合法的傍受 UAEと湾岸諸国の規制は欧州の枠組みとは大きく異なる。湾岸協力会議（GCC）諸国（アラブ首長国連邦、サウジアラビア、カタール、バーレーン、クウェート、オマーン）は、世界で最も急成長している電気通信市場の一つである。これらの市場への参入や提携を検討している欧州の通信事業者、MVNO、テクノロジー・ベンダーは、湾岸諸国における合法的な傍受の状況は、EUで慣れ親しんでいるものとは根本的に異なることを理解しなければならない。規制の理念、制度的構造、技術的要件、通信監視に対する国家の関与の度合いなど、すべてが欧州のモデルとは大きく異なっている。.
本稿では、国際通信事業者にとって最も重要な湾岸市場であるUAEを中心に、GCC地域全体に共通するテーマも取り上げる。欧州の通信事業者にとって重要なことは、湾岸通信市場に参入するためには、合法的な傍受がどのように機能するのか、誰が傍受を推進するのか、コンプライアンスは実際にどのようなものなのか、といった前提を徹底的に見直す必要があるということである。.
合法的傍受 UAE：市場参入要件
In the EU, lawful interception operates within a framework of judicial oversight, proportionality, and fundamental rights protections. Interception generally requires judicial authorisation or, for national-security interception, approval by a minister subject to independent oversight; oversight bodies review the use of surveillance powers, and operators operate within a context of legal certainty and procedural safeguards. In the Gulf states, the regulatory philosophy is markedly different. Telecommunications surveillance is generally treated as a sovereign prerogative, exercised by state security agencies with broad authority and, in most cases, limited independent oversight.
UAEでは、Telecommunications and Digital Government Regulatory Authority (TDRA)（前身はTelecommunications Regulatory Authority (TRA)）が電気通信分野の主要な規制機関である。TDRAは、合法的な傍受に関する要件を含め、事業者が機能しなければならない規制の枠組みを定めている。しかし、傍受活動の運用方針は主にセキュリティ・サービスによって決定されるため、事業者はこれらの機関と緊密に協力し、その要件を満たすように準備しなければならない。.
The UAE’s telecommunications sector is governed by Federal Decree-Law No. 3 of 2003 Regulating the Telecommunications Sector, as amended, and by the licences TDRA issues under it; the specific interception powers are not set out in a public regulation. Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes makes unauthorised interception a criminal offence. The scope of the state’s powers is significantly broader than in most EU jurisdictions, and the procedural safeguards are different in nature. The UAE has only two licensed public telecom operators (e& and du), whose licences TDRA renewed in 2026 until 2046. European entrants usually come in through a partnership or MVNO arrangement with one of them, so the LI set-up is largely the host’s.
UAEにおける技術要件
UAEにおける合法的な通信傍受に関する技術的要件は、TDRAが治安機関と協議の上で定めている。通信事業者は、以下の措置を講じることが義務付けられている。 傍受能力 that meet the TDRA’s specifications, which include the ability to intercept voice, SMS, data, and IP-based communications. The detailed technical specifications are confidential and are made available to licensees only.
One of the most significant differences from the European model is the degree of direct access that security agencies may require to an operator’s network infrastructure. Public reports suggest that in parts of the region security agencies may have more direct access to operator systems than is usual in the EU; operators should clarify the access model contractually before signing. This model contrasts sharply with the European approach, where operators typically retain control over the activation and execution of intercepts and deliver the resulting data to law enforcement through defined 引き継ぎインターフェース.
UAE licensees are also subject to content and service-access rules, for example on unlicensed VoIP, which are enforced through network filtering. These are separate from lawful interception obligations. The deployment of such technologies raises significant technical and ethical questions for European operators, particularly given the EU’s emphasis on privacy and data protection.
For operators providing services in the UAE, the technical compliance requirements are non-negotiable. Failure to deploy the required interception capabilities can put the licence of the operator concerned at risk. Compliance is monitored by the regulator and the security authorities under confidential licence conditions.
より広いGCC情勢
While each GCC state has its own regulatory framework, several common themes emerge across the region. Saudi Arabia’s Communications, Space and Technology Commission (CST) licenses operators whose obligations include cooperation with the security authorities; the detailed requirements are not public.
Qatar’s Communications Regulatory Authority (CRA) and Bahrain’s Telecommunications Regulatory Authority (TRA) likewise require licensees to cooperate with the security services. In Kuwait and Oman, the regulatory frameworks are somewhat less publicly documented, but the expectation of operator cooperation with interception requirements is consistent across the region.
A common feature across the GCC is tight control of OTT services. The Gulf states have at various times restricted or blocked VoIP services such as WhatsApp voice calls, Skype, and FaceTime, partly for commercial reasons (to protect the revenues of incumbent operators) and partly for security reasons (to maintain surveillance capabilities). Operators entering the GCC market must understand these dynamics and be prepared to comply with requirements that may include the blocking or filtering of specific services.
欧州オペレーターの課題
European operators entering the Gulf market face several significant challenges related to lawful interception. The first is the tension between the Gulf’s surveillance requirements and the EU’s legal framework for data protection and privacy. Operators subject to the GDPR may find themselves in a position where compliance with Gulf interception requirements could conflict with their obligations under EU law. A conflict arises mainly where an EU-established entity or EU-hosted systems would process the data: under Art. 48 GDPR, a third-country authority’s request alone does not legitimise a transfer. Keeping Gulf LI systems and data in-country, run by the local entity, avoids most of this tension.
The second challenge is the possibility that security agencies require more direct access to the network than European operators are used to. Clarify the access model contractually and reflect it in network design, security architecture and internal governance.
The third challenge relates to scope. Content and service-access rules, such as blocking unlicensed VoIP, may require network filtering capabilities that European operators do not use at home; these are separate from LI obligations and need their own legal and export-control review.
A fourth challenge is the lack of public documentation for some aspects of the interception requirements. While the TDRA and other Gulf regulators publish general frameworks and guidelines, the detailed technical specifications for interception are often provided on a confidential basis to licensed operators. This means that operators cannot fully assess the technical requirements before entering the market and must be prepared for an iterative process of specification review, development, and testing once they have agreed their arrangement with the host licensee.
輸出管理および倫理的配慮
European operators and technology vendors must also consider the export control implications of deploying surveillance technology in the Gulf. The EU’s Dual-Use Regulation (Regulation 2021/821) imposes export controls on certain surveillance and interception technologies, including equipment and software that could be used for the interception of telecommunications, and a catch-all for non-listed cyber-surveillance items where there is a risk of serious human rights violations (Art. 5). Operators and vendors exporting such technologies to Gulf states must ensure that they obtain the necessary export licences and comply with the conditions attached to those licences; for a German exporter the licensing authority is BAFA.
法令遵守にとどまらず、欧州の事業者が対処しなければならない倫理的配慮もある。湾岸諸国の人権記録は国際的な精査の対象になっており、こうした市場での監視技術の展開は風評リスクを伴う。事業者は、市場に参入する前に人権デューデリジェンス評価を実施し、自社の技術が国際人権基準に抵触する形で使用される可能性がある状況に対応するための方針を確立すべきである。.
いくつかの欧州企業は、湾岸および中東地域全般における監視技術の販売や展開に関連して、社会的批判や法的課題に直面している。この分野に参入する事業者は、倫理審査プロセス、内部告発者保護、活動の人権への影響に関する定期的な評価など、強固なコンプライアンス・プログラムを確実に実施すべきである。.
実践的な提言
UAEやより広範なGCC市場への参入を検討している欧州の事業者には、いくつかの実践的なステップが推奨される。まず、傍受要件、データローカライゼーション義務、EU法との抵触の可能性などを含め、対象市場の法的・規制的評価を徹底的に行う。電気通信規制と国家安全保障法に精通した現地の法律顧問を雇う。.
第二に、傍受の技術仕様を理解し、コンプライアンス・プロセスを開始するために、計画プロセスの早い段階で関連規制当局と関わること。要件が予想以上に広範囲に及ぶ可能性があるため、技術開発とテストのための十分な時間を確保する。第三に、監視関連技術の導入に伴う輸出管理上の影響を評価し、必要な許可を得てから進めること。.
第四に、人権への影響評価を実施し、湾岸諸国における監視技術運用の倫理的側面を管理するための方針と手順を確立する。第五に、コーポレート・ガバナンス構造が監視活動の適切な監視を可能にし、内部方針が現地の法的要件と組織の倫理基準の両方に合致していることを確認する。.
結論
The UAE and the broader GCC present significant opportunities for European telecommunications operators, but the lawful interception landscape in these markets requires a fundamentally different approach from what operators are accustomed to in Europe. The state-centric regulatory philosophy, the broad scope of interception powers, the possibility of direct agency access, and the ethical considerations associated with surveillance in the Gulf all demand careful preparation, specialist expertise, and a proactive approach to compliance. Operators that invest in understanding these requirements and building appropriate capabilities will be well positioned to succeed in these dynamic and growing markets, while managing the legal, technical, and reputational risks that come with operating in a fundamentally different regulatory environment.
UAEの合法的傍受の規制環境は、ヨーロッパの規範とは大きく異なる。市場参入を計画している事業者は、導入を決定する前にUAEの合法的傍受の要件を十分に理解する必要がある。.
関連記事
関連トピックについては、以下の記事を参照されたい：
- LI Requirements in the Netherlands: Telecommunicatiewet Chapter 13, ETSI-IP.nl and What MVNOs Must Know
- LGTELに基づくスペインの合法的傍受要件
- 衛星による合法的傍受：MNOと衛星の提携が新たなコンプライアンス要求を生み出す理由
外部リソース
以下の外部リソースは、さらなる背景と公式文書を提供している：
