Saudi Gazette report

RIYADH — The Saudi National Cybersecurity Authority announced incentive rewards for those who report cybercrimes, with rewards reaching up to SR50,000 or one percent of the collected fine.

The authority governor has constituted a committee, comprised of three of its staff members, to examine reports referred to it, determine the eligibility of whistleblowers for rewards, and fix the amount of reward, in accordance with the regulations.

The violations for which the whistleblowers receive the reward include conducting cybersecurity operations without a license or in violation of its terms, and non-compliance with policies, governance mechanisms, frameworks, standards, controls, and guidelines related to cybersecurity.

The violations also include refusal to provide the National Cybersecurity Authority with the information it requests while carrying out its duties and responsibilities, or misleading it, as well as possessing, selling, importing or exporting any cybersecurity-related device or service that does not comply with standards and requirements or without obtaining the necessary license or clearance. Those who obstruct or prevent inspectors from performing their duties will also face punitive measures.

According to a new draft regulation for reporting violations published on the authority’s survey platform, the reward would be granted only after the reported violation was proven. Also the decision to prove the violation shall become final, either through a court ruling or the expiration of the statutory period for appeal. The report must also have played a decisive role in proving the violation.

The conditions for receiving the reward included that the whistleblower must be neither an employee of the authority, nor his/her spouse, in-law, and relative. Also the violation must not have been previously reported or rewarded by the authority. The conditions also stipulate that reporting the violation must not be part of the whistleblowers’ duties, if they are a public employee or equivalent, and that the whistleblower must pledge not to disclose any information related to the report to others.