A Law Written for Hackers, Applied to Holidaymakers
On June 29, 2026, Amnesty International and the Gulf rights group ALQST published a joint investigation — updated July 17 — documenting eight foreign visitors to Saudi Arabia arrested and prosecuted between July 2022 and late 2025 over social media posts, including posts made before they ever entered the Kingdom. Four were on Hajj or Umrah pilgrimages; the rest were tourists or family visitors. Sentences ranged up to ten years, several after prolonged pretrial detention with delayed consular access.
The most-cited case is Ahmed al-Doush, a British national and then-Bank of America analyst arrested at Riyadh airport on August 31, 2024, as he was leaving with his pregnant wife and two children after a family visit. The Specialized Criminal Court — Saudi Arabia's terrorism tribunal — sentenced him to ten years on May 12, 2025, over posts from before his trip; an appeal cut that to five years in April 2026. Amr Abdelfattah, a French national visiting for Hajj, was detained June 16, 2024 and held eleven months before trial on charges including "insulting" the government. Fahd Ramadhan, a Dutch-Yemeni national, spent 18 months in detention without formal charge over posts sympathetic to a royal-family critic, before his release in June 2025.
The Case for the Law — and Where It Breaks Down
Saudi Arabia's defenders have a real argument, and it deserves to be stated plainly: every state polices speech that threatens public order or incites violence, and the Kingdom is entitled to enforce its own laws on its own soil, including around religious conduct during Hajj — a context where security and crowd-control failures have killed pilgrims before. A government hosting millions of foreign visitors a year has a legitimate interest in rules against defamation, incitement, and disruption.
But that is not the law actually being used here. Saudi Arabia's Anti-Cyber Crime Law (Royal Decree M/17, March 26, 2007) criminalizes, under Article 6, producing or transmitting material "impinging on public order, religious values, public morals, and privacy" — punishable by up to five years in prison and a 3 million-riyal fine. The Law on Combating Terrorism Crimes and Financing goes further: Article 1(3) defines a "terrorist crime" to include any act intended to "disturb public order," "undermine state reputation or status," or "endanger national unity" — with jurisdiction assigned to the Specialized Criminal Court, the same body created to try al-Qaeda cases. Neither provision requires intent to incite violence. Neither distinguishes a beheading video from a sarcastic tweet. And as the al-Doush and Abdelfattah cases show, both are being applied to social media posts by people who were, at the time of posting, sometimes not even in the country.
Why Vagueness Is the Actual Defect
The proportionality argument is not that Saudi Arabia may not regulate speech at all — it is that laws written to reach "any act" undermining "state reputation" fail the basic notice requirement that any criminal statute needs: a visitor cannot know, before boarding a flight, which of their years-old posts might later be read as public-order-disturbing. That unpredictability, combined with a terrorism court's jurisdiction and sentences up to a decade, is what converts an ordinary content-moderation dispute into a strategic risk for the country's own economic plan.
That plan is tourism-dependent. Saudi Arabia drew an estimated 122 million visitors in 2025 and has set a Vision 2030 target of 150 million annual arrivals, including 70 million international visitors, according to the Ministry of Tourism. Hajj and Umrah are the anchor of that flow — millions of Muslims a year with no practical alternative destination for the pilgrimage, which is precisely why prosecutions of pilgrims carry outsized reputational cost: unlike a leisure tourist, a pilgrim cannot simply choose a different country next time, but every prosecuted case still reaches the news cycle in the traveler's home country.
The Proportionate Fix
Amnesty and ALQST's core recommendation is not novel: narrow Article 6 and the terrorism law's public-order clause to require genuine incitement to violence or verifiable defamation with concrete harm, drop extraterritorial reach over pre-entry posts, and route non-violent expression cases out of the Specialized Criminal Court entirely. None of that requires the Kingdom to tolerate harassment, doxxing, or incitement — those are genuine harms, addressable under narrower fraud- and safety-focused provisions like the law's own Articles 3–5, which already cover blackmail, privacy invasion, and defamation with real victims. What proportionate reform would remove is the catch-all that currently lets a customs officer's read of a years-old post trigger a terrorism prosecution.
Until that narrowing happens, foreign ministries — the UK, US, France, and the Netherlands all have nationals among the documented cases — have an obvious interest in updating travel guidance to state plainly that social media history, not just on-the-ground conduct, is now a prosecutable risk factor for entry. That is a modest, evidence-based step; it does not require boycotting Hajj access or halting the Kingdom's broader opening. It simply tells travelers what their own governments now know: the risk is real, documented, and currently unbounded by anything resembling ordinary criminal notice.