The expansion of internet access and digital communication in Pakistan brought a parallel increase in digital fraud, harassment, and data breaches. The primary legislation dealing with these issues is the Prevention of Electronic Crimes Act (PECA), 2016.

1. Key Offences and Penalties under PECA 2016

A. Unauthorized Access to Information System (Section 3)

Commonly known as hacking, accessing any information system or data without authorization is punishable by up to 3 months in prison, a fine of up to 50,000 PKR, or both. If the unauthorized access involves critical infrastructure (critical information systems), the penalty is up to 3 years.

B. Electronic Fraud (Section 10)

Using a computer system or internet to defraud individuals, obtain financial gain, or cause damage is electronic fraud. It is punishable by up to 7 years in prison, a fine of up to 10 million PKR, or both.

C. Identity Theft / Spoofing (Section 16)

Obtaining, selling, or using another person's identity information (such as CNIC, photos, biometrics, or passwords) without authorization is identity theft. The penalty is up to 3 years in prison, a fine of up to 5 million PKR, or both.

D. Cyber Harassment and Defamation (Section 20 & 24)

• Section 20 (Dignity of Natural Person): Intentionally transmitting false information that intimidates, harms, or insults a natural person's dignity or reputation is a criminal offence. It carries a penalty of up to 3 years in prison, a fine of up to 1 million PKR, or both.
• Section 24 (Cyber Stalking): Following, contacting, or monitoring someone online despite their clear disapproval, or sharing their photos/videos online to cause harm or distress is cyberstalking. It carries up to 3 years in prison and up to a 1 million PKR fine.

2. Enforcement Agency: The FIA

The federal government has designated the Federal Investigation Agency (FIA) as the sole investigative agency under PECA. The FIA has established a specialized Cyber Crime Wing (CCW).

• Complaints: Complaints can be submitted online via the FIA CCW web portal, by email, or in person at regional Cyber Crime centers.
• Powers: The FIA can search and seize digital devices (laptops, mobile phones) under a warrant.

3. Admissibility of Electronic Evidence

Under the Qanun-e-Shahadat Order, 1984 (QSO), electronic records (emails, WhatsApp screenshots, SMS, CCTV footage) are admissible in court as secondary evidence. However, to be accepted:

1. The integrity of the data must be verified (no tampering).
2. The source device must be identified.
3. In practice, courts often require forensic reports from the FIA or independent experts to verify digital evidence.

4. Key Takeaways for Businesses and Individuals

• Data Protection: Businesses must protect customer data. Unauthorized sharing or data leaks can lead to liability under PECA.
• Social Media Caution: Sharing defamatory content, even if it is a repost or forward, can make you liable under Section 20 of PECA.