A Real Threat, A Real Response
On August 9, 2026, the UAE's Telecommunications and Digital Government Regulatory Authority (TDRA) renewed the public telecommunications licences of e& and du for another 20 years — through August 8, 2046 — replacing licences first issued in 2006. Alongside the routine renewal, TDRA's board attached a new layer of obligations: operators must geographically diversify international connectivity across multiple terrestrial systems and submarine cables, eliminate single points of failure, run regularly tested disaster-recovery mechanisms, and "develop qualified national talent capable of operating and restoring networks under exceptional circumstances" (TDRA press release).
The timing is not incidental. Since fighting broke out between Iran, Israel, and the U.S. in February 2026, the UAE's Cyber Security Council has recorded roughly 800,000 hacking attempts a day against aviation, energy, and education systems — four times the prewar rate, with AI now doing the reconnaissance and phishing work that used to take human attackers days (Rest of World). Against that backdrop, requiring redundant cable routes and drilled disaster-recovery playbooks is not regulatory overreach. It is the baseline any state with 99.7% household fibre penetration — a title the UAE has now held for a tenth consecutive year — should demand of the two carriers that constitute its entire fixed and mobile backbone. A single-cable outage or an unrehearsed failover during an actual attack would be a self-inflicted wound. The steelman case for this licence writes itself: critical infrastructure regulators worldwide, from ENISA's NIS2 directive to FCC resiliency rules, increasingly mandate exactly this kind of engineering hygiene, and the UAE's exposure — a duopoly market sitting next to an active regional conflict — makes the case stronger than most.
Where the Obligation Turns Political
The problem is not the disaster-recovery testing or the cable diversification. It's the fourth clause: training personnel to "restore networks under exceptional circumstances." Restoration presupposes disruption, and the licence text — as reported across UAE and regional trade press — does not specify who declares an "exceptional circumstance," what triggers it, or what oversight applies once a carrier is directed to take a network down and bring it back up on the state's schedule (Zawya; Developing Telecoms).
That ambiguity matters because it isn't being written onto a blank slate. The UAE already restricts VoIP to the two licensees themselves — WhatsApp calls, FaceTime, and Skype have been throttled or blocked for years — and Federal Law No. 12 of 2016 criminalizes "fraudulent" VPN use with fines up to AED 2 million ($545,000), up from the AED 500,000 ceiling set in 2012 (Bird & Bird). A jurisdiction that has spent a decade narrowing citizens' alternate routes to the open internet is now writing "restore networks under exceptional circumstances" into the core operating licence of the only two companies that carry traffic at all. Read together, the sequence is: block the workarounds, then formalize the kill switch's maintenance crew.
The Global Baseline TDRA Skipped
Access Now's #KeepItOn coalition marked its tenth anniversary this year documenting a grim trend: 313 documented shutdowns across 52 countries in 2025, more than triple the 78 recorded in 2016, with governments increasingly justifying them as wartime or emergency measures (Access Now). The countries doing the most damage to their own case are not the ones with no legal framework — they're the ones with vague ones. Courts in Africa and South Asia have started striking down shutdown orders precisely because the underlying statutes didn't specify a threshold, a maximum duration, or a review mechanism. India's Anuradha Bhasin ruling (2020) forced the government to publish shutdown orders and subject them to periodic judicial review; Nigeria's courts have done similarly. None of that exists in TDRA's licence conditions as reported.
The Fix Is Cheap
None of the technical resilience mandates need to change. What's missing is a published trigger definition — what counts as "exceptional circumstances" — a maximum duration before mandatory review, and an independent body (even an internal one, distinct from the security services requesting the restoration) that signs off before a full-network action, not after. The UAE has the administrative capacity to do this quickly; it built a functioning AI-defense program in three months after the February attacks began. Writing three sentences of scope into a telecom licence is a lower lift than that. Absent it, TDRA has bundled a genuinely good infrastructure standard with a rubber stamp for whichever ministry decides a network needs "restoring" next.