Cybercrime Law 2018
Security-focused legislation authorizing website blocking for national security concerns and implementing registration requirements for VPN providers with NTRA.
| Jurisdiction | Egypt |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
The Cybercrime Law 2018 in Egypt includes several key requirements:
- Website blocking: Authorities can block websites deemed to threaten national security or the economy. The law grants broad powers to block content without judicial oversight.
- Data retention: Internet service providers must store user data for 180 days, including browsing history, IP addresses, and other metadata. This data must be provided to authorities upon request.
- VPN registration: VPN providers must register with the National Telecom Regulatory Authority (NTRA). Unregistered VPNs are illegal.
- Social media monitoring: Accounts with over 5,000 followers are subject to monitoring by the Supreme Council for Media Regulation.
- Criminalization of online content: The law criminalizes vaguely defined acts like "threatening national security" or "disturbing public order" online.
Compliance Challenges
Organizations face several challenges in complying with this law:
- Broad and vague definitions: Terms like "national security" and "public order" are not clearly defined, making compliance difficult. Human Rights Watch notes this vagueness allows for arbitrary enforcement.
- Technical implementation of data retention: Storing large amounts of user data securely for 180 days poses technical and financial challenges, especially for smaller ISPs. Access Now highlights the privacy risks this creates.
- VPN compliance: Companies using VPNs must ensure they are registered, which can be challenging for international firms. The Cairo Scene reported on confusion around VPN registration requirements.
- Monitoring social media: Businesses with large social media followings must navigate complex monitoring requirements. Mada Masr documented cases of social media accounts being shut down.
Implementation Best Practices
To implement the law's requirements, organizations should:
- Conduct a data audit: Review what user data is collected and stored. Implement systems to retain required data securely for 180 days. The NIST Cybersecurity Framework provides guidance on data management.
- Register VPNs: Ensure all VPNs used are registered with NTRA. NTRA's website provides registration information.
- Implement content monitoring: For social media accounts over 5,000 followers, implement monitoring systems. Hootsuite's guide on social media monitoring tools may be helpful.
- Review and update policies: Update internal policies to comply with new content restrictions. The Electronic Frontier Foundation's guide on content moderation best practices offers useful insights.
- Train employees: Conduct training on the new law's requirements. SANS Institute offers cybersecurity training relevant to compliance.
Recent Updates
As of 2023, there have been no major amendments to the 2018 Cybercrime Law. However:
- In 2020, Egypt passed a personal data protection law that interacts with the Cybercrime Law's data retention requirements.
- The Supreme Constitutional Court is reviewing challenges to parts of the Cybercrime Law, particularly around website blocking. A ruling is pending.
Related Regulations
The Cybercrime Law interacts with several other Egyptian regulations:
- Personal Data Protection Law: Passed in 2020, this law governs how personal data is collected and processed, interacting with the Cybercrime Law's data retention requirements.
- Media Regulation Law: This 2018 law governs media outlets and works in conjunction with the Cybercrime Law's social media monitoring provisions.
- Anti-Terrorism Law: Amended in 2020, this law expands the definition of terrorism in ways that overlap with the Cybercrime Law's national security provisions.
Industry Impact
The Cybercrime Law has had significant impacts across industries:
- Tech industry: VPN providers and social media platforms have faced new compliance burdens and potential blocks. Some international tech companies have considered leaving the Egyptian market.
- Media and publishing: News websites and blogs face increased risk of blocking, leading to self-censorship and reduced press freedom.
- E-commerce: Online businesses must navigate complex data retention requirements, potentially increasing costs and liability risks.
- NGOs and civil society: Human rights organizations report increased difficulty operating online due to content restrictions and monitoring requirements.
Sources
- TIMEP Brief: Cybercrime Law
- Human Rights Watch: Egypt's New Law Will Crush Online Freedoms
- Access Now: Egypt's new cybercrime law another blow to free expression
- CIVICUS: Egypt "Cyber crime" law another massive blow for freedom of expression
- Cairo Scene: Egypt's Cybercrime Law Explained
- Mada Masr: Parliament passes cybercrime law regulating web content and ISP surveillance
- NIST Cybersecurity Framework
- National Telecom Regulatory Authority (NTRA) of Egypt
- Hootsuite: Social Media Monitoring Tools
- Electronic Frontier Foundation: Content Moderation
- SANS Institute Cybersecurity Courses
- IAPP: Egypt Passes Personal Data Protection Law
- TIMEP Brief: The Law Regulating the Press, Media, and the Supreme Council for Media Regulation
- TIMEP Brief: 2020 Amendments to the Counterterrorism Law
- Reporters Without Borders: New cyber-crime law tightens online censorship
- Lexology: Egypt's Cybercrime Law
Recent developments
- — Analysis of Kenya’s Computer Misuse and Cybercrimes (Amendment) Act 2024, which updates the 2018 cybercrime law with new offences (including phishing, SIM-swap fraud and cyber harassment), expanded duties for critical information infrastructure owners, and broader powers for the National Computer and Cybercrimes Coordination Committee (NC4), while noting that some speech-related provisions remain suspended pending constitutional review.[5] (source)
- — Industry commentary on the practical impact of the amended Kenyan 2018 cybercrime law, highlighting stricter reporting timelines for cybersecurity incidents, higher penalties for ICT-enabled offences, and compliance burdens on banks and telecoms designated as critical information infrastructure.[5] (source)
- — Council of Europe briefing referencing ongoing reforms to national cybercrime laws adopted around 2018, noting that 30–40 countries are currently updating their statutes to align with the Second Additional Protocol to the Budapest Convention, with particular focus on cross-border access to electronic evidence and enhanced cooperation mechanisms.[8] (source)
- — Legal update discussing Egypt’s Law No. 175 of 2018 (Information Technology Crimes / Cybersecurity Law) and recent enforcement trends, including increased use of website blocking and content takedown powers by authorities under its cybercrime and cybersecurity provisions.[2] (source)
- — Industry-focused analysis on how Egypt’s 2018 cybercrime law is affecting cybersecurity operations, with companies strengthening logging, data retention and incident response to mitigate liability risks under offences covering unlawful access, data interference and misuse of personal data.[2] (source)
- — Policy report noting that many 2018-era cybercrime statutes are being revised to modernize definitions of computer-related offences and harmonize them with international standards, leading cybersecurity firms to anticipate tighter obligations on incident reporting and cooperation with law enforcement.[8] (source)
- — U.S. presidential order on combating cybercrime, fraud and predatory schemes, directing Justice Department and other agencies to develop action plans and victim restoration programs that rely heavily on existing cybercrime laws, signaling prospective updates to investigative and cross-border enforcement practices relevant to cybersecurity providers.[1] (source)
- — News coverage of Kenya’s controversial amendments to the Computer Misuse and Cybercrimes Act 2018, emphasizing expanded government powers to shut down or delete websites and apps hosting unlawful content and imposing up to 10-year prison sentences or heavy fines for sharing electronic content likely to cause fear or incite violence.[3] (source)
- — Report on strong civil society and tech-industry reactions to Kenya’s 2018 cybercrime law amendments, with critics warning of potential misuse against dissent and online activism, while regulators argue the changes are necessary to tackle terrorism, extremism and online abuse on social media platforms.[3] (source)
- — Legal commentary describing how suspension of select harassment and “false information” clauses in Kenya’s amended 2018 cybercrime law has temporarily eased compliance pressure on businesses and individuals posting online, even as other updated cyber-fraud and critical infrastructure provisions remain fully enforceable, impacting corporate cybersecurity strategies.[5] (source)
Related regulations
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
- Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
Put it into practice
- Generate the policy: NIST CSF policy generator (generatepolicy.com)
- Buy the policy pack: Enterprise Security Bundle (cyberpolicy.shop)
- Build it yourself: Compliance Program Starter (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates