VPNs with servers in Morocco

Article 26 of the cybersecurity Law 05-20 (Bulletin officiel of 6 August 2020) requires operators of public telecommunications networks, internet access providers, cybersecurity service providers, digital service providers and internet platform publishers to follow the national authority’s directives on keeping the technical data needed to identify any cybersecurity incident: connection data, logs and security-event traces. The period is one year, which regulation may change. Failure is fined 100,000 to 200,000 dirhams (art. 50).

Decree 2-21-406 of 15 July 2021, applying Law 05-20, makes it a condition for qualifying a cybersecurity service provider that the hosting and processing of sensitive data from its detection and analysis services, and the running of those services, take place exclusively on Moroccan territory.

According to a Stanford WILMAP summary of Law 03-03 of 28 May 2003, the authorities may filter and delete content that disturbs public order by intimidation, force, violence, fear or terror, and intermediaries must block or delete such content once aware of it or on a court order. The telecommunications regulator, the ANRT, implements blocking orders; in October 2013 the Attorney General ordered it to block the Arabic and French versions of a news site.

The 2016 press and publication law carries fines rather than prison, so speech cases are brought under the Penal Code: offending the king (art. 179), insulting public officials (art. 263) and insulting constituted bodies (art. 265) have been charged together. According to the same summary, article 218-5 makes the author of an apology for terrorism, and anyone who helps disseminate it, liable, which is understood to include site owners and internet service providers.

Reports from 2022 record a sentence of four years for “disrespecting the king” and one of two years for insulting public officials in the exercise of their duties, in cases arising from online criticism.

Article 24 of the constitution makes private communications secret and provides that only justice can authorise, under the conditions and in the forms the law sets, access to their content, its disclosure or its use as evidence; article 25 guarantees freedom of thought, opinion and expression. Article 92 of Law 24-96 punishes anyone in the telecommunications sector who violates the secrecy of correspondence.

The order of the rows is the security score, and a server’s location is not a recommendation.