021-2025,’’ Public Investment Fund, Accessed July 8, 2021, https://www.pif.gov.sa/en/Pages/publicinvestmentfundprogram.aspx#6 ; Rishi Iyengar,
‘’Asia’s richest man gets $1.5 billion from Saudi Arabia for his tech war chest,’’ June, 19 2020,
 ‘’Saudi Arabian Public Investment Fund Invests $3.5 Billion in Uber,’’ Public Investment Fund, July 1, 2016, https://www.pif.gov.sa/en/MediaCenter/Pages/NewsDetails.aspx?NewsID=10.
 ‘’Information & Communications Technology,’’ Mubadala, Accessed July 8, 2021, https://www.mubadala.com/en/what-we-do/information-communications-technology.
 ‘’Mubadala Investment Company, Mubadala and Abu Dhabi Catalyst Partners Invest $150 Million in Social Media Platform Telegram,’’ Mubadala, March 23, 2021,
 ‘’Oman: Incentives announced by the Government as part of Oman Vision 2040,’’ PWC, March 14, 2021, https://www.pwc.com/m1/en/services/tax/me-tax-legal-news/2021/oman-incentives-announced-by-the-government-as-part-of-oman-vision-2040.html.
 ‘’A complete guide to free zones in Dubai,’ ; My Bayt, Accessed July 8, 2021, https://www.bayut.com/mybayut/guide-free-zones-dubai/ ; ‘’Frequently asked questions,’’ Qatar Free Zone, Accessed July 8, 2021, https://qfz.gov.qa/resources/faq/.
 ’ADGM Tech Startup Commercial License,’’ ADGM, Accessed July 8, 2021, https://www.adgm.com/faqs/adgm-tech-startup-commercial-licence#what-type-of-business-can-use-the-incentivised-tech-startup-licence ; ‘’Fostering Collaboration,’’ HUB71, Accessed July 8, 2021, https://www.hub71.com/about-us/.
 ‘’About Qatar Science & Technology Park,’’ Qatar science & Technology Park, Accessed July 8, 2021, https://qstp.org.qa/about/ ; ‘’Funding SMEs and Startups that develop products and services relevant to the local market needs,’’ Qatar science & Technology Park, Accessed July 8, 2021, https://qstp.org.qa/product-development-fund/.
 Carly Nyst and Nick Monaco, ‘’State Sponsored Trolling. How Governments Are Deploying Disinformation as Part of Broader Digital Harassment Campaigns,’’ IFT, Accessed July 8, 2021, https://www.iftf.org/fileadmin/user_upload/images/DigIntel/IFTF_State_sponsored_trolling_report.pdf ; Jakub Dalek, Ron Deibert, Bill Marczak, Sarah McKune, Helmi Noman, Irene Poetranto, and Adam Senft, Tender Confirmed, Rights at Risk,’’ Citizen Kab, September 21, 2016, https://citizenlab.ca/2016/09/tender-confirmed-rights-risk-verifying-netsweeper-bahrain/ ; ‘’The race to buy spyware in the Gulf,’’ Fanack, January 26, 2019, https://fanack.com/role-of-the-gcc/spyware-gulf/.
 ‘’How BAE sold cyber-surveillance tools to Arab states,’’ BBC,
June 15, 2017, https://www.bbc.com/news/world-middle-east-40276568.
 TOI STAFF, ‘’Report: Israel pushed NSO spyware to Gulf states to help track dissidents,’’ Times of Israel, August 23, 2020, https://www.timesofisrael.com/report-israel-pushed-nso-spyware-to-gulf-states-to-help-track-dissidents/.
 Bill Marczak, John Scott-Railton, Sarah McKune, Bahr Abdul Razzak, and Ron Deibert, ‘’Hide, and Seek. Tracking NSO Group’s Pegasus Spyware to Operations in 45 Countries,’’ Citizen Lab, September 18, 2018, https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/.
 For example, UAE spy firm DarkMatter, is known for hiring foreign expertise, including U.S. intelligence operatives.
 Christopher Bing, Joel Schectman, ‘’Special Report: Inside the UAE’s secret hacking team of U.S. mercenaries,’’ Jan 30, 2019, Reuters, https://www.reuters.com/article/us-usa-spying-raven-specialreport-idUSKCN1PO19O.
 Mark Mazzetti, Nicole Perlroth and Ronen Bergman‘’It Seemed Like a Popular Chat App. It’s Secretly a Spy Tool,’’ August 14, 2020, https://www.nytimes.com/2019/12/22/us/politics/totok-app-uae.html.
 ‘’Qatar crisis: Saudi Arabia and allies restore diplomatic ties with emirate,’’ BBC, January 5, 2021,
 Tarik M. Yousef, Omar H. Rahman, Noha Aboueldahab, Ranj Alaaldin, Adel Abdel Ghafar, Galip Dalay, Yasmina Abouzzohour, Robert P. Beschel Jr., and Nader Kabbani, ‘’What Brookings experts are saying about the breakthrough in the Gulf crisis,’’ January 10, 2021, https://www.brookings.edu/opinions/what-brookings-experts-are-saying-about-the-breakthrough-in-the-gulf-crisis/.
 David D. Kirkpatrick and Azam Ahmed, ‘’Hacking a Prince, an Emir, and a Journalist to Impress a client,’’ New York Times, August 31, 2018, https://www.nytimes.com/2018/08/31/world/middleeast/hacking-united-arab-emirates-nso-group.html.
 DFRLab, ‘’UAE Facebook pages targeted Qatar and Muslim Brotherhood,’’ Medium, October 15, 2019,
  Bill Marczak, John Scott-Railton, Noura Al-Jizawi, Siena Anstis, and Ron Deibert, ‘’Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit,’’ Citizen Lab, December 20, 2020, https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/.
 Declan Walsh and Nada Rashwan, ‘’’’‘We’re at War’: A Covert Social Media Campaign Boosts Military Rulers,’’ Citizen Lab, September 6, 2019, https://www.nytimes.com/2019/09/06/world/middleeast/sudan-social-media.html.
 ‘’In Libya, traditional and social media are used to fuel war,’’ Arab Tyrant Manual, Accessed July 9, 2021, https://arabtyrantmanual.com/in-libya-traditional-and-social-media-are-used-to-fuel-war/.
 Joyce Hakmeh,’’ Cybercrime Legislation in the GCC Countries,’’, Chatham House, July 4, 2018, https://www.chathamhouse.org/2018/07/cybercrime-legislation-gcc-countries/cybercrime-legislation-comparing-global-and-gcc.
 ‘’Decree 68 of 2016, regulating the use of newspapers for electronic media,’’ Cyrilla, Accessed July 9, 2021, https://cyrilla.org/en/entity/szid4nc8pp29pweomkpj5rk9?searchTerm=bahrain.
 ‘’Cloud Computing Regulatory framework,’’ Cyrilla, July 9, 2021, https://cyrilla.org/en/entity/9m28oc1kun5?searchTerm=Saudi%20Arabia&page=12.
 ‘’iTunes Yields To Petition From SMEX And Lebanese Band Al-Rahel Al-Kabir,’’ SMEX, May 21, 2018, https://smex.org/itunes-yields-to-petition-from-smex-and-lebanese-band-al-rahel-al-kabir/.
 ‘’Netflix removes Hasan Minhaj comedy episode after Saudi demand,’’ BBC, January 2, 2019,
 Bill Marczak and John Scott-Railton, ‘’The Million Dollar Dissident, NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender,’’ Citizen Lab, August 24, 2016,
 Access Now Team, ‘’Two years after Khashoggi’s slaying, no accountability for spyware firm or Saudi government,’’ Access Now, October 1, 2020, https://www.accessnow.org/khashoggi-two-years-later/.