A joint investigation by Amnesty International and the Saudi rights group ALQST, published 29 June 2026 and updated 17 July, documents eight cases of foreign tourists and pilgrims arrested in Saudi Arabia between July 2022 and late 2025 over social media activity — in several cases, posts made before the visitor ever crossed the border. The pattern is now familiar enough to have a name: extraterritorial speech enforcement, backed by a domestic court system with almost no independent check on prosecutorial discretion.
What the Cases Show
The report's most detailed case is Ahmed al-Doush, a British Bank of America analyst arrested at Riyadh's King Khalid International Airport on 31 August 2024 as he returned to the UK with his family. Saudi Arabia's Specialized Criminal Court (SCC) — nominally a counter-terrorism tribunal — sentenced him to 10 years on 12 May 2025 under Articles 34 and 43 of the Law of Combating Terrorism Crimes and its Financing, for social media posts predating his trip and an alleged tie to a government critic he says he barely knew. An appeal cut that to eight years in June 2025, then to five in April 2026 — a nearly 50% reduction that reads less like correction of a legal error than an acknowledgment the original sentence was excessive from the start.
Haidar Slim, a Lebanese pilgrim, was arrested after Hajj in 2022 for filming himself chanting a Shia religious slogan and sentenced to five years plus a 10,000 SAR fine; he was released in March 2025 after roughly three years served, reportedly following diplomatic intervention. A Dutch-Yemeni national, Fahd Ramadhan, spent 18 months detained without formal charge over posts sympathetic to a royal-family critic. Amnesty's Bissan Fakih summarized the pattern bluntly: visitors are "suddenly thrust into a nightmare scenario" — arrested, tried, and separated from their families "just for social media posts."
The Legal Mechanism
The enforcement tool is Saudi Arabia's 2007 Anti-Cyber Crime Law (Royal Decree M/17). Article 6 criminalizes "production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, and privacy," carrying up to five years' imprisonment and a fine of up to 3 million SAR. None of those terms — public order, religious values, public morals — is defined with enough precision to let a visitor predict what crosses the line. Saudi courts have compounded this by asserting jurisdiction over content that reaches Saudi-based readers regardless of where the poster was physically located when they hit "post," and by routing borderline expression cases through the SCC under counter-terrorism statutes carrying far harsher penalties than the cybercrime law itself.
The Case for the Law — and Why It Doesn't Hold Here
Saudi authorities would argue, not unreasonably, that a sovereign state has the right to police content that incites violence, defames religious institutions, or threatens public order within its borders — every jurisdiction, including liberal democracies, draws some line around speech tied to incitement or sectarian provocation, and Saudi Arabia's rapid social liberalization under Vision 2030 has itself generated genuine domestic backlash the state has to manage. A tourist filming a religious chant during Hajj, or a UK-based professional's years-old tweet about a government critic he barely knows, does not fit that justification. Neither involves incitement, fraud, or any conduct with a plausible nexus to harm inside the Kingdom. The law's actual operation — reaching pre-arrival speech, routing minor cases into a terrorism court, and producing sentences that appellate panels then quietly halve — is the tell that Article 6 functions as a general-purpose loyalty test rather than a proportionate public-order rule.
Why This Matters for Vision 2030
The timing sharpens the contradiction. Saudi Arabia drew roughly 122 million visitors in 2025 and is targeting 150 million annual visitors by 2030 — a headline pillar of the Vision 2030 diversification plan, alongside hosting Expo 2030 and the 2034 World Cup. A tourism strategy built on inbound volume depends on visitors trusting that a routine trip won't turn into a multi-year legal ordeal over an old post. Eight documented cases is a small number against 122 million annual arrivals, but Amnesty and ALQST are explicit that undercounting is likely, given the lack of transparency around SCC proceedings and detainees' fear of publicizing their own cases. Word-of-mouth risk, not aggregate statistics, is what shapes traveler behavior — and a handful of viral cases involving Western nationals can do outsized reputational damage to an inbound-tourism strategy that depends on exactly the demographic most likely to have an old social media footprint.
The Proportionate Fix
None of this requires Saudi Arabia to abandon content regulation. It requires narrowing Article 6 to conduct with a genuine nexus to harm — incitement, fraud, defamation with real damages — rather than leaving "religious values" and "public order" open enough to sweep in a tourist's old tweet. It requires the SCC to stop being the default venue for speech cases that carry no plausible terrorism nexus. And it requires prosecutorial guidelines that account for the jurisdictional oddity of punishing speech made before a visitor's passport was ever stamped. A regulator that wants both robust content governance and a credible tourism pipeline has to choose predictability over maximal discretion — right now, Saudi Arabia is choosing the latter, and its own appellate courts, quietly halving sentence after sentence, appear to agree.