Information Technology Crime, Digital Evidence and Rights and Freedoms Safeguards Law

This Law is entitled the ‘Information Technology Crime, Digital Evidence and Rights and Freedoms Safeguards Law’, commencing under its final chapter. It is special legislation for expressly regulated conduct and procedural powers; penal, criminal-procedure and other laws apply to unregulated matters insofar as consistent with its safeguards.

The Law shall criminalise specified attacks on system/data confidentiality, integrity and availability; combat technology-enabled fraud, extortion and exploitation; precisely regulate digital-evidence collection, preservation, examination and presentation; enable transnational investigation; and prevent cybercrime enforcement becoming a basis for general surveillance, criminalisation of lawful expression or violations of privacy and communications secrecy.

Interpretation/application shall observe legality, necessity, proportionality, precise offences/penalties, presumed innocence, defence, privacy/communications, expression/press/research freedom, verifiable evidence, non-discrimination and only necessary data intrusion for specific crimes. Expansive interpretations shall not create unlegislated criminal or procedural powers.

This Law governs offences targeting systems, computer data, accounts or digital identities or materially using information technology, and electronic-evidence procedures in any crime where necessary for investigation/trial. Digital use does not preclude a more serious statutory classification where elements are met, without double punishment for identical conduct.

The Law applies to crimes wholly/partly in Iraq, with substantial Iraqi effects, targeting systems/services/persons there, committed abroad by Iraqis where punishable locally or local law cannot apply, or affecting Iraqi governmental interests/critical infrastructure. International law, judicial cooperation and lawful double-jeopardy protection shall govern jurisdiction.

Information system means devices performing automated processing. Computer data means processable representations of facts, information or concepts. Traffic data means source, destination, route, time, volume, duration and service type, excluding substance. Content data means transmitted/stored meaning or messages. Subscriber information means identifying/contractual data connecting services to persons/entities. Service provider means providers of communications, processing, hosting, storage or digital platforms to the public or others. Digital evidence means electronic data with potential evidentiary value. Preservation means preventing alteration/deletion while data remain with holders. Seizure means investigative control of evidence or forensic copies. Encryption means methods protecting confidentiality/integrity. Critical information infrastructure means digital systems/services whose serious disruption substantially harms security, health, the economy or essential services.

Intentional unauthorised access to all or part of systems by bypassing safeguards or fraudulent means attracts detention up to one year, fines of five to twenty million dinars, or both. Merely receiving publicly available data or unexploited accidental technical errors is not an offence.

Unlawful access intended to obtain/alter protected data or enable others, targeting governmental, health, financial, electoral or critical systems, or using stolen/impersonated credentials attracts one to three years' detention and ten to thirty million dinars. Actual harm aggravates sentencing.

Intentional unauthorised technical interception of non-public data travelling to, from or within systems, including data-bearing electromagnetic emissions, attracts one to three years' detention and ten to thirty million dinars, or either. Lawful participant recording or judicially authorised monitoring remains unaffected.

Unauthorised destruction, deletion, distortion, alteration, concealment, disabling or rendering others' data unusable with harmful or unlawful-gain intent attracts one to three years' detention and ten to forty million dinars. Extensive loss, public-service stoppage or serious financial harm aggravates punishment.

Intentional unauthorised serious obstruction/disruption through input, transmission, destruction, deletion, suppression, flooding or similar technical means attracts imprisonment up to five years and twenty to fifty million dinars, considering severity, duration and affected numbers.

Access, interception or data/system damage targeting critical infrastructure and capable of seriously endangering life, public safety, national security or essential-service continuity attracts five to ten years' imprisonment and at least fifty million dinars, without prejudice to harsher classifications elsewhere.

Producing, selling, distributing or possessing programmes, devices, passwords, access codes or credentials primarily designed/prepared for chapter offences with criminal-use intent attracts detention up to three years and ten to thirty million dinars. Lawful cybersecurity, testing, research, education or administration tools with reasonable precautions are excluded.

Authorised security testing, published-disclosure-policy research or testing in owned/managed environments attracts no criminal liability if limited to proving vulnerabilities, data are used only for protection, no intentional harm occurs and responsible reporting is prompt. Gross-negligence or scope-exceeding civil liability remains.

Unauthorised account takeover/control, credential changes, owner lockout or control transfer for fraud, extortion, espionage or harm attracts one to three years' detention and ten to thirty million dinars. Sensitive financial, governmental or professional accounts attract harsher punishment.

Intentional use of others' digital identity, identifiers or credentials for gain, harm or misleading public/private bodies attracts detention up to three years and ten to thirty million dinars. Pseudonyms, parody and unverified accounts are excluded absent specific criminal intent meeting offence elements.

Intentional unauthorised data input, alteration, deletion or concealment to make false data treated as genuine for legal, financial or administrative effects attracts imprisonment up to five years and twenty to fifty million dinars, including forged records, documents, signatures or certificates with fraudulent intent.

Intentional financial loss or unlawful gain through data input/change/deletion, system interference, impersonation or digital deception attracts three to seven years' imprisonment and twenty to one hundred million dinars, with restitution/compensation under general rules.

Intentionally creating, operating or sending deceptive digital means imitating trusted services to obtain passwords, verification codes, payment data or unauthorised-access information attracts one to three years' detention and ten to thirty million dinars. Actual financial/account appropriation aggravates punishment.

Digitally threatening private-data/image/recording publication, data destruction, system disruption or unlawful acts to compel money, benefits, action or omission attracts three to seven years' imprisonment and twenty to fifty million dinars, aggravated for child victims or extreme harm.

Using or distributing technical means to encrypt/suppress others' data or disable systems, then demanding money/benefits for access restoration or non-publication, attracts five to ten years' imprisonment and at least fifty million dinars. Critical infrastructure, healthcare or foreseeable death/serious injury aggravates punishment within general limits.

Unauthorised acquisition of money, credit, paid services or economically valuable digital assets using others' payment data, accounts, identities or systems attracts computer-fraud penalties, with harsher banking/payment/anti-money-laundering provisions where elements are met.

Unlawfully obtaining private personal data or non-public correspondence then intentionally disclosing it for harm, extortion or gain attracts detention up to two years, five to twenty million dinars, or both. Journalism, research or wrongdoing reports grounded in legitimate public interest and relevant law are excluded.

Publishing or threatening identifiable persons' real/synthetic intimate images or recordings without consent for harm, humiliation or extortion attracts one to three years' detention and ten to thirty million dinars. Consent to recording/private sending is not publication consent. Courts shall urgently restrict circulation and protect identity while preserving evidence.

Using systems to produce, display, distribute, request or possess child sexual exploitation material or groom children sexually attracts the harsher applicable statutory penalties. Protection/privacy take priority; child victims shall not be criminalised for material arising from exploitation.

Intentional repeated digital monitoring, contact, location tracking or threats objectively causing reasonable physical-safety fear or serious continuing privacy intrusion attracts detention up to two years or five to twenty million dinars. Criticism, argument, incidental contact and lawful journalism are excluded.

Intentionally creating, altering or deleting evidence, metadata or logs to mislead investigators/courts, incriminate innocent persons or conceal perpetrators attracts imprisonment up to five years and twenty to fifty million dinars, including synthetic media/deepfakes with that intent.

Destroying, concealing or changing data after knowledge of valid preservation/production/seizure orders, or deliberately supplying false data in response, attracts detention up to three years and ten to thirty million dinars. Silence or refusal of self-incriminating statements alone is not punishable.

Attempts at imprisonment-punishable offences follow general rules. Voluntary abandonment before harm and effective prevention may mitigate, unless an independent offence is already complete.

Penal Code principal, accomplice, instigator and assistance rules apply. Providers, developers, researchers and publishers are not accomplices merely for general lawful-use tools/services absent specific knowledge and intentional contribution to criminal plans.

Without prejudice to individuals, entities may be liable for crimes committed in their name/interest by authorised managers/representatives or through gross supervision failure. Penalties comprise fines, confiscation, compensation and compliance; dissolution requires exceptional primarily criminal purpose and reasoned judgment.

Aggravating factors include organised groups, numerous victims, public-office/administrative/confidential-data abuse, child/vulnerable victims, serious loss/disruption, critical infrastructure and repetition. Punishment remains proportionate to conduct, harm and intent.

Courts may consider early voluntary reporting, stopping harm, restoring money/data, substantial detection assistance and effective compliance within legal limits, without unjustified exemption for serious harm or victim-rights violations.

Courts shall confiscate criminal proceeds and offender-owned tools primarily used in offences, protecting good-faith third parties. Entire devices, servers or platforms shall not be confiscated where relevant data/tools can be separated, nor disproportionately disrupt public services or innocent users' rights.

Criminal judgments do not prejudice compensation for directly connected material/moral harm and response/recovery costs. Courts may restore accounts, money or data or reverse unlawful technical effects where feasible without compromising evidence or third-party rights.

Investigators shall use the least intrusive adequate lawful means. Preservation, stored-data production, search/seizure, real-time traffic collection and content interception are distinct; lighter powers shall not disguise access requiring stronger safeguards.

On reasoned request, investigating judges may order persons/providers to preserve specified existing controlled data reasonably at risk of loss/change and necessary to specific investigations. Orders last ninety days, renewable once with reasons, without authorising inspection/use before appropriate legal powers are obtained.

Judges may temporarily prohibit order disclosure for genuine investigative risk, proportionately and reviewably. Confidential legal/compliance consultation or mandatory competent-regulator disclosure remains permitted.

Where needed to trace specific communications, judges may require preserving providers to disclose only necessary next-provider/route information, documenting every disclosure without unnecessary data.

Judges may order specified investigation-relevant subscriber information, identifying account/service, period and purpose. It excludes content and cannot expansively encompass messages or detailed browsing histories.

Compelled private files/content require reasoned judicial orders specifying type, account/system, period, crime and expected relevance. Requests shall be as specific as possible; undefined general or broad unrelated-person collection orders are prohibited.

Government-held data receive identical safeguards. Government ownership does not remove judicial requirements for correspondence, personal data or protected information. Professional secrecy/national security rules shall permit independent judicial review.

This Law does not authorise indiscriminate retention of all communications/internet users merely for possible future need. Duties concern targeted existing specified data unless separate express constitutional legislation establishes necessary, proportionate, judicially supervised retention.

Private systems/media searches require investigating-judge orders identifying crime, data/categories, system/place and scope. Statutory flagrante-delicto exceptions require immediate judicial presentation and do not authorise unlimited digital searches.

Searches shall minimise irrelevant exposure using time, account, subject or technical filters. Search shall stop when required categories exceed authority, obtaining additional orders where needed.

Where possible, documented forensic images shall replace originals for examination, with hashes or equivalent checks before/after. Technical/operational impossibility requires recorded reasons and alternatives preserving integrity and retestability.

Where authorised data reside on another system lawfully accessible from the searched system, judges may urgently extend orders. This does not authorise territorial overreach or foreign intrusion without treaties or lawful international cooperation.

Seizure shall cover necessary data/media only. Work devices, production servers or whole institutions shall not be seized where reliable specified copies suffice, unless devices themselves are criminal tools/targets or evidence cannot technically separate. Detention periods shall be minimised and lawful data copies provided where possible.

Judges may require reasonably knowledgeable persons to assist access, copying or structural interpretation without compelling accused persons' self-incriminating mental testimony. Memorised secrets shall not be compelled where essentially testimonial against their holder.

Providers/manufacturers shall not be required to weaken all users' encryption, create backdoors or general surveillance capabilities absent originally. Specific judicial orders may require intelligible available data or institution-controlled keys/decryption without new systemic weaknesses.

Likely lawyer-client, confidential journalistic, highly sensitive medical or privileged material requires independent judicial filtering before investigators access it. Judges, independent experts or separation teams may perform review.

Searches to identify confidential journalistic sources require serious-crime investigations, demonstrated necessity, unavailable less intrusive means and special reasoned judicial orders. Embarrassing/leaked public-interest publication alone shall not trigger investigation absent intentional participation in independent offences.

New-offence data beyond orders may be examined only as needed to stop imminent life danger or preserve evidence, then require fresh judicial permission before substantive use in another investigation.

For crimes punishable by at least three years' imprisonment, investigating judges may authorise targeted real-time traffic collection for specified communications, accounts or devices where necessary and less intrusive means insufficient. Orders specify scope/provider and last no more than thirty days unless judicially extended with reasons.

Content interception/listening requires special judicial orders in serious-felony investigations, serious grounds for material evidence and inadequate alternatives. Orders shall identify persons/accounts/devices, communication type, minimisation and periods up to thirty days, renewable while conditions persist.

Implementers shall stop/minimise clearly irrelevant recording and separate professionally confidential/privileged communications. Irrelevant material shall be promptly deleted when legal need ends unless judges specifically preserve it for challenge/accountability.

Interception/real-time orders shall not target broad populations, areas or entire services without judicially reviewable investigative subjects and individual/technical targets. Cybercrime enforcement alone does not justify comprehensive or continuous secret surveillance of all communications.

Protected logs shall record judicial-order identifiers, executing bodies, start/end times, systems, result access counts and scope departures, accessible to competent judges and authorised oversight.

After covert interception ends and investigative danger passes, affected persons shall receive enough notice to challenge legality, unless judges defer for specified serious ongoing-investigation or protection reasons. Deferral shall not become permanent without periodic judicial review.

For specific imminent threats to life or serious bodily safety, authorities may request immediate preservation and voluntary lawful subscriber/traffic information locating danger. Content interception or compulsory acquisition still requires courts, with judicial duty arrangements enabling urgency.

Relevant lawfully collected/preserved digital evidence is admissible where courts can assess authenticity, integrity, provenance and extraction. Electronic form alone neither excludes it nor confers automatic weight through platforms, seals or hashes.

Courts shall consider relevant system integrity, custody, hashes, creation/change logs, extraction reliability, retesting, timestamp consistency, expert reports and manipulation/synthetic-generation risks. Not every factor is required where evidence nature does not demand it.

From seizure/copying, every receipt, transfer, storage, duplication and examination shall log person, time, purpose and action. Unexplained gaps affect weight and may justify exclusion for material integrity doubt; minor formal errors alone do not exclude otherwise authenticated evidence.

Reports shall appropriately describe sources/devices, tools/versions, material settings, hashes, extraction, timezone, conversion/recovery/decryption and known errors/limits. Parties shall receive retesting information without unrelated technical secrets.

Serious disputes over AI-generated/modified recordings, images, audio or documents require independent examination where necessary and assessment of provenance, context, metadata and custody. Unexplainable/untestable automated indicators alone shall not convict.

Forensic, matching, classification and identification outputs require methods, error rates and limitations. Parties may examine experts and challenge tools. Algorithmic recommendations alone do not establish intent, identity or criminal responsibility.

Provider records may be used with proven attribution, retention and delivery methods, without presumed infallibility. Defence may seek information testing completeness, changes, automated inferences and third-party inputs.

Reliable copies, extracts or readable conversions may be submitted where conformity is proven/verifiable. Encrypted, foreign-language or technical evidence requires translations/explanations, preserving originals and disputed examination access.

Courts may exclude evidence obtained through serious constitutional violations, beyond judicial scope or in ways undermining fairness or reliability. They shall weigh violation severity, evidentiary connection and less intrusive remedies without legitimising unlawful surveillance.

Under judicial supervision and third-party privacy safeguards, defence may receive copies or suitable access to prosecution evidence and necessary reports, tools and data. Security/privacy barriers to copies require effective independent-testing alternatives.

Providers shall reasonably promptly execute valid scoped orders and judicial confidentiality, with court challenges for technical impossibility, overbreadth, legal conflicts or disproportionate effects on unrelated persons.

Providers need not monitor all transmitted/stored content or actively seek illegality. Lawful hosting, transport or caching alone creates no criminal liability absent intentional participation in specific crimes or deliberate non-compliance with valid orders.

Providers may periodically disclose aggregate request/order numbers, types and compliance/refusal rates without investigative harm. Competent courts shall annually publish aggregate preservation, production and interception statistics unless specific security considerations prevent.

Good-faith execution of believed-valid orders or refusal of unlawful action attracts no staff criminal liability absent intentional concealment, evidence destruction or overreach. Reports of illegal requests/surveillance abuse receive whistleblower/public-service safeguards.

Foreign-controlled/stored data require effective legal-assistance, treaty or international mechanisms. Technical accessibility alone does not override sovereignty. Publicly available or validly consensual access is excepted only within international law.

Opinions, criticism, news, rumours, erroneous information, satire and religious/political/social content alone are not offences unless conduct meets specific elements herein or other constitutional legislation. Vague state-prestige, public-interest or inappropriate-content labels shall not independently punish.

Access, possession or disclosure offences shall not criminalise legitimate journalistic/research receipt of source information without participation in unlawful acquisition. Applicable privacy/protected-secret laws remain where substantive conditions are met.

Accused persons may remain silent and shall not be compelled to testify against themselves. Refusal to reveal memorised passwords alone does not establish guilt. Lawful seizure, technical methods or institutional non-personal keys/data production under orders remain possible.

Persons directly affected by questioning, search or seizure may obtain counsel under criminal procedure. Covert technical measures preventing presence shall be fully recorded for later legality/scope challenge.

Authorities/courts shall prevent republication of private/sensitive criminal material, restrict access to professional need and redact published decisions where possible. Evidence collection shall not unnecessarily increase victim harm.

Courts may remove or disable specified material proven a criminal tool/proceed or direct continuing harm, identifying URLs/accounts/files wherever possible, allowing challenge and time limits where appropriate. Whole-platform/site blocking for separable material requires unavailable less restrictive means and proven necessity.

Electronic character alone does not justify detention, travel bans or all-device confiscation. Criminal-procedure necessity, flight, evidence-tampering and repetition risks apply, preferring adequate less restrictive measures.

Investigations/trials shall accommodate children, disability, extortion and gender-based violence victims and others at special risk, with confidential reporting, psychological/legal support and avoidance of unnecessary confrontation, preserving defence rights.

Competent decisions shall establish/designate cybercrime/evidence units within existing enforcement, prosecution and technical staffing, without new independent security agencies. Investigating judges supervise within constitutional/statutory competence.

National published accreditation standards shall cover staff competence, tool validation, records, evidence and quality. Lawfully registered independent experts may assist; no monopoly shall prevent defence counter-examination.

Judicial/technical bodies shall continually train judges, prosecutors, investigators and experts in evidence, custody, encryption, transnational crime, synthetic media, privacy and expression, periodically updating guidance.

The Council of Ministers, Supreme Judicial Council, Interior and Foreign Affairs shall designate national continuous contact for preservation, urgent assistance and international coordination, without extra-legal seizure/interception powers.

Collection, transfer and preservation assistance shall follow effective treaties, judicial-assistance law and national rules, respecting speciality, data and procedural safeguards. Requests may be refused for fundamental-rights violations, purely political character or missing legal grounds.

Authorities shall use lawful police/judicial and rapid-response networks and prepare for international obligations, without treating treaties not effective for Iraq as direct domestic duties before constitutional completion.

Courts, Interior and relevant bodies shall publish aggregate case numbers/types/outcomes, preservation/search/interception orders and cooperation requests, protecting secrecy/data. Reports assess legislation, resources and safeguards rather than create personal watchlists.

A confidential central judicial register shall record traffic/content orders, extensions, refusals and reviews, enabling authorised oversight of proportionality/time limits. Public reports shall not identify persons.

Officials/public-service persons intentionally misusing powers, disclosing occupationally obtained data or intercepting without judicial authority face existing criminal penalties, with official status aggravating where appropriate and victim compensation/challenge rights.

Courts shall set post-case evidence/interception retention by case and appeal types. Irrelevant or restored data from forensic copies shall be destroyed after legal need ends, documenting destruction to prevent unofficial copies.

Every three years, government shall report to Parliament on crime trends, procedural effectiveness, rights effects, technical/international developments and amendments. Reports cannot administratively expand offence elements/powers; material expansion requires legislation.

Penal Code No. (111) of 1969, as amended, continues for digitally committed general offences where elements are met; this Law governs specific technical attacks/procedures. Overlapping provisions follow concurrence/connection rules and the harsher penalty without duplication.

These special digital procedures supplement Criminal Procedure Law No. (23) of 1971, as amended. General safeguards remain and shall not be interpreted downward from statutory or constitutional protection.

Implementation shall observe personal-data/privacy, cybersecurity, critical infrastructure, communications and electronic-transaction legislation. Cybersecurity duties do not prevent judicial evidence preservation; investigations do not displace minimisation/limited retention.

Valid pre-commencement procedures remain under then-effective rules. New procedures apply subsequently where more protective without invalidating prior acts. More favourable criminal provisions follow general rules.

Within one hundred and eighty days of publication, competent bodies shall technically regulate custody, forensic imaging, preservation/production coordination, statistics and contact points, without creating new offences, penalties or surveillance powers.

The Supreme Judicial Council and technical bodies shall issue digital-evidence guidance covering forms, standards and practical procedures. Guidance shall neither bind judicial evidentiary discretion nor replace legislation.

Within one year of commencement, the Council of Ministers shall draft relevant amendments, especially paper/place-only search/seizure provisions or gaps in digital-communications confidentiality, submitting them constitutionally to Parliament.

Express conflicts are repealed only to their extent, without abolishing other statutory rights/safeguards. Overlapping penal texts shall preserve certainty and avoid duplicate criminalisation.

The Law takes effect one hundred and eighty days after Official Gazette publication. Instructions, training and technical-unit preparation provisions apply from publication; new investigative powers shall not be used before substantive commencement.