The Saudi National Cybersecurity Authority has announced incentive rewards for individuals who report cybercrimes, with payments reaching up to SR50,000 or one percent of the collected fine.
The authority governor has formed a committee consisting of three staff members to examine reports, determine whistleblower eligibility for rewards, and establish the reward amount in accordance with regulations, according to a report by the Saudi Gazette.
The violations for which whistleblowers receive rewards include conducting cybersecurity operations without a licence or in violation of its terms, and non-compliance with policies, governance mechanisms, frameworks, standards, controls, and guidelines related to cybersecurity.
Saudi Cybersecurity Authority announces reward programme for violation reports
The violations also include refusal to provide the National Cybersecurity Authority with information it requests while carrying out its duties and responsibilities, or misleading it.
Possessing, selling, importing or exporting any cybersecurity-related device or service that does not comply with standards and requirements or without obtaining the licence or clearance also qualifies for reporting.
Individuals who obstruct or prevent inspectors from performing their duties will face punitive measures.
Conditions for reward eligibility
According to a draft regulation for reporting violations published on the authority’s survey platform, the reward would be granted only after the reported violation was proven.
The decision to prove the violation shall become final, either through a court ruling or the expiration of the statutory period for appeal. The report must have played a role in proving the violation.
The conditions for receiving the reward include that the whistleblower must be neither an employee of the authority, nor their spouse, in-law, or relative. The violation must not have been reported or rewarded by the authority previously.
The conditions stipulate that reporting the violation must not be part of the whistleblower’s duties, if they are a public employee or equivalent. The whistleblower must pledge not to disclose any information related to the report to others.
