Cyber or Electronic Law to protect not violate civil liberties

Cyber crime is a growing scourge for Pakistan particularly in the absence of a well-drafted and comprehensive cyber crime law. In 2007, Prevention of Electronic Crimes Ordinance came out in public just after its approval from the Cabinet and when it was to be sent to the National Assembly of Pakistan, to be approved as a law. It was largely prepared in silos with the purpose to curb electronic crime; however, it was met with dissent from individuals as well as businesses. Prevention of Electronic Crimes Ordinance shortly referred to as PECO was labeled “Draconian” due to its major flaws and lacunas.

Most of the clauses that were part of PECO were considered obfuscated and hence widely open to misuse. In the first place, the terms Cyber and Electronic were used confusingly in the ordinance due to which it could not be established whether it was meant to deal with crimes of cyber world only or of electronic nature at large.

Most of the definitions that were part of PECO were either completely incorrect or used vague and subjective terms instead of accepted legal language.  According to Barrister Zahid Jamil who is considered an expert on IT laws, the ordinance did not mention rights of defense that a person accused under any section of it holds. In addition to this, exceptions that may be present in different scenarios were not taken into account either. During one of his presentations on PECO, Zahid discussed some of the flaws, using this actual text of the ordinance as an example. For instance, Cyber Stalking which means using Internet to follow someone or make unwanted advances and threats directed at someone, was defined in PECO as:

“ Whoever with intent to coerce, intimidate, or harass any person uses computer, computer network, internet, network site ,electronic mail or any other similar means of

communication to.—

(a) communicate obscene, vulgar, profane, lewd, lascivious, or indecent language, picture or

image;

(b) make any suggestion or proposal of an obscene nature;

(c) threaten any illegal or immoral act;

(d) take or distribute pictures or photographs of any person without his consent or knowledge;

(e) display or distribute information in a manner that substantially increases the risk of harm

or violence to any other person, commits the offence of cyber stalking.

The issues with this definition and specifically with terms highlighted in bold are:

i. If stalking is done using electronic means other than Internet as well, it should be called Electronic Stalking.

ii. Terms such as “obscene”, “indecent” are not defined in the ordinance and are highly subjective terms as what is obscene and indecent to one person, may be perfectly okay for another one.

iii. Mode of distribution of pictures is not mentioned. Also exceptions are not mentioned because it may be that one clicks a picture of say a monument and there may be someone sitting in the background. Now, when you put that picture online, the person sitting in the background can file a law suit against you and you can be punished for committing cyber stalking.

iv. Similarly, if you mention or share someone’s email address or cell number and it is deemed by that person to be increasing a risk of harm or violence to him/her, a law suit can be filed against you for Cyber Stalking.

Distribution of someone’s pictures could be illegal and mentioning email address/cell number a privacy infringement and should be dealt with Intellectual Property, Copyright Protection and Privacy laws. However, under this ordinance, they were considered cyber stalking  punishable for 7-10 years and a fine of maximum 0.3 million rupees or both; while someone who is actually stalking online may go free as nothing is mentioned about it in this definition.

PECO also had clauses that were of serious concern to business community. For instance, one of the clauses required all service providers to retain traffic data for a minimum period of 90 days and considering an ambiguous definition of Service Provider that it gave, any business, small or large, within whose premises, any sort of electronic communication is taking place using its network which may include the WiFi network as provided in Cafés and Hotels, will be required to store all data travelling through its network for a minimum 90 days.  The technical and other limitations that a business may have to do so were not taken into consideration either.

Another aspect of PECO that was of serious concern specially for the active civil society members of Pakistan was the invasive powers given to the Federal Investigation Agency to carry out investigations. Also, the way Cyber Terrorism was defined, it could be used or for that matter abused to accuse and punish any person who may be doing anything against the will of the government, under the name of protecting national security. According to the definition of Cyber Terrorism:

“Any person, group or organization who, with terroristic intent utilizes, accesses or causes to be accessed a computer or computer network or electronic system or electronic device or by any available means, and thereby knowingly engages in or attempts to engage in a terroristic act commits the offence of cyber terrorism.

Explanation 1.—For the purposes of this section the expression “terroristic intent” means to act

with the purpose to alarm, frighten, disrupt, harm, damage, or carry out an act of violence against any segment of the population, the Government or entity associated therewith.

Explanation 2.— For the purposes of this section the expression “terroristic act” includes, but is not

limited to,—

(a) altering by addition, deletion, or change or attempting to alter information that may result

in the imminent injury, sickness, or death to any segment of the population;

(b) transmission or attempted transmission o a harmful program with the purpose of

substantially disrupting or disabling any computer network operated by the Government or

any public entity;

(c) aiding the commission of or attempting to aid the commission of an act of violence against

the sovereignty of Pakistan, whether or not the commission of such act of violence is actually

completed; or

(d) stealing or copying, or attempting to steal or copy, or secure classified information or data

necessary to manufacture any form of chemical, biological or nuclear weapon, or any other

weapon of mass destruction.”

According to Barrister Zahid, a normal user who searches for WMDs or any related concept and the temporary files from the internet get stored on his/her computer, can be accused under the last point of the above definition and be given even a capital punishment.

So, there were serious implications of this ordinance for companies and individuals from any walk of life using technology not just because of its ill-constructed text but also because of its failure to provide the required protection in different areas. It was, therefore, opposed heavily by the civil society, media and businesses.  As the campaign against it gained momentum, some politicians also joined in and as a result, it was highly debated on the floor of National Assembly as well. However, the process of making proposed changes and then making it a law was delayed so much that it finally lapsed in November 2009.

Pakistan, therefore, now finds itself without an all-inclusive cyber or electronic crime law and its absence creates another set of issues. Many crimes of cyber nature cannot be taken up in court as due to their cyber nature, they are still not punishable under any law. The Electronic Transaction Ordinance (ETO) is being used to make do but it is not effective as reported by one of the Federal Investigation agency officials in one of the local newspapers:

“Without PECO, we are using Electronic Transaction Ordinance (ETO) as a backup, but the law is not very significant for courts and our trials start at the Judicial Magistrate level. The trial drags on for ages because the case grade is low and people often get away with the crime”

However, with the growing penetration of broadband, increasing mobile density and emergence of Pakistan as a popular outsourcing destination, it is imperative to have such a law; as we need to not just curb electronic offences and protect the growing number of internet users but also show the world that we have the legislation to protect their data and information, so as to attract more outsourcing.

Nevertheless, we also need to consider what a cyber or electronic law needs to have to be in harmony with internationally accepted laws:

i.            It should seek to maintain national security and provide protection to people in ways that are not contrary to fundamental human rights.

ii.            Global Nature of e-crime should be taken into consideration and ways to deal with crimes of transnational nature should be clearly defined.

iii.            Internationally accepted legal definitions of all the e-crimes should be used.

iv.            Law should take into consideration exceptions that may be present in different scenarios. For example, hacking should be a crime but white-hat hacking should be considered an exception and hence not a criminal offense.

v.            It should not be prepared secretively rather based on the input of all the stakeholder representatives.

Beside the ambiguities in the text of the law and steps to remove them, it is also imperative to consider that the major percentage of legal fraternity in Pakistan is not well-versed to how technology can and is being used in electronic crimes. This lack of in-depth knowledge can severely affect proceedings of cases involving electronic offenses even in presence of a well-drafted cyber/electronic crime law. This is because unless lawyers as well as the judges have a grip on technical forensics, they would not be able to make proper sense out of any testimony or digital evidence presented. So, efforts should also be directed towards training of legal resources so that once a carefully constructed law is out, it can also be used effectively to curb cyber/electronic crime.

References:

PECO

Understanding the E-Crime Bill

Investigators suffering from absence of law