VPNs with servers in Egypt

A service provider is any person who provides information and communication technology services to users, including those who process or store information directly or on behalf of others. On request, providers must give national security agencies the technical capabilities to perform their duties as prescribed by law (art. 2, third); failing that carries at least three months’ imprisonment and a fine of EGP 200,000 to 1 million (art. 33).

Breaching the retention duty is fined EGP 5 to 10 million, doubled on recurrence, with possible licence revocation (art. 33). Whether a VPN operator is a service provider under the law is not established.

Article 7 lets the investigating authority order the blocking of a website, inside or outside Egypt, where there is evidence that it publishes content constituting an offence under the law and threatening national security or the national economy, where technically feasible. The order goes to the competent court sitting in chambers within 24 hours, and the court must rule within 72 hours.

In urgent cases the authority may notify the regulator, which instructs the provider to block immediately. A report must reach the investigating authority within 48 hours, failing which the block is void. A blocking order lapses on dismissal of the case or final acquittal, and the order or its execution can be appealed to the criminal court (art. 8).

The law punishes violating family principles or values or the sanctity of private life, and publishing information, news or images that violate a person’s privacy without consent, whether true or false, with at least six months’ imprisonment and a fine of EGP 50,000 to 100,000, or either (art. 25). Linking another’s personal data to content contrary to public morals, or harmful to reputation, carries two to five years (art. 26).

Creating, managing or using a website or private account to commit or facilitate a crime carries at least two years (art. 27). To trace an account, the investigating authority may order a provider to hand over system data, user data and communication logs, for 30 days renewable once (art. 6); refusal is punished by at least six months or a fine (art. 32). Article 3 extends the law to some acts abroad by non-Egyptians.

On the face of the statute, stored data are disclosed only on a justified judicial order (art. 2), investigators’ orders under article 6 must be reasoned and can be appealed to the criminal court sitting in chambers, and blocking orders go to a court within 24 hours.

Against that, article 2 requires providers to give national security agencies the technical capabilities to perform their duties as the law prescribes. The order of the rows is the security score, and a server’s location is not a recommendation.