Pakistan National Assembly Passes Draconian “Prevention of Electronic Crimes Bill 2015”

Dark webVirtual Crime, Real Time: Pakistan Approves Controversial Cybercrime Bill

 

Will online “terrorism,” “hacking,” and “child pornography” be equated to “sending text messages without notifying the receiver” and “criticizing government actions on social media” in Pakistan?

The controversial “Prevention of Electronic Crimes Bill 2015” has been approved by Pakistan’s National Assembly (NA) on Wednesday—

Government’s Proposed And Modified Cybercrime Bill 2015

1.
Short title, extent, application and commencement
.

(1) This Act may be called
the Prevention of Electronic Crimes Act, 2015.
(2) It extends to the whole of Pakistan.
(3) It shall also
apply to every citizen wherever he may be, and to every other person
for the time being in Pakistan.
(4) It shall come into force at once.
2.
Definitions
.

(1) In this Act, unless there is anything repugnant in the subject or
context,

a.
“access
to  information  system”  means  gaining  control  or  right  to  use  to  the
whole  or  any  part  of  an  information  system
whether  or  not  through  infringing  any
security measure;
b.
“access  to  data”  means  gaining  control  or  right  to  read,  use,  copy,  modify  or
delete any data held in or generated by any device or information system;
c.

Authority”  means  Pakistan  Telecommunication  Authority  established  under
Pakistan  Telecommunication  (Re

organization)  Act,  1996  (Act  No.XVII  of
1996);
d.
“authorization”  includes  authorization  by  law  or  the  person  empowered  to
make such authorization;
e.
“authorized  officer”  means  an  officer  of  the  special  investigation  agency
authorized  to  perform  any  function  on  behalf  of  the  special  investigation
agency under this Act;
f.
“Code” means the Code of Criminal Procedure, 1898 (Act No.V of 1898);
g.
“content data” means any representation of facts, information or concepts in a
form  suitable  for  processing  in  an  information  system,
including  source  code
or a program suitable to cause an information system to perform a function;
h.
“Court”  means  the  Court  of  competent  jurisdiction  designated
to
try
offences
specified under
this
Act;
i.
“critical  infrastructure”  includes  the  infrastructures  so  designated  by  any
Government in Pakistan and
such other assets, systems and networks, whether
physical or virtual, so vital to the State or its organs including judicature that
their  incapacitation  or  destruction  may  have  a  debilitating  effect  on  national
security, economy, public health,safety or m
atters related thereto;
Obtained    by    Bolo    Bhi
j.
“critical  infrastructure  information  system  or  data”  means  any  information
system, program or data that supports or performs a function with respect to a
critical infrastructure;
k.
“damage
to  an  information  system”  includes  any  change  in  the  ordinary
working of an information system impairing its performance, access, output or
change  in  location  whether  temporary  or  permanent  and  with  or  without
causing any change in the information system
itself;
l.
“data” includes content data and traffic data;
m.

data  damage”
includes  altering,  deleting,  deterioration,  erasing,  suppressing,
changing   location   of   data   or   making   data   temporarily   or   permanently
unavailable;
n.
“device”  includes  any  physical
device  or  virtual  device  capable  of  being
connected with any information system;
o.
“electronic”    includes    electrical,    digital,    magnetic,    optical,    biometric,
electrochemical, wireless or electromagnetic technology;
p.
“identity  information”  means  any  information  which  may  authenticate  or
identify an individual or an information system and enable access to any data
or information system;
q.
“information”  includes  text,  message,  data,  voice,  sound,  database,  video,
signals, software, computer programs, codes includ
ing object code and source
code;
r.
“information  system”  means  an  electronic  system  for  creating,  generating,
sending,  receiving,  storing,  reproducing,  displaying,  recording  or  processing
information;
s.
“intelligence”  means  any  speech,  sound,  data,  signal,
writing,  image  or
video;“investigating  officer”  means  an  officer  of  the  special  investigation
agency designated for investigation of offences under this Act;
t.
“offence” means an offence punishable under this Act;
u.
“references” (i) to an “act” includes a series of acts;
(ii)  to  an  act  by  a  “person”  shall  include  acts  done  or  to  be  done  by  such
person  either  directly  or  through  an  automated  information  system  or  device
and whether having temporary or permanent impact;
(iii)  a
reference  to  doing  an  act  includes  a  reference  to  causing  an  act  to  be
done;
(iv)     a     reference     to     impairing,     damage,     interference,     preventing
or
hindering something includes a reference to doing so temporarily;
v.
“rules” means rules made under this Act;
Obtained    by    Bolo    Bhi
w.
“seize” with respect to information system or data includes taking possession
of  such  information  system  or  data  or  making  and  retaining  a  copy  of  such
information system or data;
x.
“service provider” includes

i.
a person acting as a service provider in relation to sending, receiving, storing,
processing  or  distribution  of  electronic  communication  or  the  provision  of  other
services in relation to electronic communication through any information system;
ii.
a person who owns, possesse
s, operates, manages or controls a public
switched network or provides telecommunication services;
iii.
any  other  person  who  processes  or  stores  data  on  behalf  of  such
electronic communication service or users of such service; or
iv.
any
person  who  provides  premises  from  where  or  facilities  through
which  the  public  in  general  may  access  information  systems  and  the
internet such as cyber cafes;
y.
“special investigation agency” means the law enforcement agency established
or designated under
this Act;
z.
“subscriber information” means any information held in any form by a service
provider relating to a subscriber other than traffic data;
aa.
“traffic data” means any data relating to a communication indicating its origin,
destination, route, time,
size, duration or type of service;
bb.
“unauthorized access” means access to an information system or data without
authorisation or in violation of the terms and conditions of the authorization;
cc.
“unauthorised interception” shall mean in relation to an inf
ormation system or
data, any interception without authorization;
(3) Other expressions used in the Act or rules framed under it but not defined herein,
unless their context provides otherwise, shall have meanings assigned to the
expressions in the Pakist
an Penal Code 1860, Code of Criminal Procedure 1898 and
‘Qanoon

e

Shahadat Order 1984, as the case may be.
CHAPTER I
OFFENCES AND PUNISHMENTS
3.
Unauthorized   access   to   information   system   or   data
.

(1)   Whoever   with
malicious intent
gains unauthorized access to any information system or data shall be
punished with imprisonment for a term which may extend to six months or with fine
which may extend to one hundred thousand rupees or with both.
4.  Unauthorized  copying  or  transmission
of  data.

Whoever
with
malicious  intent
and  without  authorization  copies  or  otherwise  transmits  or  causes  to  be  transmitted,
Obtained    by    Bolo    Bhi
any data whether by gaining access to such data or otherwise, shall be punished with
imprisonment  for  a  term  which  may  extend  to  si
x  months,  or  with  fine  which  may
extend to one hundred thousand rupess or with both.
5.  Unauthorized  access  to  critical  infrastructure  information  system  or  data.

Whoever with
malicious intent
gains unauthorized access to any critical infrastructure
information  system  or  data  shall  be  punished  with  imprisonment  upto  three  years  or
with fine which may extend to one million rupees or with both.
6.
Criminal
Interference   with   information   system   or   data
.

Whoever   with
malicious intent and without authorization interferes with or damages or causes to be
interfered with or damaged any information system or any part thereof, or data or any
part thereof, shall be punished with imprisonment which may extend to two years or
with fine which may extend to five hundred
thousand rupees or with both.
Explanation:  Interference  refers  to  doing  of  any  unauthorized  act  in  relation  to  an
information  system  or  data  that  may  disturb  normal  working  of  such  information
system with or without causing any actual damage to such info
rmation system.
7. Criminal
Interference with critical infrastructure information system or data
.

Whoever with malicious intent and without authorization interferes with or damages,
or causes to be inferred with or damaged, any critical information system or any part
thereof,  or  critical  infrastructure  data  or  any  part  thereof,  shall  be  punished  with
imprisonment which may extend to seven years or with fine which may extend to five
million rupees or with both.
8.
Cyber  terrorism
.

Whoever  commits  or  threatens  to  commit  any  of  the  offences
under sections 5 and 7 where

(a)  the  use  or  threat  is  designed  to  coerce,  intimidate,  overawe  or  create  a  sense  of
fear, panic or insecurity in the Government or the public or a section of the public or
community or sect or create a sense of fear or insecurity in society; or
(b) the use or threat is made for the purpose or motive of advancing a religious, ethnic
or sectarian cause;
shall  be  punished  with  imprisonment  of  either  description
for  a  term  which  may
extend to fourteen years or with fine which may extend to fifty million rupees or with
both.
9.
Electronic   forgery
.

(1)   Whoever,   for   wrongful   gain,   interferes   with   any
information system, device or data, with intent to cause damage or injury to the public
or  to  any  person,  or  to  make  any  illegal  claim  or  title  or  to  cause  any  person  to  part
with  property  or  to  enter  into  any  express  or  implied  contract,  or  with  intent  to
commit  fraud  by  any  input,  alteration,  deletion,  or  suppressi
on  of  data,  resulting  in
unauthentic data with the intent that it be considered or acted upon for legal purposes
Obtained    by    Bolo    Bhi
as  if  it  were  authentic,  regardless  of  the  fact  that  the  data  is  directly  readable  and
intelligible or not shall be punished with imprisonment
of either description for a term
which  may  extend  to  two  years,  or  with  fine  which  may  extend  to  two  hundred  and
fifty thousand rupees or with both.
(2)   Whoever   commits   offence   under   sub

section   (1)   in   relation   to   a   critical
infrastructure  information  system  or  data  shall  be  punished  with  imprisonment  for  a
term  which  may  extend  to  five  years  or  with  fine  which  may  extend  to  five  million
rupees or with both.
10.
Electronic  fraud
.

Whoever  for  wrongful  gain  interferes  with  or  uses  any
information  system,  device  or  data  or  induces  any  person  to  enter  into  a  relationship
or with intent to deceive any person, which act or omission is likely to cause damage
or harm to that person or any other person shall be punished with imprisonment for a
term  which  may  extent  to  two  years  or  with  fine  which  may  extend  to  ten  million
rupess, or with both.
11.
Making, supplying or obtaining devices for use in offence
.

Whoever produces,
makes,  generates,  adapts,  exports,  supplies,  offers  to  supply  or  imports  for  use  any
information system, data or device intending it primarily to be used or believing that it
is primarily to be used to commit or to assist in the commission of an offence under
this Act shall, without prejudice to any other liability that he may incur in this behalf,
be punished with imprisonment for a term which may extend to 6 months or with fine
which may extend to fifty thousand rupees or with both.
12.
Identity  crime
.

(1)  Whoever  obtains,  sells,  possesses  or  transmits  another
person’s  identity  information,  without  lawful  justification  shall  be  punished  with
imprisonment  for  a  term  which  may  extend  to  three  months  or  with  fine  which  may
extend to fifty
thousand rupees, or with both.
(2) Any person whose identity information is obtained, sold, possessed or retains may
apply to the Court competent to try offence under sub

section (1) for passing of such
others  as  the  Court  may  deem  fit  in  the  circumstances  for  securing,  destruction  or
preventing transmission of any such data.
13.  Unauthroized  issuance  of  SIM  cards  etc.

Whoever
sells  or  otherwise  provide
subscriber  identity  module  (SIM)  card,  re

usable  identification  module  (R

IUM)  or
other portable memory chip designed to be used in cellular mobile or wireless phone
for transmitting and receiving of intelligence without obtaining and verification of the
subscriber’s antecedents in the mode and manner approved by the Authority shall be
punished with impr
isonment for
a term which may extend to three years or with fine
which may extend to five hundred thousand rupees or both.
14.   Tempering   etc.   of   communication   equipment.

Whoever   changes,   alters,
tampers  with  or  re

programs  unique  device  identifier  or  international  mobile  station
equipment  identity  (IMEI)  number  of  any  stolen  cellular  or  wireless  handset  and
unlawfully  or  without  authorization  starts  using  or  marketing  it  for  transmitting  and
receiving  intelligence  through  such  mobile  or  wireless  handsets
shall  be  punished
with imprisonment which may extend to three years or with fine which may extend to
1 million rupees or both.
Obtained    by    Bolo    Bhi
15.
Unauthorized   interception
.

Whoever   intentionally   commits   unauthorized
interception by technical means of

(a) any transmission that is not intended to be and is not open to the public, from or
within an information system; or
(b) electromagnetic emissions from an information system that are carrying data,
shall
be  punished  with  imprisonment  of  either  description  for  a  term  which  may
extend to two years or with fine which may extend to five hundred thousand rupees or
with both:
16
. Offence against dignity of natural person

(1) Whoever, with malicious intent,
k
nowingly  and  publicly  exhibits,  displays,  transmits  any  electronic  communication
that  harms  the  reputation  of  a  natural  person,  threatens  any  sexual  acts  against  a
natural  person;  superimposes  a  photograph  of  the  face  of  a  natural  person  over  any
sexually
explicit   images;   distorts   the   face   of   a   natural   person;   or   includes   a
photograph  or  a  video  of  a  natural  person  in  sexually  explicit  conduct,  without  the
express  or  implied  consent  of  the  person  in  question,  intending  that  such  electronic
communication  cause  that  person  injury  or  threatens  injury  to  his  or  her  reputation,
his or her existing state of privacy or puts him or her in fear for him or her safety shall
be punished with imprisonment for a term which may extend to one year or with fine
which may ext
end to one million rupees or with both.
(2) Whoever commits an offence under sub

section (1) with respect to a minor, shall
be  punished  with  imprisonment  for  a  term  which  may  extend  to  three  years,  or  with
fine which may extend to ten million rupees or w
ith both.
(3) Any aggrieved person or his guardian where such person is a minor, may apply to
the  court  for  passing  of  such  orders  for  removal,  destruction  or  blocking  access  to
such material referred in sub

section (1) and the Court on receipt of such application
may pass such orders as deemed proper in the circumstances.
17. Malicious code.

Whoever wilfully writes, offers, makes available, distributes or
transmits  malicious  code  through  an  information  system  or  device,  with  intent  to
cause harm to any
information system or data resulting in the corruption, destruction,
alteration,  suppression,  theft  or  loss  of  information  system  or  data  shall  be  punished
with imprisonment for a term which may extend to two years or with fine which may
extend to one
million rupees or both:
Provided  that  the  provision  of  this  section  shall  not  apply  to  the  authorized  testing,
research and development or protection of any code for any lawful purpose:
Explanation.

For  the  purpose  of  this  section  the  expression  “malicious
code”
includes  a  computer  program  or  a  hidden  function  in  a  program  that  damages  any
information  system  or  data  or  compromises  the  performance  of  the  information
system or availability of data or uses the information system resources without proper
authorization
Obtained    by    Bolo    Bhi
18.  Cyber  stalking.

(1)  Whoever  with  intent  to  coerce,  intimidate,  or  harass  any
person  uses  information  system,  information  system  network,  internet,  website,
electronic mail or any other similar means of communication to,

(a) communicate
obscene, vulgar, contemptuous, or indecent intelligence;
(b) make any suggestion or proposal of an obscene nature;
(c) threaten any illegal or immoral act;
(d)  take  or  distribute  pictures  or  photographs  of  any  person  without  his
consent or knowledge
;
(e)  display  or  distribute  information  in  a  manner  that  substantially  increases
the risk of harm or violence to any other person
commits the offence of cyber stalking.
(2) Whoever commits the offence specified in sub

section (1) shall be punishable with
imprisonment  for  a  term  which  may  extend  to  two  years  or  with  fine  which  may
extend to one million rupees, or with both:
Provided  that  if  the  victim  of  the  cyber  stalking  under  sub

section  (1)  is  a  minor  the
punishment may extend to three years or with
fine may extend to ten million rupees,
or with both.
(3)  Any  person  may  apply  to  the  court  for  issuance  of  a  restraining  order  against  an
accused  of  cyber  stalking  and  the  court  upon  receipt  of  such  application  may  pass
such order as deemed appropriate in the circumstances of the case.
19.  Spamming.

(1)
Whoever  transmits  harmful,  fraudulent,  misleading,  illegal  or
unsolicited intelligence to any person without the express permission of the recipient,
or causes any information system to show any such intelligence commits the offence
of spamming.
(2)
Whoever  commits  the  offence  of  spamming  as  described  in  sub

section  (1)  shall
be punished with fine not exceeding fifty thousand rupees if he commits this offence
of  spamming  for  the  first  time  and  for  every  subsequent  commission  of  offence  of
spamming  he
shall  be  punished  with  imprisonment  for  a  term  which  may  extend  to
three months or with fine which may extend to one million rupees
or with both.
20.   Spoofing.

(1)   Whoever   dishonestly,   establishes   a   website   or   sends   any
intelligence  with  a  counterfeit
source  intended  to  be  believed  by  the  recipient  or
visitor of
the website, to be an authentic source commits spoofing.
(2) Whoever commits spoofing shall be punished with imprisonment for a tem which
may  extend  to  three  years,  or  with  fine  which  may  extend  to  five  hundred  thousand
rupees or with both.
Obtained    by    Bolo    Bhi
21.
Legal  recognition  of  offences  committed  in  relation  to  information  systems
.

(1) Notwithstanding anything contained in any other law, an offence under this Act or
any  other  law  shall  not  be  denied  legal  recognition  and  enforcement  for  the  sole
reason  of  such  offence  being  committed  in  relation  to,  or  through  the  use  of,  an
information system.
(2)  References  to  “property”  in  any  law  creating  an  offence  in  relation  to  or
concerning property, shall include information systems and data.
(3) References in any law creating an offence to an act shall include actions taken or
caused by
use of an information system.
(4)  References  to  an  act  by  a  person  in  this  Act  or  any  law  establishing  an  offence
shall include acts done or to be done by or through automated mechanisms and self

executing, adaptive or autonomous devices, programs or in
formation systems.
22. Pakistan Penal Code 1860 to apply
.

The provisions of the Pakistan Penal Code
1860 (XLV of 1860), to the extent not inconsistent with anything provided in this Act,
shall apply to the offences provided in this Act.
CHAPTER II
ESTABLISHMENT OF INVESTIGATION AND PROSECUTION AGENCY
AND PROCEDURAL POWERS FOR INVESTIGATION
23.
Establishment  of  investigation  agencies  and  prosecution
.

(1)  The  Federal
Government  shall  designate  the
Federal  Investigation  Agency  or  any  other  law
enforce
ment   agency   as   the   special   investigation   agency   for   the   purposes   of
investigation and prosecution of offences under this Act.
(2) Unless otherwise provided for under this Act the special investigation agency, the
special investigating officer, prosecution
and the court shall in all matters
follow the
procedure  laid  down  in  the  Code
to  the  extent  that  it  is  not  inconsistent  with  any
provision of this Act.
(3)   The   Government   shall   organize   specialized   courses   in   digital   forensics,
information technology, com
puter science and other related matters for training of the
officers and staff of the special investigation agency.
24.
No  warrant,  arrest,  search,  seizure  or  other  power  not  provided  for  in  the
Act
.

(1) No person whether a police officer, investigation
officer or otherwise, other
than  an  investigating  officer  of  the  special  investigation  agency  shall  investigate  an
offence under this Act:
Provided that the Federal Government or the Provincial Government may, as the case
may  be,  constitute  joint  investi
gation  team  comprising  of  the  officers  of  special
investigation  agency  and  any  other  law  enforcement  agency  including  Police  for
Obtained    by    Bolo    Bhi
investigation of events involving commission of offences under this Act and any other
law for the time being in force.
(2) No
person other than a prosecutor designated as such by the special investigating
agency shall prosecute any offence under this Act.
25.
Expedited Preservation of data
.

(1) If an investigating officer is satisfied that

(a)  data
stored  in  any  information  system  or  by  means  of  an  information  system,  is
reasonably required for the purposes of a criminal investigation; and
(b)  there  is  a  risk  or  vulnerability  that  the  data  may  be  modified,  lost,  destroyed  or
rendered inaccessible,
the  investigating  officer  may,  by  written  notice  given  to  a  person  in  control  of  the
information  system,  require  the  person  to  ensure  that  the  data  specified  in  the  notice
be preserved and the integrity thereof is maintained for a period not exceeding n
inety
days as specified in the notice.
(2)  The  period  provided  in  sub

section  (1)  for  preservation  of  data  may  be  extended
by  the  Magistrate  if  so  deemed  necessary  upon  receipt  of  an  application  from  the
investigating officer in this behalf.
26.
Retention of traffic data.

(1)
A service provider shall, within its existing or
required  technical  capability,  retain  its  traffic  data  for  a  minimum  period  of  ninety
days  or  such  period  as  the  Authority  may  notify  from  time  to  time  and  provide  that
data
to  the  special  investigating  agency  or  the  investigating  officer  whenever  so
required.
(2)
The  service  providers  shall  retain  the  traffic  data  under  sub  section  (1)  by
fulfilling  all  the  requirements  of  data  retention  and  its  originality  as  provided  under
sections 5 and 6 of the Electronic Transaction Ordinance, 2002 (LI of 2002).
(3)
Any  person  who  contravenes  the  provisions  of  this  section  shall  be  punished
with imprisonment for a term which may extend to six months or with fine which may
extend to or
with both.
27.
Warrant  for  search  or  seizure
.

(1)  Upon  an  application  by  an  investigating
officer  that  demonstrates  to  the  satisfaction  of  the  Court  that  there  exist  reasonable
grounds to believe that there may be in a specified place an information syste
m, data,
device or other articles that

(a) may reasonably be required for the purpose of a criminal investigation or criminal
proceedings  which  may  be  material  as  evidence  in  proving  a  specifically  identified
offence made out under this Act; or
(b) ha
s been acquired by a person as a result of the commission of an offence,