A new legal instrument governing information technology crimes has entered into force in Oman, broadening the state's capacity to regulate digital conduct far beyond legitimate cybersecurity objectives. Royal Decree No. 61/2026,

published in the Official Gazette on 7 June 2026, frames its prohibitions through elastic concepts — "disturbing public order," "spreading rumors," "harming the prestige of the state" — that defy objective definition. This structural vagueness places independent journalists, human rights defenders, and ordinary citizens at the mercy of prosecutorial discretion, with no reliable means of predicting which digital acts will trigger criminal liability.

The penalties attached to these offenses are severe: custodial sentences extending to fifteen years and monetary sanctions reaching 100,000 Omani rials. Such severity is not calibrated to the gravity of the acts described; rather, it operates as a deterrent mechanism, chilling public discourse and encouraging preemptive self-censorship. The law thus functions less as a tool for protecting public order than as a mechanism for policing political conformity in the digital sphere.

This legislative development is not isolated. It replicates patterns observed across the Gulf and wider Middle East, where cybercrime frameworks have been systematically repurposed to suppress dissent, shield officials from scrutiny, and close the limited civic space that digital platforms once provided. In Oman specifically, precedent exists: the 2011 Information Technology Crimes Law and the 2018 Penal Code were regularly invoked to penalize online criticism, particularly of the Sultan and the ruling family. Independent media outlets reporting on corruption or governance failures have faced sustained pressure. The new law consolidates and extends these existing constraints.

Undefined Offenses and Their Application to Journalism

Article 20 highlights the law's dangerous ambiguity. It criminalizes content that "may" disturb public order or spread "misleading information," punishing hypothetical potential rather than actual harm. Without clear definitions, these expansive terms allow authorities to politically manipulate the law and silence independent reporting that contradicts official narratives.

Where the authorities ascribe an intent to "incite sedition," penalties escalate dramatically: three to ten years' imprisonment and fines between 5,000 and 10,000 Omani rials. The concept of "sedition" is not defined in the text, leaving it open to application against any form of critical commentary, reform advocacy, or peaceful opposition to government policy.

Article 23 operates in parallel, prohibiting "false, malicious, or misleading" news intended to harm the "prestige of the state" or its institutions. By shielding every state authority with undefined terms like "malicious" and "prestige," this provision effectively criminalizes investigative reporting on public administration. Under this article, a journalist documenting procurement irregularities, environmental violations, or police misconduct could face prosecution simply if authorities determine the state's reputation has been diminished.

Investigative Journalism and Source Protection

Article 14 criminalizes the refusal to provide "secret codes of an information technology device" to law enforcement officers. Compelling journalists to surrender passwords and access credentials exposes confidential sources to identification and undermines investigative journalism, which depends upon digital safeguards for sensitive information. Source protection is an ethical and professional obligation essential to the free flow of information; any restriction must be strictly necessary and proportionate in a democratic society.

Article 12 criminalizes the possession, manufacture, or distribution of software or devices capable of concealing digital evidence. This raises serious concerns regarding the potential criminalization of encryption tools and digital privacy protections upon which journalists and human rights defenders rely to secure communications and safeguard sources.

Digital Peaceful Assembly

Article 21 criminalizes unauthorized online calls to gather, strike, or march, carrying prison sentences of up to three years. This directly violates international human rights standards; as the UN Special Rapporteur on freedom of peaceful assembly affirmed, these rights apply fully in the digital sphere and restrictions must be strictly necessary and proportionate. Requiring prior authorization for online mobilization is a sweeping limitation that guts the essence of the right and invites arbitrary enforcement.

A journalist reporting on a labor strike, an activist calling for a peaceful demonstration, or a citizen reposting an invitation to gather may face prosecution and imprisonment under this provision.

Political Criticism and Legitimacy

Article 32 criminalizes "challenging the rights or authority of the Sultan, insulting him personally, or criticizing the Sultan's wife, heir apparent, or children," with penalties of three to ten years' imprisonment and fines up to 5,000 Omani rials. This effectively outlaws political criticism of the ruler and his family, contradicting international standards affirming that public figures, including heads of state, must tolerate a higher degree of scrutiny rather than being shielded by absolute legal immunity.

Article 27 criminalizes "publicly undermining the respect due to the judiciary in a manner that casts doubt on its integrity." This restricts the right of citizens to criticize the judiciary and assess its performance — an essential right in any society committed to accountability and transparency.

Human Rights Defenders and International Engagement

Article 30 penalizes "providing false or misleading information to individuals, organizations, institutions, bodies, or any other entities, if it could harm the interests of the state or damage its reputation." This provision raises grave concerns for human rights defenders who communicate with international organizations and UN mechanisms, as it may be used to criminalize the documentation and reporting of human rights violations to global bodies.

In times of emergency or war, penalties escalate to fifteen years' imprisonment and fines of 100,000 Omani rials. Authorities may exploit any crisis — war, natural disaster, or pandemic — as a pretext to silence voices entirely and foreclose public debate on government policy. Accurate human rights reporting on violations in the Sultanate could be classified as "misleading information," rendering human rights defenders criminals under the law. This violates the right to access international protection mechanisms and undermines Oman's obligations under human rights treaties.

Extraterritorial Jurisdiction and Proportionality

Article 2 applies the law to crimes "even if committed wholly or partly outside the Sultanate of Oman, whenever they harm its interests or persons." This extraterritorial reach threatens Omani journalists and activists residing abroad, exposing them to prosecution for reports or posts published outside the country.

Multiple provisions impose penalties grossly disproportionate to the alleged offenses. Ten years' imprisonment for "challenging the Sultan's rights," or fifteen years for providing information deemed harmful to state interests during emergencies, far exceeds the principle of proportionality required under international human rights law.

The Johannesburg Principles on National Security, Freedom of Expression, and Access to Information establish that restrictions on freedom of expression in the name of national security must be strictly exceptional and cannot be used to shield governments from embarrassment or exposure of wrongdoing. Oman's law contravenes these principles by criminalizing legitimate criticism and reporting.

Regional Pattern

Oman's legislation reflects a broader regional trend in cybercrime lawmaking across the Gulf and wider Middle East. In the United Arab Emirates, cybercrime laws resulted in the ten-year imprisonment of human rights defender Ahmed Mansoor. In Bahrain, activist Nabeel Rajab was sentenced to five years for tweets criticizing airstrikes in Yemen. In Saudi Arabia, penalties of up to five years' imprisonment and fines of three million riyals are imposed for producing or storing information deemed to affect "public order, religious values, or public morals." In Jordan, the Cybercrime Law has been used to prosecute activists for Facebook posts critical of government policy.

Institutional Position

The enactment of Law No. 61/2026 marks a serious departure from the principles of justice. It undermines freedom of expression, erodes digital privacy protections, and deepens democratic regression. Employing vague and expansive criminal provisions to silence journalists, human rights defenders, and political critics does not address national challenges; it entrenches repression, restricts pluralism, and weakens public trust in the rule of law. The criminalization of source protection, encryption tools, and international human rights engagement contravenes binding obligations under the International Covenant on Civil and Political Rights, which Oman acceded to in October 2025. Immediate review of this legislation is essential to ensure compliance with constitutional safeguards and international human rights standards.

Demands Aligned with International Human Rights Principles

Released by:
Women Journalists Without Chains
Geneva, Switzerland —June 22, 2026