Osama Khalid was twelve years old when he made his first edit to the Arabic Wikipedia. By the time he was arrested in July 2020 — during Saudi Arabia's COVID-19 lockdown, at age 26 — he had become one of the encyclopaedia's senior administrators, a paediatrician, and a blogger whose 2013 posts included criticism of government plans to surveil encrypted digital communication. None of those activities crossed into incitement, fraud, or any category that most liberal democracies would treat as criminal.
He has been in al-Ha'ir Prison in Riyadh ever since.
A Sentence Built by Appeal
Khalid's sentence history is itself a document of the system's operation. He was initially sentenced to five years by Saudi Arabia's Specialized Criminal Court. On appeal — a process that in Saudi Arabia can increase punishment, not only reduce it — the sentence jumped to 32 years. Subsequent reductions brought it to 25 years in 2023, then 14 years in September 2025. The Saudi Supreme Court upheld that 14-year term in February 2026. Khalid is not due for release until 2034, by which time he will be 40.
In May 2026, eight civil society organisations — including the Electronic Frontier Foundation, ALQST for Human Rights, MENA Rights Group, Access Now, the Gulf Centre for Human Rights, and Democracy for the Arab World Now — launched a coordinated international campaign demanding his release. The EFF framed the case as part of its "Offline" project, which highlights the imprisonment of bloggers and technologists worldwide. The coalition's argument is simple: Khalid's Wikipedia edits covering the detention of women's rights activist Loujain al-Hathloul and conditions at al-Ha'ir Prison, and his blog posts criticising surveillance policy, are precisely the kind of factual speech that encyclopaedias exist to contain.
The Law That Makes This Possible
Before dismissing Saudi Arabia's position out of hand, it is worth acknowledging what motivated the 2007 Anti-Cyber Crime Law. The Kingdom confronted genuine threats: online fraud, unauthorised access to financial systems, content facilitating terrorism and human trafficking. The law was enacted at a moment when most governments were scrambling to bring digital activity under any legal framework at all, and Article 6 carries real provisions against exploitation of minors and drug trafficking that serve legitimate regulatory purposes.
But Article 6(1) — the provision most commonly used against activists — reads as follows: "The production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, and privacy, through an information network or computers." The penalty is up to five years imprisonment and fines of up to three million riyals, though courts stack charges to produce far longer sentences.
The problem is not the list of protected interests. The problem is that the law, issued by Royal Decree No. M/17 on 26 March 2007, defines none of them. What constitutes an impingement on "public order"? On "religious values"? On "public morals"? There are no definitions anywhere in the statute. Abdullah Alaoudh, research director at Democracy for the Arab World Now, put it plainly: "You can basically fit anything to it."
Legal vagueness in criminal statutes is not an oversight; it is a mechanism. Courts that might otherwise be bound by narrowly defined conduct can instead exercise unlimited discretion. In Saudi Arabia, that discretion runs through the Specialized Criminal Court — an institution originally created to try terrorism cases — which now routinely handles speech prosecuted as cybercrime.
A Pattern, Not a Precedent
Khalid's case would be easier to dismiss as aberrant if it stood alone. It does not.
In September 2024, Nourah al-Qahtani was resentenced to 35 years in prison plus a 35-year travel ban for social media posts. Cartoonist Mohammed al-Ghamdi received 23 years in October 2024 for drawings deemed insulting to authorities. Mohammad bin Nasser al-Ghamdi — who shared peaceful criticism on YouTube and X — had a death sentence reduced to 30 years in the same month. A British national was sentenced to 10 years in August 2024 for a social media post he had already deleted. In June 2025, online journalist Turki al-Jasser was executed after seven years in detention for posts on Palestine and women's rights.
Freedom House's 2025 report gave Saudi Arabia a score of 25 out of 100 on internet freedom — placing it in the "Not Free" category, with a near-failing mark on violations of user rights (5 out of 40). The 2007 law is the legal infrastructure underlying most of those cases.
Censorship Goes Transnational
The same legal authority that imprisoned Khalid is now being invoked to shape what audiences outside Saudi Arabia can access. From April 30, 2026, Meta began geo-blocking the Facebook and Instagram accounts of ALQST for Human Rights, the Democratic Diwan think tank, researcher Abdullah Alaoudh, and human rights defender Yahya Assiri — rendering their accounts unavailable to users in Saudi Arabia. Meta's content restriction reports cite Saudi government requests referencing "local legal requirements." Over 100 accounts have been restricted since March 2026. X received similar requests for prominent Saudi activists' accounts and, as of the coalition's publication date on May 20, 2026, had not complied.
The lesson is structural: a vaguely worded domestic law, consistently enforced, becomes a lever for extraterritorial censorship when technology platforms treat legal demands from authoritarian states the same as they treat requests from democratic ones.
A Contradiction Worth Naming
Saudi Arabia is simultaneously pursuing a role at the centre of the global AI moment. The Public Investment Fund is in talks to invest five billion dollars in SpaceX's Nasdaq listing. Gulf sovereign wealth co-funds the research infrastructure behind the world's most-used AI tools. Vision 2030 frames the Kingdom as a future hub for the knowledge economy.
None of that is inherently inconsistent with the 2007 law's continued operation — capital flows do not require civil liberties. But the construction of a knowledge economy does. Arabic Wikipedia depends on volunteer administrators like Osama Khalid to expand and correct its coverage of the Arab world. When a top editor is sentenced to 14 years for documenting a prison — the same prison he now inhabits — the signal to every other potential contributor is unmistakable.
The 2007 Anti-Cyber Crime Law is not unreformable. Defining "public order," "religious values," and "public morals" in statute, requiring judicial proportionality review for speech charges, and removing the Specialized Criminal Court's jurisdiction over non-violent online expression would bring Article 6 closer to international standards without dismantling the law's legitimate provisions. The international campaign for Khalid is a test of whether that reform pathway is politically imaginable — or whether the blank cheque Article 6 provides is simply too useful to surrender.