Criminal Litigation

Cyber Harassment Complaints in Pakistan: How the Process Works Under PECA

Online harassment, blackmail using private images, impersonation and targeted abuse are prosecuted under the Prevention of Electronic Crimes Act, 2016 (PECA). The substantive law has been in place for a decade — but the agency that enforces it changed recently enough that a great deal of published guidance, and a lot of well-meant advice, now points people in the wrong direction.

What changed: NCCIA replaced the FIA Cyber Crime Wing

For years the Federal Investigation Agency's Cyber Crime Wing handled these complaints. That is no longer the position. The National Cyber Crime Investigation Agency (NCCIA) was established in 2024 and became fully operational in 2025, and the amended Section 30 of PECA now vests investigation of cybercrime exclusively in the NCCIA. It is a body corporate headed by a Director General exercising the powers of an Inspector General of Police, with its own forensic capability.

Two practical consequences. First, complaints directed to legacy FIA cybercrime channels — including the old 1991 helpline, which is no longer active for these matters — may simply not reach an investigating authority. Second, in a case where timing is later scrutinised, a misdirected complaint can leave an unhelpful gap in the record between when the victim says they reported and when the investigation actually began.

Which PECA offence applies

PECA creates distinct offences, and the elements and penalties differ materially between them. Broadly, the provisions most often engaged in harassment cases cover:

• Offences against the dignity of a natural person — false or defamatory material published electronically
• Offences against the modesty of a natural person and minors — including non-consensual distribution of intimate images, which is the provision most commonly engaged in "blackmail with private photographs" cases
• Cyberstalking — repeated contact, monitoring or intimidation through electronic means
• Electronic fraud and unauthorised access — where accounts have been compromised or impersonated
• Hate speech and, at the most serious end, cyber-terrorism

Because published sources vary in how they map these to section numbers, and because the 2025 amendments renumbered and added provisions, the specific section invoked in a given complaint or FIR should be confirmed against the current text rather than assumed. What matters practically is that the section actually invoked determines what has to be proved — so it is worth getting right at the complaint stage rather than arguing about it later.

Preserving evidence before you complain

This is the part that most often determines whether a case goes anywhere, and it has to happen before the accused knows they have been reported. Once someone suspects a complaint, accounts get deleted, messages get removed and content disappears.

• Screenshots are necessary but rarely sufficient on their own. Capture URLs, account handles and profile identifiers, timestamps and message metadata wherever the platform allows.
• Use platform data-export tools where available — these produce records with metadata intact, which carries far more weight than an image file.
• Do not edit, crop or annotate the originals. Keep them unaltered and work from copies.
• Record the device the material was received on, and preserve it if practicable — forensic imaging may be relevant.
• Where the material is distressing to revisit, this work can be done by counsel or a support worker rather than the victim personally. Evidence preservation and repeated exposure to the material are not the same requirement.

Filing the complaint

Complaints are made to the NCCIA, which requires complainant identification through CNIC verification — anonymous complaints are not entertained, though PECA contains confidentiality provisions protecting victim identity from public disclosure in appropriate cases. A complaint should set out what happened, when, on which platform, the identifiers of the account involved, and be accompanied by the preserved evidence rather than a promise to supply it later. Complete initial submission is the single biggest factor in how quickly a case moves.

Timelines

Realistic expectations, drawing on reported experience: a straightforward harassment case with clear evidence and an identifiable local accused may move within weeks. Cases requiring financial tracing or inter-bank coordination take considerably longer. Where the perpetrator is outside Pakistan, or behind an anonymised account on a foreign platform, timelines extend substantially and outcomes become less certain — a reality worth understanding at the outset rather than discovering months in.

If you are the one accused

Not every PECA complaint reflects what actually happened. These provisions are sometimes deployed in the course of family disputes, business fallings-out or personal enmity, and material taken out of context can look very different in a complaint than it did in a conversation. If you receive a notice from the NCCIA, the position is the same as with any criminal allegation: obtain advice before responding, and consider whether pre-arrest bail is appropriate. Statements made informally to investigators are not a substitute for a considered written response.

The 2025 amendments

The 2025 amendments did more than reassign the investigating agency. They introduced a regulatory and adjudicatory layer around social media content — including a Social Media Complaint Council to receive public complaints, and Social Media Protection Tribunals comprising members with legal, journalistic and information-technology backgrounds, hearing appeals from the regulatory authority's decisions. A new provision criminalising the intentional dissemination of false information was also added, carrying imprisonment of up to three years and a substantial fine.

That last provision has attracted significant public debate on free-expression grounds. For present purposes the relevant point is narrower: the enforcement landscape under PECA is actively changing, and advice more than a year old should be checked against the current position before it is relied upon.

This article is general information about Pakistani law and procedure, not legal advice for any specific matter. If this touches on something you're currently facing, get in touch and we'll advise on your facts directly.