Two former employees of a prominent investment entity have been acquitted of criminal charges related to unauthorized access of electronic systems, with the rulings upheld through multiple levels of the Qatari judicial system, culminating in a final decision by the Court of Cassation.
The case originated from emails flagged by the entity’s information security system. The employees—a digital transformation specialist and a systems and solutions architect—were accused under Qatar’s Law No. 14 of 2014 on Combating Cybercrimes of unlawfully accessing confidential investment and financial data. The charges claimed that the employees had sent documents from their official work accounts to personal emails without authorization, constituting unauthorized entry into the entity’s electronic systems.
The employees were never subjected to an internal administrative investigation before the matter was escalated to criminal authorities, with the entity citing concerns over potential flight risk as justification for immediate legal action.
Their defense, led by attorney Abdullah bin Hamad al-Athbah, challenged the prosecution on three key points: whether the emails actually belonged to the employees; whether their access to the information was within their authorization; and whether the legal elements defining unauthorized access were satisfied. The defense’s approach combined legal expertise with a deep understanding of fintech, cybersecurity, and the entity’s internal system architecture.
The defense revealed significant inconsistencies and procedural flaws. Some emails attributed to one employee dated back years before he joined the entity, including correspondence from when he was employed in Singapore. This contradicted claims linking him to data transmissions that predated his association with the investment firm. Furthermore, none of the emails presented in court bore his name or official email address, raising doubts about the evidence’s reliability.
Additionally, many of the alleged breaches occurred before internal policies regulating data access were formally adopted, a gap of several years that undermined the argument that these actions violated established standards. The defense also noted that one employee retained access rights to sensitive systems well after the timeframe associated with the charges and that there was no clear evidence his access had been revoked.
Testimonies from the entity’s own witnesses further weakened the prosecution’s position. Key representatives admitted uncertainty over details such as whether the documents involved were officially classified as confidential, the precise number of emails at issue, and the validity of technical reports. Notably, they confirmed that at least one accused employee was authorized to access the data in question as part of his role as a program developer.
The Fourth Criminal Circuit closely examined the evidence and ruled that the fundamental element of unauthorized access was not proven. The court characterized the case as lacking substantive proof and described any procedural issues as administrative rather than criminal violations. Following this initial verdict, the employees traveled abroad on leave and voluntarily returned to Qatar to participate in subsequent appeal proceedings, countering earlier concerns about flight risk.
The Court of Appeal upheld the acquittal, and the Court of Cassation later dismissed further challenges to the ruling, making the acquittal final. The outcomes demonstrate the judicial system’s insistence on evidence-based verdicts, irrespective of the institutional stature of the parties involved. Defense counsel al-Athbah emphasized that the case affirmed Qatar’s judiciary as an impartial venue where truth and justice prevail over status and influence.