A leaked copy of Tunisia's new cybercrime draft law shows signs that the country's major achievements in the field of Internet freedom may soon come undone. It is unclear whether the text, leaked on July 23, represents a final draft. It is similarly unclear whether the National Constituent Assembly will have sufficient time to debate or adopt the law, as fresh legislative elections are due to be held on October 26. The bill has not been submitted to the Assembly yet, but it has provoked many a raised eyebrow among Tunisian netizens. Lawyer Kais Berrjab tweeted: la loi relative à la lutte contre la cyber-criminalité = une arme de destruction massive entre les mains de tout pouvoir en place. #tunisie — Kaïs Berrjab (@OstezEdgar) July 23, 2014 The anti-cybercrime law = an arm of mass destruction in the hands of any authority in place What's wrong with the bill? Vague and broad provisions in the bill could allow for the violation of user rights to privacy and free speech. Article 24 provides a six-month imprisonment and TND5000 (about USD 2900) fine to anyone who uses “information and communications systems to spread content showing obscene acts and assaulting good morals.” The punishment increases to a three-year jail term if the content in question “incites to immorality”. Le prochain Belaid ne sera pas assassiné. Il sera emprisonné pour atteinte aux bonnes moeurs. #A2T — Habib M. Sayah (@Habsolutelyfree) July 23, 2014 The next Belaid [in reference to left-wing politician Chokri Belaid assassinated in 2013] will not be assassinated, but will be imprisoned for assaulting good morals Article 25 punishes with five years’ imprisonment and a TND 50,000 fine anyone who “deliberately uses an information system to process others’ personal data, to link it to content that is contrary to good morals or feature it in a way which would damage their reputation or prejudice their esteem.” It is easy to imagine how such a law could be used to target bloggers or journalists writing about politicians’ activities. Chapter four on “public security and national defense measures” gives the Ministries of Defense and Interior unchecked and broad powers to access, collect or intercept communications data without judicial control. Article 30 states the following: Public authorities tasked with maintaining public order and national defense can exceptionally, and in accordance with the provisions of the fourth chapter of this law, access data stored in public or private databases, collect communications traffic or intercept, copy and store communications content to prevent organized and terrorist crimes… Under article 31, Ministers of Interior and Defense can authorize in written form access to data related to the identification of users and collection of traffic data. The draft further provides for heavy sentences for activities related to malicious hacking. Six years in jail and a TND 50,000 fine is the punishment for anyone found guilty of “deliberately impeding the functioning of an information system by introducing, sending, damaging, changing, deleting, canceling or destroying information data.” The bill's purpose The bill on Communications and Information Crimes is a project of the previous interim government of Ali Laarayedh. Indeed, former ICT minister Mongi Marzouk affirmed on several occasions that his ministry was working on a draft cybercrime law. The bill aims to consolidate the legal framework under which the Technical Telecommunications Agency (better known by its acronyms ATT or A2T), operates. The ATT was created by government decree (decree n° 2013-4506) last November with the task of providing technical support for judicial investigations into “information and communication crimes”. To this date, there is no comprehensive legal text in Tunisia on cybercrime which defines “information and communication crimes.” The bill would presumably seek to fill this legal void. Last June, ATT general-director Jamel Zenkri told the local magazine Webdo: Pratiquement, tout l’arsenal juridique nécessaire est déjà en vigueur. Il reste cependant une loi relative à la cybercriminalité qui sera bientôt élaborée.Cette loi définira exactement les différents crimes de l’Internet, et en fixera les peines. Elle apportera, aussi, plus de précisions quant aux obligations de l’ATT, lesquelles ne sont pas bien fixées. Par exemple, le décret ne détermine pas la période durant laquelle l’ATT doit conserver les données à caractère personnel avant de le détruire. Practically, all the judicial arsenal necessary [for the ATT to operate] is already into effect. However, there remains the law related to cybercrime which will soon be drafted. This law will define exactly the different Internet crimes and fix the penalties.