On 17 September 2026, an appeals court in Saudi Arabia's Eastern Region sentenced a Sri Lankan migrant worker to death over a Facebook comment. According to Human Rights Watch, Anojan Sivarasa had been convicted on 27 July by the Criminal Court of Al-Ahsa under Article 6 of the Anti-Cyber Crime Law. That court imposed five years in prison and a fine of SAR 3 million (about US$800,000). On 14 October, Sri Lanka's deputy foreign minister announced that the Saudi Supreme Court had set aside the death sentence, as reported by the Financial Express, citing the BBC.
The reversal is welcome. It does not answer the question the case raises, which is how a statute with a five-year ceiling produced a capital sentence at all.
What is established, and what is not
The facts are still unsettled. HRW gives Sivarasa's age as 24, while the Financial Express report gives 27. The Financial Express also says it is unclear whether further proceedings will follow or whether he will remain in detention. The reversal rests on statements by Sri Lankan officials. We found no published Saudi ruling or official statement. Some outlets cite a longer prison term of about 30 years, which we could not verify, so we do not rely on it. Everything below uses only the points the sources agree on.
The case for the law
The strongest defence of the law is that every state regulates online conduct. Harassment, fraud, incitement and threats are real harms, and a 2007 statute, Royal Decree M/17, was an early attempt to give Saudi courts a written framework. Saudi authorities also argue that protecting religious values is a legitimate public-order aim in a society where religion is central to law and daily life. A written statute with a fixed maximum penalty is, in principle, better than unwritten discretion.
Where the text fails the test
Article 6 sets a penalty of "imprisonment for a period not exceeding five years and a fine not exceeding three million riyals or to either punishment," per the WIPO Lex translation. Its first paragraph covers the "production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, and privacy." The official Saudi translation is published by the Bureau of Experts at the Council of Ministers.
Three features of that text matter.
- The terms are undefined. "Impinging on" public order, religious values or public morals names no standard of harm, intent or likelihood. A user cannot tell in advance where lawful opinion ends.
- Storage is an offence. A person can be liable for keeping material, not only for publishing it.
- The ceiling does not constrain outcomes. The statute says five years, yet an appeals court imposed death. Public reporting does not say which legal basis the court used. When a written limit does not bind the result, the law offers users no real notice of the risk.
Rights groups have long made the same point. ALQST described Article 6 in 2023 as covering material that affects "religious values, public morals, or privacy," and noted state television warning viewers about jail for posts.
The cost to users, platforms and the economy
The user here was a migrant worker. HRW says he deleted the comment and posted an apology video, and that his device was confiscated and his Facebook account ordered closed. Deletion and apology did not prevent a more severe sentence on appeal. Prosecutors appealed for a harsher punishment, and the appeals court went beyond the original ruling.
A legal environment like this chills speech well beyond blasphemy. Ordinary users, especially migrant workers who depend on social media to stay in touch with family, cannot predict what will be prosecuted. Platforms face the same unpredictability. Any intermediary serving Saudi users must guess how broad the "religious values" standard will be applied, and the safest guess is over-removal. That is the wrong incentive for an economy that is trying to attract digital investment and talent.
What proportionate reform would look like
A proportionate approach would keep the legitimate core of the law and narrow the rest.
- Define the harm. Replace "impinging on" with a standard tied to incitement to violence or direct threats, with intent required.
- Make the ceiling binding. If the statute caps punishment at five years, no court should be able to exceed it for the same conduct. Where another legal basis is claimed, the ruling should name it publicly.
- Publish rulings. The reported reversal rests on a foreign ministry's account. Published reasoning from the Supreme Court would let users and platforms understand the law.
- Protect retraction. Prompt deletion and apology should count heavily in mitigation, not be ignored.
Bottom line
The Supreme Court's reported action corrects one outcome, but it leaves the underlying text unchanged. As long as Article 6 turns on undefined terms and its stated limits do not bind outcomes, a single comment can carry exposure far beyond what the statute says. Clear definitions, binding penalty ceilings and published judgments would protect legitimate public-order interests while giving users and platforms a rule they can follow.