Cyber Crime Law

Now that we have a copy of Pakistan's Cyber Crime Law, we have a better understanding of what exactly constitutes a cybercrime in Pakistan and what the corresponding punishments are according to Pakistani law. We will go through the list one by one, with some explanation about the crimes and possible punishments. It's important to note that the examples of cybercrimes or scenarios discussed alongside the offenses are for reference only and may not be taken into consideration for legal matters. These examples are shared after consultation with legal officials; however, they may not be accurate.

Spreading False Information

Any person who displays false information publicly through an information system, with the intention of harming the reputation or privacy of a natural person, will be punished with imprisonment for a term of up to three years, or with a fine of up to one million rupees, or with both. When you post or share false information about a person on Facebook that could damage his or her reputation, you are not only breaking our Community Standards, but you could also be violating the law. Please keep in mind that this section does not apply to offenses committed by broadcast media licensed under the Pakistan Electronic Media Regulatory Authority Ordinance, 2002 (XIII of 2002)

Making / Spreading Explicit Images or Videos

Whoever intentionally and publicly exhibits or displays or transmits any information which superimposes a photograph of the face of a natural person over any sexually explicit image or video, or includes a photograph or video of a natural person in sexually explicit conduct, with the intent to intimidate or harass the person depicted, shall be guilty of a misdemeanour. Any person who, through an information system, causes harm to another natural person or damages their reputation, or takes revenge, or creates hatred or blackmail, shall be punished with imprisonment for a term which may extend to five years or with a fine which may extend to five million rupees or with both. A minor engaged in sexually explicit conduct; Person appearing to be a minor engage in sexually explicit conduct; Realistic images representing a minor engaged in sexually explicit conduct shall be punished with imprisonment for a term which may extend to seven years. Or with fine which may extend to five million rupees or with both.

Further logical aspects

Altering an image of someone to make it look like they are nude and/or engaging in sexual activity without their consent is illegal. This includes superimposing a person's face onto a nude body or making a sexually explicit video or image of someone without their permission. Broadcasting or posting such content on Facebook or through any other medium (such as Whatsapp) is also against

Child pornography

Anyone who intentionally produces, makes available, distributes, or transmits through an information system any material that depicts a minor engaged in sexually explicit conduct, or procures such material for themselves or another person without lawful justification, shall be punished with imprisonment for a term of up to seven years and/or a fine of up to five million rupees.

Cyber stalking

If you try to force a relationship on someone online through an internet website, email, or SMS, phone, or any communication tool, despite there being disinterest from the other party, you can be jailed for three years or fined up to one million rupees, or both. This includes repeatedly calling someone, despite the other party asking you not to, or sending emails with no interest shown by the other party. Do something in a manner that another party is harassed out of your actions is also not allowed. If you call, chat with someone and another party has no issues with that then it's all cool.

Hacking Email or Phone for Stalking

Hacking a person's email or phone in order to stalk them can lead to up to 3 years in jail or a fine of Rs. 1 million, or both.

Making Videos or Taking Pictures And Distributing without Consent

It is a criminal offence to take a photograph or make a video of any person without their consent and then distribute it in a way that harms them. If you are caught doing this, you could be jailed for up to three years and/or fined up to Rs. 1 million.

CYBER STALKING WITH A MINOR

Cyberstalking of a minor is punishable by up to 5 years in jail and/or a fine of up to 10 million rupees. This offense includes activities such as: Making contact with the minor in a way that harasses them Taking photographs or making videos of the minor without their consent Blackmailing Spying on minors

Hate Speech

Hate speech is a serious offense that can carry a prison sentence of up to seven years, a fine, or both. Anyone who prepares or distributes information that could trigger inter-faith, sectarian, or racial hatred using any information system or device can be punished under this law.

Spamming

If you spam someone with emails or SMS messages without their permission, you could face a fine of up to Rs. 50,000 for the first offense. Subsequent offenses could result in a fine of up to Rs. 5 million. You may also be sent to jail for up to three months.

Spoofing

Spoofing covers a wide range of activities, but all with the same malicious goal - to deceive someone into thinking that a fraudulent message or website is actually from a legitimate source. These actions can result in up to 3 years in jail and/or a fine of up to Rs. 500,00.

Malicious Code

Whoever commits the offense of writing, offering, making available, distributing, or transmitting malicious code with the intention of causing harm to any information system or data resulting in the corruption, destruction, alteration suppression, theft, or loss of the information system or data shall be punished with imprisonment for a term which may extend to two years or with a fine which may extend to one million rupees or with both

UNAUTHORIZED ACCESS TO INFORMATION SYSTEM OR DATA

According to the law, if you access any information system or data with the intention to commit a crime, you could go to jail for up to three months or be fined up to Rs. 50,000, or both. It is unclear how the term “dishonest” will be defined by the courts. Even worse, how will they establish if any attempt was dishonest or not? These punishments will be applicable if access to information is gained through infringing any security measure or procedure.

UNAUTHORIZED COPYING OR TRANSMISSION OF DATA

This section applies to anyone who copies or transmits data without authorization and with dishonest intention. If you are caught doing this, you may be punished with imprisonment for up to six months, a fine of up to 100,000 rupees, or both.

INTERFERENCE WITH INFORMATION SYSTEM OR DATA

If you damage or interfere with any part of an information system or data, you could be punished with imprisonment for up to two years, a fine of up to 500,000 rupees, or both. So, if you access or change someone else's data without their permission, you could be facing some serious consequences.

UNAUTHORIZED ACCESS TO CRITICAL INFRASTRUCTURE INFORMATION SYSTEM OR DATA

Whoever accesses any critical infrastructure information system or data without proper authorization or with the intention to cause harm, shall be punished with imprisonment for up to three years, or a fine of up to one million rupees, or both. Critical infrastructure refers to the systems and assets that are essential to the functioning of a society and economy. These include, but are not limited to: Assets: Physical things like buildings, equipment, and land Facilities: Services and operations like hospitals, power plants, and water treatment facilities Systems: A group of interconnected elements that work together to achieve a common goal, like transportation or communication networks Networks: Two or more nodes (points of connection) that are interconnected, like the Internet or a power grid

UNAUTHORIZED COPYING OR TRANSMISSION OF CRITICAL INFRASTRUCTURE DATA

Whoever copies or transmits critical infrastructure data without authorization or with dishonest intent will be punished with imprisonment for up to five years, a fine of up to five million rupees, or both

INTERFERENCE WITH CRITICAL INFRASTRUCTURE INFORMATION SYSTEM OR DATA

Whoever interferes with or damages a critical information system, or data, with the intention of being dishonest, shall be punished with imprisonment which may extend to seven years or with a fine which may extend to ten million rupees, or with both.

GLORIFICATION OF AN OFFENCE

Whoever prepares or spreads information about an act of terrorism with the intent to glorify it, or any person convicted of a crime relating to terrorism, or activities of prescribed organizations or individuals or groups shall be punished with imprisonment for a term which may extend to seven years or with a fine of up to ten million rupees or with both

CYBER TERRORISM

If anyone hacks into, copies, or destroys a critical information system with the goal of creating fear, panic, or insecurity in the government or public, they can be punished with imprisonment for up to 14 years or a fine of up to 50 million rupees, or both

ONLINE RECRUITMENT, FUNDING OF TERRORISM

Whoever prepares or distributes information, through any information system or device, for the purpose of funding or recruiting people for terrorism or making plans for terrorism, shall be punished with imprisonment for a term which may extend to seven years, or with a fine, or both.

ELECTRONIC FORGERY

Interfering with or using any information system, device, or data with the intent to cause damage, injury, or fraud is a punishable offense. Information systems store data that can be easily accessed and used by anyone with an internet connection. These systems were created for the purpose of making life easier for people, but some people misuse them for illegal or harmful means. If a person is found to be forging, manipulating, or doctoring data as if it were authentic, regardless of whether the data is intelligible or not, they shall be punished with imprisonment for a term which may extend to three years or with a fine of two hundred and fifty thousand rupees or with both.

ELECTRONIC FORGERY OF CRITICAL INFRASTRUCTURE

If any electronic forgery is done in relation to a critical infrastructure information system or data, the offender shall be punished with imprisonment for a term which may extend to seven years or with a fine which may extend to five million rupees or both.

ELECTRONIC FRAUD

Whoever intentionally interferes with or uses any information system, device or data, or induces any person to enter into a relationship or deceives any person, which act is likely to cause damage or harm to that person or any other person, shall be punished with imprisonment for a term which may extend to two years or with a fine which may extend to ten million rupees, or with both.

MAKING, OBTAINING, OR SUPPLYING DEVICE FOR USE IN OFFENCE

If you produce, make, generate, adapt, export, supply, offer to supply, or import any information system, data, or device with the intent to be used or believing that it is primarily to be used to commit or assist in the commission of an offense under this Act, you will be punished with imprisonment for a term which may extend to six months or with a fine which may extend to fifty thousand rupees or with both.

UNAUTHORIZED USE OF IDENTITY INFORMATION

If anyone is caught illegally obtaining, selling, or using another person's identity information, they will be punishable by imprisonment for up to three years and/or a fine of up to five million rupees.

UNAUTHORIZED ISSUANCE OF SIM CARDS ETC

Whoever sells or provides SIM cards without obtaining and verifying the subscriber’s details in a manner that’s not allowed by PTA, will be punished with imprisonment for a term which may extend to three years with or with fine which may extend to five hundred thousand rupees or with both.

TAMPERING OF COMMUNICATION EQUIPMENT

Whoever unlawfully or without authorization changes, alters, tampers with, or re-programs any communication equipment, including a cellular or wireless handset, and starts using or marketing such device for transmitting and receiving information, shall be punished with imprisonment which may extend to three years or with a fine which may extend to one million rupees, or with both.

UNAUTHORIZED INTERCEPTION

Intercepting any kind of unauthorized transmission from an information system - whether it's intended for the public or not - is a punishable offense in India. If you're caught committing this act, you could face up to two years in prison or a fine of up to 500,000 rupees.

How to Whitelist IP Address in Pakistan?

IP addresses that are not reported to the Pakistan Telecommunication Authority (PTA) for whitelisting will be blocked without any further notice. In addition, legal action will be taken against the companies involved in the use of IP addresses for the termination of any international incoming calls in accordance with Pakistani law.

Applications for IP whitelisting and VPN registration can be submitted online at IPregistration.pta.gov.pk; there is no need to visit the PTA physically. To whitelist your Call Centre's IP address with the PTA, you need to submit a request to the Vigilance Directorate at "ipreport@pta.gov.pk". Your request must be sent from a valid LDI/LLO on a PTA- notified format, and must include a Provisional Registration Certificate from the Pakistan Software Export Board. Once received, the Vigilance Directorate will process your request for approval and formalize the whitelisting of the IP(s) in question.

The PTA has reduced the documentation required for VPN registration and IP whitelisting. The following documents will now be required:

To apply for a corporate VPN, you will need the following documents:

1. A copy of the company's incorporation certificate or registration

2. The CNICs of the company's directors and shareholders

If you're a freelancer, you can get a VPN for free by providing your CNIC (both sides) and a letter of authentication from your employer or business concern.

Call Centres:

I. CNIC of applicant (both sides)

ii. You will need a Letter of Incorporation or proof of Active tax payer status

iii. Call Centre registration Certificate from PSEB

iv. Fee in case of five or more IP addresses (including previously whitelisted IP addresses)

For a video conference, you will need:

i. The CNIC of the applicant (on both sides)

ii. A letter of incorporation or a letter from a government organization or company This will ensure that the conference goes smoothly and that both parties have the required documentation.

How I can file a Cyber Crime Complaint in Pakistan ?

The government of Pakistan has introduced Cybercrime laws to help regulate the activity of its citizens on electronic forums. This includes not only popular platforms such as Facebook, WhatsApp, Telegram, and Twitter but also the use of mobile devices. If you think you're the victim of a cybercrime, you can file a complaint online with the National Response Centre for Cybercrime (NR3C). NR3C is an online complaint centre run by the Federal Investigation Authority's Cyber Crime Wing. You can report any cybercrime here, including hacking, defamation, and hate speech. It's now very easy to file a complaint if you're a victim of cybercrime in Pakistan. Some examples of cybercrime that can be reported to the FIA's cybercrime division are: Some people create fake social media accounts using your name, which can damage your reputation. Others might post your images and videos online without your consent. And still others might use social media to spread racial or ethnic hatred. Hackers can also access your private databases, including Facebook, email, and websites. Finally, some people might gain unauthorized access to your electronic devices, like laptops and phones. All of these activities can harm your reputation or defame you in some way. There has been an increase in fund transfer fraud through online platforms such as banks, ATMs, and e-wallets. This type of fraud usually happens when someone pretends to be a legitimate source of funds and tricks the victim into transferring money to them. To avoid becoming a victim of this type of fraud, always make sure that you are transferring funds to a trusted and verified source. If you are unsure about a source, contact your bank or e-wallet provider to verify the source before making any transfers.

How to Draft a Cyber Crime Complaint?

It is important that you write your complaint with full details of the cybercrime offence. A complaint can be made in English or Urdu, but it must be accompanied by all the evidence that substantiates your stance. This might include a screenshot of your Facebook page, pictures posted online, messages or pictures that you received through mobile facetime, telegram, Facebook messenger, etc.

How it is effective to make a Complaint to NR3C?

FIA's Cyber Crime Wing / NR3C has become increasingly strong and resourceful over the years. With the authority to gather information from cellular companies, Facebook, Twitter, Telegram, and other forums, they are able to help reach the person who has committed cybercrime in Pakistan based on complaints.

How I can get an Update on Cyber Crime Complaint?

You can email at helpdesk@nr3c.gov.pk or contact FIA Cyber Crime Wing at 051-9106384 or mobile number 03366006060 for any queries related to your complaint and update. At Burhan & Associates, our cybercrime expert lawyers have significant experience in handling a variety of cybercrime-related complaints. You may be worried that your complaint will go ignored, but you can rest assured knowing that our effective strategy will trigger the FIA CCW to take swift and decisive action against the offender. When it comes to such delicate matters, it's always best to consult with the best cybercrime law firm in Lahore.

How Cyber Crime in Pakistan can be reported?

If you are a victim of a cybercrime in Pakistan, you can report it to the FIA Cyber Crime Wing by following these steps: Register a complaint online by accessing the link: (http://www.nr3c.gov.pk/creport.php) You can also register a complaint via email at (helpdesk@nr3c.gov.pk). The complaint must state your name, address, and CNIC No., as well as all possible details of the act that you want to report and the name of the person or URL/link of profile through which cybercrime offence is being committed in Pakistan.

FAQs

The Prevention of Electronic Crimes Act (PECA) 2016 is the primary law addressing cybercrime in Pakistan. This law covers a broad range of cyber offenses, including unauthorized access to information systems, identity theft, cyberstalking, and online harassment. The act also prescribes penalties, ranging from fines to imprisonment, depending on the severity of the crime.

Under PECA 2016, penalties vary based on the nature of the offense. For example:
Unauthorized access to information systems: Fine of up to PKR 50,000.
Cyberstalking: Fine of up to PKR 1 million and/or imprisonment up to three years.
Identity theft: Fine of up to PKR 5 million and/or imprisonment up to three years.
Cyberterrorism: Life imprisonment or a heavy fine.
The law ensures strict consequences for serious offenses like child pornography and cyberterrorism, with harsher penalties.

To report a cybercrime in Pakistan, you can reach out to the Federal Investigation Agency's (FIA) Cyber Crime Wing, which operates a dedicated helpline and online reporting system. You can:
Call the helpline number (9911).
File a complaint online through the FIA’s cybercrime reporting portal at
Visit a regional FIA office in person to file a report.
The FIA advises victims to provide all necessary information and evidence to support their complaint.

Cyber harassment includes any form of threatening, blackmailing, or unwanted contact conducted over digital platforms. Under PECA, cyber harassment covers behaviors such as:
Sending unsolicited explicit content or threats.
Posting or sharing private images or information without consent.
Stalking or repeatedly contacting someone through electronic means to intimidate or harass them.
Victims of cyber harassment can report the incident to the FIA Cyber Crime Wing, and offenders may face fines and imprisonment if found guilty.

Yes, PECA 2016 stipulates jail time for several types of cybercrimes, including hacking, cyberterrorism, child pornography, identity theft, and cyberstalking. Jail terms can vary from a few months to life imprisonment, depending on the offense’s severity. For instance, cyberstalking can result in a prison sentence of up to three years, while cyberterrorism can lead to life imprisonment.

Yes, online defamation is punishable under PECA 2016. Posting false or damaging statements about someone with the intent to harm their reputation can be classified as defamation. Such offenses are punishable by a fine of up to PKR 1 million and/or imprisonment for up to three years.

The Federal Investigation Agency (FIA) is Pakistan's primary agency for investigating and enforcing cybercrime laws. Its Cyber Crime Wing handles complaints, conducts investigations, and takes action against offenders under PECA 2016. The FIA works to raise public awareness about cybercrime and provides guidance on safe internet practices.

Yes, hacking is considered a criminal offense in Pakistan under PECA 2016. Unauthorized access to someone else’s computer, network, or data is classified as hacking. Those found guilty can face a fine of up to PKR 1 million and imprisonment for up to three years. If hacking is done to cause harm, the penalties may be more severe.

Victims of cybercrime in Pakistan have the right to report the crime, seek protection, and receive justice under PECA 2016. The law mandates a transparent investigation process by the FIA and offers victims the right to remain anonymous if required. Victims can also pursue civil damages or compensation for losses caused by cybercrime.

PECA 2016 is considered a progressive step toward addressing cybercrime in Pakistan. However, challenges like limited awareness, technical constraints, and the need for updated infrastructure hinder full effectiveness. The law is actively enforced by the FIA’s Cyber Crime Wing, but public education and awareness about online safety remain crucial for more comprehensive protection.

Lahore Office

Block E 1, Johar Town , Lahore, Punjab , Pakistan 54000
Mr. Ahmed Burhan

Faisalabad Office

Burhan Center, 97-99, Gulistan Market Railway Road, Faislabad, Pakistan
Mr. Ahmed Burhan

UK Office

Associate Office (London)
Mr. Ahmed Burhan