The Prevention of Electronic Crimes Act, 2016 - PECA - is the statute that covers most online wrongdoing in Pakistan. Complaints under it fail far more often for want of preserved evidence than for want of a legal provision.
What PECA covers
The offences most often invoked by private complainants are:
- Unauthorised access to an information system or data, and unauthorised copying or transmission of data - the provisions that cover a hacked email, social media or banking account.
- Unauthorised use of identity information - impersonation, fake profiles, use of someone's CNIC or photographs.
- Offences against the dignity of a natural person, and offences against the modesty of a natural person, which is the provision used for non-consensual intimate images, sexualised superimposition and blackmail.
- Cyber stalking - repeated unwanted contact, monitoring, or threats through an information system.
- Electronic forgery and electronic fraud - the standard route for phishing, fake payment pages and manipulated documents.
- Child pornography, and cyber terrorism, which are treated far more seriously.
PECA has been amended more than once since 2016, including changes to the investigating agency and to certain offences and penalties. Always check the current text before relying on a section number.
Preserve the evidence first
Do this before you complain, before you block, and before you confront anyone.
- Screenshot everything - and make sure each screenshot shows the URL or the account handle and the visible timestamp. A cropped image of a message with no source is close to worthless.
- Screen-record the profile, the post and the conversation while scrolling. Video captures context that stills do not.
- Export the chat where the platform allows it, and keep the export file rather than a retyped version.
- Do not delete anything, however unpleasant - deleted messages cannot be produced, and deletion looks like suppression.
- Keep the original device if you can, and avoid factory resets. The device itself may need to be examined.
- Note the account identifiers - profile URLs, usernames, phone numbers, email addresses, transaction IDs - and any change to them over time.
- Where money was lost, keep the bank or wallet record and report to your bank immediately; speed matters for any chance of reversal.
Copy everything onto a USB drive or disc as well as keeping it on the device. Investigators will ask for a physical copy.
Where to complain
Cybercrime complaints are handled by the federal cybercrime investigation agency - a function that was carried out by the Federal Investigation Agency's Cybercrime Wing and has since been assigned to the National Cyber Crime Investigation Agency (NCCIA) under the amended framework. Complaints can be made online through the agency's portal, by its helpline, or in person at a reporting centre. Confirm the current channel before you file.
The written complaint should contain:
- Your CNIC and contact details
- A plain chronological account - what happened, when, on which platform, from which account
- The identifiers of the accused account and any known identity of the person behind it
- A list of the annexures, with the evidence attached and also supplied on a drive
- What you want - identification and prosecution, removal of the content, or both
Getting content removed
Prosecution and removal are different objectives. Removal is pursued through the platform's own reporting mechanism and, where that fails, through the Pakistan Telecommunication Authority's complaint process for unlawful online content. Do both in parallel with the criminal complaint; none of them is a substitute for the others.
Other remedies alongside PECA
Depending on the facts, you may also have a claim in defamation under the Defamation Ordinance, 2002, an offence under the ordinary provisions of the Pakistan Penal Code such as criminal intimidation or extortion, or - in a workplace context - a complaint under the Protection against Harassment of Women at the Workplace Act, 2010. Where the offender is known to you and there is an immediate threat, that is a matter for the local police and an FIR, not only for a cybercrime portal.
Two warnings
Do not negotiate with a blackmailer by paying; it invariably escalates, and the payment record is better used as evidence. And do not retaliate in kind - publishing the other person's material, or fabricating anything, converts you from complainant to accused.
This article is general information about Pakistani cybercrime procedure and not advice on a specific complaint. PECA has been amended and institutional responsibilities have changed; verify the current position and take advice from an advocate before filing.