Preliminary  feedback  on  PECB  2015  

 

Chapter  1:  Offences  and  Punishment:  

 

Section  3  &  4:    Illegal  access  to  information  system:  This  includes  description  that  would  

make  access  to  a  system  or  part  of  the  system  a  punishable  offence,  thereby  making  hacking  

a  punishable  offence  of  6  months.  However,  this  includes  nothing  about  whistleblower  

protection,  an  individual  can  gain  access  to  a  system  to  report  widespread  corruption  or  

gather  evidence  to  report  such  incidents.  There  should  be  exceptions  to  this  clause.    

 

Example:  An  employee  of  United  States’    National  Security  Agency’s    contractor  Allen  Booze,  

used  his  access  to  the  system  to  gather  and  make  public  information  about  the  widespread  

economic  espionage  and  surveillance  or  ordinary  citizen’s  around  the  world.  Snowden’s  

revelations  exposed  the  insecurity  of  national  systems  around  the  world  and  pushed  for  better  

protections.  Another  example  is  that  of  Kamran  Faisal,  a  NAB  employee,  found  dead  in  his  

room.  Faisal  was  investigating  a  high  level  case,  had  he  been  able  to  securely  gather  and  

release  documents  to  the  judiciary  he  would  have  been  able  to  assist  the  inquiry.  But  instead  

he  died  in  suspicious  circumstances  and  all  information  that  he  may  have  had  vanished  with  

him.    

 

Section  6:  This  makes  no  mention  of  white  hat  hacking.  How  can  we  expect  to  secure  

government  systems  or  keep  improving  them  if  not  for  white  hat  hacking  or  crowdsourcing  

security  issues.  Governments  around  the  world  recruit  white  hat  hackers  who  expose  security  

lapses.    

Definition:  White  hat  describes  a  hacker  (or,  if  you  prefer,  cracker)  who  identifies  a  security  

weakness  in  a  computer  system  or  network  but,  instead  of  taking  malicious  advantage  of  it,  

exposes  the  weakness  in  a  way  that  will  allow  the  system's  owners  to  fix  the  breach  before  it  

can  be  taken  advantage  by  others  (such  as  black  hat  hackers).  

Section  8:  This  prescribes  a  punishment  for  up  to  7  years  but  there  is  no  whistleblower  

protection.    

 

Chapter  2:  Establishment  investigation  agencies  and  prosecution  and  procedural  

powers  for  investigation  

   

This  should  not  be  left  to  the  discretion  of  the  federal  government  nor  should  an  executive  

body  be  arbitrarily  set  up  and  endowed  with  powers.  Any  body  the  government  wishes  to  

establish,  it  should  do  so  through  an  Act  of  parliament  so  that  it  has  statutory  backing  and  in  

its  constituting  Act  its  scope  and  functions  are  narrowly  defined  to  ensure  accountability  and  

prevent  against  misuse  and  abuse  of  power.  Furthermore,  if  any  existing  agency  is  being  

endowed  with  additional  functions,  this  too  should  be  done  through  an  amendment  to  their  

existing  Acts  and  should  pass  through  a  parliamentary  process.  No  powers  should  be  

arbitrarily  conferred  and  a  mechanism  for  recourse  needs  to  exist.  

 

Example:  If  the  language  and  process  is  not  defined,  we  will  end  up  with  an  IMCEW-­like  

scenario  except  with  an  authority  endowed  with  investigation  and  prosecution  powers.  

1   Bolo  Bhi  

 

   

Chapter  3:  International  Cooperation      

Currently,  there  is  no  indication  as  to  which  authorities  will  be  in  charge  of  what,  how  the  data  

will  exchange  hands,  what  kind  of  record  will  be  maintained  and  what  safeguards  there  are.  

 

Typically,  for  international  cooperation,  treaties  are  signed,  example  MLATs  (Mutual  Legal  

Assistance  Treaties).  This  is  something  the  Ministry  of  IT  is  aware  of  too.  This  is  signed  

through  the  Foreign  Office  and  countries  cooperate  on  the  basis  of  corresponding  laws.  

Processes  and  safeguards  are  generally  built  into  these  treaties  or  are  derived  from  existing  

law.  

 

Right  now  this  section  is  too  broad  and  vague.  Exchange  of  data  needs  to  be  defined  through  

a  process  –  especially  when  Pakistani  citizens’  data  is  being  exchanged  with  other  countries.  

We  do  not  have  data  protection  laws  and  processes  through  which  investigating  agencies  can  

lawfully  while  respecting  rights,  carry  out  their  functions.  Adequate  processes  with  protections  

must  then  be  built  in.  

   

Recommendations      

In  going  forward,  we  must  bear  in  mind  not  to  take  a  light  view  of  excesses  that  can  or  may  be  

committed.  Faisal  Chouhan’s  case  should  be  imprinted  in  memory.  Falsely  charged    under  

the  then  Pakistan  Electronic  Crimes  Ordinance,  he  languished  in  jail  for  a  crime  he  did  not  

commit.  Turned  out,  it  was  a  mistake  on  part  of  the  investigating  agencies  but  one  no  one  

wanted  to  own  up  to.  During  this  time,  his  wife  miscarried.  It  was  not  until  collective  pressure  

was  applied  and  a  hue  and  cry  raised,  that  Chouhan  was  released.    

 

Therefore,  nothing  should  be  left  open-­ended,  duties  and  functions,  especially  powers  

conferred  on  any  authority  or  agency  should  be  specifically  stated,  a  redress  mechanism  

should  exist  and  there  should  be  judicial/parliamentary  oversight  –  at  least  in  the  initial  phase.  

 

An  implementation  watch  committee  should  be  set  up  that  monitors  the  application  of  this  law  

for  at  least  a  period  of  two  years.  This  committee  should  also  be  responsible  for  the  training  of  

investigating  officers,  magistrates,  and  judiciary  to  better  understand  and  apply  the  law.  

Moreover,  there  will  need  to  be  awareness-­raising  with  citizens  to  inform  them  about  the  law.  

   

For  this,  the  government  can  and  should  join  hands  with  experts  from  the  industry  and  

members  of  civil  society.    

 

 

2   Bolo  Bhi