1 The Internet Governance and Digital Rights Monitor, 2017
Authors Sadaf Khan Talal Raza Waqas Naeem
Editing & Review Sadaf Khan Asad Baig
Design and illustrations Aniqa Haider
Published by Media Matters for Democracy 2018
Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/ Some rights reserved.
2 3
Table of Content
Section I – Internet Rights
Chapter 1 – Zip it – An account of freedom of 7 Expression online
Chapter 2 – Its a private matter – digital technology 15 and challenges to privacy
Chapter 3 – Disconnecting the masses 24
Section II – Internet Governance and Regulation
Chapter 4– The IT Policy – A rights based review 32
Chapter 5 – Pakistan’s Cybercrime Act: From 39 implementation to implications
Section III – Digital Services
Chapter 6 – E-Governance in Pakistan: Hopeful Signs for 48 the Future
Chapter 7 – Growth in E-commerce shows Promising 60 Signs for Local Digital Services Industry
4
5 6
7 Chapter 1 Zip it! - An account of freedom of expression online Sadaf Khan
The press in Pakistan is no stranger to state censorship. But in recent years the domain of censorship and restrictions on speech has spread and now, it isn’t just the press that is subjected to declared and undeclared censorship policies but activists, political workers, and human rights defenders are all increasingly being subjected to it. Another concern is that citizens may begin to internalize perspectives that justify or defend the suppression of truth and dissent. Within this scenario, the development of a truly democratic discourse remains impossible.
Introduction
The year 2017 saw the disqualification of the Pakistani Prime Minister in a case initiated on the basis of an investigative journalism project, the Panama Papers. The Panama Papers and their political fallout became a key factor that influenced policy decisions regarding the regulation of journalistic and political expression in the country. Multiple laws, including the controversial cybercrime law, Pakistan Electronic Crimes Act 2016 and the Anti Terrorism Act, were used to pressurize journalists and human rights defenders. There were various incidences of journalists and politically vocal social media users being approached and intimidated with threats of legal action.
Year 2017 also saw the first instance of mass blocking of news websites along with multiple social media platforms as the government desperately attempted to keep proceedings of a public protest under wraps. Attacks on journalists continued and expanded to include journalists who work primarily for digital mediums. In addition, there were also instances of journalists being warned to cease their social media activity. In addition to the punitive use of laws to curb expression, there were also multiple instances of hate speech and incitement to violence against those engaged in dissenting speech; the campaign that led to the murder of a university student Mashal Khan is a case in point.
This chapter outlines the key threats to freedom of expression that emerged in the year 2017.
Policy & Political Background
Since 9/11 and its security related fallout around the world, Pakistan has maintained a political narrative that holds ‘security’ as a prime objective achievable only through a compromise on certain other rights. Over the years, this narrative has provided justifications for blanket censorship, bans of social media platforms, crackdowns against vocal activists and media entities, and network disconnections. It has also received support from a significantly sizeable section of journalists and activists, who seem to have internalized its principles. Thus, policies and actions to curb freedom of expression in Pakistan have to be understood within a political landscape that promotes the sacrifice of some liberties to ensure security for all.
8
Year 2017 was a politically significant year for Pakistan for multiple reasons; most significantly because of the general elections due in 2018 and the political aftermath of the release of Panama Papers. Thus the government was involved in building a structured narrative against digital mediums, in particular social media platforms like Facebook and Twitter. From statements from the Ministry of Interior, to court decisions to directives from Pakistan Telecommunication Authority, PTA, different parts of the legislative, administrative and legal systems appeared to work together to present digital media as a persistent threat that had to be railed in.
2017 – moving towards silence
State narratives around social media
The beginning of the year 2017 was demonstrative of the direction this year would take – within the first week of January 2017, four bloggers went missing1. Within days of the bloggers’ disappearance, social media posts accusing them of anti-state and anti-Islamic activities began surfacing. These were picked up by the mainstream media too. There was fear among rights activists that upon return the bloggers would face the “wrath of zealots who want instant justice for blasphemers”2. Ms. Zohra Yusuf, Chairperson of the Human Rights Commission of Pakistan, HRCP, also saw this campaign as an effort to ‘lessen sympathy’ for the bloggers and to ensure that “when the bloggers reappear, there could be a charge against them”3.
A charge of blasphemy was formally levelled against them through a petition in Islamabad High court, IHC. However the FIA could find “no evidence” that the bloggers were engaged in blasphemy and the IHC stated that “the trial court will decide if this was a case of false accusation or lack of evidence”4.
In March 2017, during the hearing of a related case Justice Shaukat Aziz Siddiqui of the Islamabad High Court, IHC, stated that blasphemy through social media is “a greatest form of terrorism and people involved in this heinous act are biggest terrorists” 5 and ordered the Ministry of Interior to “eliminate access to blasphemous content on social media, even if it meant blocking “all access to
1 AFP (2017). Four rights activists gone missing this week. [online] DAWN.COM. Available at: https://www.dawn.com/news/1307195 [Accessed 20 Apr. 2018]. 2 Rumi, R. (2017). Opinion | Bring Pakistan’s Missing Bloggers Home. [online] Nytimes.com. Available at: https://www.nytimes.com/2017/01/20/opinion/bring-pakistans-missing- bloggers-home.html [Accessed 20 Apr. 2018]. 3 Tanzeem, A. (2017). Blasphemy Allegations Against Missing Pakistani Bloggers Backfire on Critic. [online] VOA. Available at: https://www.voanews.com/a/blasphemy-allegations-against- missing-pakistani-bloggers-backfire-critic/3694973.html [Accessed 20 Apr. 2018]. 4 DAWN.COM. (2017). No evidence found against bloggers accused of blasphemy, FIA tells court. [online] Available at: https://www.dawn.com/news/amp/1378262 [Accessed 4 May 2018]. 5 Asad, M. (2017). IHC wants blasphemous content on social media blocked. DAWN.COM. Retrieved 8 August 2017, from https://www.dawn.com/news/1319102
9 social media platforms”6. In the decision of Salman Shahid vs Federation of Pakistan, Justice Shaukat Aziz Siddiqui of IHC commented that government should try to initiate action to permanently shut down websites and pages that host blasphemous content7.
In June 2017, an Anti-Terrorism Court handed a death sentence to a man for committing blasphemy over Facebook. This sentence was given under Section 11W of the Anti-Terrorism Act with the assertion that blasphemous speech could ‘whip up sectarian hatred’8.
Blasphemous online content remained a topic of debate throughout the year and consequently social media platforms were frequently presented as anti-religious forums. In fact, the government actively engaged in a campaign to criticise social media platforms. The Ministry of Interior and the former Minister of Interior termed social media anti-state and dangerous. In a statement issued on May 23, 2017 the Interior Minister said, “our cultural and religious values are under attack from a section of social media”9. The statement also included a vow to ensure that “efforts were accelerated to track internet users’ activities online and hunt down undesirable elements”.
Intimidation of journalists
In 2017, the cyber-crime law PECA was used as a tool to intimidate and harass journalists, activists and other social media users who were engaged in political commentary on current affairs. The Federal Investigative Agency, FIA, sent notices to and interrogated various journalists, bloggers and micro-bloggers who were accused of penning anti Army content10. The choice of sections of the law used to charge these individuals was often bizarre. In a number of cases, including one of a journalist Zafar Achakzai,11, the FIA brought charges under Section 21 of PECA12 that defines offenses against modesty of a natural person and deals largely with creation and abuse of sexually explicit images to intimidate a person. In other cases the FIA did not issue formal charges and was
6 Shahzad, R. (2017). Blasphemy: IHC directs authorities to block all social media if necessary. The Express Tribune. Retrieved 8 August 2017, from https://tribune.com.pk/story/1348784/ihc- directs-authorities-block-social-media-necessary/ 7 Salman Shahid vs Federation of Pakistan via Ministry of Interior, Writ Petition739/2017 (Islamabad High Court 2017). 8 Gabol, I. (2017). First death sentence handed to man for blasphemy on social media. DAWN.COM. Retrieved 1 October 2017, from https://www.dawn.com/news/1338684 9 No restrictions either: No unbridled freedom on social media, says Nisar. (2017). The Express Tribune. Retrieved 8 August 2017, from https://tribune.com.pk/story/1417195/anti-army- content-social-media-will-not-tolerated-chaudhry-nisar/ 10 FIA traces 12 websites with anti-Army content. (2017). The Nation. Retrieved 1 October 2017, from http://nation.com.pk/national/16-May-2017/fia-traces-12-websites-with-anti-army- content 11 Shah, S. (2017). Quetta court grants bail to journalist arrested by FIA over 'anti-state' social media posts. DAWN.COM. Retrieved 1 October 2017, from https://www.dawn.com/news/1343411/quetta-court-grants-bail-to-journalist-arrested-by-fia- over-anti-state-social-media-posts 12 Hashim, A. (2017). Pakistan: Zafar Achakzai charged for anti-army post. Aljazeera.com. Retrieved 1 October 2017, from http://www.aljazeera.com/news/2017/06/pakistan-zafar- achakzai-charged-anti-army-post-170630074828317.html
10 allegedly acting under orders from the interior ministry13. This was one of the few cases of actual arrests but in 2017 at least one journalist reported he was picked up and interrogated for his social media activity14.
Following a similar attempt by FIA, another journalist, Taha Siddiqui, initiated a petition in the Islamabad High Court. The journalist was initially contacted by the Counter Terrorism Department of the agency. During the course of the court hearing, his case was transferred to the Cyber Crime Wing15 and he was later asked to visit FIA so that "technical staff may scrutinize his account”. This is against the procedure defined within the law, which requires the agency to acquire a warrant before any such logging or scrutinisation can take place. Siddiqui has since escaped an abduction attempt and relocated to France.
Hate Speech and Incitement
Another way that freedom of expression online was threatened was the use of structured hate campaigns. In such cases once again blasphemy was used as a tool of incitement. On April 13, 2017 a 23 year old university student, Mashal Khan, was murdered by a violent mob charged by accusations that Khan had conducted blasphemy online16. During investigations that followed the brutal murder, it became clear that the administration of Mardan University was involved in provoking the violence against their own student17. Fake screenshots were used by the perpetrators to incite the mob that killed Khan and mutilated his dead body. Most parties within the government were not only reluctant to take action against this brutality but some right wing parties actively tried to rile up the public sentiment further by connecting murder investigations with possible amendments in the anti-blasphemy law18.
Censorship
The most significant incident of online censorship occurred in November 2017. A group of religious parties blocked the main entry route to Islamabad and the
13 Rasmussen, S., & Gillani, W. (2017). Pakistan: man sentenced to death for blasphemy on Facebook. the Guardian. Retrieved 1 October 2017, from https://www.theguardian.com/world/2017/jun/11/pakistan-man-sentenced-to-death-for- blasphemy-on-facebook 14 Journalist freed after ‘torture’. (2017). DAWN.COM. Retrieved 1 October 2017, from https://www.dawn.com/news/1344495 15 Journalist Harassed: Case transferred to cyber crime wing - The Express Tribune. (2017). The ExpressTribune. Retrieved 1 October 2017, from https://tribune.com.pk/story/1451057/journalist-harassed-case-transferred-cyber-crime- wing/ 16 Akbar, A. and Farhan, H. (2017). Mardan university student lynched by mob over alleged blasphemy: police. [online] DAWN.COM. Available at: https://www.dawn.com/news/1326729 [Accessed 20 Apr. 2018]. 17 Akbar, A. (2017). Lynching suspect gives statement: 'University administration asked me to testify against Mashal'. DAWN.COM. Retrieved 1 October 2017, from https://www.dawn.com/news/1327576 18 Will cut tongue of anyone wanting to change blasphemy law,' says Jamaat-e-Islami KP chief. (2017). The Nation. Retrieved 1 October 2017, from http://nation.com.pk/national/01-May- 2017/will-cut-tongue-of-anyone-wanting-to-change-blasphemy-law-says-jamaat-e-islami-kp- chief
11 protest threatened to turn violent and ugly19. The protest demonstration labelled the Faizabad Dharna had been a challenge for the media from the start. Unofficial advisories to news channels had resulted in an almost total blackout of the proceedings on mainstream news channels. As a result, public was dependent on information uploaded and shared by other citizens online. As the protest was at a major entry point to Islamabad, the lack of information had a direct impact on the commute and daily routines of citizens. Within this context, the government eventually issued orders to block news channels, news websites and social media platforms20 in a desperate attempt to keep the information about an impending police operation from the public. The only explanation came from Pakistan Telecommunication Authority, PTA that stated, “social networking websites Facebook and Twitter and video-sharing sites YouTube and Dailymotion would remain blocked in the country until the law and order situation improved”21.
Other Issues
Pornographic content is banned in the country and falls within the ‘indecent and immoral’ restrictions defined in the Article 19 of the constitution of Pakistan. In 2017, the crackdown against pornographic content continued. However, the regulator, PTA, landed in controversy over an ill-advised decision to engage a fifteen year old to make a list of pornographic websites to be blocked. The teenager Ghazi Muhammad Abdullah, found almost 780,000 adult pages in six months calling this task his "religious and national” duty22.
The authorities are also on the lookout for websites linked to terrorism. Media reports suggest that agencies other than the PTA are also involved in monitoring the internet for terrorism related material. In July 2017, the Punjab Safe Cities Authority (PSCA) reported “684 objectionable pages and IDs of both Facebook and Twitter during its strike against anti-state, anti-social, blasphemous and sectarian warmongering elements on social media”23. In June 2017, the counter terrorism department in Sindh had also identified and sought action against “25 such websites, which were involved in spreading religious and ethnic extremism and terrorism”24.
19 Azeem, M. (2017). Another govt deadline to vacate Faizabad falls on deaf ears. [online] DAWN.COM. Available at: https://www.dawn.com/news/1372774/another-govt-deadline-to- vacate-faizabad-falls-on-deaf-ears [Accessed 22 Apr. 2018]. 20 Hussain, J. (2017). News channels go off air, Facebook and YouTube blocked in parts of Pakistan. [online] DAWN.COM. Available at: https://www.dawn.com/news/1372804 [Accessed 22 Apr. 2018]. 21 The Express Tribune. (2017). Facebook, Twitter, YouTube to remain blocked until law and order situation improves: PTA - The Express Tribune. [online] Available at: https://tribune.com.pk/story/1568051/1-twitter-reacts-faizabad-crackdown/ [Accessed 22 Apr. 2018]. 22 Crilly, R. (2012). Pakistan uses teenage boy to help with pornography crack down. Telegraph.co.uk. Retrieved 1 October 2017, from http://www.telegraph.co.uk/news/worldnews/asia/pakistan/9143296/Pakistan-uses-teenage- boy-to-help-with-pornography-crack-down.html 23 684 social media IDs objectionable. (2017). Thenews.com.pk. Retrieved 1 October 2017, from https://www.thenews.com.pk/print/214986-684-social-media-IDs-objectionable 24 Ali, I. (2017). CTD seeks ban on 25 websites spreading ‘terrorism, extremism’. DAWN.COM. Retrieved 1 October 2017, from https://www.dawn.com/news/1341033
12
Despite these attempts, various websites that have been actively involved in recruitment and spread of terrorism or ones being run by proscribed organisations are still operational. In May 2017, an investigation by the country’s oldest English newspaper Dawn25 demonstrated the continued presence and operation of these organisations online. The investigation showed that these organisations “are present on Facebook in the form of hundreds of pages, groups and individual user profiles” and enjoyed a collective following of 160,000 people. The investigation also found that the contents of these pages largely included “hate speech directed at religious minorities and other members of society”.
Reflections
The year 2017 has been a year of concern for freedom of expression activists in Pakistan. From the disappearance, torture and vilification of bloggers and activists in January to the unprecedented ban on news websites and social media platforms following the coverage of Faizabad Dharna in November, the government’s policies, actions and narratives have steadily created obstructions to the exercise of freedom of expression online.
Looking back at 2017, it is obvious that the government, political parties and other power hubs have all come to recognize the power of social media in setting political narratives and challenging the status quo. The response to this recognition has been one of fear and resistance. In the election year, 2018, a continuation of the measures that were tested in 2017 is already being witnessed. This might be an attempt to control the political narratives being built and challenged on social media platforms. The framing of social media platforms as anti state and anti religion stand to have a direct and significant impact on political parties using these platforms for their election campaigns. It is unfortunate that political forces themselves have been too short sighted to see the folly in their approach and have thus been complicit in the creation of an environment that threatens democratic discourse in the country.
Breaking the status quo As the general elections approach, it is important for all stakeholders to play their roles in challenging the hurdles to the exercise of freedom of expression in the country. To ensure that the policies and practices governing freedom of expression in Pakistan adhere to the human rights standards and democratic requirement, the following recommendations should be considered;
i. Civil society actors should continue to document curbs to freedom of expression and push back against regressive policies and practices that threaten this fundamental right.
ii. Media and journalists should stand united against attacks on journalistic freedoms and cover each incident with an intention to
25 Haque, J., & Bashir, U. (2017). Banned outfits in Pakistan operate openly on Facebook. DAWN.COM. Retrieved 1 October 2017, from https://www.dawn.com/news/1335561
13 build pressure on government and the state to end impunity and enact policies that allow requisite journalistic freedoms in the country.
iii. Media and civil society actors should collaborate to initiate measures that promote awareness amongst the masses regarding the importance of digital mediums as modes of expression, so that public pressure can be built for progressive policymaking on the same.
iv. The government should revise policies like those included in PECA 2016 that allow law enforcement and other authorities to misuse their powers without accountability.
v. Political parties should recognize the importance of digital and social media and ensure that their manifestos are cognizant of the importance of these mediums and are able to respond to the challenges that hamper political and democratic discourse on these mediums.
vi. All stakeholders should engage in productive dialogue to ensure that the challenges posed by social media platforms and alternate information sources are understood and tackled collaboratively and to ensure that each stakeholder is working towards improving the practice of freedom of expression online.
14
15 Chapter 2 Its a Private Matter Sadaf Khan and Talal Raza
Introduction
Pakistan’s constitution explicitly recognizes the right to privacy. The article 14 of the constitution confirms that “the dignity of man and, subject to law, the privacy of home, shall be inviolable”. 26
Furthermore, Pakistan has also ratified international covenants including International Covenant on Civil and Political Rights (ICCPR) and the Convention on the Rights of the Child that uphold the right to privacy. Furthermore, Pakistan has also signed Cairo Declaration on Human Rights in Islam that also upholds right to privacy. 27
With the rise in internet penetration, internet users are increasingly facing challenges to their privacy in the form of data breaches and data loss. Consumer Data has never been more vulnerable in Pakistan than today. There have been many instances where consumer data was compromised and exposed owing to vulnerabilities in information systems of corporations and government agencies. Yet, no substantive measures have been taken to protect consumers’ data.
Unfortunately, only a handful of data breaches reach the national news or are discussed in the mainstream media. This is owing to the sensitivities attached to such revelations. However, it is clear that personal data is extremely vulnerable in Pakistan. The problem is reflected by how casually data gets processed to track down the exact location and information of Individuals.
Policy & Political Background
Pakistan signed the open government partnership, OGP in 2017, expressing commitment to “transparency, good governance and fighting corruption”28 . Among the commitments made as a part of the OGP workplan, the ministry of information technology also committed to table data protection law29 in the national assembly. The workplan- that is yet to be made public30 and the ministry is lagging behind schedule on the initiation of public consultations on drafting the bill.
26 Privacy International, Stakeholder Report Universal Periodic 28th Session: The Right to Privacy in the Islamic Republic of Pakistan (London: Privacy International). 27 Ibid. 28 Finance Minister’s Speech at the Inauguration of the National Workshop on OGP. (2017). [ebook] p.1. Available at: http://www.finance.gov.pk/press/Speech_OGP_27072017.pdf [Accessed 4 May 2018]. 29 The Express Tribune. (2017). Need stressed to introduce data protection laws - The Express Tribune. [online] Available at: https://tribune.com.pk/story/1578862/1-need-stressed- introduce-data-protection-laws/ [Accessed 4 May 2018]. 30 Media Matters for Democracy has been a part of the consultations held by the government as a part of developing the OGP workplan and has submitted recommendations before the finalization of these commitments.
16 The lack of a data protection law is not the only policy challenge that affects the privacy rights of citizens of Pakistan. The Prevention of Electronic Crime Act 2016, PECA2016, doesn’t contain appropriate protection mechanisms for citizens. On the other hand, PECA does create space for abuse of power by authorities by defining a mechanism for real time surveillance that has been substantially weakened from the mechanisms originally defined in the Right of Fair Trial Act.
Instead of strengthening a sense of data protection, PECA2016 appears to further compromise it. For example, under PECA2016, it is mandatory for telecom and internet service providers to retain data for at least 90 days, but does not define any SOPs regarding the safeguard of this data from theft or misuse.
Although the Ministry of Information Technology and Telecom in Pakistan insists that there are sections in the legislation that prevented misuse of data. One official shared that the section 41 of the PECA prevented misuse of personal data.31 According to section 41 of PECA, any service provider/authorized officer (of FIA) will be imprisoned for three years or fined up to one million Rupees, or both, for unlawfully, and without consent, disclosing data containing a person’s personal information, with the “intent to cause or knowing that he is likely to cause harm, wrongful loss or gain to any person or compromise confidentiality of such material or data.”32 However, this provision does not comprehensively address the issues related to data protection and does not set up any autonomous body to investigate data breaches. Rather, it is the Federal Investigation agency that will deal with data breach just like any other crime.
Digital data safety – an oxymoron in Pakistan?
In 2017, we have witnessed multiple instances where the state or private entities like telecom operators and banks faced data thefts and leaks and were able to get away without any legal repercussions or even without having to inform the customers about the exact nature of these leaks.
Pakistani consumers’ data and foreign entities
One of the biggest privacy related scandals of 2017 was the resurfacing of a 2011 WikiLeak that disclosed that UK and US governments might have had access to the citizen’s data held by National Database and Registration Authority, NADRA33. Assange claimed that “a front company, the International Identity Services, was set up in the UK and hired as consultants for NADRA to “squirrel out data for all of Pakistan”34.
31 MOITT Senior official, personal communication, October 25, 2017. 32 Parliament of Pakistan, The Gazette of Pakistan (Islamabad: Parliament of Pakistan, 2016), 765. 33 Propakistani.pk. (2017). US and UK Had Access to NADRA Database: Wikileaks. [online] Available at: https://propakistani.pk/2017/06/07/us-uk-access-nadra-database-wikileaks/ [Accessed 4 May 2018]. 34 The Express Tribune. (2017). WikiLeaks tweets reminder that 'US and UK had stolen NADRA records' - The Express Tribune. [online] Available at:
17
WikiLeaks also claimed that then Prime Minister Yusuf Raza Gilani allegedly suggested this route to make citizen’s private data available to the U.S. without potential embarrassment to his party, the Pakistan Peoples’ Party. NADRA has issued a statement in 2011 denying these allegations and stated its database “cannot be replicated or shared with any country or entity no matter what the individual’s authority or position requesting to compromise NADRA records is”35. However, there have been multiple instances where claims of access to and hacking of NADRA’s data have been made by local36 and foreign hackers37. NADRA also faced allegations of having “shared database of millions of Pakistanis with a private company that was awarded a contract in 2009 for the issuance of the National Smart Card Foreigner Identity Pakistan (NICOP) and Pakistan Origin Card (POC) in the UK and Europe”38, however all allegations were officially denied. What is problematic in this context is a lack of a mechanism through which citizens can formally request access to details about these allegations that result in a complete lack of transparency and accountability.
Another blow to Pakistani consumers’ data privacy came in the shape of a reveal by Hacker group ShadowBrokers, who revealed “information detailing how the agency [NSA] accessed private and public networks in other countries”39. The data showed how NSA accessed and monitored Mobilink consumers’ data in Pakistan. Mobilink’s chief technical Officer Khalid Shehzad, talking to the media on the issue simply said that” the NSA leaks were related to Mobilink and referred to 2006 and had no implications today.”40 The assertion that simply because the information that surfaced in 2017 relates to a data security breach that occurred in 2006 is irrelevant is astounding and alarming.
https://tribune.com.pk/story/1429538/wikileaks-tweets-reminder-us-uk-stolen-nadra- records/ [Accessed 4 May 2018]. 35 Tikhonova, P. (2017). The U.S. And U.K. Stole Data Of Pakistan Citizens [ANALYSIS]. [online] ValueWalk. Available at: https://www.valuewalk.com/2017/06/us-uk-stole-pakistan-nadra- data/ [Accessed 4 May 2018]. 36 Atta, A. (2013). Official Website of NADRA E-Sahulat Gets Hacked, User Data Compromised. [online] Propakistani.pk. Available at: https://propakistani.pk/2013/09/16/official-website-of- nadra-e-sahulat-gets-hacked-user-data-compromised/ [Accessed 4 May 2018]. 37 Baloch, F. (2012). Cyber vandalism: Turkish hacker claims gaining access to NADRA, FIA servers - The Express Tribune. [online] The Express Tribune. Available at: https://tribune.com.pk/story/480044/cyber-vandalism-turkish-hacker-claims-gaining-access- to-nadra-fia-servers/ [Accessed 4 May 2018]. 38 Lack of accountability in NADRA. (2017). [ebook] Lahore: Digital Rights Foundation. Available at: https://digitalrightsfoundation.pk/wp-content/uploads/2017/06/NADRA-breaches- Infographic-Updated.pdf [Accessed 4 May 2018]. 39 The Express Tribune. (2017). NSA hacked Pakistani mobile networks: WikiLeaks - The Express Tribune. [online] Available at: https://tribune.com.pk/story/1378909/nsa-hacked-pakistani- mobile-networks-wikileaks/ [Accessed 4 May 2018]. 40 DAWN.COM. (2017). NSA hacked Pakistani mobile system: WikiLeaks. [online] Available at: https://www.dawn.com/news/1326152 [Accessed 4 May 2018].
18 ATM skimming and loss of banking data
ATM skimming i.e. the theft of financial data of ATM users remained an issue all through 2017. In most cases Chinese hackers were found to be involved in the skimming scandals. A number of skimming incidents occurred in Karachi and the FIA’s cybercrime wing initiated investigations following “complaints by the Habib Bank Limited which acknowledged that around 600 customers across the country have lost close to Rs. 10 million in the cyber attack.”41 Following these incidents, a number of Chinese nationals were arrested for installing skimming devices and running related networks42.
In an interview with Digital Rights Monitor, Imran Saeed Rana, the deputy director of FIA and officer-in-charge of National Response Center for Cyber Crimes Rawalpindi and Islamabad shared that “there has been an increase of 50.3%. He further said that in the year 2016, 375 million transactions were made through ATMs in Pakistan of nearly 4.3 trillion rupees, out of which 35,000 transactions were “bogus” which resulted in a loss of half a billion rupees.”43
Speaking to Digital Rights Monitor, a consumer of Habib Bank , one of the banks worst hit by the ATM skimming racket, said that her ATM card had been disabled by the bank following the attack. She said that the bank simply informed the customers that they were investigating a data leak and ATM cards that had been previously used in any of the hacking locations were being disabled as a caution. However, there was no clarity on the nature and extent of the threat and the bank remained ambiguous about the measures being taken to protect consumer data in future.
Banks were not the only corporate entities which showed a disregard for consumer’s right to know with regards to the privacy and possible compromise of their data.
Corporates and companies escape liability in cases on consumer data breaches
Digital Rights Monitor reported about a cyber attack at Telenor, one of Pakistan’s biggest telecom operators. According to sources within Telenor, employees of the Telecommunication giant received an email with the subject line “confidential”. The email informed the recipients that “the attachment was a new policy guideline from Ministry of Information Technology [MOITT] regarding IT
41 The Express Tribune. (2017). Beware - hackers are going after ATMs in Pakistan - The Express Tribune. [online] Available at: https://tribune.com.pk/story/1574702/2-beware-hackers-going- atms-pakistan/ [Accessed 4 May 2018]. 42 Geo.tv. (2017). Hundreds of Pakistanis lose millions in major ATM skimming fraud. [online] Available at: https://www.geo.tv/latest/170648-hundreds-of-karachiites-lose-millions-in- major-atm-skimming-fraud [Accessed 4 May 2018]. 43 Khan, A. (2017). Fraudulent transactions through ATM machines and related crimes have doubled: Officer-in-charge NR3C (Islamabad/Rawalpindi). [online] Digital Rights Monitor. Available at: http://digitalrightsmonitor.pk/fraudulent-transactions-through-atm-machines- and-related-crimes-have-doubled-from-last-year-officer-in-charge-nr3c-islamabad-rawalpindi/ [Accessed 4 May 2018].
19 security. As soon as the recipient clicked on the attachment, the embedded trojan code automatically forwarded the email to contacts within Telenor using the recipient’s email address. The sources also revealed that as a result of clicking on the attachment, numerous computers were infected. Sources also shared that the victim’s social and email accounts were all compromised while the trojan was able to retrieve data from the computers, simultaneously installing a key-logger in the process.”44
While multiple sources within Telenor confirmed this attack, Telenor Pakistan’s Director Corporate Communications Areej Khan only said that some “unusual activity on some of our personnel machines” was reported and that the company had taken “all necessary actions”.
Once again, none of the Telenor consumers were informed about this incident and had no knowledge that their data might have been compromised in this security breach.
This callous attitude of corporate entities towards consumer data has been documented across sectors. Last year, property dealing giant zameen.com and Pakistan’s most popular online car retail space PakWheels45 had also suffered data thefts that compromised consumer data, but did not have to face any legal consequences for their failure to protect customer’s information.
This lack of legal structure to protect consumer data and hold data hosting companies and corporates liable has led to an extremely careless attitude towards consumer data. A DRM investigation into the protection / privacy of data held by call centres of fast food giants like KFC, McDonald and Pizza Hut revealed that it is extremely easy for anyone to access sensitive information like home and office addresses saved with food delivery hotlines46.
The government’s indifference towards consumer data is also apparent in the fact that there are no efforts being made at the state level to raise public awareness about the implications of data thefts. Meanwhile, the government itself has issued warnings within its own quarters advising against the “use of social media applications especially “WhatsApp” as they sent user information without their intervention to abroad servers.47 The question of illegal access by state agencies
44 Raza, T. (2017). Telenor Pakistan comes under a cyber-attack; the extent of damage remains unclear. [online] Digital Rights Monitor. Available at: http://digitalrightsmonitor.pk/telenor- pakistan-comes-under-a-cyber-attack-the-extent-of-damage-remains-unclear/ [Accessed 4 May 2018]. 45 The Express Tribune. (2017). PakWheels.com hacked, over half million accounts compromised - The Express Tribune. [online] Available at: https://tribune.com.pk/story/1280485/pakwheels- com-hacked-0-6-million-accounts-compromised/ [Accessed 4 May 2018]. 46 Raza, T. (2017). No one to protect digital identity: how vulnerable is consumer data in Pakistan?. [online] Digital Rights Monitor. Available at: http://digitalrightsmonitor.pk/no-one-to-protect- digital-identity-how-vulnerable-is-consumer-data-in-pakistan/ [Accessed 4 May 2018]. 47 Khan, A. (2017). Govt warns officials WhatsApp, other mobile apps risky. [online] Digital Rights Monitor. Available at: http://digitalrightsmonitor.pk/govt-warns-officials-whatsapp-other- mobile-apps-risky/ [Accessed 4 May 2018].
20
The question about data theft and illegal data access by state agencies is difficult to document. MMfD team members came across a number of anecdotes where in journalists and political workers claimed that they had been harassed by FIA and made to hand over access to their digital communication devices, however, neither did they take any legal action against this abuse of power, nor were these incidents reported in the media. Given the history of abuse of power within Pakistan’s law enforcement agency and the fact that the Prevention of Electronic Crimes Act, 2016, does not include necessary and effective provisions for data protection, the chances of these allegations being true are high. One of the rare cases that were reported was of journalist Taha Siddiqui who was approached by the FIA’s counter terrorism wing in May 2017, initially without a written order. The journalist initially received a phone call directing him to appear in FIA headquarters for interrogation. He was also instructed to bring his devices. He refused on the basis of irregularity of this notice and eventually filed a petition in Islamabad High Court. All in all, the record of irregular and /or illegal access to digital data by law enforcement agencies using PECA2016 is still largely anecdotal and difficult to substantiate.
Is the establishment of a Privacy Commission the answer?
The situation is well reflective of the need to set up an independent privacy commission that has the independence and authority to tackle threats to citizen’s privacy. However, this is not going to be an easy challenge.
Challenges to the establishment of Privacy Commission in Pakistan:
One of the biggest challenges to establishment of Privacy Commission in Pakistan is the complete lack of sole data protection legislation, on which the Commission would be able to work against. . Although, the government made open promises to introduce such law, to both parliamentarians, and to civil society, the realities are different.
Recently, Senator Farhatullah Babar gave an interview in which he noted that the government had promised introducing data protection law within six months after enactment of cybercrime act. Although, the cybercrime act (PECA) came into effect in August 2016, the Senator was unaware that no work on the initial draft had commenced. 48 Separately, officials within Ministry of Information Technology and Telecom admitted that the bill will not be ready any time soon, and separately, another official went on to even suggest that the draft bill was not even thoroughly discussed by the government agencies. One official did suggest that the public consultation might open in early 2018. With elections scheduled to be held in mid-2018, the state machinery’s sole focus would be to prepare for elections.49 Already, there had been reports that the Minister of State Anusheh Rehman was not giving due time to the Ministry. Being an advocate, she is engrossed in fighting the political battles for the family of his party’s political elite, the Sharifs.
48 Senator Farhatullah Babar, personal communication, October 15, 2017. 49 MOITT official, personal communication.
21 The President of her ruling party Muhammad Nawaz Sharif was recently deposed from the office of Prime Minister on corruption charges. There are also cases looming against not only Mr. Sharif but his children.50
In the midst of this political instability and looming general elections, the officials indirectly acknowledged that the adoption of data protection bill could be further delayed till late 2018 or early 2019. Without a data protection law, no privacy commission can be set up.
Reflections
In addition to the instances reported here, there were also rumours about various incidents of scammers collecting bio metric data from people in order to get illegal mobile SIMS. Since the registration of SIM phone has been linked to biometrics, biometric verification machines, connected to NADRA’s database have propped up all over the country. These machines are easily available to both licensed and unlicensed businesses and we have seen various operating on roadside stalls, verifying biometrics and issuing SIM cards. Following this scammers were said to visit villages and suburban areas with large illiterate population and getting their biometrics as a part of a fraudulent ‘awards scheme’. The mainstream media did not report on these incidents.
This demonstrates the need for creating awareness among the public about the value of their personal information. A vast population of the public is just getting connected and does not have an understanding of the value of their private information and isn’t aware of the issues that biometric data in the wrong hands can create.
One key issue is the inability of the media to report on data breaches and unsafe data practices at the hands of large businesses and corporations as the same organizations also advertise on the media, thus creating a conflict of interest.
The lack of transparency about policies and procedures that are in place to secure state owned databanks holding public’s data is also concerning. Under safe city projects thousands of CCTV cameras are now collecting public’s data. The National Database and Registration Authority holds tremendous amounts of data. The linkage of phone SIMS with biometric data has also opened a completely different avenue for mass amounts of data collection. In this scenario, the absence of a law to protect the public from potential abuse and misuse of this data, makes the public vulnerable to serious violations of its right to privacy.
There is also the issue of alleged misuse of the cybercrime law, PECA 2016 and second the lax attitude taken by the government towards genuine incidents of data compromise at the hands of private entities. The abuse of law is something that was anticipated and protested by civil society activists even as the draft of cybercrime law lay in the parliament. However, the ministry of information
50 Geo News Correspondent Azam Khan, personal communication, November 01, 2017.
22 technology and the legislators chose to ignore civil society voices. As a result, the law does not contain appropriate penalties for those involved in abusing this law. Consequently, in 2017, FIA officers were involved in attaining access to user data by merely citing the law [orally] without showing any warrants. This tendency to abuse power is neither new not surprising. There is need for appropriate amendments in PECA that ensure that any authority figure involved in the abuse of power can be legally held liable.
Recommendations
The threats to privacy are inherent in a digital economy. As public and private bodies move towards the introduction of digital services and more and more people connect to the Internet, it becomes urgent to create protection mechanisms to support citizens of the country. To ensure that the appropriate legislative and policy actions are taken;
1. Civil society actors should continue to advocate for the enactment of data protection law in the country.
2. Civil society actors, including the media should initiate the discussion on the formation of a Privacy Commission that is independent and empowered to provide redressal in cases of privacy violations.
3. Media and journalists should cover the issue of data security and privacy and work to create general public awareness on the issue.
4. Media and civil society actors should monitor and report on the implementation of the OGP workplan, in particular IT ministry’s commitment to initiate a public consultation process for the drafting of data protection law.
5. Media and civil society actors should continue to document violations of privacy, including misuse and loss of consumer data by corporate entities.
6. The government should introduce laws and necessary mechanisms to ensure that corporations and other ventures follow strict regulations when collecting and securing consumer data.
7. The government should fulfill its commitment regarding the initiation of public consultations on data protection law.
23
24 Chapter 3 ‘Disconnecting’ the masses Talal Raza and Asad Baig
Pakistan’s mobile industry is growing at a rapid pace. Currently, there are 148 million mobile subscribers which makes around 77% of Pakistan’s population; 51 million have also subscribed to 3G and 4G mobile internet services.51
With the rise in the number of mobile subscribers, the demand side of digital services is growing and as a result, digital businesses and startups are taking roots. A good example would be the local ride hailing service Careem, which quite possibly has become one of the most popular digital services of Pakistan. Similarly, mobile internet is the life-force for many young startups.
However, the digital life of most mobile subscribers comes to a unexpected halt during arbitrary network shutdowns — temporary suspension of mobile services often in the pretext of security and maintaining law and order.
In one year, citizens of Pakistan may face anywhere from 6 to 10 or even more partial and/or complete network shutdowns, varying in scale and intensity. Some are localised to a city or a neighbourhood, while some can span the whole province — or more than one — and can last for a day or more.
Over the past one year, there have been at least seven different occasions where mobile networks including the mobile internet services were suspended. In some districts of Balochistan and Federally Administered Tribal Areas, mobile internet services remain suspended even after a year. History has taught us that the government may or may not notify the citizens in advance before shutting down the networks and often people find themselves stranded, caught off guard, by a surprise network shutdown. The officials of Pakistan Telecommunication Authority (PTA) mostly refrain from issuing statement, and often share the reasons of unannounced network shutdowns off the record, pointing fingers to the law enforcement agencies.
Here is a timeline of some of the network shutdowns that occurred in 2017 and were reported in media:
● Since February 2017, mobile internet is suspended in various districts of Balochistan including Pishin, Killa Abdullah, Dalbandin and Kalat keeping in view the security concerns at the request of law enforcement agencies.52 While there are reports that mobile internet is restored in Dalbandin, locals have reported that it remains suspended in other parts.53
51 “Telecom Indicators”, Pakistan Telecommunication Authority, accessed April 18, 2018, https://www.pta.gov.pk//en/telecom-indicators 52 Talal Raza, “Living off the grid: practicing journalism in Baluchistan without mobile internet”, Digital Rights Monitor, November 06, 2017, accessed April 18, 2018, http://digitalrightsmonitor.pk/living-off-the-grid-practicing-journalism-in-baluchistan-without- mobile-internet 53 Local residents, personal communication.
25
● On March 19, 2017, cellular services were briefly suspended in parts of Rawalpindi and Islamabad ahead of a military parade on March, 23 2017, commemorated as the ‘Pakistan Day’ in the remembrance of the Pakistan resolutions passed on the same date in 1940.54 On March 23, the cellular services were suspended again for a few hours.55
● On September 29-October 01, 2017, mobile phone services including the mobile internet were suspended in the wake of Ashura processions. According to the Digital Rights Monitor various cities across Pakistan including Karachi, Hyderabad, Shaheed Benazirabad, Khairpur, Sukkur, Larkana, Shikarpur, Jaccobabad, Faisalabad, Sialkot, Bhukkar, Quetta, Mach, Bolan, Sibi, Jhal Magsi, Naseerabad, Jaffarabad, Dera Murad Jamali, Dera Allah Yar and Peshawar were affected. The move was made to avoid untoward ‘security situation’ according to the official notifications.56
● On October 23, 2017, mobile services were suspended in parts of Rawalpindi/Islamabad to facilitate a musical concert organised by Pakistan army. The musical concert was organised for the participants of “Pakistan Motor Rally” at the Parade Ground. No notification was issued by PTA prior to blocking the services.57
● Between November 09, 2017 and November 15, 2017, mobile and internet services were suspended at Faizabad and adjacent areas owing to protest camp of Tehreek e Labaik ya Rasulallah. Sector I-8 and Faizabad were most affected. No official notification was issued. Later on November 25-26, mobile internet, popular social media sites including Facebook and Twitter and 22 news websites were taken down to maintain law and order for more than 30 hours. No official notification was issued.
● On November 30, 2017 it was reported that mobile phone services were suspended in three cities of Sindh including Karachi, Hyderabad, Sukkur and Quetta in wake of security concerns around route of processions of Rabiul Awal for a few hours. These suspensions were made at the request of Sindh and Balochistan home departments respectively. 58
54 “Blackout of Mobile Phone Services irks Islamabad, Pindi residents,” Dawn.com, March 20, 2017, accessed April 18, 2018, https://www.dawn.com/news/1321565 55 Ibid. 56 Asad Baig, Cellular and Internet Services remained suspended in various cities across Pakistan in the wake of Ashura; GSM tracker enabled cars stranded; millions affected,” Digital Rights Monitor, October 02, 2018, accessed March 26, 2018, http://digitalrightsmonitor.pk/cellular- and-internet-services-remained-suspended-in-various-cities-across-pakistan-in-the-wake-of- ashura-gsm-tracker-enabled-cars-stranded-millions-affected 57Talal Raza, “Mobile network shutdown in parts of Rawalpindi/Islamabad due to a ‘musical concert’,” October 23, 2017, accessed March 26, 2018, Digital Rights Monitor, http://digitalrightsmonitor.pk/mobile-network-shutdown-in-parts-of-rawalpindiislamabad- due-to-musical-concert 58 Ibid.
26
● On March 19, 2018 mobile phone services were again suspended as part of military parade celebrations for March23, the Pakistan Day. Later on March 23, cellular services were suspended again for four hours.59
Living through the network shutdowns
Mobile communications have become an integral part of our daily lives and in today’s digital world, the inability to communicate can be fatal. Shahtaj, a young girl from Rawalpindi found herself in a similar predicament when, during an ongoing network shutdown, she was injured in a road accident. Unable to call the emergency services or inform her friends and family, she had to wait on the roadside. She eventually fainted as a result of excessive bleeding. 60
Similarly, people were stranded, unable to start their cars installed with GSM trackers during the network shutdowns. A representative of a Karachi based GSM tracker company confirmed the possibility of cars getting stranded, unable to start, due to the suspension of cellular services, reported Digital Rights Monitor. 61
Particularly, in certain areas of Balochistan such as Qillah Abdullah, where mobile internet is the primary way of connecting to the Internet, journalists find it extremely difficult to report their stories to headquarters.62
Network shutdowns, the new normal
Network suspensions became the norm ten years ago at a time when Pakistan was battling with terrorism. Such were the state of affairs that terrorist attacks happened almost on a weekly basis. Religious gatherings and processions, especially around the Ashura, were most vulnerable to terrorists attacks. Evidence revealed that some of these attacks were carried out using mobile devices.
In an attempt to prevent similar attacks, the authorities opted for temporary suspension of mobile phone services especially during high profile gatherings in parts of the country especially around special occasions with a probability of large gatherings.
59 Talal Raza, “Mobile Phone Services suspended briefly suspended in parts of Rawalpindi, Islamabad, restored after Four hours,”Digital Rights Monitor, March 23, 2018, accessed April 18, 2018, http://digitalrightsmonitor.pk/mobile-phone-services-briefly-suspended-in-parts-of- rawalpindi-islamabad-restored-after-four-hours 60 Zak Rogoff, “ #KeepItOn: Pakistanis have long suffered from Internet Shutdowns: At last, their voices are being heard,” Access Now, February 28, 2018, accessed April 18, 2018, https://www.accessnow.org/pakistanis-long-suffered-internet-shutdowns-last-voices-heard 61 Asad Baig, “Cellular and Internet services remained suspended in various cities across Pakistan in the wake of Ashura; GSM tracker enabled cars stranded; millions affected”, Digital Rights Monitor, October 2, 2017, http://digitalrightsmonitor.pk/cellular-and-internet-services- remained-suspended-in-various-cities-across-pakistan-in-the-wake-of-ashura-gsm-tracker- enabled-cars-stranded-millions-affected/ 62 Talal Raza, “Living off the grid.”
27
Initially, these shutdowns were restricted to parts of Balochistan. However, by 2012, they became more frequent across Pakistan. Over the years, the practice of shutting down communications became a new normal on almost every occasion or event of prominence.
While Pakistan has come a long way from incidents of active terrorism, but it seems that the practice of shutting down communications has caught on. The government officials and the law enforcement agencies, it seems, find ‘peace of mind’ by suspending communications around the potentially high-profile occasions and events; since there is no actual evidence available to suggest the impact of these shutdowns on thwarting terrorist attacks.
The cost of network shutdowns
Digital Rights Monitor looked in to the figures made available by Pakistan Telecommunication Authority, PTA. The combined revenue generated by mobile phone companies in Pakistan for fiscal year 2016-17 was 369,118 million PKR. According to these figures, the mobile phone companies combined, generated nearly a billion PKR per day in revenue, which calculates to nearly 42 million per hour. Considering there are 147 million mobile phone subscribers in Pakistan, each subscriber has to contribute nearly .25 PKR to make up this revenue.
Based on this rudimentary calculation, a localised network shutdown in Islamabad, a relatively smaller city of Pakistan, would cost around 284,000 PKR / hour in revenue to mobile phone companies.
These estimates, albeit not accurate or official, give one an idea of revenue loss on a daily basis during network shutdowns. However, neither the governments nor the mobile phone companies come clean about the loss of revenue with official figures.
Fighting on a legal front to keep it on
Fortunately there has been positive development in pushing back on network shutdowns. In 2016, four residents of Islamabad filed a petition in Islamabad High Court through Advocate Umer Gilani challenging the legality of network shutdowns under Telecommunication Re-Organisation Act 1996. The federal government defended the act of shutting down communications temporarily under Section 54 Subsection 3, albeit the section is only application under the imposition of ‘emergency’.
On February 28, 2018 Islamabad High Court declared the network shutdowns illegal. The court noted that the cellular suspension by the government under PTA’s section 54 (3), under the pretext of law and order and national security, was in contradiction with the Constitution. It stated that section 54(3) allowed
28 government to shut down cellular services in emergency situation proclaimed by President.63
While the decision was hailed by rights activists, the government filed an intra- court appeal with the three member bench of Islamabad High Court on March 17, 2018, just ahead of the March 23 celebrations of Pakistan Day, one of the occasions on which the networks are traditionally suspended. On March 20, the bench granted an “interim” stay against the earlier decision thereby allowing government to suspend mobile phone services. The interim stay is valid till the next hearing in May. 64
Going beyond the shutdowns
On July 1, 2016, the U.N. Human Rights Council condemned all “measures to intentionally prevent or disrupt access to or dissemination of information online,” and called on governments worldwide to desist and refrain from such practices65. David Kaye, the UN Special Rapporteur for Freedom of Expression holds that ongoing shutdowns “contradict the human rights commitments that governments have made” at the HRC66.
To ensure that this violation of citizen’s right to connect, express and access information does not continue, it is important that;
i. The government should recognise the fallacy in the argument that equates network shutdowns with security and acknowledge the fact that disconnecting citizens simply leads to increased vulnerability of the citizens.
ii. The government should ensure that any orders for network disconnection are given only in cases where the threat of terrorism is imminent and verified.
iii. Both government and corporations should ensure that telecom consumers are made aware of any imminent / planned shutdowns well in advance.
iv. Corporates should abide by the UN Guiding Principals on Business and Human Rights. In particular they should try to address the adverse
63 “Islamabad High Court declares Network Shutdowns Illegal,” Digital Rights Monitor, February 26, 2018, accessed April 18, 2018, http://digitalrightsmonitor.pk/islamabad-high-court- declares-government-network-shutdown-illegal 64 Talal Raza, “Islamabad High Court allows Government to suspend Mobile Phone services, grants ‘Interim’ Stay till May,” March 20, 2018, accessed April 18, 2018, http://digitalrightsmonitor.pk/government-files-appeal-against-ihc-order-on-cellular-network- shutdowns-bench-reserves-verdict 65 Human Rights Council Resolution 32/13 66 David Kaye, UNSR FoE, Report to 35th Session of UNHRC
29 human rights impacts of shut downs67, at least by making sure that their consumers are made aware of any imminent disconnection. , including the time and location of the shutdown.
v. Civil Society actors including activists and legal fraternity should continue to engage with policy makers and legal processes to ensure that state policy towards network disconnections is discussed in its entirety and a discourse for requisite policy changes can be developed.
67 Guiding Principiles on Business and Human Rights (p. 18) available via http://www.ohchr.org/Documents/Publications/GuidingPrinciplesBusinessHR_EN.pdf last accessed 19.03.18
30
31
32 Chapter 4 Pakistan’s IT Policy: A rights based review Talal Raza
The United Nations has recognised the importance of Information and Communication Technology (ICT) and endorsed its significance in the development through various forms. For instance, the Sustainable Development Goal (SDG) 9 urges states to “significantly increase access to information and communications technology and strive to provide universal and affordable access to the Internet in least developed countries by 2020.”68
Meanwhile, in a separate resolution passed in June 2016, the United Nations Human Rights Council (UNHRC) condemned the efforts to censor online content and disrupt internet recognising that people have same rights online as they have offline.69
Pakistan’s Internet landscape is expanding at a rapid pace. At the moment, more than 50 million citizens have access to the Internet.70 Naturally, the IT industry has expanded with the expansion of the Internet. Figures from the government suggest that there are more than 2000 IT companies and call centres and more than 20,000 IT graduates produced every year.71
A number of services such as online shopping, ride haling and e-banking are increasingly integrating in the urban culture of Pakistan. Furthermore, the popularity of social media platforms such as Facebook, YouTube and Twitter has encouraged entrepreneurs, journalists, activists and politicians to use these services to reach a wider audience.
There have been instances where the platforms have played an important role in highlighting issues that are ignored by the traditional media. Given the current state of self-censorship being exercised by the mainstream media on certain thorny political and policy issues, social media platforms have been instrumental in shedding light on the matters such as the Pashtun Tahafuz Movement, which were otherwise blacked out.
However, these opportunities have also met with certain challenges. Internet access is frequently disrupted to pursue security objectives. Social media pages and accounts are taken down in collaboration with corporations and activists/journalists are finding it difficult to communicate with their sources and peers using secure communication tools. Free expression in general
68 Goal 9: Build resilient Infrastructure, promote sustainable Industrialization and foster Innovation,” UN Sustainable Development Goals, accessed April 18, 2018, https://www.un.org/sustainabledevelopment/infrastructure-industrialization/ 69 Human Rights Council Resolution 32/13, The promotion, protection, and enjoyment of human rights on the Internet, A/HRC/32/L.20 (27 June 2016), available from http://ap.ohchr.org/documents/dpage_e.aspx?si=A/HRC/32/L.20. 70 “Telecom Indicators”, Pakistan Telecommunication Authority, accessed April 18, 2018, https://www.pta.gov.pk//en/telecom-indicators 71Ministry of Information Technology and Telecom, Digital Pakistan Policy 2017 (Islamabad: MOITT)
33 has been criminalised through laws such as Prevention of Electronic Crimes Act 2016, and overbroad powers have been delegated to the Executive Institutions to censor information online.
In the midst of these challenges and opportunities, the Ministry of Information Technology and Telecom (MOITT) in August 2017, has put forth Pakistan’s first formal IT policy. Officially named the Digital Pakistan Policy 2017, the document maps out challenges and opportunities for ICT in Pakistan and “strives to improve its citizens’ quality of life and economic wellbeing by ensuring availability of accessible, affordable, reliable, universal and high quality ICT services”. MOITT has reportedly conducted various multi-stakeholder consultations for the Digital Pakistan Policy 2017.72
The policy reflects the government’s vision in terms of various IT related interventions that it plans to undertake over the course of many years. It also draws up a clear division of responsibilities and have charted out roles for the Ministry of Commerce, the Ministry of Interior, the Ministry of Planning and Development, and the Ministry of Law and Justice to name a few.
Some of the key highlights of the Digital Pakistan Policy 2017 are as follows:
Legislation
This section of the policy charts out the “necessary policy frameworks, laws and rules to enable creation of a sustainable IT environment”. Among other points, the policy recognises the importance of data protection and online privacy protection of the users and pledges to protect it through a ‘data protection law’. It also talks about developing frameworks for regulating cloud based systems that includes data classification mechanisms, and making use of digital signatures to augment data security and authentication.
It pledges to make amendments to rules of businesses of various departments to facilitate processes of e-governance including electronic workflows, e-commerce, online submissions/approvals.
Investment in infrastructure and software
The policy envisages the development of technology parks and incubation centres in various urban centres across Pakistan to encourage ICT related innovation. It also touches upon the ideas of encouraging procurement of software and hardware from local markets.
It pledges to establish innovation centres for ‘fin-tech, Internet of things and artificial intelligence’.
Also, the policy talks about setting up big data centres that would enable data mining and analysis of the big data. The policy discourages “the establishment of
72 Ibid.
34 silo IT infrastructures (small islands) in different government offices to mitigate duplication of efforts, HR requirements and operational expenses.” Interestingly, the government has also expressed interest in exploring the field of ‘Open Source’. It pledges to encourage Research and Development around Open Source.
IT interventions with the help of various government departments
A number of interventions have been proposed to revamp different sectors: In agriculture sector, it envisions setting up of “Agriculture Information Portal” that will host a wide range of information about prices, horticultural diseases and their treatment, quality of water, weather updates and supply/demand data from agricultural commodity markets. It also encourages revamping of geographical information system, preparation of research material in local languages, building of ICT capacity in local languages,
In health sector, it envisions the utilisation of telemedicine services to reach out to people in rural areas. It also envisions building an online network of medical specialists or paramedical staff to work with people directly or online. It also talks about setting up a central health database interconnecting private and public hospitals. Lastly, it envisions informing a wider audience about any epidemic in local languages using ICT tools.
In the education sector, it pledges to take measures to provide network accessibility in educational institutions in Pakistan, revamp the curriculum to meet the needs of the industry and bridge the gap between the industry and the academia and to incorporate courses around coding, cloud computing et al in curriculum. It also encourages the development of e-portals that would allow students to easily access research and other supplementary materials. Specifically, the policy pledges to bridge the gender divide in ICT by launching ‘Girls for ICT’ program. This would include establishing computer labs in girls’ schools in under developed areas and courses on computing, coding and communication in collaboration with private sector.
It also talks about encouraging people to produce and generate content in local and regional languages in the wake of establishment and operationalisation of Pakistan registry. It also pledges to support text to speech software creation for Urdu and regional/local languages to increase the utility of basic mobile phone based text messages.
In energy sector, it talks about using ICT interventions to manage energy consumption including introduction of smart metering to control consumption of electricity, billing, theft, meter and supply line tempering. It also envisions working with cellular companies to put in place 3G/4G solutions including smart grids, demand forecasting and availability of consumer portals to control energy consumption.
In the e-commerce, beyond the usual jargon of encouraging small businesses to come online, there are commitments to promote online banking services and encouraging others to employ ICT driven tools. The key pledge made by the
35 policy is to “establish a national e-commerce gateway with the State Bank of Pakistan (SBP) with the support and coordination of relevant stakeholders to promote internet merchant accounts to facilitate B2B and other in-bound transactions.”
Lastly, it also commits to take a series of measures in collaboration with Law and Justice Ministry to automate the case management within judiciary. It specifically envisions developing portals for judges so that they are able to access various kinds of information including calendar, pending tasks and quick links to research tools. It also pledges to support introduction of Online Dispute resolution for low level civil matters and thereby promoting Alternative Dispute resolution.
Policy review
The policy expresses an ambition to invest in infrastructure, building technology parks, and to work in close collaboration with various ministries towards automation of many governance services. However, for digital services to be effective and able to have an impact on people’s lives, a substantially large population of Pakistan needs to be online and have uninterrupted access to the Internet and cellular services without disruption.
Only about 30% of Pakistan’s population have access to the Internet, and while hundreds more are connecting on a daily basis, quality access for all remains a largely ‘urban’ element. Considering that nearly 62% of country’s population live in rural or semi urban areas, investment in digital services without a focus on access will further deepen the digital divide.
The policy does mention ‘access for all’ in the Section VII of the ‘Policy Goals’ and seeks to “bridge the digital divide including the urban and rural divide, gender disparity, unserved and underserved areas, inequality for the person with disabilities, by connecting the unconnected through broadband” but fails to provide a strategy to achieve this goal in the policy document.
Given the (low) quality of access and its highly urban centric nature, access for all should have been given the highest priority in Digital Pakistan Policy 2017, which unfortunately, is not the case.
In addition to the infrastructural issues surrounding quality access for all, network disruptions and shutdowns in the pretext of ‘security’ are a regular occurrence in Pakistan. The Internet remains unavailable in most bordering areas of Balochistan and Federally Administered Tribal Areas. Generally, the areas where people are unconnected because of the lack of infrastructure or overbroad security measures, are also areas which are most deprived and underserved. Hence a 'vision’ of ‘connecting the masses’ as described in the policy without due consideration to issues above is a little too ambitious and somewhat misleading.
Additionally, there have been various — albeit unconfirmed — reports making rounds claiming that the government is soliciting proposals and undertaking
36 deals to install deep packet filtering systems and to ban encryption. MOITT and the federal government of Pakistan has yet to rebut them. Synchronously, the policy is silent on enabling safe spaces for those who are under threat or are even attacked for exercising their fundamental rights online. Telegram, a safe communication tool, remains banned in Pakistan to this point without an official reason or clarification from MOITT or the federal government and so the claims of opening up the cyber space for masses are contradicted by such dubious actions.
On a positive note, it is appreciable that the government has emphasised on the importance of data protection law and pledged to take steps to protect the privacy of the people online. However, its important to mention here that despite many assurances, the MOITT and the federal government has failed to bring the legislation in the Parliament for discussion before the end of its parliamentary term in June 2018.
Additionally, the policy expresses a commitment to centralise the otherwise distributed databases of the federal government such as that of Federal Board of Revenue (FBR) and National Database and Registration Authority (NADRA), to “enable data mining and analysis” and “enhance the quality of e-Government services through real-time integrated management and data analytics”.
While the centralisation of data and services will be a step forward in e- governance, there are serious concerns surrounding the safety of data. There have been reported cases where the complete database of NADRA was found on detachable storage drives and recorded by the law enforcement agencies. The data reportedly was being sold online for as low as 5,000 PKR. The policy does express commitment to safety and security of data, but it needs to be translated in action with the same rigour.
A substantial part of the policy focuses on the promotion of digital services, including e-banking. However, it is disappointing to note that the federal government finds no urgency in addressing the rising number of cyber attacks targeting the e-banking services and other critical information infrastructure such as NADRA. The component of cyber-security also seems to be missing from the Digital Pakistan Policy 2017.
Finally, and perhaps most importantly, the policy does not pledge in any way to promote transparency in the decisions made around the Internet, especially those related to online content and policy interventions being taken by various government departments to censor online content. In a section titled ‘Legislation’ in ‘Digital Pakistan Policy Strategy’, the policy charts out a list of legislation that needs to be enacted or amended to assist in the implementation of Digital Pakistan Policy 2017.
It, however, does not include the overbroad provisions in Prevention of Electronic Crimes Act 2016 that stand to endanger and criminalise free expression online in various forms and the absolute authority given to the Pakistan Telecommunication Authority — an executive body under the federal
37 government — to censor online content interpreting the language of the Constitution of Pakistan.
Conclusion There are no doubts that the Digital Pakistan Policy 2017 seeks to expand the ICT industry and introduce various new digital services to improve the lives of citizens, but it fails to take stock of a number of Internet and digital rights issues, which makes it difficult to make full use of the potential that Internet as a universal medium has to offer. We feel that a policy that seeks “to become a strategic enabler for an accelerated digitisation eco system to expand the knowledge based economy” cannot succeed without a special focus on citizen- friendly and rights-friendly policies and strategies.
38
39 Chapter 5 Pakistan’s Cybercrime Act: From implementation to implications Talal Raza
Pakistan introduced its first comprehensive cybercrime law called “Pakistan Electronic Crimes Act (PECA)” in 2016. The law was tabled in National Assembly in 2015 but remained under discussion in both houses of the parliament. After extensive deliberations with different stakeholders including members of civil society, it was finally passed on August 11, 2016 by National Assembly of Pakistan and formally approved by the President of Pakistan. 73
Background
It was not the first piece of legislation in cyberspace. Earlier in 2002, Pakistan introduced Electronic Transaction Ordinance that included some punishments against damage or illegal access to information system. However, the bill was viewed as less effective as it did not cover widely various offences being committed in cyberspace.74 To fill the gap, the then President (retd.) General Pervaiz Musharaf promulgated Pakistan Electronic Crimes Ordinance in 2007 that covered a wide range issues in cyberspace. For the first time, the ordinance also put in place punishments against offences such as cyber terrorism. Also, around the same time, a cybercrime unit was also established within Federal Investigation Agency to lead investigations into cybercrimes. However, the ordinance could not become an act and lapsed in 2009. Dawn reported that the bill was vehemently opposed by Anusha Rehman, PML-N’s IT Minister since 2013 for ‘meting out harsh punishments for “moral crimes”.’75
During 2009-2016, Pakistan was virtually without any cybercrime law.
Salient features of PECA
It was in April 2015 when another draft bill named Pakistan Electronic Crimes Bill (PECB) emerged. Under the leadership of IT Minister Anusha Rehman, the bill was put forth as a tool to fight terrorism. An Interior Ministry report called PECB as “cornerstone of National Action Plan”, an anti-terrorism policy that was adopted by all major stakeholders from the civil and military establishment in the wake of December 2014 Army Public School Peshawar terrorist attack.76 That is why there are at least four sections that specifically deal with terrorism in cyberspace. These include Sections 9 on glorification of terrorists/terrorist
73 Parliament of Pakistan, The Gazette of Pakistan (Islamabad: Parliament of Pakistan, 2016) 74 Dr. Nadia Khadim, “Seriousness towards cybercrime laws in Pakistan,” The News, August 19, 2016 , accessed March 20, 2018, https://www.thenews.com.pk/print/143651-Seriousness- towards-cyber-crime-laws-in-Pakistan 75 “Surf Safely: Evolution of the cyberspace laws in Pakistan”, Dawn, May 10, 2016, accessed March 20, 2018, https://herald.dawn.com/news/1153380 76 Jahanzaib Haque, “Analysis: The dangers of fighting terror with a cybercrime bill,” Dawn, September 12, 2015, accessed March 20, 2018, https://www.dawn.com/news/1206465/analysis-the-dangers-of-fighting-terror-with-a- cybercrime-bill
40 offences, Section 10 on cyber terrorism, Section 11 on hatespeech and Section 12 on planning, recruitment and motivation to fund terror activities. 77
It is important to mention here that apart from anti-terror clauses, other issues are also dealt within PECA. These include punishments for offences such as online defamation, spamming, cyber stalking, electronic fraud, unauthorized issuance of SIM cards, unauthorized interception and tempering of communication equipment. Apart from that, the government is also set to introduce blasphemy provisions under PECA in the light of orders issued by Islamabad High Court. The draft amendment has yet to be tabled at the National Assembly but it has been approved by the cabinet.78
Executive’s mandate
Under PECA, a number of bodies have been given mandate to perform their respective duties including investigation against criminal offences, blocking of online content and surveillance. 79
Investigating agency
Federal Investigation Agency (FIA) has been given the mandate to investigate cases related to cybercrimes under PECA. Joint investigation teams along with other law enforcement agencies can also be formulated under the law. Recently, it was reported that Pakistan’s premier intelligence agency ISI had requested Ministry of Interior to deal with cybercrimes undermining National Security. The Government has readily agreed to this proposal and also requested civilian intelligence agency Intelligence Bureau (IB) to submit their proposals. 80 Although it is not specified what sort of crimes would be dealt by them, but cybercrimes related to terrorism are most likely to be dealt by intelligence community or along with FIA or other law enforcement agencies. It was also learned through sources that offences related to “cyber terrorism” were proposed by ISI. In fact, Haroon Baloch, a rights activist at Bytes for All Pakistan and aware of the consultation shared with the scribe that when the rights activists tried to probe FIA to talk about it.
FIA representative refused to discuss it as they said that the provisions had been proposed by ISI and that only they could discuss. Till the writing of this piece, it is not yet clear what authorities will intelligence agencies enjoy under PECA to deal with “cybercrimes that are undermining National Security” as the rules have yet to be formulated.
Additionally, FIA has also been authorized to seize data for criminal investigation after seeking a warrant from Court designated under this act. However, in cases
77 Parliament of Pakistan 78 Ibid. 79 Ibid. 80 Zahid Gishkori, “ISI to take Action against Cybercrimes Breaching National Security,” Geo News, October 20, 2016, accessed December 15, 2016, https://www.geo.tv/latest/118292-Govt- accepts-ISIs-role-in-taking-action-against-cyber-crimes.
41 (especially cyber terrorism) where the investigation officer is of the opinion that the data needed for criminal investigation may be lost or destroyed if not immediately seized, it could retain the designated data and then seek warrants from the Court within 24 hours of the data retention.81
Warrant for accessing content
Also, section 34 states that if an authorized officer is able to prove to the court that the content in a particular information system is needed to be accessed for criminal investigation, the court may order the person/service provider in charge of the information system to provide the officer with access to data. The validity of the warrant would be seven days and court needs to be reached out for further extension.82
Real time information collection
Furthermore, PECA also mandates real time content collection or surveillance for investigating cybercrimes. Section 39 of the law permits surveillance under “real time collection and recording of information” after seeking permission of the Court designated under this act. The court after receiving the request, would order the designated agency under FTA 2013 or others having the capability to carry out the information collection in collaboration with investigating agency if it is satisfied that the data is with the person/place nominated and that the data required is essential for criminal investigation. However, the permission for real time data collection would not extend beyond seven days and that Court would need to be requested again if the extension of real time data collection is required.83
Blocking of content
Under section 37 of PECA, Pakistan Telecommunication Authority (PTA) has been mandated to block any content or orders to remove it if it is against the “glory of Islam, security or defence of Pakistan, public order, decency or morality or in relation to contempt of court or commission or incitement of an offence” under this Act.84
Service providers
Service providers are bound to retain the traffic data for at least a year or as specified by PTA. They are also supposed to assist investigation agency in retrieving the data as per their request under court warrants. No criminal liability will be on service providers as long as they are assisting the executive under the PECA rules.85
81 Parliament of Pakistan. 82 Ibid. 83 Ibid. 84 Ibid 85 Ibid
42 Protection against misuse of executive authority
Apart from Court appeal against PTA on issues of content blocking, there are protections against misuse of personal data and content at the hands of service providers or officers of investigation agency. Section 41 of the law says86: “Notwithstanding immunity granted under any other law for the time being in force, any person including a service provider while providing services under the terms of the lawful contract or otherwise in accordance with the law or an authorized officer who has secured access to any material or data containing personal information about another person discloses such material to any other person, except when required by law, without the consent of the person concerned or in breach of lawful contract with the intent to cause or knowing that is he is likely to cause harm, wrongful loss or gain to any person or compromise confidentiality of such material or data shall be punished with imprisonment for a term which may extend to three years or more or with fine which may extend to one million rupees or with both:
Provided that the burden of proof of any defense taken by an accused service provider or an authorized officer that he was acting in good faith, shall be on such a service provider or the authorized officer, as the case may be.”
Computer Emergency Response teams:
Furthermore, the Federal government will also set up “Computer Emergency Response teams” comprising of technical experts from intelligence or any other agency for the protection of critical infrastructure87. It is also not clear when will the Computer Emergency Response teams be created. Till the writing of the report, nothing has been known about the establishment of Computer Emergency Response team.
Courts:
Under the PECA, the Federal Government in consultation with the Chief Justice of Pakistan will designate presiding officers to deal with cybercrime cases. The Federal government has been tasked to make arrangements to train presiding officers in computer sciences, cyber forensics, electronic transactions and data protections. It took more than seven months before 31 Additional Session Judges (ADJ) and Judicial Magistrates (JD) across Pakistan were designated by Law Ministry to deal with cybercrime cases. This included 27 ADJs and JDs in Sindh, one ADJ and a JD each in Islamabad Lahore, Rawalpindi, Peshawar and Quetta. Under PECA, the courts were designated after consultation with Chief Justices of Lahore, Peshawar, Karachi and Islamabad High Court respectively.
However, why the government decided to designate an additional session judge and a magistrate to hear cybercrime cases in each district of Sindh, whereas the most populous province Punjab only had courts designated in Lahore and Rawalpindi to hear cybercrime cases remains a mystery. “The number of
86 Ibid 87 Ibid.
43 presiding officers on PECA was decided in the light of suggestions from Chief Justices of their respective High Courts,” connived a senior official at Ministry of Information Technology adding that Ministry had no role in finalizing the number of judges.88
Collaboration with international partners
Under PECA, Pakistan government can extend its cooperation to any foreign government or international agency whether it is investigating a cybercrime or collecting information under PECA. It can also pass on the information to them when deemed appropriate.
PECA implementation and Human Rights concerns
Although, there are no internationally agreed upon principles that could guide the behaviors of states in the context of human rights while dealing with cybercrimes, normative debates within this area has begun by multiple stakeholders including civil society and corporations. A number of groups such as APC, GNI and 13 International Principles on application of Human Rights on Communications Surveillance (signed by more than 400 organizations) to the name few are important. Inspired from these normative debates, Pakistani civil society also tried to analyze the law and put forth their following concerns89:
● The law has been put in place from the security mindset rather than from the rights perspective. There should have been no space for anti-terror provisions that are pre dominantly dealing with information in the cybercrime law.90
● The language of the law is overbroad and can be used to punish political dissent.91 As evidence, the registration of cases against political activists under section 20 of PECA is interesting. A number of political activists were nabbed by FIA for being critical of the military. Interestingly, Section 20 furnishes punishments against anyone damaging the dignity of the person. Civil society challenged this move in Sindh High Court, arguing that the cybercrime act did not furnish punishments if anything was said against the dignity of armed forces and that the law was being misapplied. The case is still in Sindh High Court and points towards the substantial evidence and fears expressed earlier by rights activists. There are many provisions such as those dealing with hate-speech and cyber terrorism that can also be potentially used to silence political dissent.92
88 Talal Raza, “Pakistan’s Cyber Law: A Year in Review,” Digital Rights Monitor, October 17, 2017, accessed March 20, 2018, http://digitalrightsmonitor.pk/pakistans-cyber-law-a-year-in-review . 89 Talal Raza, The Dilemma of dealing with Terrorism in Cyberspace and Peoples’ Digital Rights: A Case Study of Pakistan (MPhil diss., National Defence University, 2017), 52-59 90 Ibid. 91 Ibid. 92 Aleena Alavi, lawyer, personal communication.
44 ● In regards to blocking, PECA is silent on whether PTA should publicly share the list of online websites/social media pages it can block. The idea of making the list public is to allow activists to see whether the justification given by PTA to block certain content was actually reasonable or it ended up blocking unrelated content. The context of this suggestion is that PTA in the past ended up blocking non-pornographic content for being pornographic. Additionally, rights activists suggested that PTA should not be given powers to block online content as it was a government body. Blocking the online content should have been the jurisdiction of an independent judicial body.93
● Also, PECA binds FIA to submit half a yearly report around PECA implementation. When the act came into force, rights activists suggested that this mechanism could have been strengthened to check human rights violations but it was least likely that parliamentarians would take up such measures. Fast forward to March 2018, since the past 19 months, FIA was only able to submit only one report that too after a lapse of 17 months in January 2018. The details of the report are not public yet and there is no publicly available information that could suggest that parliamentarians took up the matter of human rights violations under PECA. However, according to parts of the report available with Digital Rights Monitor, FIA requested the government to make cognizable some offences owing to their critical nature. These include access, modification, interference, deletion to critical infrastructure (Sections 6,7 & 8), electronic forgery (section 13), electronic fraud (Section 14), unauthorized issuance of SIM cards (Section 17), tampering of electronic equipment (Section 18), cyberstalking (Section 24) and spoofing (Section 26). 94
● Also, in the midst of rising cybercrimes where courts are faced with challenges of dealing with cybercrimes, government should have expedited the process of training presiding officers. Without understanding cybercrime, there is a chance that justice might not be dispensed. 95
● Another concern is about real time collection of information. It allows officers to collect real time information through courts’ orders for seven days. However, it doesn’t put bar on the number of times the warrant could be reissued. This law also doesn’t specify what type of technology could be used to carry out surveillance.96
93 Talal Raza, The Dilemma. 94 Talal Raza, “FIA submits ‘half-yearly’ report on electronic crimes after a one year delay; asks for 7 offences to be declared ‘non-bailable’ and a ban on ‘Bitcoin’”, Digital Rights Monitor, January 18, 2018, accessed March 20, 2018, http://digitalrightsmonitor.pk/fia-submits-half-yearly- report-on-electronic-crimes-after-a-one-year-delay-asks-for-7-offences-to-be-declared-non- bailable-and-a-ban-on-bitcoin. 95 Talal Raza, The Dilemma 96 Ibid.
45 Recommendations
Initially, when the human rights activists put forth these concerns, they were brushed aside by the government. IT Minister Anusha Rehman even accused civil society of weakening the law. However, as the months passed by, ironically, the same law was used to arrest political workers, some of them apparently affiliated with the ruling party. 97Even members of other political parties were arrested for expressing their views online against the military. However, there has not been much interest shown publicly by political parties in taking measures to reform PECA. Former Senator Farhatullah Babar noted that one way for civil society to influence the law was to engage with government on formulation of the rules under PECA. However, rules have yet to be finalized.
Surprisingly, government officials at MOITT, the ministry leading the rules formation process, were not clear when the rules would be finalized. The overall lack of transparency in the rules only give credence to the concerns of the civil society that backdoors were deliberately left within the law to twist the arms of political opponents, journalists and other free speech activists.
Moving forward, the following actions are needed from the government and other stakeholders. i. The government should prepare the rules devised under PECA at the earliest so that specifics are made clear on how the executive would operate under PECA. ii The government should also find ways to make the process of online content blocking more transparent. iii. The government should ensure that presiding officers listening to court cases are given training around cybercrimes and build their capacity to prevent misapplication of law. iv.. Civil society actors also need to come together and run organized, targeted advocacy and lobbying campaigns aimed at different stakeholders including journalists, parliamentarians and academia to help them understand the implications of the law. Unless, the issue begins resonating with them, it will be hard to push for a change and convince government lawmakers to make amends to the law.
97 Talal Raza, “PECA exposed as the ruling Pakistan Muslim League Nawaz falls victim to the law,” Digital Rights Monitor, October 18, 2017, accessed March 18, http://digitalrightsmonitor.pk/peca-exposed-as-the-ruling-party-pakistan-muslim-league- nawaz-falls-victim-to-the-law/
46 47
48 Chapter 6 E-Governance in Pakistan: Hopeful Signs for the Future Waqas Naeem
E-governance initiatives in Pakistan have received positive attention from the federal and provincial governments in the recent past, but the upward trajectory of these initiatives is undercut by territorial isolation of projects, the sluggish pace of federal policymaking, and a digital divide that persists despite a rapid rise in access to technology. The country needs to consolidate its e-governance efforts at the national level to keep up with the relative pace of progress in e-governance in the region and the larger developing world.
Introduction
E-governance involves the use of information and communication technologies (ICT) by governments to provide information and deliver services to the public.98 The Pakistani federal government first began thinking about e-governance at the dawn of the 21st Century when it engaged in a push for better ICT infrastructure. 99 Recent domestic political activity around slogans of transparency and accountability has led to a renewed surge in e-governance projects.100 101
The fresh interest in e-governance is also encouraged by Pakistan’s international commitments, such as the United Nations (UN) Sustainable Development Goals (SDGs) and the Open Government Partnership, and the country’s burgeoning technology landscape.
The number of Internet users in Pakistan has increased during the past five years. Pakistan had 42.1 million 3G/4G Internet subscribers in 2016-17 compared to 1.4 million in 2013-14, when these services were first introduced.102 During the same period, broadband Internet subscribers in the country rose to 44.6 million from 5.2 million.103
98 “UN Global E-Government Readiness Report 2005: From E-government to E-inclusion,” United Nations, accessed March 21, 2018. https://publicadministration.un.org/egovkb/Portals/egovkb/Documents/un/2005- Survey/Complete-survey.pdf 99 “Pakistan IT Policy and Action Plan,” United Nations Asian and Pacific Training Centre for Information and Communication Technology for Development, accessed March 21, 2018. http://www.unapcict.org/ecohub/resources/pakistan-information-technology-policy 100 “KP Govt introduces E-governance for Transparency, Accountability: Mushtaq,” Pakistan Today online, accessed March 21, 2018. https://www.pakistantoday.com.pk/2015/09/30/kp- govt-introduces-e-governance-for-transparency-accountability-mushtaq/ 101 Imaduddin, “E-government to achieve Transparency, Accountability in Service Delivery”. Business Recorder online, last modified June 18, 2013. https://www.brecorder.com/2013/06/18/124257/ 102 “Annual Report 2017,” Pakistan Telecommunication Authority, accessed March 21, 2018. https://www.pta.gov.pk/assets/media/ann_rep_2017.pdf 103 ibid.
49 The country’s internet penetration numbers are still below global and Asian averages.104 However, when these statistics are coupled with the fact that 7 in 10 Pakistanis own a cellphone, the potential for e-governance becomes clear.105 Pakistan’s federal and provincial governments can use technology to connect with the masses, at least in the urban centres where access is more prevalent.106
Additionally, the global discourse on e-governance considers efficient government processes, better service delivery, and increased public participation through access to information as fundamental characteristics of e- governments.107 It is essentially an ICT-route to good governance.108 Perhaps Pakistani political parties have realised e-governance could be the way to win back the trust of a public which is all too familiar with corruption, incompetence, and inefficiency in government operations.109
Policy and Regulatory Background
The earliest hint at e-governance in Pakistan appears in the federal government’s Information Technology (IT) Policy and Action Plan, launched in the year 2000. While the policy did not explicitly use the term e-governance, it did mention the use of information technology in the functioning of the government.110 It also suggested setting up IT boards in each province, and advised that national databases of economic activities should be made accessible to the public online to encourage transparency. However, its main focus was on IT infrastructure. Subsequently, an Electronic Government Directorate was established in 2002. It worked on a number of automation and e-service projects
104 Umer Ali, and Harris bin Munawwar, “Internet Landscape of Pakistan 2017,” Bytes for All, Pakistan, accessed March 21, 2018. https://content.bytesforall.pk/publication/internet- landscape-pakistan-2017 105 “Telecomm Indicators,” Pakistan Telecommunication Authority, accessed March 21, 2018. https://www.pta.gov.pk//en/telecom-indicators 106 “Offline and falling behind: Barriers to Internet adoption,” McKInsey & Company, accessed March 21, 2018. https://www.mckinsey.com/~/media/McKinsey/Industries/High%20Tech/Our%20Insights/Of fline%20and%20falling%20behind%20Barriers%20to%20Internet%20adoption/Offline_and_fa lling_behind_barriers_to_internet_adoption_full%20report_FINAL.ashx 107 “UN Global E-Government Readiness Report 2005: From E-government to E-inclusion,” United Nations, accessed March 21, 2018. https://publicadministration.un.org/egovkb/Portals/egovkb/Documents/un/2005- Survey/Complete-survey.pdf 108 Richard Heeks. Understanding e-governance for development. (Manchester: Institute for Development Policy and Management, 2001), https://s3.amazonaws.com/academia.edu.documents/31803060/e_governance_for_developmen t.pdf?AWSAccessKeyId=AKIAIWOWYYGZ2Y53UL3A&Expires=1521622971&Signature=7wJ24cR IsQV701ufZuSG2O5jdbc%3D&response-content- disposition=inline%3B%20filename%3De_governance_for_development.pdf 109 Anwar Iqbal, “Pakistanis’ trust in civilian govt has nosedived: US survey,” Dawn online, last modified February 14, 2013. https://www.dawn.com/news/786132 110 “Pakistan IT Policy and Action Plan,” United Nations Asian and Pacific Training Centre for Information and Communication Technology for Development, accessed March 21, 2018. http://www.unapcict.org/ecohub/resources/pakistan-information-technology-policy
50 before it was merged with the Pakistan Computer Bureau to form the National IT Board in 2014.111
Pakistan does not have an active e-governance policy at the federal level at the moment, but the draft Digital Pakistan Policy 2017 comes closest to providing a foundation for e-governance efforts.112
The draft, finalised in August 2017 and pending approval from the Economic Co- ordination Committee, lists the promotion of e-governance as its 12 policy goals. It suggests integrated government databases and applications could help ensure efficiency, transparency and accountability.113
The draft policy also mentions the need for better service delivery, digital security for government departments, human resources in IT, and e-government service portals for information dissemination within government and to citizens. A cross-cutting goal, for which action plans will supposedly be prepared later, is the digitisation of sectors such as agriculture, health, and commerce. These e- governance aspects of the policy are in line with some targets listed under the SDG 16, which is discussed in more detail later in this chapter.
Other than the draft policy and broader regulations for telecommunication and Internet use, there is no separate set of regulations for ICT in the country apparently.114
The 18th Constitutional Amendment allowed provinces autonomy in a number of areas. While communications remained a federal subject, there was no apparent limitation on provinces to pursue information technology (IT) issues. Perhaps that’s why provincial digital policies operate largely independently of the federal IT ministry. The Khyber Pakhtunkhwa government, for example, has outlined a “broader view” of e-governance, which is not limited to digitisation of public records but will allow citizens to access government services.115
Punjab set up its IT board as early as 1999, Sindh in 2002, and Khyber Pakhtunkhwa in 2011.116,117,118 Balochistan has an IT department that is focused on e-governance.119
111 “Introduction,” National Information Technology Board, accessed March 21, 2018. http://www.nitb.gov.pk/index.php/features/overview 112 “Digital Pakistan Policy 2017,” Federal Ministry of Information Technology and Telecommunication, accessed March 21, 2018. http://moit.gov.pk/policies/dgp08aug.pdf 113 Amin Yusufzai, “Digital Pakistan Policy 2017 at a Glance.” ProPakistani online, last modified August 15, 2018. https://propakistani.pk/2017/08/15/digital-pakistan-policy-2017-glance/ 114 “Pakistan lack laws on ICT,” The Express Tribune, last modified December 19, 2014. https://tribune.com.pk/story/809176/pakistan-lack-laws-on-ict/ 115 “E-governance,” Government of Khyber Pakhtunkhwa, accessed March 21, 2018. http://kp.gov.pk/page/e_governance 116 “About Us,” Punjab Information Technology Board, accessed March 21, 2018. https://www.pitb.gov.pk/about 117 “Karachi: Sindh IT board constituted,” DAWN, last modified November 22, 2002. https://www.dawn.com/news/67931 118 “About KPITB,” Khyber Pakhtunkhwa Information Technology Board, accessed March 21, 2018. http://www.kpitb.gov.pk/about
51 The Punjab IT Board (PITB) and the Khyber Pakhtunkhwa IT Board (KPITB) – more active than their national counterparts – are leading the e-governance initiatives in the country.
The Current State of E-Governance in Pakistan
The pre-dominant forms of e-governance interventions launched by the PITB, the KPITB, and federal ministries, including the IT ministry, can be termed as government-to-government (G2G) and government-to-citizen (G2C) services in global e-governance parlance.
The IT ministry’s key focus areas have been digitisation of records and the development an e-office suite that can be deployed in all federal government institutions to move away from the traditional offline filing system.120 The ministry has held intra-governmental events to promote the e-suite and also conducted trainings.121 122
The NITB, which works under the IT ministry, led the development of this e- office suite.123 Its other e-governance projects include an online recruitment system for the federal public service commission and an online complaint cell for the ministry of water and power. At the federal level, the National Database & Registration Authority (NADRA) serves as a good example of an e-governance solution provider. NADRA has used its digitised citizen identification and registration system to develop smart ID cards, disburse aid for social security programs (such as the Benazir Income Support Program), and digitise civil registration (such as birth and death certificates).124
The KPITB’s strategic goal is to “accelerate digitization in all sectors and position the province as a global technology hub” while its vision includes “better services and improved governance through ICTs.125” The KPITB has reached out to the tech industry in six districts through its Durshal project, which includes a government innovation lab (GIL) where innovators, software programmers, and
119 “Home,” Balochistan Science and Information Technology department, accessed March 21, 2018. http://www.balochistan.gov.pk/index.php?option=com_content&view=category&layout=blog&i d=34&Itemid=732 120 “E-governance Established to Promote Digital Culture in Pakistan,” ProPakistani, last modified September 7, 2015: https://propakistani.pk/2015/09/07/e-governance-established-to- promote-digital-culture-in-pakistan/ 121 APP, “E-governance for good governance,” Pakistan Today online, last modified May 14, 2014. https://www.pakistantoday.com.pk/2014/05/14/e-governance-for-good-governance-2/ 122 “13 ministries to have e-filing system soon,” The News International online, last modified September 5, 2015. https://www.thenews.com.pk/print/14458-13-ministries-to-have-e-filing- system-soon 123 “Introduction to e-Office Suite,” National Information Technology Board, accessed on March 22, 2018. http://www.nitb.gov.pk/index.php/public-notices/active-projects/ongoing- projects/e-office 124 “e-Governance,” National Database and Registration Authority (NADRA), accessed on March 22, 2018. https://www.nadra.gov.pk/solutions/e-governance/ 125 “About Us,” Khyber Pakhtunkhwa Information Technology Board, accessed March 22, 2018. http://www.kpitb.gov.pk/about
52 entrepreneurs can propose e-governance solutions for local government departments.126 The GIL is linked with a six-month fellowship and amongst its recent achievements is a smartphone developed for the Khyber Pakhtunkhwa Traffic Police.127 The app allows citizens to receive live traffic updates, verify their licenses, register complaints against police, among other things and works in both G2C and Citizen-to-Government (C2G) modes.128
Between 2013 and 2018, the Khyber Pakhtunkhwa government has also worked on up gradation of government websites, enacted a right to information law that includes online proactive disclosure of government records, launched an online grievance redress system for citizens, developed an e-recruitment portal, and introduced a phone-and-online system for registering police complaints.129 130 131 132 133
The PITB has operated for a longer duration than the KPITB and boasts of a vast portfolio of e-government schemes. 134 It currently employs over 1,000 professionals and has built a state-of-the-art 17-storey building for its offices in Lahore called the Arfa Software Technology Park, which also houses a tech incubator, a startup accelerator, a co-working space, and an IT university. The PITB’s five-year performance review, the “Digital Punjab: Enhancing Public Services Through Technology 2012-2017” report, provides case studies of over 80 projects altogether in sectors such as health, law and order, education, and agriculture as well as in services related to citizens and the general automation of government functions.135
In the health sector, the PITB developed a G2G smartphone application for the Extended Programme on Immunisation (EPI), which administers vaccinations to children for nine diseases, including polio, measles, and Hepatitis-B. The PITB claims the application allowed EPI to monitor attendance and performance of
126 “Durshal | Project Description,” Khyber Pakhtunkhwa Information Technology Board, accessed March 22, 2018. http://www.kpitb.gov.pk/projects/durshal 127 “Durshal GIL,” Durshal, accessed March 22, 2018. http://www.durshal.com/gil 128 Ebtihaj, “A step towards digital KPK,” Code for Pakistan, last modified July 2, 2017. http://codeforpakistan.org/blog/2017/07/02/a-step-towards-digital-kpk/ 129 “Right to Information: K-P becomes first province to enact updated RTI,” The Express Tribune online, last modified December 7, 2013. https://tribune.com.pk/story/642174/right-to- information-k-p-becomes-first-province-to-enact-updated-rti/ 130 “Home,” Khyber Pakhtunkhwa Chief Minister Online Complaint & Redressal Cell, accessed March 22, 2018. http://crckp.gov.pk/ 131 “E-recruitment Initiative,” Government of Khyber Pakhtunkhwa, accessed March 22, 2018. http://apply.kp.gov.pk/ 132 “Increased accessibility: Police launches automated complaint redressal system,” The Express Tribune, last modified November 12, 2014. 133 “Online FIR,” Khyber Pakhtunkhwa Police, accessed March 22, 2018. http://kppolice.gov.pk/online/fir.php 134 “Home,” Punjab Information Technology Board, accessed March 22, 2018. https://www.pitb.gov.pk/ 135 “Digital Punjab: Enhancing Public Services Through Technology 2012-2017,” Punjab Information Technology Board, accessed March 22, 2018. http://learn.punjab.gov.pk/publishbooklet/files/downloads/Digital%20Punjab.pdf
53 vaccinators in three provinces and helped vaccinators send immunisation data in real-time to a central database, with marked improvements.136
While the immunisation app is for internal use, a similar monitoring of education performance has been linked with a public-facing data portal. The PITB worked with the Punjab education department to give school monitoring officers tablet PCs to log performance data including statistics on enrolment, attendance and basic facilities. Previously paper forms were used. The database now has information from over 1.3 million monitoring visits and can be viewed on a dedicated website.137 In its report, the PITB claims the system has resulted in 4% improvements in teacher and student presence as well as efficient provision of support to schools that fall below target performance.
Among the purely G2C e-governance services launched by the PITB, the e- Khidmat Markaz (or e-Service Centre) facility is now operational in seven districts. These centres “offer 17 different services” such as traffic fine collection and issuance of route permits.138 The PITB claims these centres have served over 0.7 million citizens and processed 0.35 million applications.
In addition to these efforts, all four provinces are in the process of digitising their land records and setting geographical information systems for their land records.
Some of these e-governance initiatives fulfill at least at a sub-national level the sixth target of UN’s SDG 16 (Peace, Justice and Strong Institutions), which most directly supports e-governments.139 Target 6 calls on member governments to “develop effective, accountable and transparent institutions at all levels.140” The Khyber Pakhtunkhwa’s online police complaints system – Punjab has also deployed a similar system – attempts to bring transparency, for example, to the police department. The UN also recognises police as one of the two institutions most affected by corruption worldwide.141 Similarly, some of the Punjab and Khyber Pakhtunkhwa e-governance projects, such as the service centres and grievance redress system respectively, might promote effective governance and accountability.
Two other targets of SDG 16 also link with e-governance. These are target 7, which seeks to “ensure responsive, inclusive, participatory and representative
136 ibid. 137 “Home,” Programme Monitoring & Implementation Unit, Government of Punjab, accessed March 22, 2018. http://open.punjab.gov.pk/schools/home/landing 138 “Digital Punjab: Enhancing Public Services Through Technology 2012-2017,” Punjab Information Technology Board, accessed March 22, 2018. http://learn.punjab.gov.pk/publishbooklet/files/downloads/Digital%20Punjab.pdf 139 “Goal 16: Peace, Justice and Strong Institutions,” United Nations Development Programme, accessed March 22, 2018. https://www.undp.org/content/undp/en/home/sustainable- development-goals/goal-16-peace-justice-and-strong-institutions/ 140 “Goal 16 Targets,” United Nations Development Programme, accessed March 22, 2018. https://www.undp.org/content/undp/en/home/sustainable-development-goals/goal-16-peace- justice-and-strong-institutions/targets/ 141 ibid.
54 decision-making at all levels”, and target 10, which asks governments to “ensure public access to information and protect fundamental freedoms, in accordance with national legislation and international agreements”. 142 Target 10 is especially important since it leads to open data and online public participation, which are key components of e-government development indicators.143
While most of the e-governance schemes introduced in the Pakistan seem to contribute little to increase participatory decision-making, Pakistan has a strong presence of access to information legislations.
In 2010, the country’s constitution gave citizens the right of access to information through its Article 19-A.144 On paper, Pakistan’s four provinces and the federal area currently have right to information (RTI) laws. The Khyber Pakhtunkhwa, Punjab, Sindh and federal governments enacted new access to information laws between 2013 and 2018. However, the implementation of these laws is flawed. Khyber Pakhtunkhwa’s government tried to introduce amendments to weaken sections in the law that empowered citizens in February 2018. 145 The Punjab government has not appointed new information commissioners, thereby making the appellate body set up under the law dysfunctional.146 Sindh and the federal area have not even established appellate bodies mandated by their respective laws.147
Perhaps due to the slow and demanding nature of the RTI application process, the general public has not taken to the laws significantly, and mostly only civil servants, human rights activists and journalists have use the laws regularly.148
The gap between a law (or policy) and its implementation is emblematic of Pakistan’s governance problems. Often it is because governments pass legislation or policies without adequate stakeholder consultations or appropriate attention towards execution and then ignore unresolved concerns because circumstances force their focus to shift to other policy issues.149
142 ibid. 143 “United Nations E-government 2016 Survey: E-government in Support of Sustainable Development,” United Nations Public Administration Network, accessed March 22, 2018. http://workspace.unpan.org/sites/Internet/Documents/UNPAN97453.pdf 144 “Article: 19A Right to Information,” Pakistan Constitutional Law, accessed March 22, 2018. https://pakistanconstitutionlaw.com/article-19a-right-to-information/ 145 Waqas Naeem, “KP Government’s Proposed Amendments would weaken RTI Law” Media for Transparency, last modified February 27, 2018. http://pakrtidata.org/2018/02/27/right- information-kp-government-amendments-bill/ 146 Waqas Naeem, “Punjab RTI Law: Lack of Information Commission cripples Enforcement Mechanism,” Media for Transparency, last modified January 21, 2018. http://pakrtidata.org/2018/01/21/punjab-information-commission/ 147 Waqas Naeem, “Decision to form Sindh Information Commission rests with CM,” Media for Transparency, last modified February 9, 2018. http://pakrtidata.org/2018/02/09/decision- sindh-information-commission-cm/ 148 “Country Briefing Paper: Right to Information Legislation in Pakistan,” Centre for Peace and Development Initiatives (2016), accessed March 22, 2018. http://www.cpdi-pakistan.org/wp- content/uploads/2017/09/country-briefing-paper-right-to-information-legislation-in- pakistan.pdf 149 Ishrat Hussain, “Formulating Public Policy,” Dawn online, last modified November 14, 2013. https://www.dawn.com/news/1056309
55
The shaky status of RTI implementation is a reminder that strong policies can come to naught if they are not executed well. Poor implementation could pose a challenge to Pakistan’s e-governance ambitions, too. The country’s participation in the Open Government Partnership has been marred by a similar lack of timely response.
In 2016, Pakistan joined the Open Government Partnership (OGP), a multilateral initiative that secures commitments from governments to support transparency and use of technology for better governance.150 However, Pakistan has blown two deadlines to submit a national action plan forcing the OGP administration to send two letters to the Pakistani government reminding it of its responsibility.151 152
In an OGP national action plan, a government usually lists its commitments towards opening government processes to the citizens and the actual steps it would take to realise those commitments. For example, the Canadian government has committed to enhance access to information and increase transparency in budget processes, among other promises. 153 These commitments are then independently evaluated by the OGP. Pakistan’s performance at the OGP is no different from its domestic federal digital policy, mentioned earlier in this chapter, the pending approval of which has also delayed the formulation of any action plans relevant to the policy.
Another crucial challenge to e-governance in Pakistan is presented by domestic political rivalries that often lead to superficial and temporary support for important issues.
When the Pakistan Tehreek-e Insaf (PTI)-led Khyber Pakhtunkhwa government passed its RTI law in 2013, the Pakistan Muslim League-Nawaz (PML-N) quickly enacted a similar law in Punjab to match it.154 Now the Punjab government seems to have lost interest in RTI and has not bothered to appoint new information commissioners to ensure effective implementation of its law.
Political competition is common in Pakistan since the federal and provincial governments are led by three different political parties (PML-N in the centre and Punjab; Pakistan People’s Party (PPP) in Sindh; and PTI in Khyber Pakhtunkhwa)
150 “Pakistan,” Open Government Partnership, accessed March 22, 2018. https://www.opengovpartnership.org/countries/pakistan 151 “OGP_Letter_Pakistan_November2017,” Open Government Partnership, accessed March 22, 2018. https://www.opengovpartnership.org/sites/default/files/OGP_Letter_Pakistan_November2017. pdf 152 “Pakistan_Cohort Shift Letter_Jan2018,” Open Government Partnership, accessed March 22, 2018. https://www.opengovpartnership.org/sites/default/files/Pakistan_Cohort%20Shift%20Letter_J an2018.pdf 153 “Canada,” Open Government Partnership, accessed March 22, 2018. https://www.opengovpartnership.org/countries/canada 154 Muhammad Anwar, “Broken Promises on RTI,” The Express Tribune online, last modified February 11, 2016. https://tribune.com.pk/story/1045145/broken-promises-on-rti/
56 and a political alliance (Balochistan). The competition has some positive consequences, such as the passage of RTI laws or attention towards e- governance initiatives. But the mutually antagonistic politics by the three major parties – PML-N, PPP and PTI – also limits their ability to collaborate and co- operate at the national level. Even when there is technological co-operation, the political leadership wastes no time in political point-scoring.155
As a result, most of the e-governance projects remain territorially isolated in one or the other province. The ones that have been deployed nationwide were developed by the PITB, which enjoys patronage from the ruling PML-N in the federal government. On the other hand, Pakistan’s e-governance commitments, such as the SDG targets and OGP, not sub-national issues but national concerns. It is unsurprising, then, that Pakistan ranked 159 out of 193 countries in a 2016 UN survey on e-governments.156
The survey calculates its E-government Development Index (EGDI) – a composite of telecom infrastructure, human capital, and a survey-based online service index (OSI) – at the national level. The OSI is calculated through surveys of technological features of national websites and e-government policies and strategies applied for service delivery. If the federal performance lags behind provincial achievements as is the case in Pakistan, then it is going to reflect poorly on the international standing.
Pakistan’s position in the ranking has also worsened over the past few years.157 The EGDI is a relative indicator, so the drop in Pakistan’s ranking does not necessarily mean Pakistan’s e-government development has deteriorated. In fact, it means other countries have improved their e-government development at a quicker pace than Pakistan.
It is likely that Pakistan’s EGDI will improve when its recent increase in Internet penetration is reflected in the rankings in the future, but the challenge of national-level consolidation of e-governance remains.
A final challenge Pakistan needs to reckon with is its persistent digital divide. While there is no doubt that ICTs have proliferated rapidly, three quarters of the population still do not have access to Internet. But the divide is not simply one of e-haves and e-have-nots based on class. The social divisions of gender, religion, and ethnicity amplify the digital divide. In towns and villages where women are not allowed to vote in general elections, they might also not be allowed to use technology.
155 “Rana Sanaullah criticises KP Police for Delayed Arrest in Asma Murder Case,” Dunya News online, last modified February 7, 2018. https://dunyanews.tv/en/Pakistan/426796-Rana- Sanaullah-criticises-KP-Police-for-delayed-arrest-in-Asma-murder-ca 156 “United Nations E-government 2016 Survey: E-government in Support of Sustainable Development,” United Nations Public Administration Network, accessed March 22, 2018. http://workspace.unpan.org/sites/Internet/Documents/UNPAN97453.pdf 157 Hasaan Khawar, “Moving beyond e-governance,” The Express Tribune online, last modified April 14, 2017. https://tribune.com.pk/story/1383031/moving-beyond-e-governance/
57 The digital divide might not seem like an insurmountable task but it would take a lot of time, money, and resources to connect more towns and villages in the country’s rural areas to the Internet and also to bring down the cost of Internet use. Demand for data services has already pushed cellular service providers to lower costs or offer subsidised packages.158 Efforts such as the collaboration between Telenor and Facebook to provide free access to the social network could also help increase Internet penetration.159
Reflections
The development trajectory of e-governance in Pakistan over the past five years shows a healthy upward trend. The institutional foundations provided by the PITB and KPITB are likely to support more local government projects and inspire better strategies and solutions. At the same time, the major hindrances to e- government will come from traditional government’s inefficient practices, entrenched political divides, and, to a certain extent, social exclusion.
A more comprehensive e-government rollout will be gradual but inevitable. Pakistan’s middle class is growing.160 The country’s economy is also increasingly becoming reliant on the services sector.161 These two factors will inevitably increase the demand for e-solutions to civic problems because the growth of the services sector is driven by private consumption and most consumption now takes place online. The middle-income, young, urban citizens will take easily to technological innovations and are more likely to appreciate a slimmer, more efficient form of government such as an e-government.
E-governance initiatives will have to prove their utility to this demographic before these can be expanded nationwide. Fortunately existing e-governance projects have largely focused on bigger districts and cities. These projects have also mainly dealt with the most basic public sectors, such as health and education. Better service delivery in these areas would be welcomed because the privatisation of health and education has created severe economic pressures on the Pakistani urban middle class.
Recommendations
Pakistan needs to adopt an e-governance policy at the federal level and develop an action plan urgently. The federal IT ministry should also take the lead in integrating the federal plan with the provincial strategies and align the vision and goals at the national level so Pakistan can project a unified stance to the international community. For this to happen, the federal IT ministry will have to
158 “Internet Offers,” Telenor Pakistan, accessed March 22, 2018. https://www.telenor.com.pk/personal/telenor/offers/internet-offers 159 “Facebook Flex,” Telenor Pakistan, accessed March 22, 2018. https://www.telenor.com.pk/facebook-flex 160 Salman Siddiqui, “Pakistan’s middle class continues to grow at rapid pace,” The Express Tribune online, last modified May 2, 2017. https://tribune.com.pk/story/1398602/pakistans- middle-class-continues-grow-rapid-pace/ 161 Umair Javed, “A Nation of Traders,” Dawn online, last modified January 29, 2018. https://www.dawn.com/news/1385838
58 rise above partisan politics and foster collaborations between all IT departments and boards. Pakistan’s tech community does not mobilise itself along geographical lines, after all. It represents the whole of the country. In fact, the modern tech work philosophy is based on collaborations and remote workspaces. It would be silly then that the local governments work on e- governance separately and in competition.
The government also needs to focus on more G2C and C2G e-governance services to build ownership of these schemes among the public. Intra-government services are beneficial but unless the government engages the public by offering information and role in decision-making processes, the people will treat e- government as they treat traditional government: with suspicion and cynicism. Better Internet connectivity, lower prices for Internet use, and cheaper digital devices will together help get more people to connect to the World Wide Web. The governments could look to fund primary and secondary schools for IT equipment to encourage digital literacy. Local manufacturing could be promoted to bring prices of technology down.
The government should also look at securing its information and the public’s data online. Data protection and privacy laws should be enacted to ensure safety and security of digital information.
Finally, a consistent political will to pursue and develop e-governance in the country is required. It would require across-the-board consensus to minimise political interference and maintain a steady pace of progress.
59
60 Chapter 7 Growth in E-commerce shows Promising Signs for Local Digital Services Industry
Waqas Naeem
The digital services industry in Pakistan is growing. From ride sharing to buying real estate and ordering food delivery, Pakistanis are increasingly using digital services in their everyday life. The rise in e-commerce has attracted international players such as Careem and Daraz, encouraged homegrown enterprises such as Zameen and homeshopping.pk, and given a convenient social media-based business model to hundreds of small businesses. Despite the demand, the industry faces issues related to regulation, taxation and seller protections while consumers are beginning to ask for data protection and privacy guarantees from the government.
Introduction
Pakistanis bought one million items from Daraz.pk, the Pakistan branch of the UK government-funded online marketplace Daraz, and helped the company earn Rs. 3 billion in revenues during its 2017 Big Friday sale – the local equivalent of Black Friday sale, which marks the beginning of the Christmas shopping season internationally.162 163 164
The online shopping platform, developed by German company Rocket Internet, was only launched in 2012 and first imported the Black Friday-inspired shopping holiday concept to Pakistan in 2015.165 166 The meteoric rise in its popularity and sales within two years is indicative of the growing interest and familiarity in e-commerce and online retail in Pakistan.
According to the State Bank of Pakistan, the size of Pakistan’s local e-commerce market in terms of pre-paid transactions (through online debit/credit card and m-wallets) was Rs. 9.8 billion or around $93 million up until June 2017.167 This should only reflect a small segment of the actual e-commerce market since the Pakistan Telecommunication Authority (PTA) suggests “more than 95% of e- commerce transactions are done through a cash-on-delivery system.168 This has
162 “Daraz records revenue of Rs 3 billion during Big Friday sale,” Dawn online, last modified December 4, 2017. https://www.dawn.com/news/1373601 163 “About Us,” Daraz.pk, accessed March 24, 2018. https://www.daraz.pk/about/ 164 “Black Friday,” Daraz.pk, accessed March 24, 2018. https://www.daraz.pk/black-friday/ 165 ibid. 166 Osman Husain, “After a stuttering start, Rocket Internet’s Daraz ecommerce marketplace is finally poised to take off,” The Express Tribune, last modified October 2, 2015. https://tribune.com.pk/story/966196/after-a-stuttering-start-rocket-internets-daraz- ecommerce-marketplace-is-finally-poised-to-take-off/ 167 “Special Section 2: Online Payment Platforms in Pakistan – A Case of B2C E-Commerce,” State Bank of Pakistan, accessed on March 24, 2018. http://www.sbp.org.pk/reports/quarterly/fy18/First/Special-Section-2.pdf 168 “Annual Report 2017,” Pakistan Telecommunication Authority, accessed March 24, 2018. https://www.pta.gov.pk/assets/media/ann_rep_2017.pdf
61 led experts to estimate the total size of the Pakistani e-commerce market at around Rs. 65 billion or $600 million.169
State bank data shows that Pakistani consumers also made transactions worth Rs. 20.8 billion on international e-commerce websites.170 The number of mobile wallet (m-wallet) accounts in the country reached the 20-million mark, with nearly Rs. 2 billion worth of transactions, in 2016.171 With 146 million cellphone subscribers and 25.6% Internet penetration, it is likely that e-commerce will continue to grow in Pakistan.172 The growth in online business activity is also putting pressure on the government to offer a policy and regulatory framework for the industry.
Policy/Regulatory Background
The ministry of commerce finalised a policy framework for e-commerce in January 2018 after deliberating on it for a two-year period.173 It is going to be approved by the prime minister reportedly before it can be enacted. The policy and its associated action plans include a licensing and regulatory regime for e- commerce entities, supportive financial services, and consumer data protection laws, according to a news report.
Meanwhile, the Pakistan Electronic Crimes Act (PECA) 2016 provides punishments for electronic fraud.174 The Federal Investigation Agency (FIA) has taken action against fraudulent online businesses recently but it is not clear if this was done under the PECA provisions.175 The National Response Centre for Cyber Crime at the FIA lists financial fraud in its categories of cyber crime.176
169 Adam Dawood, “SBP Data shows Pakistan’s E-commerce Market crossed $600 Million Mark in 2017,” ProPakistani online, last modified February 27, 2018. https://propakistani.pk/2018/02/27/sbp-data-shows-pakistans-e-commerce-market-crossed- 600-million-mark-2017/ 170 “Special Section 2: Online Payment Platforms in Pakistan – A Case of B2C E-Commerce,” State Bank of Pakistan, accessed on March 24, 2018. http://www.sbp.org.pk/reports/quarterly/fy18/First/Special-Section-2.pdf 171 “Annual Report 2017,” Pakistan Telecommunication Authority, accessed March 24, 2018. https://www.pta.gov.pk/assets/media/ann_rep_2017.pdf 172 “Telecom Indicators,” Pakistan Telecommunication Authority, accessed March 24, 2018. https://www.pta.gov.pk//en/telecom-indicators 173 Ghulam Abbas, “Ministry of Commerce finalises e-commerce policy,”Profit magazine Pakistan Today online, last modified January 16, 2018. https://profit.pakistantoday.com.pk/2018/01/16/ministry-of-commerce-finalises-e-commerce- policy/ 174 “2016 PECA,” Digital Rights Monitor online, accessed March 24, 2018. http://digitalrightsmonitor.pk/wp-content/uploads/2017/10/2016-PECA.pdf 175 Samir Yawar, “FIA Starts Crackdown on Fraudulent Online Stores in Pakistan,” ProPakistani online, last modified May 5, 2016. https://propakistani.pk/2016/05/05/fia-starts-crackdown- on-fraudulent-online-stores-in-pakistan/ 176 “Cyber Crime,” Federal Investigation Agency National Response Centre for Cyber Crime, accessed March 24, 2018. http://www.nr3c.gov.pk/cybercrime.html
62 However, in October 2017 court sentenced three people to five years’ imprisonment under the older Electronic Transaction Order 2002 rather than PECA.177
The e-commerce policy is also likely to resolve taxation uncertainties surrounding e-commerce in the country. The federal government levied a tax on e-commerce companies in 2018 but provinces can also collect service charges from e-commerce entities, leading to a lack of clarity on tax jurisdictions.178
The Federal Board of Revenue introduced a 0.5% tax on e-commerce turnover through Finance Act 2017, which amended the Tax Ordinance 2001.179 The Section 2(38b) of the ordinance now defines an “online marketplace” as “an information technology platform run by e-commerce entity over an electronic network that acts as a facilitator in transactions that occur between a buyer and seller.180” E-commerce companies have, however, requested the government for a 10-year tax holiday.181
The PTA seems to be supporting the State Bank and other state institutions in coordinating with cellular mobile networks, which lead the major mobile-based branchless banking services in the country, and technology service providers. The telecomm regulator is also part of the National Financial Inclusion Strategy, which aims to increase the number of adults with a bank or m-wallet account to 50%.182 The PTA now also issues a Third Party Service Provider license for interoperability in mobile financial services.183
Main Section
Daraz.pk is not the only thriving online marketplace in Pakistan. Homeshopping.pk, for example, started out of a bedroom with only a Rs. 10,000 capital investment. Now its turnover stands at nearly one billion rupees and it
177 Rizwan Shehzad, “Cybercrime court gives first judgment in fraud case,” The Express Tribune online, last modified October 19, 2017. https://tribune.com.pk/story/1535122/cybercrime- court-gives-first-judgment-fraud-case/ 178 Shehryar Aziz, “E-Commerce landscape faces barriers to expansion in Pakistan,” The Express Tribune online, last modified September 18, 2017. https://tribune.com.pk/story/1509406/e- commerce-landscape-faces-barriers-expansion-pakistan/ 179 “E-commerce entities to pay 0.5pc minimum tax,” Pkrevenue.com online, last modified September 7, 2017. http://www.pkrevenue.com/inland-revenue/e-commerce-entities-to-pay-0- 5pc-minimum-tax/ 180 “Income Tax Ordinance, 2001 Amended Upto 30.06.2017,” Federal Board of Revenue, accessed March 24, 2018. http://download1.fbr.gov.pk/Docs/2017831181435412IncomeTaxOrdinance2001updatedupto 30.06.2017.pdf 181 Shahzad Paracha, “Leading e-commerce companies demand ten-year tax holiday from government,” Profit magazine Pakistan Today online, last modified February 23, 2018. https://profit.pakistantoday.com.pk/2018/02/23/leading-e-commerce-companies-demand-ten- year-tax-holiday-from-government/ 182 “Annual Report 2017,” Pakistan Telecommunication Authority, accessed March 24, 2018. https://www.pta.gov.pk/assets/media/ann_rep_2017.pdf 183 ibid.
63 plans to start its own home shopping TV channel.184 The Yayvo marketplace – owned by courier company TCS – plans to triple its revenue in 2018.185,186 In 2017, Yayvo had expected sales worth Rs. 500 million during its Black Friday- equivalent shopping week.187
These portals have benefitted tremendously from developing marketing campaigns along national days (such as Pakistan Day or Independence Day, religious festivals (such as Eid), and dedicated shopping holidays (such as Black/Big Friday).188 189
These online marketplaces are just one of the five major e-commerce players identified by the State Bank in its first quarter report for 2017-18. The major players include e-retailers and online intermediaries.
The e-retailers are mostly brand stores that have brick-and-mortar shops but have now developed online shops to cater to the Internet users. Fashion brands, such as Khaadi, Alkaram and Sana Safinaz are some examples.190 191 192 But the trend is not limited to fashion. Fast food chains and even bookstores, such as Liberty Books, receive orders online and deliver throughout Pakistan.
The so-called online intermediaries are the earliest examples of the use of the Internet in Pakistan as a vehicle for commerce.
Some of these started as informal information-sharing networks but have now acquired the status of classified advertising websites serving millions of Pakistanis. The popular PakWheels.com started as an online discussion forum for car enthusiasts in 2003 but quickly developed into a website that allows users to buy and sell new and used vehicles and automobile parts. The forum part is still intact but now it is just one part of an array of services such as insurance quotes, auction sheet verification, and car loan comparisons.193
184 “Realising Digital Pakistan: An Internet not for the few, but for the many January 2016,” Telenor Pakistan, accesed March 24, 2018. https://www.telenor.com.pk/media/wysiwyg/TELENOR_Realizing_Digital_Pakistan_Jan_2016.p df 185 “About Us,” Yayvo.com, accessed March 25, 2018. http://yayvo.com/about-us 186 Adam Dawood, “SBP Data shows Pakistan’s E-commerce Market crossed $600 Million Mark in 2017,” ProPakistani online, last modified February 27, 2018. https://propakistani.pk/2018/02/27/sbp-data-shows-pakistans-e-commerce-market-crossed- 600-million-mark-2017/ 187 Sumaira Jajja, “Black or not, Friday sales boom in Pakistan,” Dawn online, last modified November 25, 2017. https://www.dawn.com/news/1372743 188 Muneeb Ahmad, “These websites are offering March 23rd deals in Pakistan,” TechJuice online, last modified March 22, 2018. https://www.techjuice.pk/websites-offering-march-23rd-deals- pakistan/ 189 Faizan Javed, “Online Eid shopping gaining popularity,” The Nation online, last modified June 15, 2017. https://nation.com.pk/15-Jun-2017/online-eid-shopping-gaining-popularity 190 “Home,” Khaadi.com, accessed March 25, 2018. https://www.khaadi.com/ 191 “Home,” Alkaram Studio, accessed March 25, 2018. https://www.alkaramstudio.com/ 192 “Home,” Sana Safinaz, acccessed March 25, 2018. https://www.sanasafinaz.com/ 193 “About Us,” PakWheels.com, accessed March 25, 2018. https://www.pakwheels.com/main/about_us
64 Like PakWheels, Zameen.com offers a forum and blog section alongside its main service of a property portal to connect buyers and sellers of real estate. Users can search for commercial plots, homes, and rentals. The portal, launched in 2006, is backed by venture capital.194
While PakWheels and Zameen cover two high-demand yet niche markets, the website that has perhaps done the most to introduce the concept of online classifieds to the common Pakistani consciousness is OLX. The Pakistani- alternative to Craigslist, OLX allows people to put up free classified ads on its website to sell their goods and products. It was launched in 2011 and claims to control 90% of the online classifieds market share.195
While the online portals help connect buyers and sellers, the intermediaries might not exactly fall under e-commerce. OLX-based transactions, for example, are off-site and offline, managed entirely by the buyer and seller themselves and often involving cash. PakWheels and Zameen are no different.
This is perhaps why online retail is still only one percent of Pakistan’s total retail sales, as it relies mostly on the aforementioned online marketplaces.196 Still, the State Bank has identified over 500 local merchants who use banking channels to accept payments and it is believed the e-commerce market will hit the $1 billion mark by 2020.197 198
A new entrant but certainly a big player in the digital service industry is the “transportation firms”, popularly known as ride-sharing apps. Careem, the Dubai-based ride sharing platform, officially launched in Pakistan in 2016 and has since expanded from two to 12 cities; it aims to create one million jobs by 2020.199 Similarly, Uber Pakistan launched in March 2016, but its services are limited to four cities: Karachi, Lahore, Islamabad, and Rawalpindi.200 201
Both Uber and Careem got into regulatory tussles with the government in early 2017 and faced temporary suspensions, but these issues seem to be moving
194 “About Us,” Zameen.com, accessed March 25, 2018. https://www.zameen.com/about/aboutus.html 195 Abbas Naqvi, “OLX – Thousands of products in the palm of your hand,” Profit magazine Pakistan Today online, last modified February 6, 2017. https://profit.pakistantoday.com.pk/2017/02/06/olx-thousands-of-products-in-the-palm-of- your-hand/ 196 BR Research, “It’s the splurge season,” Business Recorder online, last modified November 16, 2017. https://www.brecorder.com/2017/11/16/381632/its-the-splurge-season/ 197 Usman Sheikh, “Pakistan’s e-commerce market size set to cross $1b this year,” The Express Tribune online, last modified March 19, 2018. https://tribune.com.pk/story/1663707/2- pakistans-e-commerce-market-size-set-cross-1b-year/ 198 “Our cities,” Careem, accessed March 25, 2018. https://www.careem.com/en-ae/cities/ 199 Talha bin Hamid, “In Conversation with Junaid Iqbal, CEO, Careem Pakistan,” Aurora online, last modified April 18, 2017. https://aurora.dawn.com/news/1141986 200 “Welcome to Uber Pakistan,” Uber Blog, last modified February 6, 2017. https://www.uber.com/en-PK/blog/welcome-to-uber-pakistan/ 201 “Islamabad and Rawalpindi: Your uberGO is Arriving Now!” Uber Blog, last modified April 27, 2017. https://www.uber.com/en-PK/blog/islamabad-and-rawalpindi-your-ubergo-is-arriving- now/
65 towards getting resolved.202 They continue to face protests from taxi driver unions.203
Among other digital services, e-banking solutions offered by major banks, streaming music app Patari, and food delivery services, such as FoodPanda, are notable. Finally, many small businesses are using social networks such as Facebook and Twitter to run their businesses.204 The State Bank report points out those customers usually place order directly through the social media pages and get products delivered to their homes. Businesses are also using online marketing through these social networks to reach more customers.205
One major challenge to the growth of e-commerce and consequently the digital services industry is that a majority of the Pakistani population is unbanked, that is they do not have valid bank accounts. Only 36 million people have or use a debit or credit card so instead of –-pre-payment online, most payments are cash- oriented.206 This means e-commerce retailers do not have payments up front when they are shipping out orders.207 It also means they cannot afford to not offer a cash-on-delivery payment option. M-wallets and branchless banking options, such as Telenor’s EasyPaisa and Mobilink’s Jazz Cash, have helped reduce the non-banking population. Also EasyPaisa, launched in 2011, had 9.2 million accounts and transactions worth Rs. 645 billion in 2016.208 Some online marketplaces have linked up with these mobile-based payment options to facilitate more customers.
Meanwhile, the government is also devising a National Financial Inclusion Strategy which aims to increase number of adults with a bank account or m- wallet account to 50%.209
Even with more bank accounts and debit/credit cards, the e-commerce entities need payment gateways to process payments through these cards. For a long time Pakistan did not have a payment gateway. Since 2013, four commercial
202 “Punjab govt’s new policy likely to increase Careem, Uber fares,” The Express Tribune online, last modified November 1, 2017. https://tribune.com.pk/story/1546985/1-punjab-govts-new- policy-likely-increase-careem-uber-fares/ 203 “Scores of Islamabad’s cabbies protest against online taxi services,” The Express Tribune online, last modified August 20, 2017. https://tribune.com.pk/story/1486586/scores- islamabads-cabbies-protest-online-taxi-services/ 204 Nada Zain, “How Pakistani Art Crafters Are Using Facebook,” TechJuice online, last modified July 12, 2014. 205 Farooq Tirmizi, “Marketing tools: Using Facebook ads, some businesses get off to flying start,” The Express Tribune online, last modified September 24, 2012. https://tribune.com.pk/story/441336/marketing-tools-using-facebook-ads-some-businesses- get-off-to-flying-start/ 206 Shehryar Aziz, “E-Commerce landscape faces barriers to expansion in Pakistan,” The Express Tribune online, last modified September 18, 2017. https://tribune.com.pk/story/1509406/e- commerce-landscape-faces-barriers-expansion-pakistan/ 207 Syed Amir Haleem, “Opening up to onine payment systems,” Aurora online, accessed March 25, 2018. https://aurora.dawn.com/news/1141404 208 “Annual Report 2016,”Telenor Bank, accessed March 25, 2018. http://www.telenorbank.pk/assets/pdf/annual-reports/AnnualReport2016-Final.pdf 209 “Annual Report 2017,” Pakistan Telecommunication Authority, accessed March 24, 2018. https://www.pta.gov.pk/assets/media/ann_rep_2017.pdf
66 financial institutions have set up payment gateways, which have helped local businesses.210 According to the 2017 PTA annual report, the government is also spending Rs. 200 million to develop an e-gateway system at the State Bank, which will resolve Pakistan’s payment gateway issues.
Another important issue faced by the digital services industry is ensuring the protection and privacy of consumers’ data.
Ethical hackers have previously identified vulnerabilities in both PakWheels and Zameen.com, and food delivery services are not mindful of privacy of personal information.211 The website of a government department tasked with citizen registration has been hacked multiple times in the past.212 In November 2017, a malware attack was reported on Telenor Pakistan.213
While PECA and the Electronic Transaction Ordinance 2002 have provisions against unauthorised access to information, such as a hacking incident, these laws do not have specific provisions for data protection and privacy.214 A data protection bill, drafted in 2015, was never passed into law.215 On the other hand, PECA allows the state leeway in recording, storing, and using the personal information of citizens.216 The Pakistani government has been accused in the past of secretly handing over the personal information of its citizens to foreign governments.217
Theft of personal data from point-of-service locations and bank ATM machines has also raised alarm among the Pakistani public to the vulnerability of their digital data.218
Civil society organisations have demanded better data protection laws to ensure private information of citizens is safe online. 219 This would also result in
210 Sibtain Jiwani, “Choosing the best payment gateway in Pakistan,” Smartchoice (blog), last modified July 22, 2015. https://smartchoice.pk/blog/2015/07/choosing-the-best-payment- gateway-in-pakistan/ 211 Talal Raza, “No one to protect digital identity: how vulnerable is consumer data in Pakistan?” Digital Rights Monitor online, last modified November 23, 2017. http://digitalrightsmonitor.pk/no-one-to-protect-digital-identity-how-vulnerable-is-consumer- data-in-pakistan/ 212 Usama Khilji, “Data protection and privacy,” Dawn online, last modified December 19, 2017. https://www.dawn.com/news/1377426 213 Talal Raza, “Telenor Pakistan comes under a cyber-attack; the extent of damage remains unclear,” Digital Rights Monitor online, last modified November 15, 2017. http://digitalrightsmonitor.pk/telenor-pakistan-comes-under-a-cyber-attack-the-extent-of- damage-remains-unclear/ 214 “Electronic Data Protection in Pakistan,” Bytes for All, Pakistan, accessed March 25, 2018. http://digitalrightsmonitor.pk/wp-content/uploads/2018/01/Data_Protection_in_Pakistan.pdf 215 Ibid. 216 ibid. 217 Bytes for All, “Pakistan government’s alleged leaking of citizens’ private data is unacceptable,” IFEX online, last modified June 22, 2017. https://www.ifex.org/pakistan/2017/06/21/leak- private-data/ 218 “Hundreds of Pakistanis lose millions in major ATM skimming fraud,” Geo.tv, last modified December 4, 2017. https://www.geo.tv/latest/170648-hundreds-of-karachiites-lose-millions-in- major-atm-skimming-fraud
67 customers more trustworthy and confident of their online transactions.220 The government is likely to include provisions related to consumer data protection in the draft e-commerce policy, since the working groups had reportedly suggested the inclusion of these.221 However, it will only be known for certain once the policy’s draft is made public.
Finally, the digital divide in Pakistan offers an obstacle to the growth of the digital services industry. Daraz, for example, makes 50% of its sales through customers based in Karachi, Lahore and Islamabad.222 The three cities, even though some of Pakistan’s biggest, account for only just over 15% of the country’s total population.223 The Pakistani government has made a goal to increase Internet penetration to 50% a part of its Vision 2025 policy document.224
Reflections
The country appears to be heading towards further growth in its e-commerce and digital services industry. As more people begin to become familiar with online shopping and prepayment methods, the demand will encourage more e- retailers and online marketplaces. The business interest has already developed a lobbying push on the government to better regulate the digital services industry. However, this lobbying is mostly related to pro-business reform and does not always take into account the concerns of the consumers.
The Pakistani public still only has a distant view of data vulnerabilities, and anxieties related to data protection are often temporary and linked with the next new data breach. So far, the dominant online classifieds market is managed by consumers themselves, which affords them a stronger sense of control and resultant confidence in the financial transactions. Most of the data insecurity is directed towards global Internet companies such as Google and Facebook due to the presence of targeted ads and browser behaviour, not local companies. However, it is likely that consumers will start to develop a stronger voice regarding digital data protection and privacy as the digital footprint of the average Pakistani citizen increases and as e-retail’s market share grows. The
219 “Need stressed to introduce data protection laws,” The Express Tribune online, last modified December 8, 2017. https://tribune.com.pk/story/1660359/1-online-shopping-consumer-rights- fairer-digital-marketplaces/ 220 “Online shopping: Consumer rights for fairer digital marketplaces,” The Express Tribune online, last modified March 15, 2018. https://tribune.com.pk/story/1660359/1-online- shopping-consumer-rights-fairer-digital-marketplaces/ 221 Ghulam Abbas, “Ministry of Commerce finalises e-commerce policy,”Profit magazine Pakistan Today online, last modified January 16, 2018. https://profit.pakistantoday.com.pk/2018/01/16/ministry-of-commerce-finalises-e-commerce- policy/ 222 Amber Arshad, “Aspiring to Amazon,” Aurora online, accessed March 25, 2018. https://aurora.dawn.com/news/1142029 223 Mubarak Zeb Khan, “20pc of Pakistanis live in 10 cities, census reveals,” Dawn online, last modified August 29, 2017. https://www.dawn.com/news/1354653 224 “Goals Vision 2025,” Ministry of Planning Development & Reform, Government of Pakistan, accessed March 25, 2018. http://pc.gov.pk/vision/goals
68 public demand will be necessary to force corporations and e-commerce companies to enact better security measures.
Recommendations
Pakistan was ranked 120 out of 144 countries in the United Nations Conference on Trade and Development B2C E-Commerce Index 2017, down from 110 in 2015.225 The report lists Pakistan among countries with very low readiness to business-to-consumer e-commerce. It means the country needs to make a giant effort to match up with other countries around the world in developing its digital services industry.
On the business side, as Telenor’s 2016 Realising Digital Pakistan report mentions, an elimination of device and data taxes and a reduction in restrictive legislation will encourage more investment in the digital economy. This is going to be tricky, since the government is also interested in including e-commerce in its revenue-generation plans. More mentoring and funding, either from private or government sources, for technology and startups can help more local businesses to take part in e- commerce. Most digital services will require technology to run their operations. This might include web stores, warehouses for data and products, and online customer support systems. The government can also help with some of the digital infrastructure, either by encouraging import of technology through subsidies and removal of import duties or fostering indigenous production.
For consumers, civil society organisations must keep on the pressure on the government to enact data privacy and protection laws and to get businesses to comply with these laws so that consumers know what is happening to their information.
225 “Unctad B2C E-commerce Index 2017,” United Nations Conference on Trade and Development (UNCTAD), accessed March 24, 2018. http://unctad.org/en/PublicationsLibrary/tn_unctad_ict4d09_en.pdf
69 70
71