Jordanian Cybercrime Law No. 17 of 2023: Offenses and Penalties

A single post on a social platform, a threatening message or an impersonated account may place its author before a penalty that starts with a fine of hundreds of Jordanian dinars (JOD) and reaches temporary labor, depending on the article under which the act is characterized. This field is governed in Jordan by Cybercrime Law No. 17 of 2023, which was published in the Official Gazette on August 13, 2023 and repealed Cybercrime Law No. 27 of 2015, tightened the penalties for many forms of criminal conduct and introduced new ones. Because a single act may carry more than one description under this law, and because digital evidence is preserved or lost in the first days, presenting the file to a lawyer specializing in cybercrime before any statement or complaint is often what determines the article under which the file will be heard.

1. What Is a Cybercrime Under Jordanian Law

A cybercrime within the framework of Law No. 17 of 2023 is a criminalized act committed by means of the information network, an information system or one of the information technology means, or one that targets these systems themselves. Article 2 defines "information system" broadly to include software, applications and social media platforms, so the phone, the application and the personal account have all come within the scope of the law.

This field rests on two layers that the lawyer distinguishes from the first reading of the file:

• Offenses provided for by the law itself with specific penalties, such as unauthorized access, blackmail, online fraud and publishing private images.
• Offenses set out in other legislation that are committed by electronic means, punishable by the penalty provided in that legislation under Article 26, while the harsher penalty in any other law remains applicable under Article 30.

Moving from one layer to the other changes the applicable provision, and with it the amount of the penalty.

2. What the 2023 Law Changed

The law came into force thirty days after its publication and replaced the 2015 law entirely. Among the most prominent things it introduced:

• Impersonated accounts in Article 5, whether the account is falsely attributed to an ordinary person or to an official body.
• "Character assassination" in Article 16, as an offense separate from defamation (dhamm), slander (qadh) and insult (tahqir) in Article 15.
• Fabricating and altering private images and clips in paragraph (b) of Article 20.
• The liability of the administrator of a page, group or channel for the unlawful content in it, under Article 25.

The minimum fines in most articles are now in the thousands, so the cost of an error in characterization has risen considerably compared with what it was under the repealed law.

3. Table of Cybercrime Penalties in Jordan

The table brings together the main offenses of Law No. 17 of 2023 by article, with the penalty as set by the text:

Article	Criminalized act	Prescribed penalty
3(a)	Intentionally entering or accessing a network or information system without authorization	Imprisonment from one week to three months, or a fine of 300 to 600 dinars, or both
3(b)	Access with the intent of deleting, altering or publishing data or disabling the system	Imprisonment from three months to one year and a fine of 600 to 3,000 dinars; if the result occurs: imprisonment from one to three years and a fine of 3,000 to 15,000 dinars
4(a)	Accessing the systems of ministries, security or financial institutions or critical infrastructure and viewing data affecting national security	Imprisonment from six months to three years and a fine of 2,500 to 25,000 dinars
4(b)	Accessing those systems with the intent of destroying, altering or publishing their data	Temporary labor and a fine of 5,000 to 25,000 dinars; if the result occurs: temporary labor for not less than five years and a fine of 25,000 dinars
5(a)	Creating an account, page or channel and falsely attributing it to a natural or legal person	Imprisonment for not less than three months, or a fine of 1,500 to 15,000 dinars, or both
5(c)	Falsely attributing the account or website to an official body or a public official	Not less than temporary labor, and a fine of 15,000 to 45,000 dinars
6	Introducing or using a malicious program to destroy data or disable systems	Imprisonment for not less than six months and a fine of 2,500 to 10,000 dinars
7	Intercepting data or capturing its content without right	Imprisonment for not less than six months and a fine of 1,500 to 6,000 dinars; on disclosure of what was intercepted: imprisonment for not less than one year and a fine of 3,000 to 6,000 dinars
8	Obtaining or using electronic payment data	Imprisonment from one to three years and a fine of 2,500 to 10,000 dinars; on appropriating another's property: imprisonment for three years and a fine of 10,000 to 20,000 dinars
9	Attacking money-transfer systems or banking services	Temporary labor for not less than five years and a fine of 25,000 to 75,000 dinars
10	Appropriating another's property fraudulently or under a false name via the network	Imprisonment for not less than one year and a fine of 5,000 to 25,000 dinars; attempt is punished by the same penalty
12	Manipulating the IP address to commit or conceal an offense	Imprisonment for not less than six months or a fine of 2,500 to 25,000 dinars
13(a)	Publishing or promoting pornographic material via the network	Imprisonment for not less than six months or a fine of 3,000 to 6,000 dinars
15	Publishing false news targeting national security and social peace, or defaming, slandering or insulting any person	Imprisonment for not less than three months, or a fine of 5,000 to 20,000 dinars, or both
16	Attributing acts to a person without right in a way that amounts to character assassination	Imprisonment for not less than three months, or a fine of 5,000 to 20,000 dinars, or both
17	Publishing what incites sedition, strife or hatred, calls for violence or shows contempt for religions	Imprisonment from one to three years, or a fine of 5,000 to 20,000 dinars, or both
18(a)	Blackmail or threats to compel a person to act or refrain from acting, or to obtain a benefit	Imprisonment for not less than one year and a fine of 3,000 to 6,000 dinars
18(b)	Threatening to commit an offense or to attribute matters offensive to honor, with an express or implied demand	Temporary labor and a fine of 5,000 to 10,000 dinars
20(a)	Publishing a private image, recording or video with the intent of defamation, harm or gain	Imprisonment for not less than three months and a fine of 20,000 to 40,000 dinars
20(b)	Fabricating or altering a private image or clip with the same intent	Imprisonment for not less than two years and a fine of 25,000 to 50,000 dinars
21	Requesting or accepting a benefit to publish unlawful content or false news	Imprisonment from one to three years and a fine equal to the value of what was requested or accepted, but not less than 5,000 dinars
22	Collecting money from the public electronically to invest it without a license	Imprisonment for not less than three months and a fine of 5,000 to 15,000 dinars, with return of the funds
23	Promoting the collection of donations electronically without a license	Imprisonment from six months to one year and a fine of 3,000 to 5,000 dinars

The table alone is not enough to know the fate of a particular file. A message carrying a private image together with a demand for money may be read as blackmail under Article 18 or as publishing private matters under Article 20, and an impersonated account used to collect money may combine Articles 5 and 10 together. Choosing the provision best suited to the facts is itself a legal question that merits consultation, because the difference between two descriptions may be the difference between imprisonment and temporary labor.

4. When the Cybercrime Penalty Is Doubled and When It Is Reduced

The penalty does not stop at the limits in the table. Article 28 provides for doubling the penalties set out in the law in four cases:

• If the offender committed the offense by exploiting their position, work or powers.
• If there are multiple victims.
• If any of the offenses in this law is committed repeatedly.
• If the offense was committed for the benefit of a foreign state or an unlawful organization.

A post that reaches more than one person may move the file to a doubled penalty. Conversely, Article 29 allows the court to reduce the penalty by half if the offender provides information about the offense before it is referred to the Public Prosecutor and that information would lead to uncovering the offense or its perpetrators. The lawyer assesses this option carefully before any statement, because its effect depends on its timing and on the content of what is said.

The law widens the circle of liability: Article 27 punishes the accomplice, the accessory and the instigator with the penalty of the principal offender, and Article 25 holds the person who actually administers a public page, group or channel accountable for the unlawful content in it, while excluding personal accounts unless their owner refuses to remove the content after a request from the injured party or the competent authority.

5. The Complaint and the Public Right

Not all cybercrimes are prosecuted in the same way. For publishing pornographic material under item (1) of paragraph (a) of Article 13, prosecution proceeds on the complaint of a victim who has reached eighteen, and the public-right action (the State's right to prosecute) lapses with their pardon. Publishing private images and clips under paragraph (a) of Article 20 is punishable "upon complaint". Offenses under Article 15, however, are prosecuted by the Public Prosecution without the need for a complaint whenever they are directed at one of the authorities of the State, official bodies or public administrations.

The effect of reconciliation or withdrawal therefore differs from one file to another, and whether the waiver of the private right (the victim's personal claim) ends the file or the public right remains in place is a question the lawyer settles after reading the article charged. The same question recurs in property offenses where the traditional description meets the electronic one, as in the offense of fraud under the Jordanian Penal Code.

6. Digital Evidence and Its Evidentiary Weight

In Article 36, the law gives evidence extracted from devices, networks, information systems and service providers evidentiary weight before the courts, and treats the IP address as one of the means of proof. Article 33 allows the Public Prosecutor or the court to oblige platforms and service providers to preserve data urgently and to provide what reveals the identity of the account holder.

But legal evidentiary weight does not in itself settle the soundness of the evidence. Among the points the lawyer scrutinizes: how the evidence was extracted, whether its chain of custody remained unbroken until it was presented to the court, whether the screenshots or metadata were altered, and whether the IP address links the act to the accused personally or to a device used by more than one person.

Practical note: Paragraph (d) of Article 36 punishes anyone who conceals, tampers with or destroys digital evidence with imprisonment for not less than three months. Therefore, do not delete any conversation, post or account, and do not contact the other party, before presenting the incident to a lawyer, since deletion may cost the victim their evidence and may add a new charge to the accused's file. The correct course of action differs according to each party's position, which becomes clear by reading the facts or consulting a specialist lawyer.

7. Jurisdiction, Courts and the Course of the File

Article 35 requires the Judicial Council to designate specialized public prosecutors and judges at the courts of first instance and the magistrates' courts to hear these offenses, and Article 34 gives these cases urgent status, so the file moves faster than ordinary criminal cases, and the time available to build the legal position is shorter.

The file usually passes through the complaint and the technical investigation, then the Public Prosecutor, then the trial and the means of challenge. The lawyer's role differs according to the client's position:

• For the complainant: characterizing the incident under the most precise article, preserving the evidence before it disappears, and claiming the private right and compensation.
• For the respondent: attending the first statement, contesting the harsher description, reviewing the soundness of the digital evidence, and assessing the effect of reconciliation or of providing information.

This field intersects with traditional offenses, as in the offense of online fraud and its characterization, and forgery of private documents where the forged document is used through a digital means.

Frequently Asked Questions

What are cybercrimes in Jordan?

They are the acts criminalized by Cybercrime Law No. 17 of 2023, such as unauthorized access, account impersonation, fraud, blackmail, defamation and slander via platforms, and publishing private images, in addition to every offense in other legislation committed by electronic means under Article 26.

What is the penalty for cybercrimes in Jordan?

The penalty differs from one article to another: it starts with imprisonment from one week to three months or a fine of 300 to 600 dinars for unauthorized access, and reaches temporary labor for not less than five years and a fine of up to 75,000 dinars for attacks on banking service systems. Determining the article that applies to a particular incident is settled by the lawyer after reading the file.

What is electronic theft under Jordanian law?

The law does not use this term, but it addresses its forms in Article 8 on electronic payment data, in Article 10 on fraudulently appropriating another's property via the network, and in Article 9 where the attack targets money-transfer systems and banking services.

Is the cybercrime penalty doubled when the offense is repeated?

Yes, Article 28 provides for doubling the penalty when any of the law's offenses is committed repeatedly, as well as when there are multiple victims, when a position is exploited, or when the offense is committed for the benefit of a foreign state or an unlawful organization.

Is the administrator of a page or group accountable for other people's posts?

Yes, under Article 25, if they are the person responsible for actually administering the public page, group or channel. Who actually administers it is a question of fact that the lawyer assesses in each file.

Can the perpetrator of a cybercrime be prosecuted if they are outside Jordan?

The Jordanian courts have jurisdiction under Article 38 whenever the offense harms the interests of the Kingdom or of its citizens or residents, or its effects occur in the Kingdom. Actual enforcement against an offender residing abroad, however, goes through international judicial cooperation and differs according to the country and the circumstances of the file.

Legal Consultation

Cybercrime cases are sensitive on both sides: the complainant may quickly lose their digital evidence, and the respondent may find themselves facing a description harsher than the facts because of a first statement given without consultation. Many of the fines here are in the tens of thousands of dinars, the penalty may be doubled for repetition or multiple victims, and the cases are heard on an urgent basis, leaving insufficient time to correct an error in characterization. The firm offers specialist legal consultation in criminal cases and cybercrime that begins with identifying the most precise article for the incident, with a connected understanding of the most common forms such as the offense of online blackmail and defamation, slander and insult by electronic means. You can contact Alabwini Law Firm & Legal Consultancy to present the file and discuss the available options.