Much hype has been generated among the Pakistani Internet community that the modified draft of Prevention of Electronic Crimes Act 2015 (PECA-2015) was “bulldozed” through the National Assembly Standing Committee on IT. To be more precise, most of the committee’s members said they weren’t consulted before it was passed onward to the National Assembly for final approval.
For starters, we at PakWired have been noticing the lack of subject knowledge exhibited by mainstream media groups when discussing the bill. Even some of the NGOs and INGOS commenting on its salient features keep referring to it as the ‘cybercrime’ bill (which it isn’t). This particular bill, which will become an Act if approved, will deal with the domain of electronic crimes. Agreed that most of its offences deal with those committed in cyberspace, but it is not a comprehensive cyber-related bill in itself.
A lot of concerned citizens have been voicing concerns about human rights limitations and restrictions in PECA-2015. Will we be arrested if we misrepresent someone just for fun? Will we be punished if we criticize politicians and army generals on social media? Will I be penalized and jailed for using someone’s pictures without their permission, even if it’s not for negative reasons?
To remove the clouds of confusion, let us study some of the key offences mentioned in the most recent draft of PECA-2015 (passed on September 17, 2015):
Illegal Intrusion
Section 3. Unauthorised access to information system or data.- Whoever intentionally gains unauthorised access to any information system or data shall be punished with imprisonment for a term which may extend to three months or with fine up to fifty thousand rupees or with both.
Comment: Whoever tries to login to someone’s system or account either by physical intrusion or electronic/cyber hacking, he/she will either be jailed till 3 months, fined Rs. 50,000 or both.
Unauthorized Sharing of Stolen Data
Section 4. Unauthorised copying or transmission of data.- Whoever intentionally and without authorisation copies or otherwise transmits or causes to be transmitted any data shall be punished with imprisonment for a term which may extend to six months, or with fine up to one hundred thousand rupees or with both.
Comment: If someone copies data without your knowledge and even shares them with unauthorized people, they will either serve till 6 months in jail, pay a fine of Rs. 100,000 (1 lakh) or both.
Infiltration Into Sensitive Systems
Section 8. Interference with critical infrastructure information system or data.- Whoever intentionally interferes with or damages, or causes to be interfered with or damaged, any part or whole of a critical information system , or data , shall be punished with imprisonment which may extend to seven years or with fine up to ten million rupees or with both.
Comment: Critical infrastructure refers to sensitive installations such as mainframe servers in industries, banks, corporations, military units, energy plants, etc. Anyone who tries to break into their hardware/software will either be jailed till 7 years, fined Rs. 10,000,000 (1 crore) or both.
Hate Speech and Support for Accused Suspects
Section 9. Glorification of an offence and hate speech. Whoever prepares or disseminates information, through any information system or device, where the commission or threat is with the intent to:-
(a) glorify an offence or the person accused or convicted of a crime and support terrorism or activities of proscribed organizations; and
(b) advance religious, ethnic or sectarian hatred
shall be punished with imprisonment for a term which may extend to five years or with fine up to ten million rupees or with both.
Explanation: “Glorification” includes depiction of any form of praise or celebration in a desirable manner.
Comment: If someone praises any suspected criminal or terrorist who is undergoing trial, he/she will be punished. Similarly, if someone intends to use cyberspace to spread religious, ethnic or sectarian hatred, they will also be charged for committing an offence under this section. The punishment for these offences is uptil 5 years of jail time, fine till Rs. 10,000,000 (1 crore) or both. Hence, no page, forum, blog or website which spreads fanaticism and extremism will be allowed to operate. To be noted with attention that ‘glorification’ of a suspected offender doesn’t mean you can’t defend them through legal justifications; it simply means you won’t be allowed to shower them with praises. In most ways, this is a self-contradicting principle but still, it gives some leeway for defence or an accused.
Spreading Panic and Inciting Terrorism
Section 10. Cyber terrorism. –Whoever commits or threatens to commit any of the offences under sections 6, 7, 8 or 9 of this Act, where the commission or threat is with the intent to:-
(a) coerce, intimidate, overawe or create a sense of fear, panic or insecurity in the Government or the public or a section of the public or community or sect or create a sense of fear or insecurity in society; or
(b) advance religious, ethnic or sectarian discord,
shall be punished with imprisonment of either description for a term which may extend to fourteen years or with fine up to fifty million rupees or with both.
Comment: This is perhaps the most significant piece of legislation formulated in Pakistan, as far as use of cyberspace is concerned. A host of terrorist organizations and independent militants use cyberspace to indoctrinate, radicalize and recruit unknowing foot soldiers. Daesh especially, is known for its special cyber skills. Whoever commits offences under Sections 6, 7, 8 or 9 of this Act with to threaten someone, spread religious (inter-religious)/ethic (Mohajir/Punjabi/Sindhi/Balochi, etc) or sectarian (Sunni/Shia/Wahhabi/Ismaili etc) hatred will either be jailed till 14 years, fined Rs. 50,000,000 (5 crore) or both. Here is a summary of what the proclaimed sphere of offences are:
• Section 6 is an offence regarding unauthorized infiltration and access to critical infrastructure information systems (civil/military/power/industrial/corporate, etc)
• Section 7 is an offence regarding unauthorized copying and sharing/broadcasting of that confidential data with unauthorized persons.
• Section 8 is an offence in which someone tries to tamper with the data in an attempt to discredit, destroy or change it. This is mostly in situations such as espionage or propaganda.
• Section 9 is an offence which comprehensively covers suspects who prepare hate material, distribute it and who also praise someone’s offence. For example, someone on social media, websites, blogs or forums who admires terrorists and their ideology.
Generally speaking, it talks about sympathizers and supporters of hate and extremism.
Perhaps the most controversial statement in this section are the words “threatens to commit”. Someone who commits something is understandable and clear, but how can one define the act of “threatening” to commit something? Who will gauge a suspect’s intentions, and how?
Fraud
Section 11. Electronic forgery.- (1) Whoever, interferes with or uses any information system, device or data, with the intent to cause damage or injury to the public or to any person, or to make any illegal claim or title or to cause any person to part with property or to enter into any express or implied contract, or with intent to commit fraud by any input, alteration, deletion, or suppression of data, resulting in unauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic, regardless of the fact that the data is directly readable and intelligible or not shall be punished with imprisonment of either description for a term which may extend to three years, or with fine up to two hundred and fifty thousand rupees or with both.
(2) Whoever commits offence under sub-section (1) in relation to a critical infrastructure information system or data shall be punished with imprisonment for a term which may extend to seven years or with fine up to five million rupees or with both.
Comment: Whoever tries to fool people by deception in cyberspace or through electronic means, in ways which can cause damage, injury or widespread misunderstandings, will either be jailed till 3 years, fined Rs. 250,000 (2 lakh 50 thousand) or both. If someone tries to apply the same deceptive malpractices to a critical infrastructure information system (and one that can have tremendously dire nationwide consequences), he/she will either be punished uptil 7 years in jail, fined Rs. 5,000,000 (50 lakh) or both. In this section, the following statement “make any illegal claim or title” is worth noting. Viewed in the full perspective, it also implies that whoever makes memes with sensational claims or publishes hearsay stories about someone (which could be any public figure or even ordinary citizens) will be punished. A lot of people might find this to be a sigh of relief (for protection) whereas others view it as an attempt at subjugating their right to free speech.
Assisting Miscreants
Section 13. Making, obtaining, or supplying device for use in offence.- Whoever produces, makes, generates, adapts, exports, supplies, offers to supply or imports for use any information system, data or device, primarily with the intent to be used or believing that it is primarily to be used to commit or to assist in the commission of an offence under this Act shall, without prejudice to any other liability that he may incur in this behalf, be punished with imprisonment for a term which may extend to 6 months or with fine up to fifty thousand rupees or with both.
Comment: Let’s put it this way… think carefully before sharing your computer, smartphone, laptop, USB, CD, etc with someone since they could potentially be caught later on if suspected of involvements in illegal/terrorist activities. The more precaution, the better! Although this sounds good, it could be misused by investigators. Whoever is charged under this offence will either be jailed for 6 months, fined Rs. 50,000 or both.
Identity Theft and Abuse
Section 14. Unauthorised use of identity information.-(1) Whoever obtains, sells, possesses, transmits or uses another person’s identity information without authorisation shall be punished with imprisonment for a term which may extend to three years or with fine up to five million rupees, or with both.
(2) Any person whose identity information is obtained, sold, possessed, used or transmitted may apply to the Authority for securing, destroying, blocking access or preventing transmission of identity information referred to in sub-section (1) and the Authority on receipt of such application may take such measures as deemed appropriate for securing, destroying or preventing transmission of such identity information.
Comment: Identity thieves beware! If someone runs Facebook pages, Twitter handles or blogs pretending to be someone else, they have committed an offence. Similarly, if someone has compiled a target’s biodata and misuses or shares it with someone (without permission), he/she will either be jailed till 3 years, fined Rs. 5,000,000 (50 lakh) or both. The victim in this case can approach the relevant authority to protect their information from being further exploited by undesirable elements.
Maligning Individuals
Section 18. Offences against dignity of natural person– (1) Whoever intentionally publicly exhibits or displays or transmits any false information, which is likely to harm or intimidate the reputation or privacy of a natural person shall be punished with imprisonment for a term which may extend to three years or with fine up to one million rupees or with both:
Provided, nothing under this sub-section (1) shall apply to anything aired by a broadcast media or distribution service licensed under Pakistan Electronic Media Regulatory Authority Ordinance, 2002 (XIII of 2002).
(2) Any aggrieved person or his guardian, where such person is a minor, may apply to the Authority for passing of such orders for removal, destruction or blocking access to such information referred to in sub-section (1) and the Authority on receipt of such application, may take such measures as deemed appropriate for securing, destroying, blocking access or preventing transmission of such information.
Comment: Criticizing private and public institutions will be fine but if someone targets the reputation and “dignity” of a natural person (i.e. a real individual) through false information, which can harm their image or actual physical self, the offender will either be jailed till 3 years, fined Rs. 1,000,000 (10 lakh) or both. It specifically says that electronic media groups registered and approved by PEMRA will be exempted from this section. Anyone who has been subjected to false propaganda and malicious campaigning can approach the relevant authority for help in putting an end to their misery. The concerning question here is, what about online journalists and digital news forums? Will they be exempted like their counterparts in electronic media? If not, why the discrimination? Social media has proven to be more trendy these past years, this is why online activists and journalists can be wrongfully implicated under this section.
Section 19. Offences against modesty of a natural person and minor.- (1) Whoever intentionally and publicly exhibits or displays or transmits any information which:-
(a) superimposes a photograph of the face of a natural person over any sexually explicit image; or
(b) distorts the face of a natural person or includes a photograph or a video of a natural person in sexually explicit conduct; or
(c) intimidates a natural person with any sexual act,
shall be punished with imprisonment for a term which may extend to seven years or with fine up to five million rupees or both.
(2) Whoever commits an offence under sub-section (1) with respect to a minor shall be punished with imprisonment for a term which may extend to ten years, or with fine up to ten million rupees or with both.
(3) Any aggrieved person or his guardian, where such person is a minor, may apply to the Authority for passing of such orders for removal, destruction or blocking access to such information referred to in sub-section (1) and (2) and the Authority on receipt of such application may take such measures as deemed appropriate for securing, destroying, blocking access or preventing transmission of such information.
Comment: Putting it simply, if someone tries to edit someone’s photos to present him/her as pornographic, or tries to blackmail someone by creating such content (for financial or personal grudges), the offender will be jailed till 7 tears, fined Rs. 5,000,000 (50 lakh) or both. If someone tries to do the same with a minor i.e. if it is a case of pedophilia, the offender will either be punished for 10 years jail, fined Rs. 10,000,000 (1 crore) or both. Furthermore, the victim of cyber blackmailing or his/her guardians (in case they are minors) can approach the relevant authority to obtain, destroy or block access to vile content depicting them.
Blackmailing
Section 21. Cyber stalking.- (1) Whoever with the intent to coerce or intimidate or harass any person uses information system, information system network, the Internet, website, electronic mail, information or any other similar means of communication to:-
(a) communicate obscene, vulgar, contemptuous, or indecent information; or
(b) make any suggestion or proposal of an obscene nature; or
(c) threaten to commit any illegal or immoral act; or
(d) take a picture or photograph of any person and display or distribute without his consent or knowledge in a manner that harms a person; or
(e) display or distribute information in a manner that substantially increases the risk of harm or violence to any person, commits the offence of cyber stalking.
(2) Whoever commits the offence specified in sub-section (1) shall be punishable with imprisonment for a term which may extend to one year or with fine up to one million rupees, or with both:
Provided that if the victim of the cyber stalking under sub-section (1) is a minor the punishment may extend to five years or with fine upto ten million rupees, or with both.
(3) Any aggrieved person may apply to the Authority for issuance of appropriate orders for removal or destruction of, or blocking access to such information as referred to in sub-section (1) and the Authority upon receipt of such application may take such measures as deemed appropriate for removal or destruction of, or blocking access to, such information.
Comment: Whoever tries to stalk someone online with the intent to cause harm or simply to damage their repute, they will either be jailed till a year, fined upto Rs. 1,000,000 (10 lakh) or both. If the case involves a child, the punishment can be increased to 5 year jail time, Rs. 10,000,000 (1 crore) fine or both. Victims who have been stalked can approach the relevant authority for assistance. In most ways, this section is somewhat similar to Section 19.
Harassment
Section 22. Spamming.- (1) Whoever with intent transmits harmful, fraudulent, misleading, illegal or unsolicited information to any person without the express permission of the recipient, or causes any information system to show any such information commits the offence of spamming.
Explanation.- “Unsolicited information” does not include:
i. Marketing authorized under the law; or
ii. Information which has not been specifically unsubscribed by the recipient.
(2) A person engaged in direct marketing shall provide the option to the recipient of direct marketing to unsubscribe such marketing.
(3) Whoever commits the offence of spamming as described in sub-
section (1) or engages in direct marketing in violation of sub-section (2), for the first time, shall be punished with fine not exceeding fifty thousand rupees and for every subsequent violation shall be punished with imprisonment for a term which may extend to three months or with fine up to one million rupees or with both.
Comment: Sub-section (1) is a rather bizarre and same old offence already highlighted in Sections 18, 19 and 21. Sub-section (2) says that marketing companies will be bound to give mail recipients the option to unsubscribe. What is clearly lacking is the definition of “spamming”. Marketing companies should not send messages to people who never opted for their updates in the first place. Everyone’s email addresses can be found and messages can be sent without the receiver’s intent. Why doesn’t this section mention this? Anyhow, the punishment is as follows: If a spammer commits his/her first offence in this regard, they can be fined till Rs. 50,000. If their offensive behavior persists, they will either be jailed till 3 months, fined Rs. 1,000,000 (10 lakh) or both.
Unauthorized Imitation
Section 23. Spoofing.- (1) Whoever dishonestly, establishes a website or sends any information with a counterfeit source intended to be believed by the recipient or visitor of the website, to be an authentic source commits spoofing.
(2) Whoever commits spoofing shall be punished with imprisonment for a term which may extend to three years, or with fine up to five hundred thousand rupees or with both.
Comment: If someone makes parody websites or those impersonating original people, places, things and organizations, he/she will be considered guilty of “spoofing”. What is concerning in this statement is how the law will determine whether someone is “dishonest”. Whoever is charged under this offence will either be jailed till 3 years, fined till Rs. 500,000 (5 lakh) or both. This section is quite vague and leaves a lot of further questions unasked.
Leave a Reply
This site uses Akismet to reduce spam. Learn how your comment data is processed.
