The unit’s employees will be tasked with hacking computers or phones of any person or private organization that is defined as a threat to cybersecurity and within 24 hours of identifying a potential threat, the unit has the authority to access the device and extract data without a court order.

7amleh – The Arab Centre for Social Media Advancement warns of the risks and dangers that emanate from the newly proposed Cyber Security and National Cyber Directorate Bill in Israel. The bill, which was circulated to ministers in Netanyahu’s government last month, represents years of consultation about Israel’s approach to cybersecurity. 

In the law’s organizational aspects, it will grant the prime minister the power to appoint new employees into the unit confidentially without conducting a formal recruitment process. The unit’s employees will be tasked with hacking computers or phones of any person or private organization that is defined as a threat to cybersecurity and within 24 hours of identifying a potential threat, the unit has the authority to access the device and extract data without a court order. This data will then be inserted into a national database of threat indicators, which has already been the subject of much public controversy with critics citing this in relation to a broader issue of user privacy. Moreover, these employees enjoy legal impunity and cannot be sued or filed for complaint.   

The bill provides the legal basis for the establishment of the Israeli National Cyber Directorate (INCD), which will have increased authority to issue national guidance on cybersecurity matters, even within the scope of other regulators in areas such as finance, health, transport, energy and communications. This represents a crucial turning point in how Israel is dealing with national cybersecurity issues. The INCD will be the national cybersecurity regulator, a task that is usually designated to military or security bodies, whose power would be constrained by legal obligations.

Additionally, the INCD will have direct accountability to the prime minister who defines cyber threat priorities. This constitutes the first cyber unit that is circumventing legal proceedings under the pretext of fighting cybercrime.Throughout the bill, the terms “attack” and “threat” are vaguely and loosely defined and subject to wide interpretation. For example, the INCD has the authorization to hack any person or entity that constitutes a threat to the Israeli economy. Under this same definition, any demonstration against Israeli economic initiatives is considered a cyber threat.

Furthermore, the bill proposes to protect Israel from environmental and health disasters. Identifying someone who has a contagious disease allows the INCD to immediately hack or confiscate their electronic devices. Due to the abovementioned, 7amleh – The Arab Centre for Social Media Advancement reaffirms that the proposed bill is in stark contradiction with all international conventions that aim to safeguard human and digital rights. The bill brings about challenges in balancing democratic rule of law and strengthening national security as it overrides the Israeli judicial system and legal frameworks that are in place to protect citizens. 

Nadim Nashif, the Executive Director of 7amleh, stated the following: “The INCD’s duties, such as hacking and confiscating electronic devices, in the proposed bill have always been enforced against Palestinians, but the government is now proposing to integrate this bill into a legal framework which legitimizes these acts beyond the scope of law enforcement and legal proceedings.”  

For further reading on the matter, please see: Council on Foreign Relations, A Look at Israel’s New Draft Cybersecurity Law, July 2018.  Cybersecurity Research Centre, The New Israeli Cyber Law Draft Bill - A Preliminary Overview, July 2018.