An Expanding Dragnet Around Ordinary Speech
A joint report by Amnesty International and the Saudi human rights group ALQST, published June 29, 2026 and updated July 17, 2026, documents eight foreign nationals arrested and prosecuted by Saudi Arabia's Specialized Criminal Court (SCC) — a tribunal created for terrorism cases — for social media activity, including posts made before they ever entered the country. The organizations say they are aware of 13 further cases they have not been able to fully verify. The pattern is consistent: visitors detained on arrival, mid-stay, or while trying to leave; interrogated about old tweets, Hajj-related photos, or even 'likes'; and in several cases convicted under Cybercrime Law provisions that were never designed for tourists.
The emblematic case is Ahmed al-Doush, a British national and then-senior business analyst at Bank of America, arrested on August 31, 2024 at Riyadh's King Khalid International Airport as he returned to the UK after visiting family. Amnesty documents that the interrogation centered on social media posts from 2018 concerning Sudan and a tangential acquaintance with the son of a UK-based Saudi dissident. The SCC sentenced him to 10 years on May 12, 2025; an appeal cut that to eight years in June 2025, and a further appeal reduced it to five years in April 2026. The UN Working Group on Arbitrary Detention concluded, in a decision issued March 2, 2026, that Saudi authorities had not provided credible evidence and that al-Doush's detention is arbitrary under international law, calling for his immediate release. Other documented cases include Haidar Slim, a Lebanese national sentenced to five years and a 10,000 SAR fine for filming Shia religious chanting during Hajj (released March 2025 after diplomatic intervention), and Amr Abdelfattah, a French national held 11 months before trial on charges including insulting the government and praising 'prosecuted individuals.'
The Law Being Used
The prosecutions rely on Saudi Arabia's Anti-Cyber Crime Law, issued by Royal Decree No. M/17 in 2007. Article 6 criminalizes 'production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, and privacy' online, carrying up to five years' imprisonment and fines as high as 3 million SAR. That language was drafted for a pre-smartphone internet and was never narrowed as its use expanded; it now sits alongside counter-terror statutes that give the SCC — a court built for genuinely violent extremism — jurisdiction over what amounts to ordinary expression.
Steelmanning Riyadh's Position
Saudi Arabia is not wrong that every state polices some online content: incitement to violence, credible threats, and child safety material are prosecuted everywhere, and no serious free-speech advocate argues otherwise. Saudi officials would also point out that as an open society with distinct religious and social norms, the Kingdom is entitled to enforce standards around public order and religious sanctity — many countries maintain broadly worded public-order or blasphemy-adjacent statutes on the books, and Saudi Arabia frames its Cybercrime Law the same way its defenders frame hate-speech laws elsewhere: as protecting a value the state judges worth protecting, even when it collides with speech.
That argument, however, does not survive contact with the actual cases Amnesty and ALQST document. A law aimed at protecting religious values or public order does not require jailing a British bank analyst for a 2018 tweet about Sudan, or a French Hajj pilgrim over an eleven-month pretrial detention for allegedly 'praising' someone the state disfavors. When 'undermining public order' is elastic enough to cover a photograph, a like, or a years-old post the poster had already deleted, the statute stops functioning as a content standard and starts functioning as a discretionary tool against anyone the state wants to hold — foreign nationals with no local support network being especially easy targets.
Why This Is a Business and Reputational Problem, Not Just a Rights One
The timing compounds the damage. Saudi Arabia is mid-way through Vision 2030's tourism build-out: the Kingdom logged roughly 122 million visitors in 2025, a 5% annual increase generating an estimated SR300 billion ($81 billion) in tourism spending, and is targeting 150 million annual visitors — 70 million international — by 2030, according to Arab News reporting on Ministry of Tourism data. A regime that can convert a routine social media presence into a multi-year prison sentence, with no clear line indicating what crosses it, is a direct liability against that goal. Investors, expatriate professionals, and ordinary tourists all now carry a case file's worth of reasons to hesitate — al-Doush was not an activist or a journalist, he was a bank employee visiting family.
What Proportionate Reform Looks Like
The fix is not abolishing content moderation; it is narrowing Article 6's language to require actual incitement, credible threat, or specific harm — not vague 'undermining public order' — and moving foreigner cases out of the SCC's terrorism jurisdiction entirely. Guaranteeing prompt consular access, public charge sheets, and appeal timelines consistent with international fair-trial standards would cost Riyadh little and would remove the single biggest reputational drag on its tourism ambitions. Until then, every visitor's phone is effectively evidence waiting to be reinterpreted.