Hacking Offenses in Jordan and the Specialist Lawyer's Role

Hacking into an account or an information system can expose the secrets of a person or an organization within minutes, disrupt its work, and open the door to other offenses such as blackmail, fraud and smearing. The Jordanian legislature regulated these acts under Cybercrime Law No. 17 of 2023, which replaced Cybercrime Law No. 30 of 2010 and its amendment by Law No. 27 of 2015, and set out the prohibited acts and the penalties prescribed for them. However, a single incident may fall under several provisions of this law and of the Penal Code at the same time, and determining its correct description, whether authorization existed, and which legislation was in force when it occurred are matters a specialist lawyer settles after reviewing the file.

The seriousness of the offense of hacking lies in what may follow from it: an attack on the confidentiality and integrity of data, the disruption of information systems, the seizure of information and the violation of privacy, in addition to the possibility of using it as a means of committing other offenses.

1. What Is Meant by the Offense of Hacking

1. The Concept of an Offense in General

In legal terms, an offense is any act or omission that the law criminalizes and for which it prescribes a penalty or a legal measure, where the elements required by the applicable legislative provision are met. Offenses take many forms depending on the nature of the conduct and the legal interest the legislature protects, and technological development has produced new forms of criminal acts committed using computers, electronic networks or information systems.

2. The Concept of Hacking

Hacking takes many forms, and its concept is defined according to the nature of the act committed, its purpose and the means used, as well as the legislation that regulates it. In technical terms, hacking may mean gaining access to an information system, a network, an online account or digital data by exploiting a security vulnerability or using a particular technical means.

Not every security check or test of electronic systems is necessarily an offense; a test may be carried out with the system owner's permission or as part of legitimate protection and maintenance work. But if access takes place without authorization, or the person exceeds the limits of the authorization granted, or commits prohibited acts such as tampering with data, disrupting the system or intercepting information, criminal liability may arise under the applicable legal provision.

Accordingly, the offense of hacking is any unlawful conduct consisting of intentionally accessing an information network, an information system or a website without authorization, or in breach of the limits of the authorization granted, or of using technical means to commit acts that the law criminalizes and that affect the confidentiality, integrity or availability of data or the rights of others.

Correct legal characterization requires identifying the act that actually took place, the means used, whether authorization existed, the criminal intent, and the result the legal provision requires where the result is one of the offense's elements. These are elements the lawyer studies one by one before settling on the description.

2. Characteristics of the Offense of Hacking

Offenses connected with hacking have a number of characteristics that set them apart from many traditional offenses:

1. Reliance on Technical Means

These offenses are committed using computers, smartphones, information networks, applications or other digital means, and the technology may be the means of committing the offense or the very target of the attack.

2. Crossing Geographic Borders

The act may originate in one country while the targeted or harmed system is in another, which raises questions of territorial jurisdiction, the applicable law, and international cooperation in gathering evidence and prosecuting offenders.

3. The Difficulty of Detecting Some of Its Forms

Those who commit cybercrime may use means to hide their identities, change connection addresses or erase digital logs, making it more complex to detect some acts and attribute them to those who committed them. Even so, digital evidence, access logs, connection data and technical examinations may help identify the source of online activity and link it to the person responsible, in accordance with accepted legal and technical rules.

4. Speed of Execution and Breadth of Effects

Some cyberattacks can target a large number of users or systems within a short period, and may lead to disrupted services, leaked data or large-scale financial losses.

5. The Variety of Offenders' Motives

The motive may be financial, personal, commercial or political, and may be connected with espionage, revenge, proving technical skill or gaining access to confidential data.

6. The Difficulty of Assessing Damage in Some Cases

The damage caused by hacking is not limited to direct financial losses; it may include loss of data, disruption of business, harm to reputation, violation of privacy and loss of trust in online services.

7. The Possibility of Concealing or Tampering with Evidence

Deleting or altering data or changing digital logs may make it difficult to reconstruct the facts, which is why preserving electronic evidence and examining it through sound procedures is of great importance. This is a technical and legal matter at the same time, and its assessment is not left to personal judgment.

3. Causes and Motives for Committing the Offense of Hacking

The motives that may drive people to commit cybercrime are many and cannot be reduced to a single cause, as they differ according to the nature of the offender, the aim of the conduct and the surrounding circumstances:

Political and military motives: some cyberattacks may aim to obtain confidential information or government or military data, disrupt vital systems, or affect the work of state institutions, in ways that may harm national security or strategic interests.
Commercial and economic motives: some people may hack systems to obtain trade secrets or information about customers, production plans or financial data, in order to gain an unlawful competitive advantage or harm a commercial competitor.
Financial motives: the aim may be to seize money, financial data or payment card information, to blackmail victims for sums of money, or to use stolen data for fraud.
Personal motives: the offender may hack out of curiosity or a wish to prove technical skill or to take on a challenge, but these motives do not make the conduct lawful if it involves an act prohibited by law.
Revenge and harming others: the offender may target a person or an organization because of an earlier dispute, seeking to access their accounts, publish private information, disrupt their services or damage their reputation.
Amusement and adventure: some people may believe that unauthorized access to electronic systems is merely an experiment or a joke, but the nature of the motive does not remove criminal liability where the elements and legal conditions of the offense are met.

4. Forms of the Offense of Hacking and Related Offenses

Hacking and the acts connected with it take many forms, the most notable of which are:

Unauthorized access: gaining access to an information network, an information system or a website without permission, or beyond the limits of the permission granted.
Tampering with data: deleting, modifying, changing, destroying, transferring or copying data unlawfully.
Disrupting information systems: deliberately interfering with the operation of an information system or electronic network in a way that hinders or stops services.
Intercepting communications and data: capturing, intercepting or eavesdropping on information without authorization, according to the relevant legal conditions.
Theft of financial information: obtaining credit card data or information used in online financial and banking transactions without authorization.
Spreading malicious software: using programs or technical tools with the aim of destroying data, disrupting systems or gaining unlawful access to information.
Online espionage: obtaining confidential or private information without right.
Online blackmail: using data, images, recordings or private information to threaten a person or to make them do or refrain from doing something.
Online fraud: using electronic means to deceive victims and seize money or data.
Smearing and attacks on reputation: publishing or sending content involving defamation (dhamm), slander (qadh) or insult (tahqir), where the elements required by law are met.
Online identity impersonation: using another person's data or account to mislead others or to obtain an unlawful benefit.
Piracy of software and content: copying, distributing or exploiting software without a license, if the act constitutes an infringement of rights protected by law.

These forms are not all necessarily subject to the same legal provision; the legal characterization of each incident is determined by its elements, and a single act may constitute more than one offense if their legal conditions are met. The following table shows the main forms and the interest the law protects in each:

Form	Target of the attack	Protected interest	What the lawyer examines when characterizing it
Unauthorized access	The network, system or website	The confidentiality and sanctity of the system	Whether authorization existed and its limits, and whether intent is present
Tampering with data and disrupting systems	The data and the system itself	The integrity and availability of data	The nature of the act that followed access and its purpose
Intercepting communications and data	Information in transit	The confidentiality of communications	Whether the conditions of the applicable provision are met
Seizing financial data	Payment and account data	Financial assets and trust in transactions	The link between the act and offenses of fraud or theft
Systems of national importance	Systems and data connected with national security and the national economy	National security and public safety	The nature of the targeted system and data
Blackmail, smearing and impersonation	The person, their reputation and private data	Privacy and personal dignity	Each act and its provision standing apart from the offense of access

5. The Effects of the Offense of Hacking

Hacking has many effects that may go beyond the direct damage to the targeted system or device:

Harm to national security: targeting government systems or critical infrastructure may expose sensitive information, disrupt essential services or harm national interests.
Violation of privacy: hacking may lead to access to images, correspondence, personal information or health and financial data, in a way that affects individuals' private lives.
Economic losses: organizations and individuals may suffer financial losses from stolen money, disrupted systems, data recovery, fixing security vulnerabilities or losing customers.
Harm to reputation and standing: leaked data or the publication of private information or offensive content may damage the reputation of a person or organization and affect their social or professional relationships.
Disruption of online services: educational, health, banking or commercial organizations may have their services disrupted, which reflects negatively on the interests of those they serve.
Facilitating other offenses: stolen data may be used for fraud, blackmail, identity impersonation, threats or other acts the law criminalizes, including the forms covered in the article The Crime of Online Fraud in Jordanian Law.

6. The Offense of Hacking in Jordanian Legislation

The Jordanian legislature regulated cybercrime under Cybercrime Law No. 17 of 2023, which is the legislation the lawyer refers to when examining facts subject to its provisions, taking into account amendments and other relevant provisions. Cybercrime Law No. 30 of 2010 and its amendment by Law No. 27 of 2015 are earlier legislation that must not be confused with the later law.

Practical note: The articles and penalties cited in some older studies are taken from the earlier legislation, so the lawyer first establishes the date of the incident, then the legislation that applies to it, before building any characterization or defense; this calls for checking the provision in force at the time of the incident or consulting a specialist lawyer.

1. Unauthorized Access to Information Systems

Accessing information systems, networks or websites without authorization, or in breach of or beyond the authorization, is one of the forms addressed by Jordanian cybercrime legislation. Applying the legal provision requires determining the nature of the system accessed, the limits of the permission granted, whether the access was intentional, and whether it was accompanied by further acts such as deletion, modification, destruction or disruption of the system.

2. Attacks on Data and Information Systems

Some cybercrimes concern acts that target the integrity or availability of data, such as deleting, modifying or destroying information or disrupting an information system, and the penalty may differ according to the nature of the act, its purpose, and the body or interest that was attacked.

3. Intercepting Data and Communications

Criminal liability may arise when data is captured, intercepted or eavesdropped on without right, according to the conditions and elements set by the legal provision that applies to the facts.

4. Attacks on Financial and Banking Data

Financial and banking data enjoy special legal protection, given the financial losses and the damage to trust in online transactions that may follow from seizing or unlawfully using them.

5. Access to Systems of National Importance

Acts that target data or systems connected with national security, public safety or the national economy may be subject to special rules depending on the nature of the targeted system and data and whether the relevant legal provisions apply.

6. Offenses Connected with Defamation, Slander and Blackmail

Hacking may be accompanied by separate acts, such as publishing offensive information, threatening people with publishing their private data, or demanding sums of money in exchange for not publishing it. In these cases the lawyer examines each act separately and determines the legal provision that applies to it, and does not assume that all these acts constitute the offense of unlawful access. The rules on offensive publication in particular are covered in the article The Crimes of Defamation, Slander and Insult in Jordanian Law.

7. A Note on Article 11 of the Earlier Legislation

Article 11 of the earlier Cybercrime Law concerns sending, resending or publishing data or information involving defamation, slander or insult. It is not correct to treat it as a general definition of the offense of hacking, because it deals with a different form of criminalized acts.

Likewise, the claim that including applications within the law's definitions necessarily leads to restricting freedom of expression or violating privacy needs an analysis of the relevant provisions and the safeguards for applying them, and it is not correct to state it as an absolute legal conclusion without legislative study.

7. Jordanian Court Decisions on Hacking and Cybercrime

Court decisions show the importance of distinguishing between merely accessing an available electronic link and acts that involve disrupting the system, hindering its operation, making unauthorized changes, or publishing content the law criminalizes.

One example is Decision No. 118 of 2021 issued by the Amman Court of First Instance in its appellate capacity on January 5, 2021, concerning the hacking of a lecture held remotely and its disruption for a short period, followed by the publication of a video clip showing the incident. The court relied on technical evidence and the accused's confession, and upheld the judgment under appeal as to the offenses charged against him, under the provisions that applied at the time of the incident.

The significance of this decision is that making an electronic link available to join a lecture does not necessarily mean permission to disrupt it, obstruct its content or tamper with it, as the law distinguishes between permission to enter and permission to carry out further acts inside the system. Drawing the line between what was permitted and what exceeded it is itself a legal question on which all liability depends, and it merits consultation.

Another is Decision No. 2931 of 2021 issued by the Court of Cassation in its criminal capacity on September 9, 2021, concerning facts of private filming, blackmail and the publication of content that violated the victim's privacy. The facts of this decision show that the use of electronic means may be accompanied by other offenses, and that the legal characterization is not necessarily limited to a standalone cybercrime but may include offenses set out in the Penal Code or other legislation, where their elements are met.

The lawyer reviews the full text of each decision, its number, date, operative part and the provisions it applied, before relying on it in a memorandum or pleading, because extracts alone do not reveal all the facts on which the judgment was based.

8. Frequently Asked Questions

What is meant by the offense of hacking under Jordanian law?

It is any unlawful conduct consisting of intentionally accessing an information network, an information system or a website without authorization or in breach of the limits of the authorization, or of using technical means to commit acts that the law criminalizes and that affect the confidentiality, integrity or availability of data or the rights of others.

Which law currently governs hacking offenses in Jordan?

Cybercrime Law No. 17 of 2023, which replaced Cybercrime Law No. 30 of 2010 and its amendment by Law No. 27 of 2015. The applicable provision is determined by the date of the incident.

Is every security test of an electronic system an offense?

No. A test carried out with the system owner's permission or as part of legitimate protection and maintenance work is not necessarily an offense, while access without authorization, exceeding its limits or tampering with data may give rise to criminal liability.

Does entering through an available link remove liability if the system is disrupted?

Not necessarily. In Decision No. 118 of 2021 issued by the Amman Court of First Instance in its appellate capacity, the incident concerned hacking a remote lecture and disrupting it, and the judgment under appeal was upheld, because permission to enter does not mean permission to disrupt the lecture or tamper with it.

Can hacking constitute more than one offense?

Yes. Hacking may be accompanied by separate acts such as blackmail, fraud or publishing content involving defamation or slander, and each act is examined under the provision that applies to it, whether in the Cybercrime Law or in the Penal Code.

Can a hacker located outside Jordan be prosecuted?

The act may originate in one country while the damage occurs in another, which raises questions of territorial jurisdiction, the applicable law and international cooperation in gathering evidence, and the lawyer determines the legal tools available in each case.

Legal Consultation

Hacking cases are among the most delicate criminal cases; for the victim, proving the incident may depend on digital evidence that is easily lost or altered, and for the respondent, access they believed was permitted may turn into a charge of several offenses at once. A mistake in identifying the legislation in force at the time of the incident or in describing the act may change the whole course of the file. For specialist legal consultation in criminal cases and cybercrime, and for the related provisions in Jordanian Cybercrime Law No. 17 of 2023 and Online Blackmail in Jordanian Law, you can contact Alabwini Law Firm & Legal Consultancy.

The Offense of Hacking Under Jordanian Law: Its Concept, Characteristics, Forms and Legal Effects