Introduction

Our client is a leading IT company specializing in software development and website solutions. It is a foreign company based outside the country. In the past, the company’s director was accused in a criminal case in the UAE. The accusation was related to one of the company’s employees who allegedly hacked and destroyed the data of a website.

Case Overview

This cybercrime and criminal law matter involved allegations against a software development company following a cyber-attack that disrupted a major UAE institution’s website. Leaders Advocates successfully defended the company, resulting in a full acquittal before the Dubai Criminal Court.

The Background

The company had entered into a contract with a major institution in the UAE to create and develop a website that provides services to over 10,000 clients. However, due to a dispute between the accused company and a former employee, the employee launched a cyber-attack, exploiting a vulnerability known as SQL Injection.
This attack resulted in the destruction of the targeted institution’s database and the deletion of critical data, leading to a 15-day disruption of their website.
The Public Prosecution conducted an investigation with the software developer company and heard testimonies from the victim’s information security staff before referring the matter to the Criminal Court.

Legal Challenges

The primary legal challenge was defending the software development company against allegations of responsibility for the cyber-attack. The case involved complex technical issues relating to cybersecurity, SQL Injection, website security, and the allocation of legal liability for the security breach.

Our Legal Strategy

The accused company (“Our Client”) instructed Leaders Advocates after six other law firms were unable to fully understand the technical aspects of the case.
We submitted a detailed defense memorandum explaining that the software development company had not committed any criminal offense. We argued that the principal cause of the breach was the targeted institution’s failure to implement adequate cybersecurity measures.
Furthermore, we explained that the former employee’s knowledge of the source code did not enable the hacking process. We also clarified that the SQL code was required to establish communication between the Microsoft database and the developed software.
In addition, we demonstrated that the SQL injection vulnerability has been widely known within the cybersecurity industry for more than 15 years and could have been prevented through commonly available security solutions, including Web Application Firewall (WAF) technology.
As part of the proceedings, the Criminal Court appointed an independent committee of cybersecurity experts to examine the technical evidence.

The Result

The court-appointed cybersecurity experts concluded that the software development company was not responsible for the hacking incident.
According to their report, the primary cause of the breach was the inadequate protection implemented by the victim’s cybersecurity team. The experts found that relying solely on a firewall did not provide sufficient protection and that additional security measures, including a Web Application Firewall (WAF), should have been implemented.
The experts further concluded that the victim launched the website despite known security vulnerabilities, which ultimately led to the cyber-attack.
Based on the technical expert report, the Criminal Court acquitted our client and convicted the former employee, who was tried in absentia, for his involvement in the incident.

Why This Case Matters

This case demonstrates the importance of experienced criminal lawyers in Dubai with knowledge of cybercrime, cybersecurity, and complex technical evidence. It also highlights how expert legal representation can successfully challenge allegations involving software development and information security.