On May 12, 2026, the Electronic Frontier Foundation relaunched its Offline campaign around a single name: Osama Khalid. A physician who began editing Wikipedia Arabic at age twelve, Khalid was arrested in July 2020 during Saudi Arabia's COVID-19 lockdown. His sentence has been a moving target — five years, then 32 on the prosecutor's appeal, then 25, then 14 — and his advocates report the 14-year term was upheld in February 2026. He is not due for release until 2034. His offence, as EFF describes it, was "sharing information online that conflicted with official narratives": Wikipedia entries on Saudi human rights, including the treatment of women's-rights activist Loujain al-Hathloul and conditions in Al-Ha'ir prison, and blog posts criticising state plans to surveil encrypted platforms.
Khalid's case is not a glitch in enforcement. It is the Anti-Cybercrime Law working as written.
A statute built to be elastic
Saudi Arabia's Anti-Cyber Crime Law, issued by Royal Decree No. M/17 in March 2007, opens with defensible objectives. Article 2 lists information security, protection of the lawful use of computers, and safeguarding the national economy. Few would argue a state shouldn't criminalise hacking, blackmail, or fraud committed over a network — and Articles 3 through 5 do exactly that, with unauthorised access, defamation, and privacy intrusion carrying up to a year in prison.
The problem is Article 6. It punishes the "production... of material impinging on public order, religious values, public morals, or privacy" transmitted over an information network, with imprisonment of up to five years and a fine of up to three million riyals. "Public order," "religious values," and "public morals" are nowhere defined in the text, and there is no carve-out for journalism, research, art, or political criticism. A provision nominally aimed at pornography and trafficking sites becomes, in practice, an instrument for prosecuting a tweet or a Wikipedia edit. The vagueness is the feature, not the flaw.
The pipeline: from cyber-statute to terrorism court
The mechanics compound the problem. Online-speech cases are routinely funneled to the Specialised Criminal Court — the tribunal Saudi Arabia uses to try terrorism cases — and prosecuted under a blend of the cybercrime law and the kingdom's counter-terrorism provisions. The effect is to recast ordinary expression as a national-security threat, attracting the procedural severity and lengthy sentences built for terrorism.
The pattern is consistent. Salma al-Shehab, a Leeds PhD student, was handed 34 years by the Specialised Criminal Court in 2022 for tweeting and retweeting Saudi women's-rights activists — a sentence Amnesty International documented before her eventual release in February 2025. The arithmetic of these cases — five years inflated to 32, six to 34 — reveals a system in which the written penalty is a floor, not a ceiling, and in which an appeal is as likely to multiply a sentence as to cut it.
Platforms become the enforcement layer
What is new in 2026 is how far enforcement now reaches. Since late April, according to a joint statement led by Access Now and ALQST and signed by twelve human-rights organisations, Meta has geo-blocked the Facebook and Instagram accounts of Gulf-focused NGOs and researchers — including ALQST, Democratic Diwan, Abdullah Alaoudh, and Yahya Assiri — from audiences inside Saudi Arabia and the UAE. The groups say more than 100 pages and accounts have been restricted since March 2026 at the Saudi government's request, citing local cybercrime law.
Meta's own Transparency Center confirms the machinery. The company publishes a "Content Restrictions Based on Local Law" report, restricts content that it deems lawful under its own Community Standards once a government reports it as illegal locally, and now does so "at scale and in country" where local law compels it. Notably, X declined to comply with parallel Saudi requests to geo-block activist accounts as of May 20. The divergence is the point: compliance is a choice, not a technical inevitability.
Steelmanning the regulator — and why it fails
There is a legitimate version of all this. States have a real interest in policing genuine cybercrime, and a platform operating inside a jurisdiction can argue that geo-blocking specific content is less censorious than a countrywide ban of the service — a "least-restrictive" posture that keeps ordinary Saudis online. Content moderation at national scale is genuinely hard, and "follow local law" is a coherent default that Meta ties to its Global Network Initiative commitments.
But the defence collapses on the facts. A law is not proportionate when its operative terms are undefined, when it routes speech through a terrorism court, and when a Wikipedia edit can cost fourteen years. Proportionality requires that restrictions be necessary, narrowly tailored, and predictable — the opposite of Article 6's elastic catch-alls. And a platform's "least-restrictive" rationale curdles when the underlying demand is itself transnational repression aimed at human-rights defenders, many of them in exile. Blocking the critics rather than the criticism is not neutrality; it is participation.
The proportionate path
For Saudi Arabia, the credible reform is to confine the cybercrime law to actual cybercrime — fraud, intrusion, non-consensual imagery — and to strike or sharply narrow Article 6's speech provisions, with explicit protection for journalism, research, and political expression. For platforms, the GNI principles they invoke demand more than a transparency table: a published legal basis for each restriction, narrow construction of vague demands, refusal of orders that plainly target protected speech, and notice to affected users.
An open internet is an economic asset, not a security liability. Khalid's fourteen years are a measure of how far a vaguely drafted statute can travel — and a reminder that the companies now routing around it have become part of the story.