Al Wakeelo
Your Digital Lawyer, Always on Duty
Initializing Secure Chambers
Your Digital Lawyer, Always on Duty
Initializing Secure Chambers
Petitioner: Mst. Saima Noreen VS Respondent: State and another
Court Name: Lahore High Court Judge(s): Aalia Neelum, Syed Shahbaz Ali Rizvi, Farooq Haider Title: Mst. Saima Noreen vs State and another Case No.: Crl. A. No. 59829 of 2021 and Crl. Misc. No. 2 in of 2021 Date of Judgment:2023-01-31 Reported As: PLJ 2023 Cr.C. 371, PLD 2024 Lahore 522 Result: Application dismissed
Judgment ORDER Crl. Misc. No. 02 of 2021 By means of instant miscellaneous application filed under Section 428, Cr.P.C. read with Section 561-A, Cr.P.C., following prayer has been made: "It is, therefore, most respectfully prayed that this petition may kindly be allowed and additional evidence in the shape of oral and documentary may either takes itself or by the Court of Session or Magistrate, in the interest of justice, as early as possible. It is further prayed, till the final decision of this petition, direction may kindly be issued to the relevant mobile companies, to preserve the CDRs, of PW-3 mobile Muhammad Ilyas ASI (0302- 8155856), PW-4 Muhammad Aslam Investigating Officer (0300-6034187), PW-5 Aqsa Aslam (0307- 0877678), petitioner Saima Noreen and her husband Sheikh Munir (0300-9604095)." 2. Facts of the case, succinctly required for disposal of the instant miscellaneous application are that applicant/appellant has been convicted and sentenced under Section 9(c) of the Control of Narcotics Substance Act, 1997 by learned Additional Sessions Judge/Judge Special Court CNSA, Sargodha vide judgment dated: 02.09.2021; applicant/appellant has filed appeal against aforementioned judgment before this Court, which has already been admitted for regular hearing vide order dated 30.11.2021 passed by this Court; during pendency of main appeal, appellant/applicant has preferred instant miscellaneous application. 3. Learned counsel for the applicant/appellant, while opening his arguments, submits that during trial of the case, while recording her statement under Section 342, Cr.P.C., applicant produced copy of CDR of Mobile No. 0307-0877678 as Mark-C, copy of CDR of Mobile No. 0307-3849701 as Mark-D, copy of CDR of Mobile No. 0302-8155856 as Mark-E and copy of CDR of Mobile No. 0300-6039187 as
---
## Page 2
Mark-F; further submits that applicant filed application for summoning representative of JAZZ Telecom Company for verification of CDRs Mark C, D, E & F and also exhibiting the same but same was dismissed by the learned trial Court vide order dated: 02.06.2021 without adverting to real facts and circumstances of the case in its true perspective; also adds that aforementioned CDRs negate presence of prosecution witnesses at the place of recovery. Learned counsel finally prays for summoning record of aforementioned CDRs along with representative of JAZZ Telecom Company and taking additional evidence in this regard. 4. On the other hand, learned Deputy Attorney General assisted by learned Assistant Attorneys General, learned Assistant Advocates General and learned Additional Prosecutor General assisted by learned Deputy Prosecutor General have opposed this miscellaneous application with vehemence. 5. Learned counsel for Pakistan Telecommunication Authority (hereinafter to be referred as PTA) while submitting report on behalf of PTA submits that record of CDR is only kept for one year by service provider and this application has been filed with much delay hence now it is impossible to produce the same; also adds that CDR is preserved by automated system without intervention of service provider hence summoning of representative of service provider is of no avail in this case and finally requests for dismissal of this application. 6. Arguments advanced pro and contra have been heard and available record perused. 7. CDR is abbreviation of "Call Data Record" of SIM which is abbreviation of "Subscriber Identity Module". As per "Report" submitted on behalf of Pakistan Telecomunication Authority, PTA was established under Section 3 of Pakistan Telecommunication (Re-organization) Act, 1996 and is mandated to regulate the establishment, maintenance and operation of the telecommunication system and provision of telecommunication services in Pakistan. Prevention of Electronic Crimes Act, 2016 (hereinafter to be referred as PECA, 2016) is the law which has been legislated and promulgated to prevent unauthorized acts with respect to information systems and to provide mechanism for related offences as well as procedure for investigation, prosecution, trial and international cooperation with respect thereof and matters connected therewith or ancillary thereto. Federal Government of Pakistan under Section 29 read with Section 51 of PECA, 2016 made/notified the Prevention of Electronic Crimes Investigation Rules, 2018 for carrying out the purpose of PECA, 2016. PTA is a regulator and it has entered into contracts with cellular telecommunication companies which provide cellular phone service to the people in Pakistan as the "Service Provider"; term "Service Provider" has been defined in Section 2 (xxviii) of PECA, 2016 which is hereby reproduced: "(xxviii) "service provider" includes a person who,-- (a) acts as a service provider in relation to sending, receiving, storing; processing or distribution of any electronic communication or the provision of other services in relation to electronic communication through an information system; (b) owns, possesses, operates, manages or controls a public switched network or provides telecommunication services; or (c) processes or stores data on behalf of such electronic communication service or users of such service;" Section 32 of PECA. 2016 provides that "a service provider shall within its existing or required technical capability, retain its specified traffic data for a minimum period of one year or such period as the "Authority" may notify from time to time" which is hereby reproduced: "32. Retention of traffic data.--(1) A service provider shall, within its existing or required technical capability, retain its specified traffic data for a minimum period of one year or such period as the Authority may notify from time to time and, subject to production of a warrant issued by the Court, provide that data to the investigation agency or the authorized officer whenever so required.
---
## Page 3
(2) The service providers shall retain the traffic data under sub-section (1) by fulfilling all the requirements of data retention and its originality as provided under Sections 5 and 6 of the Electronic Transactions Ordinance, 2002 (LI of 2002). (3) Any owner of the information system who is not a licensee of the Authority and violates sub- section (1) shall be guilty of an offence punishable, if committed for the first time, with fine which may extend to ten million rupees and upon any subsequent conviction shall be punishable with imprisonment which may extend to six months or with fine or with both:-- Provided that where the violation is committed by a licensee of the Authority, the same shall be deemed to be a violation of the terms and conditions of the licensee and shall be treated as such under the Pakistan Telecommunication (Re-organization) Act, 1996 (XVII of 1996). Said requirement of retaining traffic data is also mentioned in the service agreements/license issued to cellular telecommunication companies (licensee) and its clause 6-8-1 is relevant in this regard. Therefore, service providers are bound, amongst others, to maintain call data record (CDR) of its customers/users of mobile phone for a period of one year. Main object of maintaining said record is purely technical in nature and to facilitate the better provision of service inclusive of installation of various equipment and expansion of the equipment from time to time in this regard. Said "data" is stored in the form of pickets at the information system/server belonging to said service provider. As "data" is voluminous in nature, therefore, its long time preservation becomes impossible and that is why a period of one ; year is fixed in the agreement/license (mentioned above). Government enjoys facility of said stored CDR in the investigation of certain crimes in the country. Federal Ministry of Interior, Government of Pakistan regulates the procedure for the acquisition of CDR for the said purpose from the service providers. Section 2(xx) of PECA, 2016 defines "Information System" which means an electronic system for creating, generating, sending, receiving, storing, reproducing, displaying, recording or processing any information whereas Section 2(xix) of Act ibid defines "information" which includes text, message, data, voice, sound, database, video, signals, software, computer programmes, any forms of intelligence as defined under the Pakistan Telecommunication (Re-organization) Act, 1996 and codes including object code and source code. "Information system" is presumed to be built, maintained and operated in most secured environment, however, damage to the data cannot be ruled out. The term "data" is defined in Section 2(xiii) of PECA. 2016 and it includes content data and traffic data; as per Section 2(viii) of Act ibid, "content data" means any representation of fact, information or concept for processing in an information system including source code or a program suitable to cause an information system to perform a function; and as per Section on 2(xxx) of Act ibid, "traffic data" means data relating to a communication indicating its origin, destination, route, time, size, duration or type of service whereas "data damage" has been defined in Section 2(xiv) of Act ibid as under: "(xiv) "data damage" means alteration, deletion, deterioration, erasure, relocation, suppression of data or making data temporarily or permanently unavailable;" Similarly, "unauthorized access" has been defined in Section 2(xxxi) of PECA, 2016 which is hereby reproduced: "(xxxi)"unauthorized access" means access to an information system or data which is not available for access by general public, without authorization or in violation of the terms and conditions of the authorization;" whereas Section 2(xxxii) of the Act ibid defines "unauthorized interception" as under: "(xxxii)"unauthorized interception" shall mean in relation to an information system or data, any interception without authorization;" and "authorization" has been defined under Section 2(v) of PECA, 2016 as under: "(v) "authorization" means authorization by law or by the person empowered to make such authorization under the law:
---
## Page 4
Provided that where an information system or data available for open access by the general public access to or transmission of such information system or data shall be deemed to be authorized for" the purposes of this Act.;" whereas "authorized Officer" has been defined by Section 2(vi) of the Act ibid as below: "(vi) "authorized officer" means an officer of the investigation agency authorized to perform any function on behalf of the investigation agency by or under this Act;" Other related terms have also been defined by Section 2 of PECA, 2016 which are hereby reproduced for ready reference: "2. Definitions. (1) In this Act, unless there is anything repugnant in the subject or context,-- (i) "act includes,-- (a) a series of acts or omissions contrary to the provisions of this Act; or (b) causing an act to be done by a person either directly or through an automated information system or automated mechanism or self-executing, adaptive or autonomous device and whether having temporary or permanent impact; (ii) "access to data" means gaining control or ability to use, copy, modify or delete any data held in or generated, by any device or information system; (iii) "access to information system" means gaining control or ability to use any part or whole of an information system whether or not through infringing any security measure; (iv) "Authority" means Pakistan Telecommunication Authority established under the Pakistan Telecommunication (Re-organization) Act, 1996 (XVII of 1996); (vii) "Code" means the Code of Criminal Procedure, 1898 (Act V of 1898); ............................ (ix) "Court" means the Court of competent jurisdiction designated under this Act; (x) "critical infrastructure" means critical elements of infrastructure namely assets, facilities, systems, networks or processes the loss or compromise of which could result in-- (a) major detrimental impact on the availability, integrity or delivery of essential services including those services, whose integrity, if compromised, could result in significant loss of life or casualties, taking into account significant economic or social impacts; or (b) significant impact on national security, national defense, or the functioning of the state: Provided that the Government may designate any private or Government infrastructure in accordance with the objectives of sub-paragraphs (i) and (ii) above, as critical infrastructure as may be prescribed under this Act; (xi) "critical infrastructure information system or data" means an information system, program or data that supports or performs a function with respect to a critical infrastructure; "damage to an information system" means any unauthorized change in the ordinary working of an information system that impairs its performance, access, output or change in location whether temporary or permanent and with or without causing any change in the system; (xv) "device" includes,-- (a) physical device or article; (b) any electronic or virtual tool that is not in physical form; (c) a passwo rd, access code or similar data, in electronic or other form, by which the whole or any part of an information system is capable of being accessed; or (d) automated, self-executing, adaptive or autonomous devices, programs or information systems; (xvi) "dishonest intention" means intention to cause injury, wrongful gain or wrongful loss or harm to any person or to create hatred or incitement to violence; (xvii) "electronic" includes electrical, digital, magnetic, optical, biometric, electrochemical, electromechanical, wireless or electromagnetic technology;
---
## Page 5
(xviii) "identity information" means an information which may authenticate or identify an individual or an information system and enable access to any data or information system; (xix) "information" includes text, message, data, voice, sound, database, video, signals, software, computer programmes, any forms of intelligence as defined under the Pakistan Telecommunication (Re-organization) Act, 1996 (XVII of 1996) and codes including object code and source code; (xx) "information system" means an electronic system for creating, generating, sending, receiving, storing, reproducing, displaying, recording or processing any information; (xxi) "integrity" means, in relation to an electronic document, electronic signature or advanced electronic signature, the electronic document, electronic signature or advanced electronic signature that has not been tampered with, altered or modified since a particular point in time; (xxii) "interference with information system or data" means and includes an unauthorized act in relation to an information system or data that may disturb its normal working or form with or without causing any actual damage to such system or data; (xxiii) "investigation agency" means the law enforcement agency established by or designated under this Act; (xxiv) "minor" means, notwithstanding anything contained in any other law, any person who has not completed the age of eighteen years; (xxv) "offence" means an offence punishable under this Act except when committed by a person under ten years of age or by a person above ten years of age and under fourteen years of age, who has not attained sufficient maturity of understanding to judge the nature and consequences of his conduct on that occasion; (xxvi) "rules" means rules made under this Act; (xxvii) "seize" with respect to an information system or data includes taking possession of such system or data or making and retaining a copy of the data; ............................. (xxix) "subscriber information" means any information held in any form by a service provider relating to a subscriber other than traffic data; ........................... (xxxxiii) "unsolicited information" means the information which is sent for commercial and marketing purposes against explicit rejection of the recipient and does not include marketing authorized under the law. (2) Unless the context provides otherwise, any other expression used in this Act or rules made thereunder but not defined in this Act, shall have the same meanings assigned to the expressions in the Pakistan Penal Code, 1860 (Act XLV of 1860), the Code of Criminal Procedure, 1898 (Act V of 1898) and the Qanoon-e-Shahadat Order, 1984 (P.O.No. X of 1984), as the case may be." Under Section 35 of PECA, 2016 powers of authorized officer have been mentioned which is reproduced as under: "35. Powers of an authorized officer.--(1) Subject to provisions of this Act, an authorized officer shall have the powers to,-- (a) have access to and inspect the operation of any specified information system; (b) use or cause to be used any specified information system to search any specified data contained in or available to such system; (c) obtain and copy only relevant data, use equipment to make copies and obtain an intelligible output from an information system; (d) have access to or demand any information in readable and comprehensible format or plain version;
---
## Page 6
(e) require any person by whom or on whose behalf, the authorized officer has reasonable cause to believe, any information system has been used to grant access to any data within an information system within the control of such person; (f) require any person having charge of or otherwise concerned with the operation of any information system to provide him reasonable technical and other assistance as the authorized officer may require for investigation of an offence under this Act; and (g) require any person who is in possession of decryption information of an information system, device or data under investigation to grant him access to such data, device or information system in unencrypted or decrypted intelligible format for the purpose of investigating any such offence:-- Explanation.--Decryption information means information or technology that enables a person to readily retransform or unscramble encrypted data from its unreadable form and from ciphered data to intelligible data.. (2) In exercise of the power of search and seizure of any information system, program or data the authorized officer at all times shall,-- (a) act with proportionality; (b) take all precautions to maintain integrity and secrecy of the information system and data in respect of which a warrant for search or seizure has been issued; (c) not disrupt or interfere with the integrity or running and operation of any information system or data that is not the subject of the offences identified in the application for which a warrant for search or seizure has been issued; (d) avoid disruption to the continued legitimate business operations and the premises subjected to search or seizure under this Act; and (e) avoid disruption to any information system, program or data not connected with the information system that is not the subject of the offences identified in the application for which a warrant has been issued or is not necessary for the investigation of the specified offence in respect of which a warrant has been. issued. (3) When seizing or securing any data or information the authorized officer shall make all efforts to use technical measures to maintain its integrity and chain of custody. The authorized officer shall seize an information system, data, device or articles, in part or in whole, as a last resort only in the event where it is not possible under the circumstances to use such technical measures or where use of such technical measures by themselves shall not be sufficient to maintain the integrity and chain of custody of the data or information system being seized. (4) Where an authorized officer seizes or secures any data or information system, the authorized officer shall ensure that data or information system while in the possession or in the access of the authorized officer is not released to any other person including competitors or public at large and details including log of any action performed on the information system or data is maintained in a manner prescribed under this Act." Whereas Section 36 of the Act ibid has provided the mechanism for dealing with the seized data or information system which is also hereby reproduced:- "36. Dealing with seized data or information system.-- (1) If any data or information system has been seized or secured following a search or seizure under this Act, the authorized officer who undertook the search or seizure shall, at the time of the seizure,-- (a) make a list of what has been seized or rendered inaccessible, with the date and time of seizure; and (b) give a copy of that list to,-- (i) the occupier of the premises; or
---
## Page 7
(ii) the owner of the data or information system; or (iii) the person from whose possession the data or information system has been seized, in a prescribed manner in the presence of two witnesses. (2) The authorized officer, upon an application of the owner of the data or information system or an authorized agent of the owner and on payment of prescribed costs, shall provide forensic image of the data or information system to the owner or his authorized agent within a time prescribed under this Act. (3) If the authorized officer has reasons to believe that providing forensic image of the data or information system to the owner under sub-section (2) may prejudice,-- (a) the investigation in connection with which the search was carried out; or (b) another ongoing investigation; or (c) any criminal proceedings that are pending or that may be brought in relation to any of those investigations, the authorized officer shall, within seven days of receipt of the application under sub-section (2), approach the Court for seeking an order not to provide copy of the seized data or information system. (4) The Court, upon receipt of an application from an authorized officer under sub-section (3), may after recording reasons in writing pass such order as deemed appropriate in the circumstances of the case. (5) The casts associated with the exercise of rights under this section shall be borne by the person exercising these rights." and Section 41 of PECA, 2016 deals with "confidentiality of information" which is hereby reproduced: "41. Confidentiality of information.--Notwithstanding immunity granted under any other law for the time being in force, any person including a service provider while providing services under the terms of lawful contract or otherwise in accordance with the law, or an authorized officer who has secured access to any material or data containing personal information about another person, discloses such material to any other person, except when required by law, without the consent of the person concerned or in breach of lawful contract with the intent to cause or knowing that he is likely to cause harm, wrongful loss or gain to any person or compromise confidentiality of such material or data shall be punished with imprisonment for a term which may extend to three years or with fine which may extend to one million rupees or with both: Provided that the burden of proof of any defense taken by an accused service provider or an authorized officer that he was acting in good faith, shall be on such a service provider or the authorized officer, as the case may be." 8. As per report submitted by PTA, Federal and Provincial Interior Ministries have authorized the police department under their jurisdiction and other law enforcement agencies to obtain the CDRs as and when required from the service providers. The officials, who perform said job and have been duly authorized by designation as well as other relevant information relating to them, whereby their authority can be identified, have been shared with the service providers. Generally, they are authorized to obtain the requisite CDR through e.mail which is replied to by the automated system and there is no human involvement at the end of the service providers. In reply to Court's query, learned counsel for PTA submits that there is no need to summon any representative of service provider for verification of CDR because there is no human involvement in replying the information relating to CDR by the automated system. Subject to any mechanical error or hacking there is no possibility of leakage of CDR at the end of "service provider". The leakage of the data and information, if any, is likely to have happened at the other end i.e. who has requisitioned the information. It goes without saying that in order…
Read the unabridged text and precedent citation network on Al Wakeelo Legal Research Platform.