The Egyptian Human Rights Forum has released a 55-page report titled “Programming Silence: How Do Laws Restrict Digital Rights in Egypt?”, examining how legislation enacted between 2003 and 2025 built a system of control over digital space at the expense of the safeguards enshrined in the 2014 Constitution.
The report traces this system across thirteen areas, from website blocking and online newspaper licensing to mandatory retention of users’ data, the criminalisation of encryption and possession of telecommunications equipment and drones, and the new Criminal Procedure Law, whose implementation parliament postponed until October 2027.
It concludes that the crisis begins not with an absence of constitutional provisions but with their translation into laws that redefine the boundaries of rights through flexible criteria such as “national security”, “public order” and “family values”, allowing intervention first and review afterwards.
A constitution that protects, provisions that exempt
The report begins with the constitutional framework. Article 65 guarantees expression “through speech, writing, imagery, or other means of expression and publication”, wording that encompasses posts, videos, podcasts and blogging without requiring an internet-specific provision. Article 70 guarantees freedom of electronic publication and the right to establish digital media. Article 71 prohibits the censorship, confiscation, suspension and closure of newspapers and media outlets except “in times of war or general mobilisation”, and bars custodial penalties for publication offences except incitement to violence, discrimination and attacks on personal honour.
Article 68 makes official information and documents “the property of the people” and requires the state to digitise them “by all modern means and tools”. Article 57 prohibits accessing or monitoring electronic correspondence except “by a reasoned judicial order, for a specified period”, requires the state to protect citizens’ right to use public communications services, and prohibits their arbitrary disruption or denial. Articles 94, 95, 97 and 99 add the rule of law, the principle of legality in offences and penalties, and a ban on shielding administrative decisions from judicial review; they also make violations of private life an offence not subject to a statute of limitations. Article 31 incorporates information-space security into national security and leaves its measures to legislation, while Article 92 prohibits laws restricting rights in ways that impair their essence. Article 93 gives ratified international treaties the force of law, including the International Covenant on Civil and Political Rights, whose Article 19 guarantees freedom of expression and Article 17 prohibits arbitrary interference with privacy and correspondence.
The report finds that some subsequent legislation approached digital space “through the logic of authoritarian control rather than the safeguarding of rights”. It identifies five laws that carried this shift: the laws regulating media and the press, counterterrorism, combating information technology crimes, personal data protection, and telecommunications regulation and its amendments.
Three routes to blocking
The report documents that widespread blocking began on 24 May 2017 without an official announcement identifying the authority that issued the decision or its legal basis. It then gradually expanded to encompass political and rights platforms, technical services and tools for circumventing blocks, according to a paper by Masaar.
It says blocking is not confined to one law but is spread across three routes. The criminal route began with Counterterrorism Law No. 94 of 2015, the first law explicitly to provide for blocking. Its Article 29 imposes aggravated imprisonment of at least five years on anyone who establishes or uses a website to promote terrorist ideas or “mislead the security authorities”, and at least ten years on anyone who unlawfully accesses a government website. Article 49 empowers the prosecution to suspend or block these websites. The Anti-Cybercrime Law, No. 175 of 2018, then introduced two procedures in Article 7: a blocking order issued by an investigating authority must be submitted to a court sitting in chambers within 24 hours, with a decision due within 72 hours; and an urgent procedure in which police authorities notify the National Telecommunications Regulatory Authority (NTRA), which instructs the service provider to impose an immediate temporary block. The record must be submitted to the investigating authority within 48 hours, or the block is deemed never to have existed. The report notes that the service provider implements the block immediately, encouraging excessive compliance and an expanded scope to avoid liability.
The regulatory route lies in Press and Media Regulation Law No. 180 of 2018. Article 3 prohibits censorship but allows the Supreme Council for Media Regulation to “delete or block offending material” during war or mobilisation. Article 6 permits the blocking of any website without a valid licence. Article 19 extends prohibitions on false news, incitement, hatred, discrimination and denigration of religions to every account or blog with more than 5,000 followers, and allows the council to suspend or block it by its own decision.
The structural route runs through Telecommunications Regulation Law No. 10 of 2003. Although it does not explicitly mention blocking, Article 64 requires operators to provide “technical capabilities” within the network for the armed forces and national security agencies. Article 67 allows the networks of any operator to be placed under the management of the “competent authorities” in “any other cases relating to national security”. Citing Masaar, the report refers to a 2013 Administrative Court judgment blocking YouTube for a month over a film insulting the Prophet, based on a broad interpretation of these two articles. It concludes that this fragmentation leaves digital actors unable to know “which standard will be applied, which authority will act, and under what procedures”.
A 50,000-pound licence, with no tacit approval
The report describes licensing as “closer to a condition of existence than to limited professional regulation”, since an existing website can be treated as an unlawful activity simply because it lacks authorisation. Three texts govern the issue: Law No. 180 of 2018, its executive regulations issued by Prime Ministerial Decree No. 418 of 2020, and the licensing regulations issued by Supreme Council Decision No. 26 of 2020. The law required existing entities to regularise their status within six months of the regulations taking effect.
Licence application forms request details of the owner and legal representative, language, nature of activity, funding sources, and administrative and editorial structure. The report considers this to place the independence of digital initiatives under administrative assessment and allow “disclosure requirements” to be used as leverage. Article 11 of the regulations sets the application fee at EGP 50,000 (about $901) for a website and EGP 250,000 (about $4,507) for a media outlet. Applications are referred to the licensing committee within a week, and the committee prepares its report within thirty days. Article 12 provides for a council decision within ninety days, but this is an administrative deadline whose expiry has no consequences, unlike print journalism, where the council’s silence constitutes tacit approval.
A licence lasts five years and is renewed six months before expiry for the same fee. Article 16 requires licensed websites to retain everything they publish for at least a year and deposit a monthly copy with the council. They must also maintain a copy of their servers inside Egypt at a location that is “secure and known to the council”, which cannot be changed without its approval. Article 5 of the licensing regulations states that all requirements in the forms are “essential conditions”. The report concludes that licensing has shifted from an establishment procedure into a “continuous instrument of discipline” controlling the survival of independent platforms.
From mobile signal boosters to every communications device
The report traces the 2022 amendment to the Telecommunications Law, which the government approved in July that year with the stated aim of increasing penalties for possessing illegal mobile signal boosters. It was then enacted as Law No. 172 of 2022, published in the Official Gazette on 26 December 2022. The amendment replaced the first paragraph of Article 44 and Article 77, extending the prohibition from importation, manufacture and assembly to possession, use, operation, installation and marketing of any “item of telecommunications equipment” without authorisation from the NTRA.
The new Article 77 sets imprisonment of one to five years and a fine of EGP 2 million to EGP 5 million (about $36,000 to $90,000) for importation, manufacture, assembly and marketing, and imprisonment and a fine of EGP 100,000 to EGP 300,000 (about $1,803 to $5,408) for possession, use, installation and operation. Wireless devices covered by a general licence are exempt. Aggravated imprisonment applies if the purpose is to harm national security, penalties are doubled for repeat offences, and confiscation applies in all cases.
The report says the relationship between individuals and the law has been reversed from “general permission with a specific prohibition” to “a blanket prohibition with a conditional exception”, while the scope of “equipment” depends on changing lists approved by the regulator.
It warns that the prohibition could cover maintenance, repairs and field testing, putting pressure on spare-parts markets, small workshops and second-hand sales in ways that could produce an “indirect monopolistic effect”. It could also prompt network and information security researchers to avoid particular projects or move them abroad, and increase the risk of selective enforcement because most equipment has dual uses.
Four layers of surveillance
The report identifies mass surveillance as a “permanent operational capacity” resting on four layers. The first is technical access within networks under Articles 64 and 67 of the Telecommunications Law. According to the report, Egypt has no independent oversight of the limits on requests or their documentation. The second is mandatory retention under Article 2 of the Anti-Cybercrime Law: service providers must retain for 180 days data identifying users, content data under their control, communications traffic, terminal equipment data, and any other data specified by the regulator’s board. They must provide national security agencies with “all technical capabilities” upon request.
The report finds that this metadata, even without content, maps circles of communication and patterns of movement precisely, transforming surveillance “from collection on suspicion into advance collection about everyone, followed by later searches of the stored data”.
The third layer is the expansion of interception powers under Criminal Procedure Law No. 174 of 2025, which shifted the centre of gravity from strict judicial oversight to the Public Prosecution. The fourth is Article 46 of the Counterterrorism Law, which permits the prosecution in terrorism cases to authorise monitoring of conversations and messages and recording of what takes place in private locations for thirty days, renewable for “one or more further periods”. The report warns that the broad definition of terrorism brings political and journalistic communications within this framework, and that the vast stockpile of data increases the risks of leaks and breaches.
The report says Personal Data Protection Law No. 151 of 2020 has a “modern appearance”, but Article 3 of its promulgating provisions excludes six categories: data processed for personal use; for official statistics or pursuant to a legal provision; for media purposes, subject to accuracy and without prejudice to media laws; data in arrest records, investigations and lawsuits; data held by national security agencies and “whatever they deem necessary for other considerations”; and data held by the Central Bank and entities under its supervision, except money transfer and currency exchange companies.
The same article requires the Data Protection Centre, at the request of national security agencies, to notify a controller or processor to amend, erase or block data within a specified period, and the controller must comply. Citing a joint paper by Masaar and the Egyptian Initiative for Personal Rights, the report adds that the executive regulations created a network of licences and permits for controllers and processors, and a dedicated channel for reporting breaches “related to considerations of national security protection” in coordination with security agencies. It concludes that privacy “is mentioned as a right, before routes to exemptions are opened that tie the ceiling of protection to the structure and channels of power”.
A 1937 law pursues today’s posts
The report describes Penal Code No. 58 of 1937 as one of today’s most effective tools for restricting digital rights, because Article 171 defines publicity to include “any other means”. A post, comment or video can therefore be treated as public publication even if intended only for friends.
On false news, Article 102 bis punishes anyone who deliberately disseminates false news or rumours liable to disturb public security, spread fear or harm the public interest with imprisonment and a fine of EGP 50 to EGP 200, and a prison sentence and a fine of EGP 100 to EGP 500 in wartime. It also extends to possession of publications and printing and recording equipment prepared for that purpose. Article 188 punishes publication “in bad faith” with up to one year’s imprisonment and a fine of EGP 5,000 to EGP 20,000 (about $90 to $361). The report considers “bad faith” a discretionary assessment that is difficult to refute. Article 80(d) punishes any Egyptian who disseminates false news abroad that undermines confidence in the state’s finances or its standing with six months to five years’ imprisonment and a fine of EGP 100 to EGP 500. Given the internet’s cross-border nature, this provision can apply to posts accessible outside Egypt.
On insult and defamation, Article 303 punishes defamation with a fine of EGP 5,000 to EGP 15,000, rising to EGP 10,000 to EGP 20,000 if directed at a public official because of their duties. Article 306 punishes insult with a fine of EGP 2,000 to EGP 10,000. Article 307 doubles fines for publication in newspapers, while Article 308 increases the penalty to both imprisonment and a fine for attacks on personal honour or “damage to family reputations”. On affronts to officials and institutions, Article 133 punishes insulting a public official with up to six months’ imprisonment or a fine of up to EGP 200; Article 185 punishes abuse of a public official with a fine of EGP 10,000 to EGP 20,000; Article 179 punishes insulting the president with a fine of EGP 10,000 to EGP 30,000 (about $180 to $541); and Article 184 punishes insulting parliament, the army, courts and authorities with imprisonment and a fine of EGP 5,000 to EGP 10,000. The report also cites Article 98(f), concerning exploitation of religion and contempt of religions, punishable by six months to five years’ imprisonment, and Article 178 on material “offending public decency”, punishable by up to two years’ imprisonment and a fine of EGP 5,000 to EGP 10,000.
The report finds that content creators face two routes. The first is regulatory: under Article 19 of the Media Law, any account with more than 5,000 followers is reclassified as a public publishing medium that the Supreme Council may suspend or block. Intervention occurs first and is then challenged before the administrative courts. The second is criminal, through the Anti-Cybercrime Law. Article 24 punishes fabricating an account and falsely attributing it to another person with at least three months’ imprisonment and a fine of EGP 10,000 to EGP 30,000. This rises to at least one year’s imprisonment and a fine of EGP 50,000 to EGP 200,000 (about $901 to $3,606) if the account harms the person to whom it is attributed, and to a prison sentence and a fine of EGP 100,000 to EGP 300,000 if the offence targets a public legal entity. Citing a Masaar paper published in May 2021, the report warns that the provision could extend to satirical accounts and pseudonyms.
Article 25 combines “violations of family principles or values”, privacy violations and large volumes of unsolicited messages under one penalty: at least six months’ imprisonment and a fine of EGP 50,000 to EGP 100,000. The report draws on the Egyptian Initiative for Personal Rights’ December 2025 report “Disciplining Society”, which interpreted this article as an instrument of social control “with class and gender effects”.
Terrorism: when official statements become the truth
The report says the Counterterrorism Law redefines the entire digital space “as a security domain”, beginning with the definition in Article 2, which extends to threats and intimidation intended to “disrupt public order”. Article 28 imposes at least five years’ imprisonment for direct or indirect promotion of a terrorist offence, and seven years if it occurs in places of worship or among members of the army and police. The penalty also applies to possession of printing and recording equipment. Article 35 imposes a fine of EGP 200,000 to EGP 500,000 (about $3,606 to $9,014) on anyone who publishes news about terrorist operations or counterterrorism operations “contradicting official statements issued by the Ministry of Defence”, with the possibility of a one-year professional ban. The report finds that this provision makes “truth a matter of administrative decision rather than the result of independent investigation”, and restricts investigative journalism and reporting based on witnesses and unofficial sources.
Criminal procedure: surveillance, tracking and remote trials
The report recalls that Criminal Procedure Law No. 174 of 2025 was passed after amendments to articles to which the president had objected, and was published on 12 November 2025. It was due to take effect on 1 October 2026 before parliament agreed on 30 September 2026 to postpone it by a year. It says the law codifies “practices to which the authorities have become accustomed” in recent years and identifies five routes affecting digital rights.
Article 117 gives a chief prosecutor the power to issue a reasoned order, valid for thirty days and renewable, to monitor communications, social media accounts “not available to everyone”, email, and text, voice and image messages on phones. Article 114 adds “the use of technical means to track the accused” to alternatives to pretrial detention, through a decision by the justice minister in coordination with the interior and communications ministers. The report describes this as shifting deprivation of liberty “from the place of detention to digital infrastructure”. The same article permits prohibiting an accused person from contacting people “in any form whatsoever”, a phrase that encompasses phones, apps and email. Article 232 establishes telephone notification centres under the Justice Ministry that obtain the accused person’s national ID and telephone numbers, while Article 233 leaves proof of receipt of notifications to a ministerial decision. The report warns against equating technical delivery of a message with the accused person’s actual knowledge, disregarding ownership or changes of the telephone line, a malfunctioning phone, or being outside the country. Articles 530 to 537 regulate remote investigations and trials, including consideration of pretrial detention, and empower investigating and trial authorities to record and retain hearings without defendants’ or witnesses’ signatures. According to the report, the state thus becomes the sole holder of evidence of what occurred, and the defence must ask its adversary for a copy of the recording if a violation takes place.
The report returns to Article 67 of the Telecommunications Law as the oldest framework for cutting communications, since it transfers management of the network itself to the state in disasters, general mobilisation and “any other cases relating to national security”, without defining the “competent authorities” or imposing limits on duration, geographical scope or proportionality. Although Article 25 requires licensees to maintain service, Article 82 imposes imprisonment on those who fail to comply with requisition orders, and a prison sentence in wartime or mobilisation. The report cites the nationwide shutdown of internet and communications on 28 January 2011, drawing on the Association for Freedom of Thought and Expression’s March 2018 paper “Isolation”.
Article 64 of the Telecommunications Law requires both operators and users not to use any devices to encrypt telecommunications services without approval from the regulator, the armed forces and national security agencies, except for radio and television broadcasting. Article 81 punishes violations with imprisonment and a fine of EGP 10,000 to EGP 100,000 (about $180 to $1,803), along with temporary suspension of the licence. The report finds that ambiguity over what “constitutes an encryption device” encourages journalists, researchers and activists to avoid protective tools. It identifies a paradox in the Anti-Cybercrime Law’s executive regulations, which require service providers to encrypt data using AES-128 and a key of at least 128 bits that they retain: “managed” encryption within the compliance system, alongside restrictions on encryption controlled by users.
Drones: possession is a crime until the Defence Ministry permits it
The report presents Law No. 216 of 2017 as a model of “criminalising technology”. Article 1 defines a drone as any object that flies without a pilot, “whatever its shape or size”, and can carry something that “poses a threat to national security”, and designates the Ministry of Defence as the competent authority. Article 2 prohibits public and private entities and individuals from importing, manufacturing, assembling, trading, possessing or using drones without a permit.
The executive regulations, issued by Prime Ministerial Decree No. 931 of 2018, require applications to be submitted to the Armed Forces Operations Authority, treat thirty days without a response as a refusal, and provide for permits lasting no more than three years, to be renewed three months before expiry. Permit holders must keep two registers reviewed by specialists designated by the ministry and notify it within three days if the activity ends. Appeals are considered by a committee formed by the defence minister. Security approvals and Civil Aviation Ministry approval are required according to whether the purpose is economic, sporting or research-related. Universities are exempt only if they include an aviation department. According to Masaar, even exempt very light aircraft require a customs report and Defence Ministry review within thirty days.
Article 3 imposes one to seven years’ imprisonment and a fine of EGP 5,000 to EGP 50,000 (about $90 to $901), or either penalty; life imprisonment if the purpose is terrorist; and the death penalty if a death results, with confiscation in favour of the armed forces. Article 4 gives members of the military judicial police law-enforcement powers, and the law assigns jurisdiction to the military judiciary. The report warns that this model “can be extended to other technologies”.
Nine recommendations
The Forum calls for blocking and suspension to be tied to specific criteria and for “national security”, “imminent danger” and “family values” to be defined. It urges reasoned written notice, immediate appeal before an independent judge, suspension of the measure on appeal where serious harm results, and publication of periodic data on blocking orders. It also calls for an end to costly prior licensing of independent news websites, proportionate fees, silence to count as approval, and reduced archiving and server localisation requirements. It urges shorter and narrower data-retention requirements, access tied to a reasoned judicial order, narrower exemptions under the Data Protection Law, and stronger independence for its enforcement body.
It also calls for review of false-news offences, reduced imprisonment in publication cases, and civil alternatives for insult and defamation; protection of encryption and anonymity “as security tools, not grounds for suspicion”; and a shift in telecommunications equipment and drone regulation towards distinguishing levels of risk and exempting maintenance and research. Before the Criminal Procedure Law takes effect in October 2027, it calls for implementing safeguards for digital tracking and remote trials that protect confidentiality, defence rights and the integrity of recordings.
The report concludes that the problem “lies less in the absence of provisions than in the absence of clear operational limits” that prevent exceptions from becoming everyday practice. It says the state’s presence should be measured not by the breadth of its power to intervene, but by its ability to manage risks “without turning society into a permanent circle of suspicion”.
Neither the Egyptian government, the Supreme Council for Media Regulation nor the NTRA had commented on the report at the time this coverage was prepared.
