UAE Cybersecurity Official Warns of VPN Abuse

The top cyber official in the United Arab Emirates (UAE) worries that virtual private networks (VPNs) are being misused in the country.

"We have no problem with people using VPNs, but using it for bad things is the problem," Muhammad Al Kuwaiti, head of cybersecurity at UAE Government, recently told local reporters.

UAE residents increased their downloads of VPN apps by 1.83 million in 2023, reaching a total of 6.1 million, according to the Global VPN Adoption Index by Atlas VPN.

This pushed the UAE VPN adoption rate to 61.7% last year, the second highest in the world after Qatar’s 69.87%. 

Strict Regulations and Censorship

VPN usage in the UAE is high because the country set strict regulations on Internet content, including the censorship of designated websites and online services, says Ezzeldin Hussein, regional director, sales engineering, Middle East, Turkey and Africa (META), SentinelOne.

"VPNs allow users to bypass these restrictions and access content that may be blocked or unavailable in the country, such as VoIP services," Hussein explains.

He added that the UAE is a global commerce hub, so visiting business travelers often use VPNs to access corporate networks, communicate securely abroad, and overcome geo-restrictions on services and content.

Individuals in the UAE also turn to VPNs to encrypt their Internet traffic and protect their personal information from surveillance, hacking, and data breaches, he notes.

VPNs for WhatsApp, FaceTime Access

Nord Security says the usage of VPN is growing in the UAE and wider Gulf as residents use it make audio-video calls through apps such as WhatsApp, Skype, FaceTime, and dating apps.

However, the Telecommunications and Digital Government Regulatory Authority (TDRA) guidelines clearly forbids the use of VPNs for illegal means, including hiding an IP address to gain access to forbidden communications sites, such as WhatsApp — which is seen to be a rival to the government's incumbent VoIP services.

Under the decree law to combat false rumors (or fake news) and cybercrimes, UAE residents who violate the law and misuse VPNs could face imprisonment and fines between Dh500,000 to Dh2 million.

Gopan Sivasankaran, general manager at Secureworks for Middle East, Turkey, and Africa, says the UAE is home to a large percentage of expat workers who may be tempted to employ VPNs to access media content from their home country, or call international friends and family. 

Aside from the legal risks, Sivasankaran warns of consumer complacency surrounding VPN's unique cybersecurity risks.

"In the same way that the cloud is sometimes dismissed as 'somebody else's computer,' third-party VPN services are 'somebody else's network.' They will protect your local traffic on a hotel or public WiFi network but that protection ends at the VPN service provider's server," he says. Rogue providers could potentially monetize, monitor, or interfere with VPN traffic, he adds.

"The customer takes it on trust that nothing nefarious is done with their communications."

Cybercrime Investigation Challenges

From a national cybersecurity perspective, widespread VPN usage poses challenges for law enforcement and intelligence agencies tasked with monitoring cybercrime and national security threats, cautions SentinelOne's Hussein.

"The anonymity afforded by VPNs can make it difficult to trace the origin of malicious activities or identify individuals involved in cyberattacks or other illicit activities conducted online," he says.

"Ultimately, governments will face policy and regulatory challenges in balancing the need to protect cybersecurity with respecting individual privacy rights and freedom," Hussein adds. "It is important to educate the general public about the responsible use of VPNs and the potential risks of VPN misuse."