Iran - Computer Crimes Law (CCCCXXX/2009)

Overview

The Computer Crimes Law (Law on Computer Crimes), approved by the Islamic Consultative Assembly on 5/3/1388 (Solar Hijri) (5 Khordad 1388 — 26 May 2009) and published in the Official Gazette (No. 18742), adds a dedicated set of computer-related offences and penalties to Book Five (Ta'zirat) of the Islamic Penal Code. The law establishes criminal prohibitions and penalties related to unauthorized access, unlawful interception and monitoring of communications, interference with computer and telecommunications systems and data, publication or distribution of unlawful or immoral material via computer or telecom systems, and auxiliary offences related to the operation and custodianship of protected systems. The statute assigns implementing obligations to competent ministries and law-enforcement bodies and provides for procedural interaction with the Criminal Procedure Code. (See original summaries and commentary at https://www.iranrights.org/fa/library/document/2741/?utm_source=openai.) The full text of the law as referenced in the original material is available at: https://iranhrdc.org/islamic-republic-of-iran-computer-crimes-law/.

Definitions

The statute sets out key conceptual definitions used throughout the law, including but not limited to: "data" (with subcategories such as "secret data" where disclosure would harm national security or national interests); "computer/telecommunications systems and networks"; and the notion of systems or data "protected by security measures" (that is, subject to technical or administrative protections). These definitions determine when access or use is unlawful and the applicable offences. The law further empowers executive organs to prepare implementing regulations covering classification and handling of secret data and related technical criteria. (See the statutory definitions and implementing-authority provisions in the enacted text and accompanying explanatory material referenced in the original sources: https://www.iranrights.org/fa/library/document/2741/?utm_source=openai.)

Governance and Institutional Framework

Enforcement and operational governance under the law involve multiple state actors. Core institutions identified by the law and subsequent implementation practice include the judiciary (including prosecutors and courts handling computer-crime matters), law-enforcement units (notably police cyber units), and several ministries with defined coordination or rulemaking roles — in particular the Ministry of Justice and the Ministry of Communications and Information Technology. The law contemplates inter-ministerial cooperation for technical and evidentiary rules, and envisages committees or decision-making bodies responsible for classification, content determination and the blocking or restriction of access to specified online content where the law provides the legal basis. Subsequent institutional developments (specialised cyber police, prosecutorial units and unified judicial rulings) have been reported in implementation accounts and secondary analyses. (See original references: https://www.iranrights.org/fa/library/document/2741/?utm_source=openai and commentary cited in the original detailed summary.)

Key Focus Areas

• Unauthorized access: criminalization of access to data or computer/telecommunications systems that are protected by security measures.
• Unlawful interception and monitoring: offences covering interception or monitoring of communications in transit without lawful authority.
• Breach of protected or classified data: provisions penalizing breach of security measures to obtain classified, secret or sensitive data.
• Content distribution and publication: prohibition on publication or distribution of unlawful or "immoral" material via computer or telecom systems, with blocking and censorship mechanisms envisaged.
• Operator and custodian responsibilities: liability for persons responsible for protected systems whose negligence facilitates offences; obligations to maintain reasonable security measures.
• Evidence and procedural matters: assignment of duties to ministries to issue rules on collection, validation and preservation of electronic evidence; procedural interaction with the Criminal Procedure Code.
• Corporate and administrative sanctions: administrative measures available against legal persons (temporary suspension, dissolution, and other sanctions) alongside custodial and monetary penalties for natural persons.

Implementation Framework

The law requires public bodies and private operators to adopt and maintain reasonable security measures for systems and data. Competent ministries (notably the Ministry of Justice in cooperation with the Ministry of Communications and Information Technology) were given timelines to prepare implementing regulations and procedural rules — for example, on evidentiary standards and electronic evidence collection. Obligations also include log-keeping, cooperation with judicial orders, and adherence to decisions of authorised committees tasked with content classification or blocking. Procedural rules not specifically provided by the law defer to the general Criminal Procedure Code. The law provides mechanisms for seizure of equipment, blocking access to specified content, and other procedural measures to support enforcement and evidence preservation. (See the law’s implementation provisions and the implementing obligations originally summarized at https://www.iranrights.org/fa/library/document/2741/?utm_source=openai.)

Monitoring and Evaluation

Monitoring and evaluation of compliance and enforcement under the law are implemented through judicial oversight, dedicated prosecutorial units, and law-enforcement cyber units. The law envisages inter-agency and ministerial coordination to issue technical and evidentiary regulations and contemplates committees or high-level decision-making bodies for content classification and blocking. Public reporting and analyses since enactment have documented active enforcement, the institutionalisation of website-blocking processes, and the development of case law and unified rulings that shape evidentiary and jurisdictional practice. Specific formal monitoring and evaluation mechanisms (such as periodic public reports or independent oversight bodies) are not detailed in the original summary and would depend on subsequent implementing regulations and institutional practice. (Original commentary and reporting referenced in the detailed summary: https://www.iranrights.org/fa/library/document/2741/?utm_source=openai and related implementation accounts.)

Penalties, Liability, and Appeals

The law prescribes a range of penalties and remedies. Criminal sanctions include custodial sentences of varying lengths depending on offence category and culpability, and monetary fines (amounts specified in statute and subject to periodic adjustment mechanisms tied to official inflation indices). The statute also provides for administrative sanctions against legal persons — including temporary suspension or dissolution depending on the severity and recurrence of violations. Procedural enforcement tools include seizure of equipment and court-authorised blocking of access to content. The law assigns criminal liability to responsible individuals for failures to implement required security measures and for negligent custodianship of protected systems. Appeal routes and appellate jurisdiction operate through the judiciary’s standard procedures (including any special appellate or unified-ruling processes applicable to penal matters), with procedural interaction governed by the Criminal Procedure Code and subsequent judicial rulings. (See statutory penalty provisions and procedural interaction discussed in the original source material: https://www.iranrights.org/fa/library/document/2741/?utm_source=openai.)

Relationship to Other Instruments

The Computer Crimes Law was integrated into Book Five (Ta'zirat) of the Islamic Penal Code and therefore interacts directly with the general penal provisions of the consolidated code. It also interfaces with the Criminal Procedure Code for procedural matters not specially provided by the law. The statute sits alongside other sectoral laws, such as intellectual property statutes and other regulatory provisions related to data protection or telecoms, and is shaped by subsequent amendments, judicial unity rulings and prosecutorial guidelines that influence jurisdiction, evidentiary standards and enforcement practice. The law provides that where acts involving computer systems are not specifically penalized by its provisions, other applicable criminal laws may be applied. (See integration and interaction notes in the original material: https://www.iranrights.org/fa/library/document/2741/?utm_source=openai.)

International Alignment

The original statutory text and the summarized material do not set out explicit commitments to or alignment with international instruments (treaties or supranational regulatory frameworks) within the law’s text as summarized. Implementation and interpretation interact primarily with domestic instruments (the Islamic Penal Code and the Criminal Procedure Code) and with domestic implementing regulations issued by Iranian ministries and judicial bodies. Where external alignment or international cooperation mechanisms exist, they are not identified in the original summary and would be a matter for separate treaty practice or bilateral/multilateral cooperation outside the core statutory provisions. (No international organisation or treaty sources were cited in the original material: see the original references noted at https://www.iranrights.org/fa/library/document/2741/?utm_source=openai.)

Implementation Timeline

Sources and References