Eight Visitors, One Pattern
A joint report published by Amnesty International and the Saudi human rights group ALQST in June 2026 documents eight foreign nationals — tourists, Hajj and Umrah pilgrims, and business travelers — arrested in Saudi Arabia between July 2022 and late 2025 over social media posts, including content published before they ever set foot in the Kingdom. Four were on religious pilgrimage; the other four were visiting for tourism, family trips, or work. The organizations say they are aware of 13 further cases they have not yet been able to fully investigate (Amnesty International).
The most prominent case is Ahmed al-Doush, a British national and Bank of America business analyst arrested at Riyadh airport on August 31, 2024, as he tried to fly home with his wife and children after a family visit. He was later told the charges stemmed from tweets about Sudan he had posted — and deleted — in 2018, along with his acquaintance with the son of a UK-based Saudi dissident. Saudi Arabia's Specialized Criminal Court, the tribunal created to hear terrorism cases, sentenced him to 10 years in May 2025. On appeal that fell to eight years, then to five in April 2026. The UN Working Group on Arbitrary Detention has since concluded his detention violates international law and called for his immediate release (Amnesty International urgent action). Also documented: Lebanese pilgrim Haidar Slim, sentenced to five years for filming himself chanting during Hajj, and Dutch-Yemeni national Fahd Ramadhan, held 18 months without formal charge.
The Law Doing the Work
The charges in these cases typically run through Article 6 of Saudi Arabia's 2007 Anti-Cyber Crime Law, which criminalizes "production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, and privacy" through a computer or network — punishable by up to five years in prison and a fine of up to 3 million riyals (roughly $800,000) (Anti-Cyber Crime Law, Royal Decree M/17). Where authorities allege a link to national security or dissent, cases move instead to the Specialized Criminal Court under counter-terrorism statutes, as happened with al-Doush.
The Case for the Law — and Its Limits
Saudi Arabia's defenders have a real argument, and it deserves to be stated plainly: every sovereign state sets rules for content that threatens public order or incites unrest, and visitors who choose to travel somewhere are generally expected to know and follow local law once they arrive — ignorance of local statutes is rarely a defense anywhere, and states have legitimate interests in policing incitement, harassment, and genuine security threats conducted online. A country hosting millions of pilgrims and tourists a year is entitled to insist that its laws apply within its borders.
But that argument collapses once the underlying conduct precedes the border crossing. Al-Doush's tweets were posted, and deleted, in 2018 — six years before Saudi authorities detained him at an airport he was leaving, not entering. A traveler cannot look up a criminal code before a trip and know what to avoid if the code punishes speech from years earlier, made in another country, about a third country's civil war. That is not enforcement of local law; it is retroactive, extraterritorial prosecution of expression that occurred entirely outside Saudi jurisdiction, dressed up in the language of "public order" and "religious values" broad enough to cover almost anything a prosecutor dislikes.
Vision 2030's Contradiction
The timing sharpens the problem. Saudi Arabia recorded roughly 122 million total visitors in 2025 — including 29.7 million international arrivals — and is chasing a Vision 2030 target of 150 million annual visitors, with 70 million of those from abroad (Arab News). Tourism liberalization, e-visas, and Hajj/Umrah expansion are centerpieces of the Kingdom's post-oil economic strategy. A prosecutorial posture that treats the ordinary digital footprint any traveler carries — old tweets, WhatsApp forwards, a video of a pilgrimage chant — as grounds for a five-to-ten-year sentence is directly at odds with that ambition. Every widely publicized case like al-Doush's is a data point a prospective visitor, or their employer's travel-risk team, will now weigh before booking a flight.
What Proportionate Regulation Would Look Like
A cybercrime law with a legitimate public-order purpose does not need to reach pre-arrival, foreign-hosted speech to function. Riyadh could narrow Article 6's application to conduct occurring within the Kingdom, publish clear guidance for visitors on what online activity carries legal risk, and separate ordinary expression offenses from the Specialized Criminal Court's terrorism track, which was not designed for tweets about a neighboring country's politics. None of that requires abandoning content rules Saudi Arabia is entitled to set for itself. It requires drawing a line between regulating conduct in your territory and reaching backward into a traveler's history in a different country — a line that, right now, Saudi courts are not drawing at all.