The Federal Investigation Agency (FIA) has been replaced by the National Cyber Crime Investigation Agency (NCCIA) under the Prevention of Electronic Crimes Act (PECA) of 2016. A committee to review the proposed amendments to PECA 2016 has been formed and reportedly, a Digital Rights Protection Authority is on the cards. The Punjab Assembly has passed a defamation law to shield public officeholders from criticism. A ‘final’ round of consultations is underway on the Personal Data Protection Bill. As the ban on X (formerly known as Twitter) has entered its fourth month; the government has sought billions in the forthcoming social media regulation budget and there are reports of a China-like firewall being installed.

Common to all these developments is the lack of transparency, consultation, arbitrariness and the underlying question: to what purpose? To the discerning, the answer is clear: more control.

On May 3, 2024, a notification for the NCCIA surfaced. The narrative deployed by the government prior to this was the FIA’s failure to do its job – the harassment of women, and the spread of pornography, fake news and propaganda on social media.

What was the assessment of the FIA’s many failures that led to the formation of the NCCIA? The ‘protection of women and children’ narrative was also used at the time of the enactment of PECA and they were clearly not the beneficiaries of the law. Rights advocates and lawyers who routinely deal with the FIA on PECA cases have been consistently saying that the FIA does not facilitate genuine grievances about harassment and other crimes under the law. Instead, political cases are swiftly taken up, while crimes against citizens covered under the law are given no priority.

Over the years, the FIA’s excesses have been checked by various courts. It seems the motivation to set up a new agency is to provide a clean slate by disassociating all jurisprudential checks established to date and posing this as a new agency free from that baggage, but all the while instructing it to do more of the same at the behest of the executive.

Since the notification of the NCCIA, no details have emerged regarding its operationalisation, and the FIA is still issuing call-up notices. While the rules setting up the NCCIA say the FIA “shall cease to perform functions,” the FIA and its officers will be permitted to perform functions for up to a year until the transfer of cases is completed. This will be counted as “deputation to the NCCIA.” Not only are the rules contradictory, but there is a conflict between this notification and the 2023 amendments to PECA.

The NCCIA was established by an SRO through the exercise of the executive’s powers. While Section 29 of PECA permits the federal government to designate or establish an investigation agency, the 2023 amendment to Section 30 of PECA, on powers to investigate, names the FIA. Yet, in the original 2016 law, nowhere is the FIA mentioned; instead, references are made to an investigation agency. It was through an SRO that the FIA was designated as the investigation agency for PECA under Section 29. However, the 2023 amendment adds the FIA by name to the law, giving it powers to investigate offences under the act. However, an executive notification or delegated legislation cannot override a legislative amendment. This will need addressing.

Meanwhile, a nine-member committee was set up by the prime minister at the end of May to review the proposed amendments to PECA and “build political consensus”. But no one knows what these amendments are because the bill has not been shared publicly. According to news reports, a Digital Rights Protection Authority will be created – and although it may have the words ‘rights’ and ‘protection’ in its name, it is likely to do the opposite.

Currently, content regulation powers under Section 37 of PECA lie with the Pakistan Telecommunication Authority (PTA). The exercise of these powers has been arbitrary and the basis of court challenges, the most recent being the ban on X, which the PTA has conveniently distanced itself from, placing the responsibility on the Ministry of Interior (MoI), which has no legal authority under the law. The ruse now is ‘national security’. The MoI, in its response to the Islamabad High Court, also invoked the 2021 Social Media Rules, citing their violation by X and hence the penalties for non-compliance with the government’s directives and the requirement to set up offices and deploy staff in Pakistan. This means that the government’s territorial jurisdiction can extend over X, forcing compliance with laws and extra-legal directives. A modified version of what was proposed in the e-Safety Bill under the PDM government is being created to regulate online content, but if news reports are anything to go by, it will also ‘prosecute offences.’ It is likely that more offences will be inserted into PECA, making PECA 2.0 even more draconian.

Recent news reports point to the deployment of a national firewall and a request by the government for Rs 20 billion for social media regulation. Of course, there is no acknowledgment by the government and queries go unanswered. These decade-old objectives are to control what enters and goes out of Pakistan. This will not be limited to content restrictions and raises concerns regarding encrypted content and the privacy of communication, especially the references made to deep packet inspection, intent to trace IPs and block/register VPNs. What is being presented as a firewall is likely to be a combination of tech tools along with policy and legal measures aimed at restricting and filtering content, discerning identities, and initiating criminal prosecutions using existing and future laws.

The Punjab government has passed a defamation law in much haste and its territorial jurisdiction extends beyond the province. It focuses on social media and allows public officeholders to be claimants and reverses the requirement for the burden of proof – where the claimant does not have to prove loss or damage for a claim to be sustained. General damages start at three million rupees and are 10 times this amount as punitive damages. The cases will proceed before tribunals, the heads of which will be appointed by the government. Not only can the tribunals impose fines, they can also instruct that a defendant’s social media account be disabled. A defendant does not have an automatic right to a defence but must plead it through an application before the tribunal. Public officeholders, defined as constitutional officeholders, are provided with a parallel process. Their claims will proceed before a bench of the High Court and they are exempt from personal attendance and can nominate an authorised officer to appear on their behalf. If this does not reek of malintent and elite privilege, what does?

Widely condemned, the bill should have been scrapped, as there is nothing in it for the protection of private individuals; it simply serves public officeholders. Yet, the acting governor signed it into law on June 7, 2024, following which it has been challenged before the Lahore High Court.

According to a public announcement by the Ministry of Information Technology and Telecom (MoITT), a final round of consultations on the Personal Data Protection Bill will be held in the last week of June 2024 – but with whom and on what draft, is unclear. The draft available on the website is from 2023, which received approval in principle by the Federal Cabinet under the PDM government and was vehemently opposed by civil society and industry. Statements by industry associations warned of the impact the bill would have on the local industry, with the added risk of foreign companies withdrawing from Pakistan. Among the many problematic provisions are data localisation requirements, restrictions on cross-border data flow and the setting up of a commission devoid of independence to facilitate data sharing with the government. The individuals who signed up through the form available on MoITT’s website received no response until May 29, 2024, when standard template emails were sent out saying details of the consultation would be made available soon.

Protectionist narratives and name changes fool no one. PECA is an instrument of abuse. Defamation laws already exist. The Personal Data Protection Bill, while necessary, must address the concerns raised

Farieha Aziz is a journalist and co-Founder, Bolo Bhi.