What is the PECB?
PECB stands for Prevention of Electronic Crime Bill 2015.
Is it the first time a cybercrime law has been tabled?
PECO (Pakistan Electronic Crime Ordinance) was promulgated by Musharraf in 2007. Since it was an ordinance, it lapsed in 2009. There was huge uproar against it because innocent people were charged and framed. It gave excessive powers to FIA (Federal Investigation Agency), which were abused.
Once it lapsed, there were efforts to revive it and introduce PECO as an act. That is when the business industry really got involved and started drafting their own version. ISPAK (Internet Service Providers Association) and P@SHA (Pakistan Software Houses Association) led this initiative.
In 2014, there were meetings at the Ministry of IT & Telecommunications which members of P@SHA & ISPAK attended to finalise the industry stakeholder draft (please note that no civil society organization or individuals were privy to these meetings or drafts). This was then sent to the Cabinet Division. From there it emerged earlier this year with modifications.
We were informed the bill was being presented before the National Assembly Standing Committee on IT and Telecommunication for approval, and one of the MNAs asked us to send in any reservations if we had any. This is what we sent him, which was shared with members of the committee: Speak now or forever hold your breath.
What has changed now? Why should you be concerned?
The draft bill prepared by P@SHA was then sent to a sub-committee, which was formed to work on the bill further. Bolo Bhi held consultations with industry and civil society members, and technical experts – we were also in touch with the original drafters of this law to discuss our reservations with the bill.
However, only a government-led committee has been reviewing the bill. These reservations were also raised by parliamentarians on national television.
Why are there so many versions of the modified draft?
Citizens, industry, journalists and businesses have been kept in the dark regarding the modifications of the draft bill. Please note the bill has been modified four times. A fourth version was tabled in front of the Standing Committee of IT, in mid-April 2015, and will now be tabled in front of the National Assembly.
Are you supporting cybercrime and advocating for terrorists by opposing the bill?
No, we are doing exactly the opposite. By speaking against a poorly-drafted bill, we are advocating for necessary protections, for laws that would work to protect civilians rather than persecute them.
The point is not that the law should not pass, but rather, that it is drafted with input, does not repeat mistakes of previous version (i.e. PECO), doesn’t subvert due process & trample basic rights, and allows for effective action at the same time. And that it actually tackles issues of crimes online.
Are you supporting paedophiles, harassers and pornographers?
No. Section 18 of the PECB deals with offences against the dignity of a natural person – we want to ask what the need is to criminalize this when the defamation laws exist. Similarly, offences delineated in Section 19 involving the misuse of images etc in sexually explicit content are already criminalised by means of existing laws.
Are you supporting fraud, identity theft or forgery?
We believe certain aspects of the bill are good since there has been an increase in electronic crimes. However, the vague wording of such provisions could allow for misuse and abuse. For instance, you can get charged for simply using someone else’s Facebook account, which is an unreasonable extension of the law. These provisions specially need to be concisely worded to prevent citizens from being prosecuted without good reason. Similarly, Section 15: Unauthorized issuance of SIM cards makes operators criminally liable whereas this is an already regulated sector and the policy directives and existing laws apply. That is the reason we feel this section should be omitted altogether.
What about privacy issues?
The provisions in the bill go against the right to privacy of the people. The provisions allow for
- Retention of data by ISPs
- Supply of data to foreign entities
- Officials or investigatory bodies to force you to give up your private information to be used against you in criminal investigations
What about due process of law?
We believe the bill violates due process of law; it allows for expedited gathering of information. That means it gives investigating officials the right to force you to retain (and maybe provide) private information even before they obtain a warrant.
A warrant for searches and seizures also does not specify what constitutes “reasonability” which means that there is no stress to prove whether the information looking to be obtained is actually beneficial to their case.
Obscene, indecent and immoral material on the internet is widespread. Do you believe that users should be allowed to access such information?
We believe in self-regulation. Even if one blocks such material online, the content will always be available via proxy servers or other such means. Therefore, censorship is not the solution to avoid such material on the internet.
One must first understand that such material must be searched for, and then voluntarily clicked on in order to obtain access. The web will not and does not provide you with such material; users must actively and willingly search and obtain such material.
While we understand it is easy to obtain such material, it must also be noted software that allows a person to block such material themselves does exist. For instance, Net Nanny or WebWatchers are all readily available and can be installed on information devices to block such materials from being accessible to young users, or to filter out objectionable websites/information for safe browsing.
We should allow users personal accountability. The state is not a parent, and should not act as one. Access to information is a right; an unalienable one that cannot and should not be violated. Section 34 of this bill violates that right. We also have seen in the past that websites and information online have been blocked, without good reason (IMDB, WordPress, Rolling Stones Magazine). The abuse of this section could be widespread and will affect education, businesses and the progress of society.
Spamming is a huge problem in Pakistan; widespread fraud emails, telecoms messaging. Do you believe such a nuisance should continue existing?
No, we don’t. We disagree with the clause because there are exceptions such as “marketing authorized by law” or “information not unsubscribed by recipient” which will allow for these problems to still exist in the form of corporate and commercial spamming, while innocent citizens would wind up criminalized under the law for sharing links online or students requesting help from their friends on social media.
The transmission of ‘unsolicited intelligence’ without the ‘express permission of the recipient’ has been criminalized as per the language of this clause. It is unclear as to how one should acquire express permission. Definition of spamming also not provided. Spamming can be curtailed through filters in email inboxes for example, number-blocking options in mobile phones. This should be dealt with through policy guidelines and a regulatory framework, not as a criminal offence.
This is why the clause should be omitted altogether.
Certain persons in society, for example women, are more vulnerable in real life and now, on the internet as well. Are you against the protection of such vulnerable groups through the cybercrime law?
Not at all. We believe it is essential to safeguard the interests of all groups, especially vulnerable ones. The harassment of women is an important online issue. However, the language of the bill not only fails to properly address the issue, but it also creates further complications.
Section 21 on cyberstalking in sub-clause (d) fails to make a distinction between public and private spaces. Therefore, if an individual is photographed at a public event, where it is a reasonable enough assumption that cameras will be present—at weddings, festivals, art exhibitions—they can file a case against the photographer on the basis of feeling annoyed or harassed at being photographed. It makes it imperative to clarify the language so as to prevent misuse of the law.
Furthermore, Section 21 has criminalized the dissemination of “obscene, vulgar, contemptuous, or indecent intelligence” without defining what counts as obscene, vulgar, or contemptuous. A debate between people on Facebook can be grounds for charging someone for cyberstalking, and possessing the intent to harass, intimidate, or coerce someone though contemptuous intelligence. Therefore, it is necessary to prevent the misuse of this clause by clarifying the language, so the protection of people, especially women, against online sexual harassment is ensured without creating legal loopholes for abuse of the law.
Moreover, both Section 18 and Section 19 do not take into account the need for privacy for women who fall victim to internet blackmailing, harassment, and cybercrimes. The bill establishes that a guardian must file a report against the perpetrator in case of the victim being a minor. However, there is no provision whereby an adult can choose to appoint a person to file a complaint on their behalf; victims would naturally be wary of coming forward due to social pressures and a need to protect privacy. The same protection therefore, should be granted to all victims as well.
Section 18 also creates an exemption for broadcast media. When cybercrime cases are highlighted by mainstream news media, not only will be the victim’s personal information be available via public record, but they will also not be protected from broadcast media’s mawkish treatment human rights issues, such as playing music in the background while running personal details of the victims on screen.
Section 19 defines offences against the dignity of a natural person and in sub clause (c), includes “distorts the face of a natural person” which is grounds for the criminalization of memes and online comics. This portion of the sub-clause would have to be struck out completely to keep the language tightly worded, and ensure that there is no legal loophole for misuse of the law.
Furthermore, Clause 18, 19, and 21 allow complaints to be made directly to PTA. This means that the determination of the offence as well as required action to deal with a complaint would be solely at PTA’s discretion. None of these clauses require going to court, and moreover, they can easily be misused by complainants or the Authority as well.
Clause  from sections 18, 19 and 21 should be omitted. Determination of the offense, grievance and relief should be subjected to a court process rather than be decided arbitrarily by an executive authority. The court can, in turn, order the relevant authority to take appropriate action once the offence has been established, but executive authorities must not play judge, jury and executioner.
One of Pakistan’s major issues is terrorism and sectarian violence. If this law would protect us from terrorist and hate material online, then what is the problem?
The problem is that the law would not only fail to adequately address the issue of hate material such as terrorist content, sectarian hatred, and violence against religious minorities, but it would also result in catastrophic misuse of the law.
Section 9, glorification of an offence and hate speech, criminalises the preparation or dissemination of content that “supports terrorism and activities of proscribed organizations” and “advances religious, ethnic, or sectarian hatred”. Again, this is ambiguous and loosely worded language. The first issue is that which proscribed organizations would fall under this law, because several organizations working on issues such as minority rights issues, or missing persons in conflict areas, could wind up on this list and therefore, be criminalized simply for working on social justice issues. The second issue is that there is no distinction between the glorification of an accused or a convicted individual, which is a problem as in the case of an accused, the crime has not been established by the court yet.
Sub-clause (c) of Section 9 which talks about advancing religious, ethnic or sectarian hatred needs to be defined clearly because in its current form it could be used to silence dissent and shut down civil discourse on theology and religion. This could be in the form of conferences, seminars, and/or panel discussions on Sufism, or the beginning of violence in Karachi, and similar topics.
For example, there was uproar in Lahore University of Management Sciences (LUMS) in April 2015 where a student discussion on the missing Baloch was shut down by order of the state. Under the presence of laws such as sub-clause (c), this could be a criminal act because the law would provide a means to draw connections between discussion on missing persons and Baloch separatism. This of course is not a logical connection but it would make such activities illegal and thus result in such misuses of the law.
The same misuse would apply to sub-clause (b) of Section 10 on cyber-terrorism. Cyber-terrorism is not clearly defined in either a local context or on the basis of international definitions. It also does not take into account protections for white hat hackers. Additionally, the law must clarify that an attack must “severely damage or disrupt national defence or other vital social services and result in serious harm to the public welfare.”
It is of course, essential to have protections against hate speech. But navigating the blurred lines between free speech and hate speech is stepping into murky waters; therefore, this is a matter that requires much deliberation, and legal language that is tightly worded so as to ensure the passage of justice without impinging upon the rights of citizens.
How is the proposed law harmful for coders?
Section 20 deals with malicious code, and an exception needs to be created for this clause. What may be deemed as ‘malicious codes’ or ‘viruses’ are taught and written as part of academic disciplines. That is how software is developed to combat them. An exception for this should be clearly stipulated or it would create a sense of fear among academics of being potentially charged for a crime, and create hesitation to apply what is learnt in this discipline for legitimate purposes. Moreover, most USBs carry viruses – oftentimes without the knowledge of the owner. Scenarios in which unwittingly a USB transmits a virus should be accounted for. The manner in which this offence would be determined should be specified in clearer terms.
What are the problems with Section 34?
At first glance, it might look as if Section 34 (which deals with removing or blocking information) is very comprehensive. However, in reality, it guarantees little to no protection to citizens, and in fact, tramples upon their right to free speech and freedom of expression as enshrined in Article 19 of the Constitution , that deals with freedom of expression which is only limited by reasonable restrictions.
That means, if freedom of speech were to be limited, these limitations should be clearly explained and must be reasonable. For example “integrity of Pakistan” is too vague – what essentially falls under integrity remains unclear. Would it range from criticism of the government to videos of burning the country’s flag? All the categories need to be clearly defined, with certain provisions such as “decency and morality” to be taken out completely. It is not the states place to deem what is immoral and decent; it is a personal and subjective choice.
Similarly, “in the interest of…friendly relations with foreign states” should be removed completely as it is a way of restricting freedom of opinion. If not removed, then define these provisions clearly.
Section 34 also curbs media freedom. The government would be able to acquire powers to order media houses’ web platforms to remove any material they deem inappropriate. Example: criticism of the government or a view contrary to theirs could be removed if the state thinks that it is ‘anti-state’ or against ‘national interest.’ Such excessive powers are unconstitutional.
What are the positives of the cybercrime bill?
Sections on electronic fraud and forgery, identity theft, unauthorized issuance of SIM Cards are a few examples of what is good about the bill. These sections have addressed the exact problem and provided clear instructions on what falls under these offences.
We need to address the law in a way that covers the real problems of the cyber world, while respecting the rights of citizens online. Freedom of speech, opinion and expression is inalienable, and censorship does not curb terrorism.